@redue/cli 0.1.0-alpha.27 → 0.1.0-alpha.29

package/CHANGELOG.md

@@ -1,5 +1,96 @@
 # Changelog
 
+## 0.1.0-alpha.29 — 2026-11-03
+
+Editing documentation no longer makes sandboxed checks STALE, a fast check
+is skipped or recorded as it should be, and macOS test runs can no longer
+reach a service started outside them.
+
+- **Documentation is hidden too (`sandbox-v3`).** A sandboxed run now also
+  hides the project's documentation: files named `*.md`, `*.mdx`, `*.rst`,
+  `LICENSE*` or `CHANGELOG*` anywhere, and text, image and PDF files in the
+  root `docs/` folder (code there stays visible). The receipt names the
+  files the run hid, and a later edit to one of them leaves the result
+  CURRENT: editing the README no longer makes the tests STALE. A new
+  documentation file still counts. `init` tries this first, then the
+  git-ignored files only (`sandbox-v2`), then the whole checkout. A check
+  that reads documentation (a doctest over the README) keeps `sandbox-v2`.
+  Run `redue init` again to move an existing check to `sandbox-v3`.
+- **A fast check is no longer missed by the hook.** The hook waited half of
+  the check's last run for `redue status`, so a 0.2 s mypy got 0.1 s, the
+  status answer came too late, and the agent's run went unrecorded. The
+  wait is now at least 2 s. `REDUE_HOOK_LOG` (an absolute file path) makes
+  the hook write one line per Bash command with its decision and why.
+- **macOS test runs get no network.** Seatbelt cannot refuse only the ports
+  that were already listening (a per-port rule under a loopback allow is not
+  applied; an allow list of every other port does not compile), so a macOS
+  test run now gets Unix sockets in its own temporary directory only, as a
+  typecheck or lint does. A suite that needs loopback fails `init`'s trial
+  and runs without REDUE. Test checks set up by alpha.28 on macOS are not
+  CURRENT after the upgrade.
+- **`redue status` reconciles by default.** `redue status --cached` gives the
+  observer's last published answer; `--sync` is still accepted. Like
+  `--sync`, plain `status` exits 2 when it cannot reach the observer (after
+  `redue stop`, for example); `--cached` exits 0.
+- **`redue setup` says more and prints less.** It lists the checks it left
+  out and why (a kind it found nothing for, a proposed `tsc --noEmit` no
+  recipe takes), says what recording only means, and prints one line per
+  recorded run instead of the check's whole output.
+- `redue remove-state` waits for the observer to exit before removing its
+  state (a Windows ENOTEMPTY).
+- **Measured.** In the product census, repositories whose qualifying
+  sandboxed check keeps the documentation hidden, out of those with one:
+  TypeScript on Linux, typecheck 17 of 19, lint 20 of 20, tests 7 of 8; on
+  macOS 12 of 13, 14 of 16, 6 of 9. Python on Linux 15 of 15, 22 of 22, 12
+  of 17; on macOS 11 of 13, 17 of 17, 8 of 11. No network for macOS test
+  runs cost 1 TypeScript suite (it starts a server on 127.0.0.1) and 2
+  Python suites: test suites qualifying on macOS went from 12 to 11
+  (TypeScript) and 14 to 11 (Python; one checkout no longer installs). The
+  strace cross-check found no read outside the recorded inputs. In a Claude
+  Code follow-up on starlette and nestjs-api-gateway, a README edit made no
+  check STALE; the hook skipped mypy, pytest and the lint, and each skipped
+  command passed when run plainly.
+
+## 0.1.0-alpha.28 — 2026-11-02
+
+Test suites can run in the sandbox, so REDUE can reuse a passing test run
+for more projects, Python included.
+
+- **Sandboxed tests.** A root test script that the direct test recipe does
+  not take, and pytest in a Python project's `.venv`, can now use the
+  sandboxed recipe. `init` keeps it only when the run in the sandbox gives the
+  same exit status and test counts as a plain run. On top of what a
+  typecheck or lint gets, a test run gets:
+  - **Loopback only.** It may listen on any address and connect to the local
+    host and Unix sockets, never to a remote host. On macOS, Seatbelt
+    enforces that. On Linux, a seccomp filter refuses UDP and other non-TCP
+    sockets, TCP Fast Open and `io_uring`, and hands each `connect` to
+    REDUE's launcher. The launcher allows a local port nothing listens on or
+    one the run's own processes listen on, and refuses everything else,
+    including a service you started outside the run (a local database). If
+    the launcher cannot start or stops early, the result is UNVERIFIED.
+  - **A private `/tmp`.** Its `TMPDIR` is new for each run, and it may not
+    write elsewhere in `/tmp` or `/var/tmp`.
+  - **A fresh home** for each run, as on CI.
+  - **Ignored files hidden** when the trial agrees, else the whole checkout.
+- **Measured.** In the product census, test suites with a qualifying check
+  (alpha.27 in brackets): TypeScript on Linux 11 (2), on macOS 12 (2);
+  Python on Linux 17 (0), on macOS 14 (0). The strace cross-check found no
+  read outside the recorded inputs. The Linux connect supervisor added at
+  most 1.5% over the sandbox without it on suites with worker processes
+  (pytest-xdist, Jest, Vitest): apprise 233 s to 237 s, run-to-run spread
+  218-243 s. In a pilot with Claude Code on two pytest projects, the hook
+  skipped both "do the tests still pass?" reruns (19 s to 6 s and 28 s to
+  7 s), and plain reruns agreed with both skips.
+- **macOS hides contents only.** On macOS, a hidden file's contents and
+  execution are refused, but its metadata is not, as on Linux. A test that
+  writes into an ignored folder works.
+- Known limits: a suite that reads back ignored files it writes in the same
+  run (a coverage database, a build it starts) gets the whole checkout, and
+  one that writes tracked files or coverage data during the run ends
+  UNVERIFIED. On Linux, a test that needs a service started outside the run
+  fails in the sandbox, so `init` leaves it to a plain run.
+
 ## 0.1.0-alpha.27 — 2026-11-01
 
