@redue/cli 0.1.0-alpha.29 → 0.1.0-alpha.30

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.1.0-alpha.30 — 2026-11-03
+
+`init` runs a check fewer times, and tests try the sandbox first.
+
+- **Fewer trial runs at init.** A check proposed for the sandboxed recipe
+  now runs once plainly and once in the sandbox with ignored files and
+  documentation hidden (`sandbox-v3`). If they differ, it runs once more
+  with the whole checkout (`sandbox-v1`), compared with the same plain run.
+  When the plain run passed and the sandboxed one failed only on reading a
+  hidden file, the check gets `sandbox-v1` without that run. `init` no
+  longer tries `sandbox-v2`; existing `sandbox-v2` checks keep working.
+  On the 13 census repos with the slowest checks, `init --dry-run` took
+  4740 s in all before and 3870 s after on Linux, 6929 s and 5784 s on
+  macOS. OneUptime went from 1204 s to 903 s (Linux) and 1206 s to 605 s
+  (macOS). Nomi did not get faster (485 s to 383 s on Linux, 836 s to
+  893 s on macOS): its typecheck agrees on the first trial, and each of its
+  two runs stops at init's 5-minute limit.
+- **Tests try the sandbox first.** For a Node test script, `init` tries the
+  sandboxed recipe before the direct test recipe, which becomes its
+  fallback, when both would run the same script. In the census, on the repos where both qualified (2 on each OS),
+  the direct recipe's results went STALE when the project's build rewrote
+  its output, and the sandboxed results stayed CURRENT. A test script now
+  costs `init` one plain run and one or two sandboxed runs.
+- Known limit: artsy/eigen's typecheck, which fails in the census, no
+  longer agrees with the whole checkout at init and falls back to the
+  general recipe (Linux) or recording (macOS).
+
 ## 0.1.0-alpha.29 — 2026-11-03
 
 Editing documentation no longer makes sandboxed checks STALE, a fast check

package/bin/redue.mjs

@@ -7,7 +7,7 @@ import {directCompiler,directQualification,directEnvironment,directInstalledInpu
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
-import {docsQualification,hiddenDocsIssue,hiddenListIssue,hiddenQualification,isSandboxed,pythonTool,sandboxEnvironment,sandboxInterpretationOf,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
+import {docsQualification,hiddenDocsIssue,hiddenListIssue,isSandboxed,pythonTool,sandboxEnvironment,sandboxInterpretationOf,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -156,11 +156,15 @@ if(command==='init'){
     discovery.checks=chosen;discovery.config.checks=chosen.map(row=>row.config);
   }
   // A sandboxed check is proposed only when it gives the same exit status and
-  // output inside the sandbox as outside it: first with the checkout's
-  // git-ignored files and documentation hidden (sandbox-v3), then with the
-  // git-ignored files hidden (sandbox-v2), else with the whole checkout
-  // (sandbox-v1), reusing the plain run. Otherwise init writes what it would
-  // have without the sandboxed recipe, with the reason.
+  // output inside the sandbox as outside it, with the checkout's git-ignored
+  // files and documentation hidden (sandbox-v3). When the plain run passed
+  // and the sandboxed one failed only because it was refused a file it hid
+  // (sandboxTrial's refusedHidden), the check gets the whole checkout
+  // (sandbox-v1) without another run: without the hiding it can only fail
+  // where the plain run passes. Any other difference is tried once with the
+  // whole checkout, reusing the plain run. Otherwise init writes what it
+  // would have without the sandboxed recipe, with the reason. Each check
+  // costs one plain run and one or two sandboxed runs.
   const trialIssue=trial=>trial.issue?`the sandbox cannot run here (${trial.issue})`:
     // A failure both ways that shows a refusal cannot be told from a real one.
     trial.same?null:trial.plain!==trial.sandboxed?`exit ${trial.sandboxed} inside the sandbox, ${trial.plain} outside it${trial.line?` (${trial.line})`:''}`:
@@ -175,18 +179,15 @@ if(command==='init'){
     if(!docs.issue&&docs.same){
       row.config={...row.config,qualification:docsQualification};row.qualification=docsQualification;
       row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;continue;}
-    // Without a list of the documentation, the git-ignored files are still tried.
-    const hidden=docs.plainRun?await sandboxTrial(discovery.root,row.config,{hide:true,plain:docs.plainRun}):
-      docs.issue===hiddenDocsIssue?await sandboxTrial(discovery.root,row.config,{hide:true}):docs;
-    if(!hidden.issue&&hidden.same){
-      row.config={...row.config,qualification:hiddenQualification};row.qualification=hiddenQualification;
-      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore are its input")+
-        `; ran both ways at init, exit ${hidden.plain}; it needs the documentation (${trialIssue(docs)})`;continue;}
-    // Without git, nothing is hidden: the whole checkout is tried on its own.
-    const trial=hidden.plainRun?await sandboxTrial(discovery.root,row.config,{plain:hidden.plainRun}):
-      hidden.issue===hiddenListIssue?await sandboxTrial(discovery.root,row.config):hidden;
+    if(!docs.issue&&docs.refusedHidden){
+      row.reason+=`; at init it passed, then failed reading a file that was hidden (${docs.refusedHidden}), so the whole checkout is its input, not run that way at init`;continue;}
+    // Without a list of the ignored files or the documentation, the whole checkout is tried on its own.
+    const trial=docs.plainRun?await sandboxTrial(discovery.root,row.config,{plain:docs.plainRun}):
+      [hiddenListIssue,hiddenDocsIssue].includes(docs.issue)?await sandboxTrial(discovery.root,row.config):docs;
+    if(trial!==docs&&!trial.issue)trials++;
     const issue=trialIssue(trial);
-    if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}; it needs files git ignores (${hidden.issue??trialIssue(hidden)})`;continue;}
+    if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}; the whole checkout is its input: `+
+      (docs.issue?docs.issue:`with the files git ignores and the documentation hidden, ${trialIssue(docs)}`);continue;}
     if(row.fallback)discovery.checks[at]={...row.fallback,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
     else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
   }
@@ -230,7 +231,7 @@ if(command==='init'){
     if(!samePath(realObservedPath(path.dirname(configFile)),discovery.root))
       error('init writes only at the repository root; use --config there or --dry-run');
     fs.writeFileSync(configFile,JSON.stringify(discovery.config,null,2)+'\n',{flag:'wx'});
-    if(!json){console.log(`Created ${configFile}. ${trials?'Sandboxed checks ran both ways to confirm them; no results were recorded.':'No checks were executed.'}`);
+    if(!json){console.log(`Created ${configFile}. ${trials?'Checks ran inside and outside the sandbox to choose their recipe; no results were recorded.':'No checks were executed.'}`);
       console.log('Ready to qualify means the supported contract will be validated; it is not verification evidence.');
       console.log(`Next: review the config, then redue start and redue run ${JSON.stringify(discovery.checks[0].config.name)}.`);
       console.log('Connect your agent: redue agent setup codex (or claude). Preview with --dry-run.');

