@redue/cli 0.1.0-alpha.30 → 0.1.0-alpha.31

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.1.0-alpha.31 — 2026-11-03
+
+A check that runs longer than init's trial limit no longer holds up
+`init` for three runs, and can be set up in the sandbox later.
+
+- **A run past the trial limit never agrees.** Each trial run at `init`
+  stops after 5 minutes. alpha.30 counted a timeout on both sides as
+  agreement and ran every trial of a check that timed out. Now, when the
+  plain run reaches the limit, `init` runs nothing in the sandbox and
+  writes the fallback; when a sandboxed run reaches it, no further trial
+  follows. On the 13 census repos with the slowest checks, `init --dry-run`
+  took 6224 s in all with alpha.30 and 3670 s now on Linux, 8331 s and
+  4776 s on macOS. ADOSMissionControl went from 1138 s to 581 s (Linux),
+  agent-afk from 936 s to 323 s, Nomi from 860 s to 528 s (macOS). Checks
+  that moved from the sandbox to their fallback: 2 of 210 on Linux
+  (ts-liveview typecheck, open-science lint), 3 of 210 on macOS (Nomi and
+  ts-liveview typecheck, OneUptime lint).
+- **`redue init --no-time-limit`.** `redue setup` names the checks that
+  ran past the limit and prints one command, such as
+  `redue init --check typecheck --no-time-limit`. It runs their trials with
+  no limit and updates only their rows in the existing config (a row that
+  runs the same script), restarts a running observer, and leaves the
+  config one `redue remove` still deletes. `init --json` gives such a
+  check's kind as `time_limit`.
+
 ## 0.1.0-alpha.30 — 2026-11-03
 
 `init` runs a check fewer times, and tests try the sandbox first.

package/bin/redue.mjs

@@ -33,7 +33,10 @@ Commands:
                        init, agent setup claude, start, one recorded run per check
   remove [--yes]       Undo setup: integration, observer state, and the config setup created
   init [--dry-run] [--workspace NAME] [--check KIND] [--recipe typescript-direct|tests-direct|node-script|sandbox]
-                       Discover existing scripts; optionally select one workspace/check
+       [--no-time-limit]
+                       Discover existing scripts; optionally select one workspace/check.
+                       --no-time-limit: trial runs have no 5-minute limit; with a config, the checks
+                       it does not run in the sandbox are tried, and those that qualify are updated
   agent setup codex|claude [--dry-run|--apply] [--json]
   agent doctor [codex|claude] [--json]
   agent remove codex|claude [--dry-run|--apply] [--json]
@@ -118,11 +121,13 @@ if(command==='init')for(let i=0;i<args.length;){
 }
 const check=['run','detail','explain'].includes(command)&&args[0]&&!args[0].startsWith('--')?args.shift():null;
 if(command==='run'&&!check)error('run requires a check name');
-if(args.some(value=>!['--json','--sync','--cached','--dry-run','--short'].includes(value)))error('unknown option; use --help');
+if(args.some(value=>!['--json','--sync','--cached','--dry-run','--short','--no-time-limit'].includes(value)))error('unknown option; use --help');
 if(sync&&!['status','detail','explain'].includes(command))error('--sync is for status or detail');
 if(cachedOnly&&(command!=='status'||args.includes('--sync')))error('--cached is a status option; do not combine it with --sync');
 if(short&&(command!=='status'||json||args.includes('--sync')))error('--short is a cached status option; do not combine it with --sync or --json');
 if(dryRun&&command!=='init')error('--dry-run is for init');
+const noTimeLimit=args.includes('--no-time-limit');
+if(noTimeLimit&&command!=='init')error('--no-time-limit is for init');
 