 A build or test run no longer makes a sandboxed typecheck or lint STALE,

package/README.md

@@ -26,13 +26,17 @@ redue setup claude
 stops before writing anything if the dependencies are not installed. It:
 
 - finds your typecheck, lint and test scripts and writes `redue.config.json`
-  (it never changes your scripts, source or dependencies). Checks REDUE can
-  only record, not reuse, are listed as recording-only;
+  (it never changes your scripts, source or dependencies). In a Python
+  project it finds these tools in `.venv/bin`, with the arguments your CI
+  workflows, Makefile, justfile, tox, nox or scripts give them: mypy,
+  pyright and ty (typecheck), ruff (lint) and pytest (test). It says which
+  checks it left out and why, and which it can only record, not reuse;
 - connects Claude Code: a short section in `CLAUDE.md`, a skill, and two hooks
   in `.claude/settings.local.json`;
 - starts REDUE's file observer, waits while it indexes the project (a minute
   or more in a large one), then runs each check that can qualify once, so
-  there is a first result to reuse;
+  there is a first result to reuse, and prints one line per run (the run's
+  own output only when it fails);
 - prints every file it writes. Running it again changes nothing.
 
 Then start a new Claude Code session in the project and work as usual. When
@@ -43,7 +47,7 @@ through REDUE so the new result is recorded.
 To look yourself:
 
 ```text
-$ redue status --sync
+$ redue status
 ✓ typecheck  CURRENT / PASS
 ✓ lint  CURRENT / PASS
 
@@ -54,10 +58,10 @@ src/main.ts changed
 Due again when verification is needed: redue run "typecheck"
 ```
 
-`--sync` checks the files and your environment before it answers; this is
-what the agent asks. Plain `redue status` is a fast cached answer and can say
-UNVERIFIED ("cannot confirm your execution context") where `--sync` would say
-CURRENT.
+`redue status` checks the files and your environment before it answers, as
+the agent's hook does. `redue status --cached` gives the last answer the
+observer published without checking; it can say UNVERIFIED ("cannot confirm
+your execution context") where `redue status` would say CURRENT.
 
 `redue stats` shows, per check, the reruns the hook skipped, the time saved,
 the recorded runs and the top reasons a check was UNVERIFIED, from a log kept
@@ -65,28 +69,52 @@ on your machine.
 
