@redue/cli 0.1.0-alpha.3 → 0.1.0-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.0-alpha.4 — 2026-10-07
+
+- Withdraw automatic npm-launcher applicability because update notifications consume
+  unobserved remote/cache/time state. Npm scripts still run and record outcomes.
+- Preserve historical PASS/FAIL and require stop/start when upgrading an observer.
+  Do not delete receipts. See the [maintainer notice](docs/user/npm-launcher-notice.md).
+- Supported Yarn/pnpm and explicit reviewed contracts are unchanged. No agent
+  activation or npm direct-compiler recipe is included in this correction.
+
 ## 0.1.0-alpha.3 — 2026-10-06
 
 Install: `npm install --global @redue/cli@alpha`.

package/README.md

@@ -1,7 +1,9 @@
 # REDUE
 
-Maintainer notice: alpha.2 users should review the
-[receipt-selection correction and interim guidance](docs/user/receipt-selection-notice.md).
+Maintainer notice: alpha.4 withdraws automatic npm-launcher applicability.
+Npm commands still execute and record historical outcomes, but remain UNVERIFIED.
+[Why this changed and how to upgrade without deleting receipts](docs/user/npm-launcher-notice.md).
+Alpha.2 users should also review the [receipt correction](docs/user/receipt-selection-notice.md).
 
 **Know what still holds. Redo what's due.**
 
@@ -12,6 +14,8 @@ REDUE keeps persistent verification state for your codebase so developers and
 coding agents can see which previous checks still apply to the code they have now.
 It records evidence, not proofs of correctness.
 
+For a qualified supported Yarn/pnpm check (ordinary npm scripts are recording-only):
+
 ```text
 $ redue status --sync
 ✓ typecheck  CURRENT / PASS
@@ -85,7 +89,8 @@ has been verified.
 - macOS, Linux, and Windows on supported local filesystems; Node 22+.
 - Linux also requires Python 3 for observation. No WSL or Git Bash needed on Windows.
 - npm, pinned Yarn `node-modules`, and pinned pnpm 12 isolated/hoisted layouts.
-- Automatic qualification for supported TypeScript invocations; workspace
+- Automatic qualification for the supported Yarn/pnpm TypeScript invocations; npm
+  launcher checks are recording-only in alpha.4. Workspace
   boundaries follow the files actually consumed, including built declarations.
 - Existing test/lint/build and arbitrary commands can record results while
   their applicability remains unqualified.

package/bin/redue.mjs

@@ -266,6 +266,7 @@ const checks=publicConfig.checks.map(check=>{
     coverageReasons:check.coverageReasons||Object.fromEntries(
       categories.map(category=>[category,reason])),
     qualification:check.qualification||null,script:check.script||null,
+    ...(npmAutomatic?{qualificationInterpretation:'npm-launcher-withheld@1'}:{}),
     workspace:check.workspace||null,kind:check.kind||null};
 });
 const runtime={schema:1,provider:'declared-project@1',root,state,checks};

package/docs/user/getting-started.md

@@ -57,6 +57,12 @@ prefix. Uninstalling the package does not remove local verification evidence;
 `redue remove-state` is a separate, explicit action. Alpha.1 remains available as
 historical software and is superseded for package identity, not a runtime defect.
 
+## Upgrading to alpha.4
+
+Stop every observer using the installation before upgrading, then restart each
+with the same config/state selection. See [the npm launcher notice](npm-launcher-notice.md)
+for exact commands. Do not remove state or delete receipts.
+
 ## First project
 
 From the project root:
@@ -74,7 +80,9 @@ Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
 `redue.config.json`. An existing config is never overwritten. No checks are run and
-no dependencies installed. A missing/unsupported boundary is explained.
+no dependencies installed. A missing/unsupported boundary is explained. Npm-launcher typechecks are
+recording-only in alpha.4; a passed execution is historical PASS with UNVERIFIED
+applicability, not reusable CURRENT.
 
 “Ready to qualify” means REDUE has a supported recipe whose prerequisites will be
 validated. It is not a receipt. “Recording-only” can record PASS/FAIL without claiming

package/docs/user/npm-launcher-notice.md

@@ -0,0 +1,42 @@
+# npm launcher applicability correction — alpha.4
+
+Alpha.4 withdraws automatic applicability for npm-backed TypeScript checks using
+`typescript-noemit-v1`. Alpha.3 was demonstrated to admit an npm invocation whose
+update notification consumes unobserved remote responses, cache and time. Those
+inputs can change the outer npm result without changing the tracked project or
+caller identity. The controlled reproduction does not establish a public registry
+malfunction, affected-user count, or compiler completion in the failing npm case.