package/docs/user/getting-started.md

@@ -100,11 +100,12 @@ redue explain typecheck
 Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
-`redue.config.json`. An existing config is never overwritten. No checks are run and
-no dependencies installed. A missing/unsupported boundary is explained. `init` tries
+`redue.config.json`. An existing config is never overwritten. No dependencies are
+installed; a check proposed for the sandboxed recipe runs once plainly and once or
+twice in the sandbox, and no results are recorded. A missing/unsupported boundary is explained. `init` tries
 the strict recipes first and uses the [general recipe](node-script.md) for a root
 typecheck or lint script none of them takes. Test scripts use the
-[direct test recipe](tests-direct.md).
+[sandboxed recipe](sandbox.md) first, then the [direct test recipe](tests-direct.md).
 
 “Ready to qualify” means REDUE has a supported recipe whose prerequisites will be
 validated. It is not a receipt. “Recording-only” can record PASS/FAIL without claiming

package/docs/user/sandbox.md

@@ -20,8 +20,13 @@ built declarations) gets the whole checkout. See
 
 ## Where it applies
 
-- **Tests:** a root `test` script the [direct test recipe](tests-direct.md)
-  does not take, and pytest in the project's `.venv`. See [tests](#tests).
+- **Tests:** a root `test` script, and pytest in the project's `.venv`. See
+  [tests](#tests). For a Node test script, `init` tries the sandbox before the
+  [direct test recipe](tests-direct.md), which becomes the fallback, when
+  both would run the same script. In the
+  census, on the repos where both qualified, the direct recipe's results went
+  STALE when the project's build rewrote its output, and the sandboxed ones,
+  with ignored files hidden, stayed CURRENT.
 - **Node projects:** a root `typecheck` or `lint` script (npm, pnpm, or Yarn
   with the `node-modules` linker). `init` tries the
   [direct TypeScript recipe](direct-typescript.md) and the pnpm and Yarn
@@ -70,11 +75,17 @@ keeps `uv run` or `poetry run` in front, so the environment still syncs first.
 
