@redue/cli 0.1.0-alpha.30 → 0.1.0-alpha.32

package/src/daemon.mjs

@@ -25,7 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
-import {isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
+import {compactKey,installedTreeOf,isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -338,7 +338,49 @@ function combinedFiles(name) {
     Object.entries(entry.index.exportFiles(name)))files[`external:${entry.root}:${rel}`]=hash;
   return files;
 }
+// The files of a sandboxed run's snapshot and receipt, smaller: each
+// installed tree (a node_modules or .venv directory, outermost) as one entry,
+// `<tree>/:installed:`, with a digest of its files and their identities, and
+// every other file as it is. The fingerprint still covers every file; this map
+// names a changed input and decides which changes a hidden run could see. A
+// receipt says it holds this form (filesCompact), and is compared with it.
+// The entry's name is a path inside its tree, so whether a hidden run could
+// see a change to it is decided as for the files it stands for: beneath a
+// hidden entry, or new where git ignores it now.
+const compactCache=new Map();
+function compactFiles(name) {
+  const summary=combinedSummary(name),key=`${summary.revision}\0${summary.fingerprint}`;
+  const cached=compactCache.get(name);
+  if(cached?.key===key)return {...cached.files};
+  const out={},trees=new Map();
+  for(const [rel,hash] of Object.entries(combinedFiles(name))){
+    const tree=installedTreeOf(rel);
+    if(tree===null){out[rel]=hash;continue;}
+    let list=trees.get(tree);if(!list)trees.set(tree,list=[]);
+    list.push([rel,hash]);
+  }
+  for(const [tree,list] of trees){list.sort(([a],[b])=>a<b?-1:a>b?1:0);out[compactKey(tree)]=sha(JSON.stringify(list));}
+  compactCache.set(name,{key,files:out});
+  return {...out};
+}
+// The current files in the form receipt `r` holds them.
+const filesFor=(name,r)=>r?.filesCompact===true?compactFiles(name):combinedFiles(name);
+// Whether a receipt's run, which passed, is the second in a row during which
+// the same inputs changed (selfChange), and its plan, environment and every
+// other input are as they were at its start.
+function onlySelfChanged(name,row,r,contextHashes) {
+  const self=r.selfChange,context=contextHashes?.[name];
+  if(r.result!=='PASS'||!(self?.streak>=2)||!Array.isArray(self.files)||r.planId!==row.plan.id||!r.files||!context)return false;
+  for(const [key,value] of Object.entries(context))if(!key.startsWith('__redue_env_')&&r.environmentHashes?.[key]!==value)return false;
+  const skip=new Set(self.files),strip=files=>Object.fromEntries(Object.entries(files).filter(([file])=>!skip.has(file)));
+  const before=strip(r.files),now=strip(filesFor(name,r)),paths=[...new Set([...Object.keys(before),...Object.keys(now)])];
+  if(hiddenRun(r))return sandboxVisibleChange(root,r.sandbox.hidden,before,now,paths,{docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null})===null;
+  return paths.every(file=>before[file]===now[file]);
+}
+// A changed input as status names it: an installed tree by its path.
+const inputName=file=>file?.endsWith('/:installed:')?file.slice(0,-'/:installed:'.length):file;
 function describeChangedInput(plan,file) {
+  if(file.endsWith('/:installed:'))return `${file.slice(0,-'/:installed:'.length)} (installed files) changed`;
   const boundary=[...external.keys()].find(value=>file.startsWith(`external:${value}:`));
   const physical=boundary?path.join(boundary,file.slice(`external:${boundary}:`.length)):
     path.join(root,file);
@@ -355,7 +397,7 @@ function describeChangedInput(plan,file) {
 const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
 function visibleChange(row,r,name) {
   const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
-  if(row.visibleKey!==key){const current=combinedFiles(name);
+  if(row.visibleKey!==key){const current=filesFor(name,r);
     row.visibleKey=key;row.visibleChange=sandboxVisibleChange(root,r.sandbox.hidden,r.files,current,[...Object.keys(r.files),...Object.keys(current)],
       {docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null});}
   return row.visibleChange;
@@ -389,6 +431,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
           `; declared input checkpoint changed (${row.lastReason||'content or membership'})`:'';