 if(command==='init'){
   const {discoverNodeProject,sourceLinkIssue}=await import('../src/node-onboarding.mjs');
@@ -164,36 +169,63 @@ if(command==='init'){
   // where the plain run passes. Any other difference is tried once with the
   // whole checkout, reusing the plain run. Otherwise init writes what it
   // would have without the sandboxed recipe, with the reason. Each check
-  // costs one plain run and one or two sandboxed runs.
+  // costs one plain run and one or two sandboxed runs. A run past the trial
+  // limit ends the check's trials (time_limit); --no-time-limit sets none.
   const trialIssue=trial=>trial.issue?`the sandbox cannot run here (${trial.issue})`:
+    trial.timedOut?`it ran past init's 5-minute trial limit${trial.timedOut==='sandboxed'?' inside the sandbox':''}`+
+      ` (redue init --check ${trial.kind} --no-time-limit tries it without the limit)`:
     // A failure both ways that shows a refusal cannot be told from a real one.
     trial.same?null:trial.plain!==trial.sandboxed?`exit ${trial.sandboxed} inside the sandbox, ${trial.plain} outside it${trial.line?` (${trial.line})`:''}`:
     trial.line?`it fails both ways (exit ${trial.plain}), with a sign of a refusal inside the sandbox (${trial.line})`:
     `the output differs inside the sandbox: ${JSON.stringify(trial.output.sandboxed)} instead of ${JSON.stringify(trial.output.plain)}`;
+  // With --no-time-limit and a config, the checks the config has and does
+  // not run in the sandbox are tried, and one it lacks when --check names
+  // it. Those that qualify replace their rows (a row that runs the same
+  // script) or are added.
+  const configured=fs.existsSync(configFile);
+  let existing=null,existingText=null;
+  if(configured&&noTimeLimit){
+    try{existingText=fs.readFileSync(configFile,'utf8');existing=JSON.parse(existingText);}catch(e){error(`cannot read ${configFile}: ${e.message}`);}
+    if(!Array.isArray(existing?.checks))error(`cannot read ${configFile}: it has no checks`);
+    if((existing.root??'.')!=='.'||!samePath(realObservedPath(path.dirname(configFile)),discovery.root))
+      error('init updates only a config at the repository root, without root; run it there');
+  }
+  const timeout=noTimeLimit?0:undefined,improved=new Map();
   let trials=0;
   for(const [at,row] of [...discovery.checks.entries()]){
     if(row.qualification!==sandboxQualification||row.level!=='ready')continue;
+    const old=existing?.checks.find(check=>check.name===row.config.name);
+    const sameRun=old&&old.kind===row.config.kind&&(row.config.script?old.script===row.config.script:
+      JSON.stringify(old.command)===JSON.stringify(row.config.command));
+    const notTried=!existing?null:!old?(checkSelection?null:'the config does not have it; name its kind with --check to add it'):
+      isSandboxed(old.qualification)?'the config already runs it in the sandbox':sameRun?null:'the config runs something else under that name';
+    if(notTried){discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: not tried; ${notTried}`});continue;}
     if(!json)console.error(`Running ${row.config.name} inside and outside the sandbox to confirm it...`);
-    const docs=await sandboxTrial(discovery.root,row.config,{hide:'docs'});
+    const docs={...await sandboxTrial(discovery.root,row.config,{hide:'docs',timeout}),kind:row.config.kind};
     if(!docs.issue)trials++;
     if(!docs.issue&&docs.same){
       row.config={...row.config,qualification:docsQualification};row.qualification=docsQualification;
-      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;continue;}
-    if(!docs.issue&&docs.refusedHidden){
-      row.reason+=`; at init it passed, then failed reading a file that was hidden (${docs.refusedHidden}), so the whole checkout is its input, not run that way at init`;continue;}
+      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;
+      improved.set(row.config.name,row.config);continue;}
+    if(!docs.issue&&!docs.timedOut&&docs.refusedHidden){
+      row.reason+=`; at init it passed, then failed reading a file that was hidden (${docs.refusedHidden}), so the whole checkout is its input, not run that way at init`;
+      improved.set(row.config.name,row.config);continue;}
     // Without a list of the ignored files or the documentation, the whole checkout is tried on its own.
-    const trial=docs.plainRun?await sandboxTrial(discovery.root,row.config,{plain:docs.plainRun}):
-      [hiddenListIssue,hiddenDocsIssue].includes(docs.issue)?await sandboxTrial(discovery.root,row.config):docs;
+    const trial=docs.timedOut?docs:docs.plainRun?{...await sandboxTrial(discovery.root,row.config,{plain:docs.plainRun,timeout}),kind:row.config.kind}:
+      [hiddenListIssue,hiddenDocsIssue].includes(docs.issue)?{...await sandboxTrial(discovery.root,row.config,{timeout}),kind:row.config.kind}:docs;
     if(trial!==docs&&!trial.issue)trials++;
     const issue=trialIssue(trial);
     if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}; the whole checkout is its input: `+
-      (docs.issue?docs.issue:`with the files git ignores and the documentation hidden, ${trialIssue(docs)}`);continue;}
-    if(row.fallback)discovery.checks[at]={...row.fallback,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