+
+Npm commands still execute exactly as configured through `redue run CHECK`.
+They still record PASS/FAIL. Previous PASS remains historical PASS; applicability
+is now UNVERIFIED, including after synchronization or a successful new npm run.
+This is a correction to the claimed boundary, not evidence that the code failed.
+Supported Yarn/pnpm and independently reviewed explicit contracts are unchanged.
+
+Until upgraded, do not rely solely on automatic npm CURRENT to skip the npm
+invocation. A different verification recipe requires explicit selection and fresh
+evidence; it cannot reinterpret an old npm receipt. Alpha.4 does not ship the
+experimental npm direct-compiler recipe or agent activation.
+
+## Upgrade without losing history
+
+First stop **every observer using this installation**, using each original config
+and any explicit state directory. Then upgrade that same installation and restart
+each observer with the same selections:
+
+```sh
+redue --config /path/to/project/redue.config.json stop
+npm install --global @redue/cli@0.1.0-alpha.4
+redue --config /path/to/project/redue.config.json start
+redue --config /path/to/project/redue.config.json status --sync
+```
+
+Repeat the stop/start commands for each project. If you originally used
+`--state-dir`, supply the identical directory on every REDUE command. If installed
+with a custom npm `--prefix`, supply the same prefix during installation. On Windows
+use `npm.cmd`/`redue.cmd` if required by existing PowerShell policy; do not change it.
+
+**Do not delete receipts or use `remove-state` as an upgrade step.** An upgraded
+client refuses an obsolete running observer interpretation and asks for stop/start.
+Restart reconciles existing state and preserves immutable historical runs. This
+correction does not silently change your project config or configured command.

package/docs/user/supported-projects.md

@@ -15,14 +15,13 @@ At the repository root, `init` looks for existing typecheck, test, lint, and
 build scripts. It prefers familiar script names, then unique recognizable
 `tsc`, Vitest/Jest, ESLint, or Vite commands under other names. Multiple
 matches are reported as ambiguous rather than guessed. It never creates a new
-project script. It recognizes canonical
-`tsc --noEmit` on local npm installations as a candidate for automatic
-qualification. Before CURRENT is possible, a read-only probe checks the
-TypeScript configuration and effective file list, local compiler, installed
-contents, npm/Node identity, and relevant caller context. Unsupported plugins,
-preloads, config graphs, or outside-root inputs leave the check UNVERIFIED with
-an explanation. A discovered script can still be run and recorded in that
-state. Root and package-level npm/Yarn workspace scripts are discovered from
+project script. Canonical `tsc --noEmit` npm scripts are discovered and recorded, but their
+automatic applicability is withdrawn in alpha.4: npm's update notification uses
+remote/cache/time inputs outside the observed contract. Even a successful run
+remains UNVERIFIED/PASS. Historical receipts are retained. See the
+[maintainer notice](npm-launcher-notice.md). A separately selected verification
+obligation would require an explicit configuration and fresh evidence; alpha.4
+does not provide the unreleased npm direct-compiler recipe. Root and package-level npm/Yarn workspace scripts are discovered from
 `package.json` workspace declarations. Pinned Yarn 4 `node-modules`/classic
 workspaces with a standalone `tsc -p .` script, local TypeScript, a conventional
 `src` include, and Node module resolution can qualify automatically. For one

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.4",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/node-onboarding.mjs

@@ -116,7 +116,7 @@ function classify(kind,scriptName,script,pkg,managerInfo,root) {
     managerInfo.name==='npm'&&
     exists(path.join(root,'tsconfig.json'))&&
     exists(path.join(root,'node_modules/typescript/package.json')))
-    return {level:'ready',reason:'canonical local tsc --noEmit; checked again before reuse',
+    return {level:'recording',reason:'npm launcher uses unobserved remote/cache/time inputs; execution can be recorded, but cannot be reused',
       qualification:'typescript-noemit-v1'};
   if(kind==='typecheck')return {level:'recording',reason:
     'TypeScript invocation, installation, or configuration is outside the automatic noEmit contract'};
@@ -183,7 +183,7 @@ export function discoverNodeProject(root) {
     if(!script)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
       classify(kind,script,scripts[script],pkg,pm,root);
-    if(workspaces&&classification.level==='ready')classification={level:'recording',
+    if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
     if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&

package/src/typescript-contract-probe.mjs

@@ -1,188 +1,5 @@
 #!/usr/bin/env node
-// Read-only applicability probe for the deliberately narrow npm/tsc --noEmit
-// contract. It emits one digest; failures emit only a fixed diagnostic code.