       const probeIssue=row.probeError?`; state probe unavailable: ${row.probeError}`:'';
       item.reason='input coverage unresolved: '+row.plan.unresolved.join('; ')+checkpoint+probeIssue;
+      // Recording-only (no qualification contract, inputs it cannot resolve):
+      // no run can make it CURRENT. A qualified check's unresolved inputs can
+      // be fixed, so it stays due.
+      if(!row.plan.qualification)item.verifiable=false;
       return item;
     }
     if(row.probeError){item.reason=row.probeError;return item;}
@@ -410,6 +456,13 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=`target execution ${r.target?.status||'unavailable'}`;return item;}
     if(r.target.status==='failed'&&result!=='FAIL'){
       item.reason='target failure conflicts with outer invocation outcome';return item;}
+    // The same inputs changed during its last two passing runs, and nothing
+    // else changed since: no run of it can be confirmed. Anything else
+    // changing makes it due again.
+    if(!r.stable&&onlySelfChanged(name,row,r,contextHashes)){
+      item.verifiable=false;
+      item.reason=`the same inputs changed during its last two runs (${r.selfChange.files.slice(0,5).join(', ')}${r.selfChange.files.length>5?' and more':''}), so no result of it can be confirmed; it is due again when anything else changes`;
+      return item;}
     if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
       // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
       const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox|network supervisor)/.test(issue));
@@ -446,16 +499,16 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     else if(r.fingerprint!==combinedSummary(name).fingerprint&&!(hiddenRun(r)&&visibleChange(row,r,name)===null)) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
       if(row.staleReasonKey!==key&&hiddenRun(r)){
-        row.staleInputs=[visibleChange(row,r,name)];row.staleReason=describeChangedInput(row.plan,row.staleInputs[0]);row.staleReasonKey=key;}
+        const seen=visibleChange(row,r,name);row.staleInputs=[inputName(seen)];row.staleReason=describeChangedInput(row.plan,seen);row.staleReasonKey=key;}
       if(row.staleReasonKey!==key){
         let changed=row.lastReason;row.staleInputs=[];
         const candidate=changed?.endsWith(' changed')?changed.slice(0,-8):null;
-        if(candidate&&r.files?.[candidate]!==index.files.get(candidate)){
+        if(candidate&&!(r.filesCompact===true&&installedTreeOf(candidate)!==null)&&r.files?.[candidate]!==index.files.get(candidate)){
           changed=describeChangedInput(row.plan,candidate);row.staleInputs=[candidate];}
         else {
-          const current=combinedFiles(name);
+          const current=filesFor(name,r);
           if(r.files)for(const f of new Set([...Object.keys(r.files),...Object.keys(current)]))
-            if(r.files[f]!==current[f]){changed=describeChangedInput(row.plan,f);row.staleInputs=[f];break;}
+            if(r.files[f]!==current[f]){changed=describeChangedInput(row.plan,f);row.staleInputs=[inputName(f)];break;}
         }
         row.staleReason=changed||
           (['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
@@ -500,7 +553,7 @@ function knownStale(name,row) {
   const r=receipts[name];
   if(!r?.files||r.planId!==row.plan.id||row.probeError||pendingChecks.has(name)||
     row.probeCache?.input===inputKey(row))return false;
-  const current=combinedFiles(name),files=Object.keys(current);
+  const current=filesFor(name,r),files=Object.keys(current);
   return files.length!==Object.keys(r.files).length||files.some(file=>r.files[file]!==current[file]);
 }
 // A run can rebuild a certificate that no longer applies only because indexed
@@ -1174,7 +1227,8 @@ async function request(message) {
     if(message.action==='snapshot'||message.action==='prelaunch') {
       data.snapshots={};for(const [name,row] of index?.checks||[])
         if(!message.name||message.name===name)
-          data.snapshots[name]={...combinedSummary(name),files:combinedFiles(name),
+          data.snapshots[name]={...combinedSummary(name),files:message.compact===1?compactFiles(name):combinedFiles(name),
+          ...message.compact===1?{filesCompact:true}:{},
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
             // Complete only when the oldest kept event follows the given serial.