 To undo everything setup did: `redue remove`.
 
+## Still CURRENT after your build and tests
+
+Running the project's build or tests writes files (`dist/`, `.next/`,
+coverage). REDUE leaves those out when the files are git-ignored, so a
+typecheck or lint that passed stays CURRENT. In the census, after each
+project's own build, tests, typecheck and lint ran, the share of sandboxed
+checks still CURRENT:
+
+| | alpha.26 | alpha.27 |
+|---|---|---|
+| TypeScript, Linux | 5 of 43 | 31 of 37 |
+| TypeScript, macOS | 5 of 38 | 24 of 34 |
+| Python, Linux | 24 of 37 | 31 of 38 |
+| Python, macOS | 20 of 33 | 28 of 34 |
+
+The rest changed for real: the build rewrote a tracked file (a sitemap, a
+feed, a generated source), added a file git doesn't ignore, or installed
+packages.
+
 ## What it covers today
 
 In a census of 120 active public TypeScript repositories (November 2026, REDUE
-at commit e264a67, before 0.1.0-alpha.27), each installed as its users would,
-with dependencies' install scripts on, 90 installed cleanly on a macOS runner.
+at commit 8cb32d6, before 0.1.0-alpha.29), each installed as its users would,
+with dependencies' install scripts on, 89 installed cleanly on a macOS runner.
 A check counts when two recorded runs on the same code both came out CURRENT
-on the same inputs. 35 repositories had at least one such check:
+on the same inputs. 34 repositories had at least one such check:
 
 | Check | Repositories | How |
 |---|---|---|
-| Typecheck | 22 | 16 by running the project's script in an OS sandbox ([sandboxed recipe](docs/user/sandbox.md)), 15 of them with the files git ignores hidden; 5 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)); 1 by running the script with every Node process recorded ([general recipe](docs/user/node-script.md)) |
-| Lint | 24 | 21 sandboxed recipe (19 with ignored files hidden), 3 general recipe |
-| Tests | 2 | Vitest run directly ([direct test recipe](docs/user/tests-direct.md)) |
+| Typecheck | 20 | 13 by running the project's script in an OS sandbox ([sandboxed recipe](docs/user/sandbox.md)), 12 of them with the files git ignores and the documentation hidden; 5 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)); 2 by running the script with every Node process recorded ([general recipe](docs/user/node-script.md)) |
+| Lint | 20 | 16 sandboxed recipe (14 with ignored files and documentation hidden, 1 with ignored files hidden), 4 general recipe |
+| Tests | 11 | 9 sandboxed recipe with no network (6 with ignored files and documentation hidden, 3 with ignored files hidden); 2 Vitest run directly ([direct test recipe](docs/user/tests-direct.md)) |
+
+alpha.28 found 38 repositories on macOS. Test runs there no longer get
+loopback, which cost 1 test suite (it starts a server on 127.0.0.1). Of the
+other 3, one lint check was lost to a documentation-hiding bug fixed before
+this release, one checkout now installs with pnpm in a way REDUE does not
+take, and one `init` did not answer within the census's 10 minutes. On
+Linux, where tests keep loopback, 10 test suites qualified.
 
 In a census of 120 Python repositories, 74 installed on a Linux runner
-and 23 had a qualifying check: typecheck (mypy, pyright, ty) 15, lint (ruff)
-22, all through the sandboxed recipe with ignored files hidden. A check whose
-git-ignored files are hidden stays CURRENT when a build or test run rewrites
-them: after each project's build and tests ran, 31 of 37 such TypeScript
-checks and 31 of 38 Python checks were still CURRENT on Linux. On Linux, every sandboxed run was traced
-with strace: each file it read in the checkout was a recorded input, a cache
-or its own output.
+and 31 had a qualifying check: typecheck (mypy, pyright, ty) 15, lint (ruff)
+22, tests (pytest) 17, all through the sandboxed recipe (15, 22 and 12 of
+them with ignored files and documentation hidden). On Linux, every sandboxed
+run was traced with strace: each file it read in the checkout was a recorded
+input, a cache or its own output.
 