 ## Files git ignores and documentation
 
-`init` runs each check four ways at most: plainly, then sandboxed with the
-files git ignores and the documentation hidden, with only the files git
-ignores hidden, and with the whole checkout (reusing the plain run). The first
-sandboxed way that gives the same result is written: `sandbox-v3`,
-`sandbox-v2` or `sandbox-v1`.
+`init` runs each check plainly, then sandboxed with the files git ignores and
+the documentation hidden. When both give the same result, it writes
+`sandbox-v3`. When the plain run passed and the sandboxed one failed only
+because it was refused a file it hid (no other refusal line, and not a line
+the plain run printed too), it writes `sandbox-v1` (the whole checkout)
+without running it again: without the hiding, a run can then only fail
+where a plain one passes, never pass where it fails. When the runs differ
+in another way, `init` runs the check once more with the whole checkout,
+reusing the plain run, and writes `sandbox-v1` only if that agrees. So a
+check runs two or three times at init, not four. `init` no longer writes
+`sandbox-v2`; a check already set up with it keeps it.
 
 With `sandbox-v3`, each run also hides the documentation: the files git
 lists (and does not ignore) named `*.md`, `*.mdx`, `*.rst`, `LICENSE*` or
@@ -88,7 +99,7 @@ like one, or a change made while the run ran still counts. On macOS the
 files with those extensions are refused by name pattern, in any case and in
 `node_modules` too: `README.MD` or `Docs/logo.svg` is refused but not
 listed, so an edit to it counts, and a check that reads one gets
-`sandbox-v2` on macOS. `LICENSE*` and `CHANGELOG*` files are refused by the
+`sandbox-v1` on macOS. `LICENSE*` and `CHANGELOG*` files are refused by the
 exact paths git lists, so `license-check.ts` stays readable. On Linux each
 listed file is hidden like a git-ignored one. In a checkout with more than
 100 `LICENSE*` and `CHANGELOG*` files (vendored packages), those files are
@@ -218,10 +229,13 @@ CURRENT means the last sandboxed run's inputs are unchanged:
 A run the sandbox refused something fails like any other. REDUE does not run
 every failure twice to find out:
 
-- `init` runs each proposed check twice, plainly and sandboxed, and proposes
-  it only when both give the same exit status and the same output, and a
-  failure shows no sign of a refusal. The output is compared without colors,
-  timings, the temporary and home directories, and lines about caches.
+- `init` runs each proposed check plainly and sandboxed, and proposes it
+  when both give the same exit status and the same output, and a failure
+  shows no sign of a refusal. The output is compared without colors,
+  timings, the temporary and home directories, and lines about caches. The
+  one exception is a check that passed plainly and failed only because it
+  was refused a hidden file: it gets the whole checkout without another run
+  (see [files git ignores](#files-git-ignores-and-documentation)).
   Otherwise `init` writes what it would have without this recipe and says why.
   These are the only runs `init` makes.
 - When a `sandbox-v2` or `sandbox-v3` run fails with a refusal that names a hidden file, it

package/docs/user/supported-projects.md

@@ -57,11 +57,11 @@ changes. Unsupported custom resolution, project references, outside-root
 source links, and installation modes remain recording-only. Other Yarn
 typechecks, Vitest/Jest, ESLint, and builds in workspace packages start
 recording-only unless a separately justified explicit contract is provided.
-For a single-package project whose test script runs Vitest 4/5 or Jest 29
-directly, `init` uses the direct test recipe, which records the run and guards
-its inputs; see [direct tests](tests-direct.md). Other root test scripts get
-the sandboxed recipe when its trial gives the same exit status and test counts
-as a plain run.
+A root test script gets the sandboxed recipe when its trial gives the same
+exit status and test counts as a plain run. Otherwise, for a single-package
+project whose test script runs Vitest 4/5 or Jest 29 directly, `init` uses the
+direct test recipe, which records the run and guards its inputs; see
+[direct tests](tests-direct.md).
 In particular, test caches and build-generated inputs are not excluded to
 make evidence green.
 

package/docs/user/tests-direct.md

@@ -1,7 +1,7 @@
 # Direct test recipe (Vitest and Jest)
 
-`redue init` (or `redue init --recipe tests-direct --check test` for this recipe
-alone) records a project's unit test run and reports later whether that result
+`redue init --recipe tests-direct --check test` (or `redue init`, where the
+[sandboxed recipe](sandbox.md) cannot take the test script) records a project's unit test run and reports later whether that result
 still applies to the files you have.
 It supports a single-package project installed by npm, pnpm 9-12 (isolated or
 hoisted `node_modules`) or Yarn with the `node-modules` linker, whose test

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.29",
+  "version": "0.1.0-alpha.30",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/node-onboarding.mjs