package/src/landlock.py

@@ -321,6 +321,9 @@ def main(argv):
     version, err = abi()
     if version is None:
         sys.exit(f'landlock.py: Landlock unavailable (errno {err})')
+    # Below ABI 4 Landlock cannot refuse TCP: a run that must be off the network does not start.
+    if no_tcp and version < 4:
+        sys.exit(f'landlock.py: Landlock ABI {version} cannot keep a run off the network')
     reading = EXECUTE | READ_FILE | READ_DIR
     handled = reading | (WRITE if deny_write else 0)
     attr = RulesetAttr(handled, (BIND_TCP | CONNECT_TCP) if no_tcp and version >= 4 else 0,

package/src/presentation.mjs

@@ -6,7 +6,7 @@ const recipes={'npm-typescript-direct-v1':'direct TypeScript recipe','npm-tests-
   'sandbox-v2':'sandboxed recipe, git-ignored files hidden','sandbox-v3':'sandboxed recipe, git-ignored files and docs hidden'};
 export const recipeLabel=recipe=>recipes[recipe]??null;
 export function checkLabel(row) {
-  return row.result==='FAIL'?'FAILED':row.freshness;
+  return row.verifiable===false?'NOT VERIFIABLE':row.result==='FAIL'?'FAILED':row.freshness;
 }
 export function explanation(row) {
   const reason=row.reason||'No verification evidence is available.';
@@ -25,11 +25,12 @@ export function renderStatus(value,{short=false}={}) {
   const lines=[];
   for(const row of value.checks||[]) {
     const label=checkLabel(row),symbol=label==='CURRENT'&&row.result==='PASS'?'✓':label==='FAILED'?'✗':'?';
-    const mark=label==='STALE'?'⚠':symbol;
+    const mark=label==='STALE'?'⚠':label==='NOT VERIFIABLE'?'–':symbol;
     const historical=row.result?` / ${row.result}`:'';
     const recipe=label==='CURRENT'?recipeLabel(row.recipe):null;
     lines.push(`${mark} ${row.name}  ${label}${historical}${recipe?`  (${recipe})`:''}`);
-    if(label!=='CURRENT')lines.push(`  ${row.result==='FAIL'?`Historical failure; applicability ${row.freshness}. `:''}${explanation(row)}`);
+    if(label==='NOT VERIFIABLE')lines.push(`  Not verifiable: ${explanation(row)}`);
+    else if(label!=='CURRENT')lines.push(`  ${row.result==='FAIL'?`Historical failure; applicability ${row.freshness}. `:''}${explanation(row)}`);
   }
   if(!lines.length)lines.push('UNVERIFIED — observation is initializing; no check state is available yet.');
   if(!value.observation?.healthy)lines.push('Observation unavailable or pending. Previous results are not reusable.');

package/src/sandbox.mjs

@@ -100,8 +100,15 @@ export function sandboxEnvironment(python=false,manager=null,kind=null){
 }
 