 Everything else stays UNVERIFIED, with a reason you can read in
 `redue explain`. The usual ones: a script starts a program REDUE cannot see
@@ -142,7 +170,7 @@ harness, tasks and raw results are in [`eval/`](eval/README.md).
 redue init          # write redue.config.json from your scripts
 redue start         # start the file observer
 redue run typecheck # run a check through REDUE and record the result
-redue status --sync # what still holds
+redue status        # what still holds
 ```
 
 Codex is supported too (`redue agent setup codex --apply`); see

package/bin/redue.mjs

@@ -7,7 +7,7 @@ import {directCompiler,directQualification,directEnvironment,directInstalledInpu
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
-import {hiddenListIssue,hiddenQualification,isSandboxed,pythonTool,sandboxEnvironment,sandboxInterpretationOf,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
+import {docsQualification,hiddenDocsIssue,hiddenListIssue,hiddenQualification,isSandboxed,pythonTool,sandboxEnvironment,sandboxInterpretationOf,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -40,8 +40,8 @@ Commands:
                        Connect project instructions; explicit setup only
   start                Start the local observer
   stop                 Stop this observer
-  status [--json|--short] Read conservative cached status
-  status --sync        Reconcile inputs and caller context before answering
+  status [--json]      Reconcile inputs and caller context, then answer (--sync is the same)
+  status --cached [--json] | --short  The last answer the observer published, without reconciling
   explain [CHECK] [--json] Explain applicability (synchronized; may cost more than a rerun)
   detail [CHECK] [--json]  Alias for explain
   run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
@@ -102,9 +102,12 @@ const json=args.includes('--json');
 // run --if-due: run the check only when its last pass does not apply now.
 const ifDue=command==='run'&&args.includes('--if-due');
 if(ifDue)args.splice(args.indexOf('--if-due'),1);
-const sync=args.includes('--sync');
+// status syncs by default (warm, it costs well under 100 ms more than the
+// cached answer); --cached and --short read the cached answer.
+const cachedOnly=args.includes('--cached');
 const dryRun=args.includes('--dry-run');
 const short=args.includes('--short');
+const sync=args.includes('--sync')||command==='status'&&!cachedOnly&&!short;
 let workspaceSelection=null,checkSelection=null,recipeSelection=null;
 if(command==='init')for(let i=0;i<args.length;){
   if(args[i]==='--workspace'||args[i]==='--check'||args[i]==='--recipe'){
@@ -115,9 +118,10 @@ if(command==='init')for(let i=0;i<args.length;){
 }
 const check=['run','detail','explain'].includes(command)&&args[0]&&!args[0].startsWith('--')?args.shift():null;
 if(command==='run'&&!check)error('run requires a check name');
-if(args.some(value=>!['--json','--sync','--dry-run','--short'].includes(value)))error('unknown option; use --help');
+if(args.some(value=>!['--json','--sync','--cached','--dry-run','--short'].includes(value)))error('unknown option; use --help');
 if(sync&&!['status','detail','explain'].includes(command))error('--sync is for status or detail');
-if(short&&(command!=='status'||json||sync))error('--short is a cached status option; do not combine it with --sync or --json');
+if(cachedOnly&&(command!=='status'||args.includes('--sync')))error('--cached is a status option; do not combine it with --sync');
+if(short&&(command!=='status'||json||args.includes('--sync')))error('--short is a cached status option; do not combine it with --sync or --json');
 if(dryRun&&command!=='init')error('--dry-run is for init');
 
 if(command==='init'){
@@ -153,6 +157,7 @@ if(command==='init'){
   }
   // A sandboxed check is proposed only when it gives the same exit status and
   // output inside the sandbox as outside it: first with the checkout's
+  // git-ignored files and documentation hidden (sandbox-v3), then with the
   // git-ignored files hidden (sandbox-v2), else with the whole checkout
   // (sandbox-v1), reusing the plain run. Otherwise init writes what it would
   // have without the sandboxed recipe, with the reason.
@@ -165,11 +170,18 @@ if(command==='init'){
   for(const [at,row] of [...discovery.checks.entries()]){
