@redue/cli 0.1.0-alpha.31 → 0.1.0-alpha.33

package/src/daemon.mjs

@@ -25,7 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
-import {isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
+import {compactKey,installedTreeOf,isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -338,7 +338,49 @@ function combinedFiles(name) {
     Object.entries(entry.index.exportFiles(name)))files[`external:${entry.root}:${rel}`]=hash;
   return files;
 }
+// The files of a sandboxed run's snapshot and receipt, smaller: each
+// installed tree (a node_modules or .venv directory, outermost) as one entry,
+// `<tree>/:installed:`, with a digest of its files and their identities, and
+// every other file as it is. The fingerprint still covers every file; this map
+// names a changed input and decides which changes a hidden run could see. A
+// receipt says it holds this form (filesCompact), and is compared with it.
+// The entry's name is a path inside its tree, so whether a hidden run could
+// see a change to it is decided as for the files it stands for: beneath a
+// hidden entry, or new where git ignores it now.
+const compactCache=new Map();
+function compactFiles(name) {
+  const summary=combinedSummary(name),key=`${summary.revision}\0${summary.fingerprint}`;
+  const cached=compactCache.get(name);
+  if(cached?.key===key)return {...cached.files};
+  const out={},trees=new Map();
+  for(const [rel,hash] of Object.entries(combinedFiles(name))){
+    const tree=installedTreeOf(rel);
+    if(tree===null){out[rel]=hash;continue;}
+    let list=trees.get(tree);if(!list)trees.set(tree,list=[]);
+    list.push([rel,hash]);
+  }
+  for(const [tree,list] of trees){list.sort(([a],[b])=>a<b?-1:a>b?1:0);out[compactKey(tree)]=sha(JSON.stringify(list));}
+  compactCache.set(name,{key,files:out});
+  return {...out};
+}
+// The current files in the form receipt `r` holds them.
+const filesFor=(name,r)=>r?.filesCompact===true?compactFiles(name):combinedFiles(name);
+// Whether a receipt's run, which passed, is the second in a row during which
+// the same inputs changed (selfChange), and its plan, environment and every
+// other input are as they were at its start.
+function onlySelfChanged(name,row,r,contextHashes) {
+  const self=r.selfChange,context=contextHashes?.[name];
+  if(r.result!=='PASS'||!(self?.streak>=2)||!Array.isArray(self.files)||r.planId!==row.plan.id||!r.files||!context)return false;
+  for(const [key,value] of Object.entries(context))if(!key.startsWith('__redue_env_')&&r.environmentHashes?.[key]!==value)return false;
+  const skip=new Set(self.files),strip=files=>Object.fromEntries(Object.entries(files).filter(([file])=>!skip.has(file)));
+  const before=strip(r.files),now=strip(filesFor(name,r)),paths=[...new Set([...Object.keys(before),...Object.keys(now)])];
+  if(hiddenRun(r))return sandboxVisibleChange(root,r.sandbox.hidden,before,now,paths,{docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null})===null;
+  return paths.every(file=>before[file]===now[file]);
+}
+// A changed input as status names it: an installed tree by its path.
+const inputName=file=>file?.endsWith('/:installed:')?file.slice(0,-'/:installed:'.length):file;
 function describeChangedInput(plan,file) {
+  if(file.endsWith('/:installed:'))return `${file.slice(0,-'/:installed:'.length)} (installed files) changed`;
   const boundary=[...external.keys()].find(value=>file.startsWith(`external:${value}:`));
   const physical=boundary?path.join(boundary,file.slice(`external:${boundary}:`.length)):
     path.join(root,file);
@@ -355,7 +397,7 @@ function describeChangedInput(plan,file) {
 const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
 function visibleChange(row,r,name) {
   const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
-  if(row.visibleKey!==key){const current=combinedFiles(name);
+  if(row.visibleKey!==key){const current=filesFor(name,r);
     row.visibleKey=key;row.visibleChange=sandboxVisibleChange(root,r.sandbox.hidden,r.files,current,[...Object.keys(r.files),...Object.keys(current)],
       {docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null});}
   return row.visibleChange;
@@ -389,6 +431,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
           `; declared input checkpoint changed (${row.lastReason||'content or membership'})`:'';
       const probeIssue=row.probeError?`; state probe unavailable: ${row.probeError}`:'';
       item.reason='input coverage unresolved: '+row.plan.unresolved.join('; ')+checkpoint+probeIssue;
+      // Recording-only (no qualification contract, inputs it cannot resolve):
+      // no run can make it CURRENT. A qualified check's unresolved inputs can
+      // be fixed, so it stays due.