-import {compilerFiles} from './typescript-list.mjs';
-import {contextOnly,probeResult} from './probe-result.mjs';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import {createHash} from 'node:crypto';
-import {createRequire} from 'node:module';
-import {spawnSync} from 'node:child_process';
-import {withinPath as within,realObservedPath} from './path-identity.mjs';
-import {timing} from './decision-profile.mjs';
-
-const [rootArg,scriptName,npmArg]=process.argv.slice(2);
-const hash=value=>createHash('sha256').update(value).digest('hex');
-const fail=code=>{throw Object.assign(Error(code),{code});};
-const digestFile=file=>hash(fs.readFileSync(file));
-const require=createRequire(import.meta.url);
-function treeHash(dir){
-  const digest=createHash('sha256');let count=0;
-  const visit=(folder,rel='')=>{
-    for(const entry of fs.readdirSync(folder,{withFileTypes:true}).sort((a,b)=>
-      a.name.localeCompare(b.name))){
-      const name=rel?rel+'/'+entry.name:entry.name,full=path.join(folder,entry.name);
-      if(entry.isDirectory())visit(full,name);
-      else if(entry.isFile()){digest.update(name+'\0'+digestFile(full)+'\0');count++;}
-      else fail('npm-installation-unobservable');
-    }
-  };
-  visit(dir);return [digest.digest('hex'),count];
-}
-function npmRcKeys(file){
-  if(!fs.existsSync(file))return null;
-  const keys=[];
-  for(const line of fs.readFileSync(file,'utf8').split(/\r?\n/)){
-    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-    const at=trimmed.indexOf('=');if(at<0)fail('npm-configuration-unsupported');
-    const key=trimmed.slice(0,at).trim();
-    if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-      fail('npm-configuration-unsupported');
-    keys.push(key);
-  }
-  return keys.sort();
-}
-try{
-  if(!rootArg||!scriptName||!npmArg)fail('probe-arguments');
-  const root=realObservedPath(rootArg),npm=realObservedPath(npmArg);
-  const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.scripts?.[scriptName]?.trim()!=='tsc --noEmit'||
-    pkg.scripts?.['pre'+scriptName]||pkg.scripts?.['post'+scriptName])
-    fail('typecheck-script-changed');
-  if(process.env.NODE_OPTIONS||process.env.NODE_PATH||process.env.BASH_ENV||
-    process.env.ENV||Object.entries(process.env).some(([key,value])=>{
-      if(/^npm_config_prefix$/i.test(key)&&process.platform==='win32'){
-        // The Windows runner supplies a global npm prefix independently of
-        // the selected local compiler. Its value is part of caller context.
-        return !path.isAbsolute(value);
-      }
-      return /^(npm_config_|DYLD_|TSGO_)/i.test(key);
-    }))fail('execution-environment-unsupported');
-  let npmRoot;
-  if(process.platform==='win32'){
-    if(path.basename(npm).toLowerCase()!=='npm.cmd')
-      fail('npm-installation-layout-unsupported');
-    npmRoot=path.join(path.dirname(npm),'node_modules','npm');
-    const body=fs.readFileSync(npm,'utf8');
-    if(!body.includes('node_modules\\npm\\bin\\npm-cli.js')||
-      !body.includes('node_modules\\npm\\bin\\npm-prefix.js')||
-      !body.includes('"%NODE_EXE%" "%NPM_CLI_JS%" %*'))
-      fail('npm-installation-layout-unsupported');
-    const prefix=spawnSync(process.execPath,[path.join(npmRoot,'bin','npm-prefix.js')],
-      {cwd:root,env:process.env,encoding:'utf8',timeout:4000,stdio:['ignore','pipe','ignore']});
-    const selectedPrefix=prefix.stdout?.trim();
-    if(prefix.error||prefix.status!==0||!selectedPrefix||
-      !path.isAbsolute(selectedPrefix))fail('npm-installation-layout-unsupported');
-    // npm.cmd selects the prefix's CLI only when that file exists. Otherwise
-    // it runs the bundled CLI beside npm.cmd; observe the same branch here.