 // Whether this machine can sandbox a run: {mode} or {issue}. Asked once per process.
+// On Linux, `cache` (a file in REDUE's state) keeps a Landlock answer for the
+// same kernel, launcher Python and launcher, so a run does not start Python to
+// ask again. The launcher checks again when it starts a run, and a run it
+// cannot sandbox is not reused (launcherFailure).
 let support=null;
-export function sandboxSupport(){
+const launcherKey=python=>{try{const st=fs.statSync(fs.realpathSync(python),{bigint:true});
+  return digest(JSON.stringify([os.release(),python,...['dev','ino','size','mtimeNs'].map(key=>String(st[key])),digest(fs.readFileSync(landlockScript))]));}
+  catch{return null;}};
+export function sandboxSupport({cache=null}={}){
   if(support)return support;
   if(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_SANDBOX==='unavailable')
     return support={mode:null,issue:'the sandbox is turned off for this test'};
@@ -114,11 +121,15 @@ export function sandboxSupport(){
   if(process.platform==='linux'){
     const python=launcherPython();
     if(!python)return support={mode:null,issue:'the Landlock launcher needs Python 3'};
+    const key=cache?launcherKey(python):null;
+    if(key)try{const kept=JSON.parse(fs.readFileSync(cache,'utf8'));
+      if(kept?.key===key&&Number.isInteger(kept.abi)&&kept.abi>=4)return support={mode:'landlock',abi:kept.abi,python};}catch{}
     let abi=null;
     try{abi=JSON.parse(spawnSync(python,['-I','-W','ignore',landlockScript,'--probe'],{encoding:'utf8',timeout:10000}).stdout).abi;}catch{}
     if(!Number.isInteger(abi))return support={mode:null,issue:'Landlock is unavailable in this kernel'};
     // ABI 4 (Linux 6.7) is the first that can refuse TCP connections.
     if(abi<4)return support={mode:null,issue:`Landlock ABI ${abi} cannot keep a run off the network; it needs ABI 4 (Linux 6.7)`};
+    if(key)try{const temp=`${cache}.${process.pid}.tmp`;fs.writeFileSync(temp,JSON.stringify({key,abi}),{mode:0o600});fs.renameSync(temp,cache);}catch{}
     return support={mode:'landlock',abi,python};
   }
   return support={mode:null,issue:'the sandboxed recipe runs on macOS and Linux only'};
@@ -267,14 +278,19 @@ export function sandboxDirs(state,name){
 // git cannot list them. Only the project's rules count (.gitignore files and
 // .git/info/exclude), not a user's global excludes file, as on CI.
 const installedTree=/(?:^|\/)(?:node_modules|\.venv)(?:\/|$)/;
+// The outermost installed tree a checkout path is in (`a/node_modules`), or
+// null. Never hidden itself; the observer keeps such a tree as one entry in a
+// sandboxed run's files, `<tree>/:installed:` (compactKey).
+export const installedTreeOf=rel=>rel.startsWith('external:')?null:/^(.*?(?:^|\/)(?:node_modules|\.venv))(?:\/|$)/.exec(rel)?.[1]??null;
+export const compactKey=tree=>`${tree}/:installed:`;
+const compactTree=key=>key.endsWith('/:installed:')?key.slice(0,-':installed:'.length):null;
 const runnerCache=picomatch(sandboxCaches,{dot:true});
 const projectGit=['-c','core.excludesFile=/dev/null'],gitEnv=()=>({...process.env,GIT_OPTIONAL_LOCKS:'0'});
+const hiddenArgs=[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory'];
+const hiddenOf=r=>r.status!==0?null:r.stdout.split('\0').filter(Boolean).filter(rel=>!installedTree.test(rel)&&
+  !runnerCache(rel)&&!runnerCache(rel.replace(/\/$/,'')+'/x'));
 export function hiddenEntries(root){
-  const r=spawnSync('git',[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory'],
-    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
-  if(r.status!==0)return null;
-  return r.stdout.split('\0').filter(Boolean).filter(rel=>!installedTree.test(rel)&&
-    !runnerCache(rel)&&!runnerCache(rel.replace(/\/$/,'')+'/x'));
+  return hiddenOf(spawnSync('git',hiddenArgs,{cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()}));
 }
 