-    else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
+      (docs.issue?docs.issue:`with the files git ignores and the documentation hidden, ${trialIssue(docs)}`);
+      improved.set(row.config.name,row.config);continue;}
+    // time_limit: the kind that --check takes to try it without the limit.
+    const limited=trial.timedOut?{timeLimit:row.config.kind}:{};
+    if(row.fallback)discovery.checks[at]={...row.fallback,...limited,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
+    else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,...trial.timedOut?{time_limit:row.config.kind}:{},reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
   }
   discovery.checks=discovery.checks.filter(Boolean).map(({fallback,...row})=>row);
   discovery.config.checks=discovery.checks.map(row=>row.config);
-  const configured=fs.existsSync(configFile),unsupported=Boolean(discovery.observationIssue||
+  const unsupported=Boolean(discovery.observationIssue||
     discovery.manager.issue&&!['npm','yarn','pnpm'].includes(discovery.manager.name)||
     discovery.manager.name==='yarn'&&!discovery.manager.version);
   const willWrite=!dryRun&&!configured&&!unsupported&&discovery.checks.length>0;
@@ -202,9 +234,9 @@ if(command==='init'){
     installation_layout:discovery.manager.layout,
     issue:discovery.observationIssue||discovery.manager.issue,workspaces:discovery.workspaces,
     ambiguous:discovery.ambiguous,skipped:discovery.skipped||[],
-    checks:discovery.checks.map(({config:check,level,reason})=>({name:check.name,
+    checks:discovery.checks.map(({config:check,level,reason,timeLimit})=>({name:check.name,
       script:check.script||null,command:check.command||null,
-      workspace:check.workspace||null,level,reason})),config:configFile,
+      workspace:check.workspace||null,level,reason,...timeLimit?{time_limit:timeLimit}:{}})),config:configFile,
     written:willWrite,existing:configured,writable:!configured&&!unsupported&&discovery.checks.length>0};
   if(!json) {
     if(summary.package_manager||!discovery.python)console.log(`Node ${summary.node}; ${summary.package_manager||'unknown package manager'}`+
@@ -223,7 +255,8 @@ if(command==='init'){
       console.log(`  ${row.kind}: ambiguous scripts (${row.scripts.join(', ')}); choose one explicitly`);
     for(const row of summary.skipped)console.log(`  Skipped: ${row.reason}`);
     if(!summary.checks.length)console.log('No useful existing verification scripts found.');
-    console.log(configured?`Existing ${configFile} left unchanged.`:
+    console.log(existing&&improved.size?(dryRun?`Preview only; ${configFile} was not updated.`:`Updating ${[...improved.keys()].join(', ')} in ${configFile}.`):
+      configured?`Existing ${configFile} left unchanged.`:
       dryRun?`Preview only; ${configFile} was not written.`:
         willWrite?`Writing ${configFile}; inspect it before running checks.`:'No configuration will be written.');
   }
@@ -236,6 +269,23 @@ if(command==='init'){
       console.log(`Next: review the config, then redue start and redue run ${JSON.stringify(discovery.checks[0].config.name)}.`);
       console.log('Connect your agent: redue agent setup codex (or claude). Preview with --dry-run.');
       console.log('Then redue status says whether each result applies to the files as they are now.');}
+  } else if(existing&&improved.size&&!dryRun){
+    if(fs.readFileSync(configFile,'utf8')!==existingText)error(`${configFile} changed while the checks ran; nothing was written. Run init again`);
+    // The observer keeps the config it started with: it is restarted around the update.
+    const state=stateOverride||projectState(discovery.root,configFile);
+    let running=false;try{running=processAlive(Number(fs.readFileSync(path.join(state,'observer.lock','pid'),'utf8')));}catch{}
+    const self=action=>spawnSync(process.execPath,[process.argv[1],'--config',configFile,...stateOverride?['--state-dir',stateOverride]:[],action],
+      {stdio:['ignore','pipe','pipe'],encoding:'utf8'});
+    if(running&&self('stop').status!==0)error('the observer did not stop; nothing was written');
+    const names=new Set(existing.checks.map(check=>check.name));
+    existing.checks=[...existing.checks.map(check=>improved.get(check.name)??check),...[...improved.values()].filter(check=>!names.has(check.name))];
+    const text=JSON.stringify(existing,null,2)+'\n';
+    fs.writeFileSync(configFile,text);
+    // A config setup created is still one redue remove deletes.
+    (await import('../src/setup.mjs')).configRewritten(discovery.root,existingText,text);
+    Object.assign(summary,{written:true,updated:[...improved.keys()],observer:!running?'not running':self('start').status===0?'restarted':'not started'});
+    if(!json)console.log(`Updated ${[...improved.keys()].join(', ')} in ${configFile}.`+
+      {restarted:' Restarted the observer with it.','not started':' The observer did not start again: run redue start.','not running':''}[summary.observer]);
   } else if(unsupported&&!json)console.log(`No config written: ${summary.issue||'unsupported discovery boundary'}.`);
   if(json)console.log(JSON.stringify({...summary,proposed_config:discovery.config}));
   await exit(0);