     if(row.qualification!==sandboxQualification||row.level!=='ready')continue;
     if(!json)console.error(`Running ${row.config.name} inside and outside the sandbox to confirm it...`);
-    const hidden=await sandboxTrial(discovery.root,row.config,{hide:true});
-    if(!hidden.issue)trials++;
+    const docs=await sandboxTrial(discovery.root,row.config,{hide:'docs'});
+    if(!docs.issue)trials++;
+    if(!docs.issue&&docs.same){
+      row.config={...row.config,qualification:docsQualification};row.qualification=docsQualification;
+      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;continue;}
+    // Without a list of the documentation, the git-ignored files are still tried.
+    const hidden=docs.plainRun?await sandboxTrial(discovery.root,row.config,{hide:true,plain:docs.plainRun}):
+      docs.issue===hiddenDocsIssue?await sandboxTrial(discovery.root,row.config,{hide:true}):docs;
     if(!hidden.issue&&hidden.same){
       row.config={...row.config,qualification:hiddenQualification};row.qualification=hiddenQualification;
-      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore are its input")+`; ran both ways at init, exit ${hidden.plain}`;continue;}
+      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore are its input")+
+        `; ran both ways at init, exit ${hidden.plain}; it needs the documentation (${trialIssue(docs)})`;continue;}
     // Without git, nothing is hidden: the whole checkout is tried on its own.
     const trial=hidden.plainRun?await sandboxTrial(discovery.root,row.config,{plain:hidden.plainRun}):
       hidden.issue===hiddenListIssue?await sandboxTrial(discovery.root,row.config):hidden;
@@ -222,7 +234,7 @@ if(command==='init'){
       console.log('Ready to qualify means the supported contract will be validated; it is not verification evidence.');
       console.log(`Next: review the config, then redue start and redue run ${JSON.stringify(discovery.checks[0].config.name)}.`);
       console.log('Connect your agent: redue agent setup codex (or claude). Preview with --dry-run.');
-      console.log('Use redue status first. --sync can establish applicability, but may cost more than rerunning a cheap check.');}
+      console.log('Then redue status says whether each result applies to the files as they are now.');}
   } else if(unsupported&&!json)console.log(`No config written: ${summary.issue||'unsupported discovery boundary'}.`);
   if(json)console.log(JSON.stringify({...summary,proposed_config:discovery.config}));
   await exit(0);
@@ -381,7 +393,7 @@ const checks=publicConfig.checks.map(check=>{
   const windowsContext=process.platform==='win32'?
     ['ComSpec','COMSPEC','PATHEXT','USERPROFILE']:[];
   const autoEnvironment=npmDirect?directEnvironment:testsDirect?testEnvironment:generalScript?scriptEnvironment(manager):
-    sandboxed?sandboxEnvironment(Boolean(pythonTool(check)),check.script?manager:null):npmAutomatic?{variables:['NODE_OPTIONS','NODE_PATH','CI','HOME',
+    sandboxed?sandboxEnvironment(Boolean(pythonTool(check)),check.script?manager:null,check.kind):npmAutomatic?{variables:['NODE_OPTIONS','NODE_PATH','CI','HOME',
     'NODE_ENV','BASH_ENV','ENV',...windowsContext],prefixes:['npm_config_','DYLD_','TSGO_'],
     pathExecutables:['node','npm'],executableIdentity:true}:yarnWorkspace?
     {variables:['NODE_OPTIONS','NODE_PATH','CI','HOME','NODE_ENV','BASH_ENV','ENV',...windowsContext],
@@ -408,7 +420,7 @@ const checks=publicConfig.checks.map(check=>{
     ...(npmDirect?{qualificationInterpretation:directInterpretation}:{}),
     ...(testsDirect?{qualificationInterpretation:testsInterpretation}:{}),
     ...(generalScript?{qualificationInterpretation:scriptInterpretation}:{}),
-    ...(sandboxed?{qualificationInterpretation:sandboxInterpretationOf(check.qualification)}:{}),
+    ...(sandboxed?{qualificationInterpretation:sandboxInterpretationOf(check.qualification,check.kind)}:{}),
     workspace:check.workspace||null,kind:check.kind||null};
 });
 const runtime={schema:1,provider:'declared-project@1',root,state,checks};

package/docs/user/agents.md

@@ -12,8 +12,8 @@ generic agent's instructions with the project owner's permission.
    `redue --config CONFIG status --sync --json`. Do not infer a recipe from its name.
    Cached status cannot establish its caller context. In mixed configurations,
    assess each check's contract separately; this is not a global sync-first policy.