 // The documentation files docPatterns names among the files git lists and
@@ -283,9 +299,11 @@ export function hiddenEntries(root){
 // Relative; null when git cannot tell. git filters by pathspec, so a large
 // checkout is not listed whole.
 const docMatch=picomatch(docPatterns,{dot:true});
+const docsArgs=()=>[...projectGit,'ls-files','-z','--cached','--others','--exclude-standard','--',...docPatterns.map(pattern=>`:(glob)${pattern}`)];
 export function hiddenDocs(root){
-  const r=spawnSync('git',[...projectGit,'ls-files','-z','--cached','--others','--exclude-standard','--',...docPatterns.map(pattern=>`:(glob)${pattern}`)],
-    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
+  return docsOf(root,spawnSync('git',docsArgs(),{cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()}));
+}
+function docsOf(root,r){
   if(r.status!==0)return null;
   const out=new Set();
   for(const rel of r.stdout.split('\0'))if(rel&&!out.has(rel)&&docMatch(rel))
@@ -343,7 +361,8 @@ export function visibleChange(root,hidden,before,current,paths,{during=false,doc
   const covered=changed.filter(beneath),fresh=changed.filter(file=>!(file in before)&&!beneath(file));
   if(covered.length){
     const tracked=trackedBeneath(root,entries.filter(entry=>covered.some(file=>file===entry||file.startsWith(entry+'/'))));
-    const found=covered.find(file=>!tracked||tracked.has(file));
+    // An installed tree kept as one entry counts when git tracks any file in it.
+    const found=covered.find(file=>!tracked||tracked.has(file)||compactTree(file)!==null&&[...tracked].some(rel=>rel.startsWith(compactTree(file))));
     if(found)return found;
   }
   if(!fresh.length)return null;
@@ -556,6 +575,11 @@ export function stopGroup(pid){
 export function endWithChild(child){
   child.on('exit',()=>{stopGroup(child.pid);setTimeout(()=>{child.stdout?.destroy();child.stderr?.destroy();},1000).unref();});
 }
+// The launcher's own line when it could not sandbox a run (Landlock
+// unavailable, or a rule it could not add), or null.
+// Only its refusals before the command starts, and only as the run's whole output.
+export const launcherFailure=text=>/^landlock\.py: (?:Landlock unavailable|Landlock ABI \d+ cannot|create_ruleset|add_rule|no_new_privs|restrict_self)[^\n]*$/
+  .exec(String(text).trim())?.[0].slice(0,200)??null;
 // Runs argv in its own process group to the end, with no terminal input:
 // {status, signal, error, timedOut, stdout, stderr}, each output kept up to
 // 64 MB and decoded at the end. `echo` also passes the output through.
@@ -595,13 +619,17 @@ function refusedHidden(plain,sandboxed,entries,supervisor){
   const others=sandboxed.output.split(/\r?\n/).filter(text=>!hiddenRefusal(text,entries)).join('\n');
   return denialLine(others)?null:line;
 }
-// {same, plain, sandboxed, line, refusedHidden} or {issue} when the sandbox cannot run here.
+// init's limit on each trial run, in ms; a test can shorten it.
+export const trialLimit=process.env.VSTATE_TEST_FAULTS==='1'&&Number(process.env.VSTATE_TEST_TRIAL_LIMIT)||300000;
+// {same, plain, sandboxed, line, refusedHidden, timedOut} or {issue} when the sandbox cannot run here.
+// A run that reaches `timeout` (0: none) is never the same as another:
+// `timedOut` says which, and when the plain run does, no sandboxed run follows.
 // With `hide` 'docs', the documentation (hiddenDocs) is hidden too.
 // With `hide`, the git-ignored entries hiddenEntries lists are kept from the
 // sandboxed run, and it also returns them, their count, the run times and, on
 // Linux, the launcher's rule count and setup time.
 // `plain`: the plain run of an earlier trial of the same check, reused.
-export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:earlier=null}={}){
+export async function sandboxTrial(root,check,{timeout=trialLimit,hide=false,plain:earlier=null}={}){
   const supported=sandboxSupport();
   if(supported.issue)return {issue:supported.issue};
   const python=Boolean(pythonTool(check));
@@ -621,6 +649,7 @@ export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:e
     const run=async(argv,env)=>{const started=Date.now(),r=await runToEnd(argv,{cwd:root,env,timeout});
       return {status:r.timedOut?'timeout':r.status??r.signal??r.error?.code,output:`${r.stdout}\n${r.stderr}`,ms:Date.now()-started};};
     const plain=earlier??await run(command,{...process.env,...python?{}:{npm_config_update_notifier:'false'}});
+    if(plain.status==='timeout')return {same:false,plain:'timeout',sandboxed:null,timedOut:'plain',line:null,refusedHidden:null,plainRun:plain};
     const reads=[root,home,tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
     const sandboxed=await run(sandboxArgv(supported.mode,command,{reads,tmp,python:supported.python,hidden,stats,
       ...hide==='docs'?{docs:{root,entries:docEntries}}:{},
@@ -644,8 +673,9 @@ export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:e
     const counts=tests?[plain,sandboxed].map(r=>testCounts(r.output)):null;
     const read=counts?.some(c=>Object.values(c).some(value=>value!==null));
     const differs=tests&&read?(JSON.stringify(counts[0])===JSON.stringify(counts[1])?null:{plain:JSON.stringify(counts[0]),sandboxed:JSON.stringify(counts[1])}):output;
-    const same=plain.status===sandboxed.status&&!denied&&!differs&&!supervisor;
-    return {same,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,
+    const timedOut=sandboxed.status==='timeout'?'sandboxed':null;
+    const same=!timedOut&&plain.status===sandboxed.status&&!denied&&!differs&&!supervisor;
+    return {same,plain:plain.status,sandboxed:sandboxed.status,output:differs,plainRun:plain,timedOut,
       line:supervisor||denied||(plain.status===sandboxed.status?null:sandboxed.output.trim().split('\n').at(-1)?.slice(0,200)||null),
       refusedHidden:same?null:refusedHidden(plain,sandboxed,entries,supervisor),
       ...hide?{hidden:entries.length,entries,docs:docEntries.length,plainMs:plain.ms,sandboxedMs:sandboxed.ms,...launcher?{rules:launcher.rules,setupMs:launcher.ms}:{}}:{}};

package/src/setup.mjs

@@ -12,7 +12,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {spawnSync} from 'node:child_process';
-import {testCounts} from './sandbox.mjs';
+import {isSandboxed,testCounts} from './sandbox.mjs';
 import {createInterface} from 'node:readline/promises';
 import {projectState} from './project-location.mjs';
 import {claudeHooksInstalled,removeClaudeHooks,removeIntegration} from './agent-integration.mjs';
@@ -31,6 +31,18 @@ async function confirm(question,yes,{defaultYes}){
     return defaultYes?!/^n/i.test(answer):/^y/i.test(answer);}finally{prompt.close();}
 }
 