package/docs/user/getting-started.md

@@ -100,7 +100,8 @@ redue explain typecheck
 Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
-`redue.config.json`. An existing config is never overwritten. No dependencies are
+`redue.config.json`. An existing config is not overwritten (`init --no-time-limit`
+updates the rows of checks it [qualifies](sandbox.md#files-git-ignores-and-documentation)). No dependencies are
 installed; a check proposed for the sandboxed recipe runs once plainly and once or
 twice in the sandbox, and no results are recorded. A missing/unsupported boundary is explained. `init` tries
 the strict recipes first and uses the [general recipe](node-script.md) for a root

package/docs/user/sandbox.md

@@ -87,6 +87,20 @@ reusing the plain run, and writes `sandbox-v1` only if that agrees. So a
 check runs two or three times at init, not four. `init` no longer writes
 `sandbox-v2`; a check already set up with it keeps it.
 
+Each trial run stops after 5 minutes. A run that stops there never counts as
+agreeing: when the plain run reaches the limit, `init` runs nothing in the
+sandbox and writes the fallback; when a sandboxed run reaches it, no further
+trial follows. `init` marks such a check (`time_limit` in `--json` gives
+its kind), and `redue setup` names them and prints one command:
+`redue init --check typecheck --no-time-limit` (or `redue init
+--no-time-limit` for several kinds). With an existing config, that command
+runs with no limit the checks the config has and does not run in the
+sandbox, and a check it lacks when `--check` names its kind. It replaces
+the row of each that qualifies, if the row runs the same script, or adds
+it, and leaves the rest of the config as it was. It restarts a running
+observer with the new config, and `redue remove` still deletes a config
+`setup` created.
+
 With `sandbox-v3`, each run also hides the documentation: the files git
 lists (and does not ignore) named `*.md`, `*.mdx`, `*.rst`, `LICENSE*` or
 `CHANGELOG*` anywhere, and text, image and PDF files (`.txt`, `.adoc`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.30",
+  "version": "0.1.0-alpha.31",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/sandbox.mjs