-    const alternate=path.join(selectedPrefix,'node_modules','npm','bin','npm-cli.js');
-    if(fs.existsSync(alternate)&&
-      realObservedPath(alternate)!==realObservedPath(path.join(npmRoot,'bin','npm-cli.js')))
-      fail('npm-installation-layout-unsupported');
-  }else npmRoot=path.dirname(path.dirname(npm));
-  if(path.basename(npmRoot)!=='npm'||path.basename(path.dirname(npmRoot))!=='node_modules')
-    fail('npm-installation-layout-unsupported');
-  const home=process.platform==='win32'?os.homedir():process.env.HOME;
-  if(!home||!path.isAbsolute(home))fail('home-context-unavailable');
-  const npmConfig=[path.join(root,'.npmrc'),path.join(home,'.npmrc')]
-    .map(file=>[hash(file),npmRcKeys(file)]);
-  const contextFacts={
-    npmTree:treeHash(npmRoot),npmConfig,
-    node:hash(JSON.stringify([process.version,realObservedPath(process.execPath),
-      fs.statSync(process.execPath).size])),
-    shell:process.platform==='win32'?hash(JSON.stringify([
-      realObservedPath(process.env.ComSpec||process.env.COMSPEC||''),
-      digestFile(process.env.ComSpec||process.env.COMSPEC||''),
-      process.env.PATHEXT||'',digestFile(npm),
-      digestFile(path.join(root,'node_modules','.bin','tsc.cmd'))])):
-      digestFile('/bin/sh')};
-  const contextHash=hash(JSON.stringify(contextFacts));
-  if(contextOnly(contextHash))process.exit(0);
-  const tsRoot=path.join(root,'node_modules','typescript');
-  let tsc;
-  if(process.platform==='win32'){
-    const shim=path.join(root,'node_modules','.bin','tsc.cmd');
-    const body=fs.readFileSync(shim,'utf8').replace(/\r\n/g,'\n').trim();
-    const expected=`@ECHO off
-GOTO start
-:find_dp0
-SET dp0=%~dp0
-EXIT /b
-:start
-SETLOCAL
-CALL :find_dp0
-
-IF EXIST "%dp0%\\node.exe" (
-  SET "_prog=%dp0%\\node.exe"
-) ELSE (
-  SET "_prog=node"
-  SET PATHEXT=%PATHEXT:;.JS;=;%
-)
-
-endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\..\\typescript\\bin\\tsc" %*`;
-    if(body!==expected)fail('typescript-executable-changed');
-    tsc=realObservedPath(path.join(tsRoot,'bin','tsc'));
-  }else{
-    tsc=realObservedPath(path.join(root,'node_modules','.bin','tsc'));
-    if(tsc!==path.join(tsRoot,'bin','tsc'))fail('typescript-executable-changed');
-  }
-  const configReads=new Set(),visited=new Set();
-  let ts;try{ts=require(tsRoot);}catch{}
-  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
-    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
-      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
-    const parseConfig=file=>{
-      const absolute=path.resolve(file);
-      if(!within(absolute,root))fail('typescript-config-outside-repository');
-      if(visited.has(absolute))return;visited.add(absolute);
-      if(visited.size>64)fail('typescript-config-graph-too-large');
-      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
-      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
-      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
-      if(parsed.options?.incremental||parsed.options?.composite)
-        fail('typescript-incremental-unsupported');
-      for(const reference of parsed.projectReferences||[])
-        parseConfig(reference.path.endsWith('.json')?reference.path:
-          path.join(reference.path,'tsconfig.json'));
-    };
-    parseConfig(path.join(root,'tsconfig.json'));
-  }else{
-    // TypeScript 7's native compiler does not expose the previous config API.
-    // Its CLI reports the effective config; restrict this path to one direct
-    // config rather than guessing about extends/reference provenance.