+// The setup record of the checkout at `root`, in its shared Git directory.
+function recordOf(root){
+  const common=git(root,'rev-parse','--git-common-dir');
+  return common.status===0?path.join(path.resolve(root,common.stdout.trim()),`redue-setup-${hash(root).slice(0,16)}.json`):null;
+}
+// When init updates the config setup created, the record follows, so that
+// redue remove still deletes it.
+export function configRewritten(root,before,after){
+  const file=recordOf(root),record=file&&JSON.parse(readText(file)??'null');
+  if(record?.configCreated&&record.configHash===hash(before))fs.writeFileSync(file,JSON.stringify({...record,configHash:hash(after)},null,2)+'\n');
+}
+
 export async function setupCommand(args,{entry,cwd=process.cwd()}){
   const action=args.shift();
   const yes=args.includes('--yes'),rest=args.filter(arg=>arg!=='--yes');
@@ -50,8 +62,7 @@ export async function setupCommand(args,{entry,cwd=process.cwd()}){
     stdio:options.capture?['ignore','pipe','pipe']:'inherit',timeout:options.timeout});
   // One record per checkout, beside the others in the shared Git directory:
   // linked worktrees share .git/info/exclude.
-  const common=path.resolve(root,git(root,'rev-parse','--git-common-dir').stdout.trim());
-  const recordFile=path.join(common,`redue-setup-${hash(root).slice(0,16)}.json`);
+  const recordFile=recordOf(root),common=path.dirname(recordFile);
   // Other checkouts' records, for checkouts that still exist.
   const others=()=>{try{return fs.readdirSync(common).filter(name=>/^redue-setup-[0-9a-f]{16}\.json$/.test(name)&&path.join(common,name)!==recordFile)
     .map(name=>JSON.parse(readText(path.join(common,name))??'null')).filter(other=>other&&fs.existsSync(other.root));}catch{return [];}};
@@ -78,6 +89,12 @@ async function setup({root,redue,yes,record:previous,recordFile,exclude,save}){
   const found=JSON.parse(preview.stdout);
   if(!configExisted&&!found.writable)throw Error(`nothing to set up: ${found.issue||(found.checks.length?found.checks.map(check=>`${check.name}: ${check.reason}`).join('; '):'no typecheck, lint or test script REDUE can use')}`);
   const levels=new Map(found.checks.map(check=>[check.name,check.level]));
+  // The checks whose trial ran past init's time limit, unless the config
+  // already runs them in the sandbox, and the kinds init's --check takes.
+  const sandboxed=new Set(configExisted?JSON.parse(readText(configPath)).checks.filter(check=>isSandboxed(check.qualification)).map(check=>check.name):[]);
+  const limited=[...found.checks.map(check=>[check.name,check.time_limit]),...(found.skipped||[]).map(row=>[row.kind,row.time_limit])]
+    .filter(([name,kind])=>kind&&!sandboxed.has(name));
+  const limitedKinds=[...new Set(limited.map(([,kind])=>kind))];
   const names=configExisted?JSON.parse(readText(configPath)).checks.map(check=>check.name):found.checks.map(check=>check.name);
   const ready=names.filter(name=>levels.get(name)==='ready');
   console.log(`Setting up REDUE for Claude Code in ${root}`);
@@ -161,6 +178,8 @@ async function setup({root,redue,yes,record:previous,recordFile,exclude,save}){
   if(ready.length&&!due.length)console.log(`Already CURRENT: ${ready.join(', ')}.`);
   for(const row of statusOf())console.log(`  ${row.name}: ${row.freshness}${row.result?' / '+row.result:''}${row.freshness==='CURRENT'?'':
     levels.get(row.name)!=='ready'?' — recording only':' — '+row.reason}`);
+  if(limited.length)console.log(`${limited.map(([name])=>name).join(', ')} ran past init's 5-minute trial limit, so ${limited.length>1?'they are':'it is'} not sandboxed. `+
+    `To try ${limited.length>1?'them':'it'} without the limit: redue init${limitedKinds.length>1?'':` --check ${limitedKinds[0]}`} --no-time-limit`);
   console.log('Done. Start a new Claude Code session in this project. Undo with redue remove.');
   return {applied:true};
 }