@@ -595,13 +595,17 @@ function refusedHidden(plain,sandboxed,entries,supervisor){
   const others=sandboxed.output.split(/\r?\n/).filter(text=>!hiddenRefusal(text,entries)).join('\n');
   return denialLine(others)?null:line;
 }
-// {same, plain, sandboxed, line, refusedHidden} or {issue} when the sandbox cannot run here.
+// init's limit on each trial run, in ms; a test can shorten it.
+export const trialLimit=process.env.VSTATE_TEST_FAULTS==='1'&&Number(process.env.VSTATE_TEST_TRIAL_LIMIT)||300000;
+// {same, plain, sandboxed, line, refusedHidden, timedOut} or {issue} when the sandbox cannot run here.
+// A run that reaches `timeout` (0: none) is never the same as another:
+// `timedOut` says which, and when the plain run does, no sandboxed run follows.
 // With `hide` 'docs', the documentation (hiddenDocs) is hidden too.
 // With `hide`, the git-ignored entries hiddenEntries lists are kept from the
 // sandboxed run, and it also returns them, their count, the run times and, on
 // Linux, the launcher's rule count and setup time.
 // `plain`: the plain run of an earlier trial of the same check, reused.
-export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:earlier=null}={}){
+export async function sandboxTrial(root,check,{timeout=trialLimit,hide=false,plain:earlier=null}={}){
   const supported=sandboxSupport();
   if(supported.issue)return {issue:supported.issue};
   const python=Boolean(pythonTool(check));
@@ -621,6 +625,7 @@ export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:e
     const run=async(argv,env)=>{const started=Date.now(),r=await runToEnd(argv,{cwd:root,env,timeout});
       return {status:r.timedOut?'timeout':r.status??r.signal??r.error?.code,output:`${r.stdout}\n${r.stderr}`,ms:Date.now()-started};};
     const plain=earlier??await run(command,{...process.env,...python?{}:{npm_config_update_notifier:'false'}});
+    if(plain.status==='timeout')return {same:false,plain:'timeout',sandboxed:null,timedOut:'plain',line:null,refusedHidden:null,plainRun:plain};
     const reads=[root,home,tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
     const sandboxed=await run(sandboxArgv(supported.mode,command,{reads,tmp,python:supported.python,hidden,stats,
       ...hide==='docs'?{docs:{root,entries:docEntries}}:{},
@@ -644,8 +649,9 @@ export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:e
     const counts=tests?[plain,sandboxed].map(r=>testCounts(r.output)):null;
     const read=counts?.some(c=>Object.values(c).some(value=>value!==null));
     const differs=tests&&read?(JSON.stringify(counts[0])===JSON.stringify(counts[1])?null:{plain:JSON.stringify(counts[0]),sandboxed:JSON.stringify(counts[1])}):output;
-    const same=plain.status===sandboxed.status&&!denied&&!differs&&!supervisor;
-    return {same,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,
+    const timedOut=sandboxed.status==='timeout'?'sandboxed':null;
+    const same=!timedOut&&plain.status===sandboxed.status&&!denied&&!differs&&!supervisor;
+    return {same,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,timedOut,
       line:supervisor||denied||(plain.status===sandboxed.status?null:sandboxed.output.trim().split('\n').at(-1)?.slice(0,200)||null),
       refusedHidden:same?null:refusedHidden(plain,sandboxed,entries,supervisor),
       ...hide?{hidden:entries.length,entries,docs:docEntries.length,plainMs:plain.ms,sandboxedMs:sandboxed.ms,...launcher?{rules:launcher.rules,setupMs:launcher.ms}:{}}:{}};

package/src/setup.mjs

@@ -12,7 +12,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {spawnSync} from 'node:child_process';
-import {testCounts} from './sandbox.mjs';
+import {isSandboxed,testCounts} from './sandbox.mjs';
 import {createInterface} from 'node:readline/promises';
 import {projectState} from './project-location.mjs';
 import {claudeHooksInstalled,removeClaudeHooks,removeIntegration} from './agent-integration.mjs';
@@ -31,6 +31,18 @@ async function confirm(question,yes,{defaultYes}){
     return defaultYes?!/^n/i.test(answer):/^y/i.test(answer);}finally{prompt.close();}
 }
 