-    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
-    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
-      fail('typescript-config-graph-unsupported');
-    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
-      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
-    const effective=JSON.parse(shown.stdout);
-    if(effective.compilerOptions?.plugins?.length||
-      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
-      fail('typescript-config-graph-unsupported');
-    configReads.add(config);
-  }
-  for(const file of configReads)if(!within(realObservedPath(file),root))
-    fail('typescript-config-outside-repository');
-  const listingStarted=performance.now();
-  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
-  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
-    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
-      maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
-    error:listed.error?.code||null});
-  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
-  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
-    .map(file=>path.resolve(file));
-  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
-    fail('typescript-input-outside-repository');
-  const facts={schema:1,root:hash(root),script:scriptName,
-    configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),
-    ...contextFacts};
-  probeResult(hash(JSON.stringify(facts)),contextHash,captured?.queries);
-}catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:
-  'typescript-contract-unavailable'}`);process.exitCode=2;}
+// Retired npm-launcher interpretation. Do not return even a context-only digest:
+// old receipts and cached compiler certificates cannot qualify this obligation.
+console.error('VSTATE_REASON:npm-launcher-unobserved-inputs');
+process.exitCode=2;

package/src/typescript-qualification.mjs

@@ -50,47 +50,7 @@ export function qualifyTypeScript(root,selected,discovered={}) {
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification!=='typescript-noemit-v1')return null;
-  const issues=[];
-  let pkg;
-  try{pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));}
-  catch{issues.push('package manifest unavailable');}
-  if(!selected.script||pkg?.scripts?.[selected.script]?.trim()!=='tsc --noEmit'||
-    pkg?.scripts?.['pre'+selected.script]||pkg?.scripts?.['post'+selected.script])
-    issues.push('typecheck script is not the supported standalone tsc --noEmit invocation');
-  if(selected.command?.length!==3||selected.command[1]!=='run'||
-    selected.command[2]!==selected.script)
-    issues.push('package-manager invocation differs from the discovered script');
-  try{const npm=fs.realpathSync(selected.command[0]);
-    const supported=process.platform==='win32'?path.basename(npm).toLowerCase()==='npm.cmd'&&
-      fs.existsSync(path.join(path.dirname(npm),'node_modules','npm','bin','npm-cli.js')):
-      path.basename(npm)==='npm-cli.js'&&
-      path.basename(path.dirname(path.dirname(npm)))==='npm';
-    if(!supported)
-      issues.push('npm executable layout is not supported');}
-  catch{issues.push('npm executable unavailable');}
-  if(!fs.existsSync(path.join(root,'tsconfig.json')))
-    issues.push('tsconfig.json is missing');
-  if(!fs.existsSync(path.join(root,'node_modules','typescript','package.json'))||
-    !fs.existsSync(path.join(root,'node_modules','.bin',
-      process.platform==='win32'?'tsc.cmd':'tsc')))
-    issues.push('local TypeScript installation is missing');
-  if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
-    !selected.inputs?.includes('package.json')||
-    !selected.inputs?.includes('tsconfig.json'))
-    issues.push('TypeScript source/config file-set declaration is incomplete');
-  if(!selected.installedInputs?.includes('node_modules/**'))
-    issues.push('installed package contents and membership are not declared');
-  if(!selected.environment?.executableIdentity||
-    !['node','npm'].every(name=>selected.environment?.pathExecutables?.includes(name))||
-    !['NODE_OPTIONS','NODE_PATH','HOME','BASH_ENV','ENV'].every(name=>
-      selected.environment?.variables?.includes(name))||
-    !['npm_config_','DYLD_','TSGO_'].every(name=>
-      selected.environment?.prefixes?.includes(name)))
-    issues.push('caller toolchain or execution context declaration is incomplete');
-  if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='typescript-contract-probe.mjs'&&
-    argv[2]&&fs.existsSync(argv[2])&&
-    realObservedPath(argv[2])===root&&argv[3]===selected.script&&
-    argv[4]===selected.command[0]))
-    issues.push('TypeScript input and toolchain probe is missing');
-  return {qualified:issues.length===0,issues};
+  // Retired automatic launcher contract: npm's notifier consumes unobserved
+  // remote/cache/time state. A successful execution is still an outcome.
+  return {qualified:false,issues:['npm launcher applicability is unqualified: update notification uses unobserved remote/cache/time inputs; run the npm script when needed']};
 }