-3. For other/unknown recipes, query ordinary `status --json` first and decide whether
-   synchronization is worthwhile. Ordinary status and `--short` remain cheap inspection.
+3. For other/unknown recipes, `status --json` synchronizes too (`--sync` is the
+   same); `status --cached --json` and `--short` remain cheap inspection.
 4. Reuse only schema 1, healthy observation and the selected check's CURRENT/PASS
    with `reuse_eligible: true`. Missing eligibility means false. A historical FAIL
    is never green evidence. Do not rerun eligible evidence merely for freshness.
@@ -167,11 +167,18 @@ commands never start the hook. The installed skill lists these exact commands,
 so the agent uses forms the hook recognizes.
 
 On a match, the hook runs `redue status --sync --json`. It waits up to half the
-duration of the check's last completed run, at most 10 seconds, so waiting never
-costs more than half a run. With no completed run it waits 2 seconds. A check
-that takes a few hundred milliseconds is therefore rarely skipped; skipping it
-would save almost nothing, and the hook does not rewrite it to `redue run`
-either. Claude Code's own limit for the hook is 15 seconds.
+duration of the check's last completed run, at least 2 seconds and at most 10
+seconds. A status call usually takes 70-250 ms, so a fast check (mypy in 0.2 s)
+is still skipped when CURRENT, or run through `redue run` and recorded when not.
+When the observer is slow or stuck, a matching command can wait the full 2
+seconds before it runs as written. Claude Code's own limit for the hook is 15
+seconds.
+
+To see why the hook decided what it did, set `REDUE_HOOK_LOG` to an absolute
+file path in the environment Claude Code starts with. The hook appends one JSON
+line per Bash command: the command, the decision (`deny`, `rewrite` or
+`allow`) and why, such as `no check matches the command` or `status did not
+answer within 2000 ms`.
 It blocks the command only when the check is CURRENT, PASS and
 `reuse_eligible: true`. The message names the check and the receipt's run ID. Every
 other result allows the command: STALE, UNVERIFIED, FAILED, a timeout, an error, or

package/docs/user/getting-started.md

@@ -117,9 +117,10 @@ compiler invocation it selects, and for npm the
 run through the package manager. No existing configuration is silently migrated.
 Only use configs and probes from trusted repositories: these execute local code.
 
-`status` is cached and conservative. `status --sync` and `explain` revalidate caller
-context and may execute read-only probes. Synchronization can be slower than a cheap
-check, especially on Windows. Choose deliberately. A timeout is UNVERIFIED, not green.
+`status` and `explain` revalidate caller context and may execute read-only probes
+(`status --sync` is the same as `status`). `status --cached` is the cached,
+conservative answer, without revalidating. Synchronization can be slower than a
+cheap check, especially on Windows. A timeout is UNVERIFIED, not green.
 
 ## Lifecycle and removal
 

package/docs/user/json.md

@@ -1,7 +1,7 @@
 # Alpha JSON interface (schema 1)
 
-Use `status --json` for cached state, `status --sync --json` for caller-aware
-applicability, and `explain CHECK --json` for selected synchronized detail.
+Use `status --json` (or `status --sync --json`) for caller-aware applicability,
+`status --cached --json` for cached state, and `explain CHECK --json` for selected synchronized detail.
 `detail` remains an alias. Successful reads emit one JSON object, no human prose.
 
 ```json

package/docs/user/node-script.md

@@ -8,8 +8,8 @@ pnpm and Yarn TypeScript recipes, the [direct test recipe](tests-direct.md)
 and, on macOS and Linux, the [sandboxed recipe](sandbox.md) first. It uses
 the general recipe for a root typecheck or lint script none of them takes,
 and where the sandbox cannot run (at init, or at run time inside Claude
-Code's macOS sandbox). Test scripts use the direct test recipe; `init` does
-not propose the general recipe for them.
+Code's macOS sandbox). Test scripts use the direct test recipe or the
+sandboxed recipe; `init` does not propose the general recipe for them.
 
 It supports a project installed by npm, pnpm 9-12 (isolated or hoisted
 `node_modules`) or Yarn with the `node-modules` linker, with one lockfile kind