@@ -3,7 +3,8 @@ import {testProject,testRecipeScript,testCheckInputs,testsQualification} from '.
 import {generalIssue,scriptCheckInputs,scriptProject,scriptQualification} from './node-script.mjs';
 import {sandboxCheckInputs,sandboxKinds,sandboxQualification} from './sandbox.mjs';
 // Init proposes the general recipe for typecheck and lint scripts; test
-// scripts use the direct test recipe (Vitest, Jest).
+// scripts use the sandboxed recipe first, then the direct test recipe
+// (Vitest, Jest).
 const generalKinds=['typecheck','lint'];
 const perPackageLimit=50;
 import fs from 'node:fs';
@@ -302,7 +303,8 @@ export function discoverNodeProject(root,{recipe=null}={}) {
     // sandboxed recipe, which also covers programs the general recipe cannot
     // record. It is ready only once init has run it both ways (bin/redue.mjs);
     // `fallback` is the row init writes when that shows a difference or the
-    // sandbox cannot run here: the general recipe's, when it takes the script.
+    // sandbox cannot run here: the general recipe's, when it takes the script,
+    // or the direct test recipe's.
     // Where the sandbox cannot start at run time, a script the general recipe
     // takes is recorded as it would record it (cli.mjs).
     // A script whose program is not installed gets none, and neither does one
@@ -310,7 +312,12 @@ export function discoverNodeProject(root,{recipe=null}={}) {
     const writes=script&&['pre'+script,script,'post'+script].map(name=>scripts[name]).find(text=>typeof text==='string'&&
       /(?:^|\s)--(?:fix|write|unsafe-fixes)(?=[\s=]|$)/.test(text));
     if(writes)classification={...classification,reason:`Sandboxed recipe unavailable (the script changes files: ${writes.match(/--(?:fix|write|unsafe-fixes)/)[0]}); ${classification.reason}`};
-    if((auto||recipe==='sandbox')&&script&&sandboxKinds.includes(kind)&&classification.level!=='ready'&&!observationIssue&&
+    // A test script gets it before the direct test recipe, which is then its
+    // fallback, when both run the same script: in the census the direct
+    // recipe's results went STALE when the build changed its output, and the
+    // sandboxed ones stayed CURRENT.
+    if((auto||recipe==='sandbox')&&script&&sandboxKinds.includes(kind)&&!observationIssue&&
+      (classification.level!=='ready'||auto&&kind==='test'&&check.script===script)&&
       !/REDUE cannot find/.test(generalIssue||'')&&!writes){
       try{
         const project=scriptProject(root,script);

package/src/sandbox.mjs

@@ -583,7 +583,19 @@ export function runToEnd(argv,{cwd,env,timeout=0,echo=false,started=null}){
     child.on('close',(status,signal)=>finish({status,signal}));
   });
 }
-// {same, plain, sandboxed, line} or {issue} when the sandbox cannot run here.
+// The line that shows a run that failed in the sandbox, and passed outside
+// it, was refused a file it hid, when nothing else differs that a refusal
+// could explain: no other refusal line, no supervisor issue, and not a line
+// the plain run printed too. A run without the hiding then could only fail
+// where the plain one passes, never pass where it fails.
+function refusedHidden(plain,sandboxed,entries,supervisor){
+  if(plain.status!==0||supervisor||!entries.length)return null;
+  const line=hiddenRefusal(sandboxed.output,entries);
+  if(!line||plain.output.includes(line))return null;
+  const others=sandboxed.output.split(/\r?\n/).filter(text=>!hiddenRefusal(text,entries)).join('\n');
+  return denialLine(others)?null:line;
+}
+// {same, plain, sandboxed, line, refusedHidden} or {issue} when the sandbox cannot run here.
 // With `hide` 'docs', the documentation (hiddenDocs) is hidden too.
 // With `hide`, the git-ignored entries hiddenEntries lists are kept from the
 // sandboxed run, and it also returns them, their count, the run times and, on
@@ -632,8 +644,10 @@ export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:e
     const counts=tests?[plain,sandboxed].map(r=>testCounts(r.output)):null;
     const read=counts?.some(c=>Object.values(c).some(value=>value!==null));
     const differs=tests&&read?(JSON.stringify(counts[0])===JSON.stringify(counts[1])?null:{plain:JSON.stringify(counts[0]),sandboxed:JSON.stringify(counts[1])}):output;
-    return {same:plain.status===sandboxed.status&&!denied&&!differs&&!supervisor,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,
+    const same=plain.status===sandboxed.status&&!denied&&!differs&&!supervisor;
+    return {same,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,
       line:supervisor||denied||(plain.status===sandboxed.status?null:sandboxed.output.trim().split('\n').at(-1)?.slice(0,200)||null),
+      refusedHidden:same?null:refusedHidden(plain,sandboxed,entries,supervisor),
       ...hide?{hidden:entries.length,entries,docs:docEntries.length,plainMs:plain.ms,sandboxedMs:sandboxed.ms,...launcher?{rules:launcher.rules,setupMs:launcher.ms}:{}}:{}};
   }finally{fs.rmSync(scratch,{recursive:true,force:true});}
 }