+// The setup record of the checkout at `root`, in its shared Git directory.
+function recordOf(root){
+  const common=git(root,'rev-parse','--git-common-dir');
+  return common.status===0?path.join(path.resolve(root,common.stdout.trim()),`redue-setup-${hash(root).slice(0,16)}.json`):null;
+}
+// When init updates the config setup created, the record follows, so that
+// redue remove still deletes it.
+export function configRewritten(root,before,after){
+  const file=recordOf(root),record=file&&JSON.parse(readText(file)??'null');
+  if(record?.configCreated&&record.configHash===hash(before))fs.writeFileSync(file,JSON.stringify({...record,configHash:hash(after)},null,2)+'\n');
+}
+
 export async function setupCommand(args,{entry,cwd=process.cwd()}){
   const action=args.shift();
   const yes=args.includes('--yes'),rest=args.filter(arg=>arg!=='--yes');
@@ -50,8 +62,7 @@ export async function setupCommand(args,{entry,cwd=process.cwd()}){
     stdio:options.capture?['ignore','pipe','pipe']:'inherit',timeout:options.timeout});
   // One record per checkout, beside the others in the shared Git directory:
   // linked worktrees share .git/info/exclude.
-  const common=path.resolve(root,git(root,'rev-parse','--git-common-dir').stdout.trim());
-  const recordFile=path.join(common,`redue-setup-${hash(root).slice(0,16)}.json`);
+  const recordFile=recordOf(root),common=path.dirname(recordFile);
   // Other checkouts' records, for checkouts that still exist.
   const others=()=>{try{return fs.readdirSync(common).filter(name=>/^redue-setup-[0-9a-f]{16}\.json$/.test(name)&&path.join(common,name)!==recordFile)
     .map(name=>JSON.parse(readText(path.join(common,name))??'null')).filter(other=>other&&fs.existsSync(other.root));}catch{return [];}};
@@ -78,6 +89,12 @@ async function setup({root,redue,yes,record:previous,recordFile,exclude,save}){
   const found=JSON.parse(preview.stdout);
   if(!configExisted&&!found.writable)throw Error(`nothing to set up: ${found.issue||(found.checks.length?found.checks.map(check=>`${check.name}: ${check.reason}`).join('; '):'no typecheck, lint or test script REDUE can use')}`);
   const levels=new Map(found.checks.map(check=>[check.name,check.level]));
+  // The checks whose trial ran past init's time limit, unless the config
+  // already runs them in the sandbox, and the kinds init's --check takes.
+  const sandboxed=new Set(configExisted?JSON.parse(readText(configPath)).checks.filter(check=>isSandboxed(check.qualification)).map(check=>check.name):[]);
+  const limited=[...found.checks.map(check=>[check.name,check.time_limit]),...(found.skipped||[]).map(row=>[row.kind,row.time_limit])]
+    .filter(([name,kind])=>kind&&!sandboxed.has(name));
+  const limitedKinds=[...new Set(limited.map(([,kind])=>kind))];
   const names=configExisted?JSON.parse(readText(configPath)).checks.map(check=>check.name):found.checks.map(check=>check.name);
   const ready=names.filter(name=>levels.get(name)==='ready');
   console.log(`Setting up REDUE for Claude Code in ${root}`);
@@ -161,6 +178,8 @@ async function setup({root,redue,yes,record:previous,recordFile,exclude,save}){
   if(ready.length&&!due.length)console.log(`Already CURRENT: ${ready.join(', ')}.`);
   for(const row of statusOf())console.log(`  ${row.name}: ${row.freshness}${row.result?' / '+row.result:''}${row.freshness==='CURRENT'?'':
     levels.get(row.name)!=='ready'?' — recording only':' — '+row.reason}`);
+  if(limited.length)console.log(`${limited.map(([name])=>name).join(', ')} ran past init's 5-minute trial limit, so ${limited.length>1?'they are':'it is'} not sandboxed. `+
+    `To try ${limited.length>1?'them':'it'} without the limit: redue init${limitedKinds.length>1?'':` --check ${limitedKinds[0]}`} --no-time-limit`);
   console.log('Done. Start a new Claude Code session in this project. Undo with redue remove.');
   return {applied:true};
 }