+      if(!row.plan.qualification)item.verifiable=false;
       return item;
     }
     if(row.probeError){item.reason=row.probeError;return item;}
@@ -410,6 +456,13 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=`target execution ${r.target?.status||'unavailable'}`;return item;}
     if(r.target.status==='failed'&&result!=='FAIL'){
       item.reason='target failure conflicts with outer invocation outcome';return item;}
+    // The same inputs changed during its last two passing runs, and nothing
+    // else changed since: no run of it can be confirmed. Anything else
+    // changing makes it due again.
+    if(!r.stable&&onlySelfChanged(name,row,r,contextHashes)){
+      item.verifiable=false;
+      item.reason=`the same inputs changed during its last two runs (${r.selfChange.files.slice(0,5).join(', ')}${r.selfChange.files.length>5?' and more':''}), so no result of it can be confirmed; it is due again when anything else changes`;
+      return item;}
     if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
       // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
       const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox|network supervisor)/.test(issue));
@@ -446,16 +499,16 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     else if(r.fingerprint!==combinedSummary(name).fingerprint&&!(hiddenRun(r)&&visibleChange(row,r,name)===null)) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
       if(row.staleReasonKey!==key&&hiddenRun(r)){
-        row.staleInputs=[visibleChange(row,r,name)];row.staleReason=describeChangedInput(row.plan,row.staleInputs[0]);row.staleReasonKey=key;}
+        const seen=visibleChange(row,r,name);row.staleInputs=[inputName(seen)];row.staleReason=describeChangedInput(row.plan,seen);row.staleReasonKey=key;}
       if(row.staleReasonKey!==key){
         let changed=row.lastReason;row.staleInputs=[];
         const candidate=changed?.endsWith(' changed')?changed.slice(0,-8):null;
-        if(candidate&&r.files?.[candidate]!==index.files.get(candidate)){
+        if(candidate&&!(r.filesCompact===true&&installedTreeOf(candidate)!==null)&&r.files?.[candidate]!==index.files.get(candidate)){
           changed=describeChangedInput(row.plan,candidate);row.staleInputs=[candidate];}
         else {
-          const current=combinedFiles(name);
+          const current=filesFor(name,r);
           if(r.files)for(const f of new Set([...Object.keys(r.files),...Object.keys(current)]))
-            if(r.files[f]!==current[f]){changed=describeChangedInput(row.plan,f);row.staleInputs=[f];break;}
+            if(r.files[f]!==current[f]){changed=describeChangedInput(row.plan,f);row.staleInputs=[inputName(f)];break;}
         }
         row.staleReason=changed||
           (['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
@@ -500,7 +553,7 @@ function knownStale(name,row) {
   const r=receipts[name];
   if(!r?.files||r.planId!==row.plan.id||row.probeError||pendingChecks.has(name)||
     row.probeCache?.input===inputKey(row))return false;
-  const current=combinedFiles(name),files=Object.keys(current);
+  const current=filesFor(name,r),files=Object.keys(current);
   return files.length!==Object.keys(r.files).length||files.some(file=>r.files[file]!==current[file]);
 }
 // A run can rebuild a certificate that no longer applies only because indexed
@@ -1174,7 +1227,8 @@ async function request(message) {
     if(message.action==='snapshot'||message.action==='prelaunch') {
       data.snapshots={};for(const [name,row] of index?.checks||[])
         if(!message.name||message.name===name)
-          data.snapshots[name]={...combinedSummary(name),files:combinedFiles(name),
+          data.snapshots[name]={...combinedSummary(name),files:message.compact===1?compactFiles(name):combinedFiles(name),
+          ...message.compact===1?{filesCompact:true}:{},
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
             // Complete only when the oldest kept event follows the given serial.

package/src/landlock.py

@@ -321,6 +321,9 @@ def main(argv):
     version, err = abi()
     if version is None:
         sys.exit(f'landlock.py: Landlock unavailable (errno {err})')
+    # Below ABI 4 Landlock cannot refuse TCP: a run that must be off the network does not start.
+    if no_tcp and version < 4:
+        sys.exit(f'landlock.py: Landlock ABI {version} cannot keep a run off the network')
     reading = EXECUTE | READ_FILE | READ_DIR
     handled = reading | (WRITE if deny_write else 0)
     attr = RulesetAttr(handled, (BIND_TCP | CONNECT_TCP) if no_tcp and version >= 4 else 0,

package/src/presentation.mjs

@@ -6,7 +6,7 @@ const recipes={'npm-typescript-direct-v1':'direct TypeScript recipe','npm-tests-
   'sandbox-v2':'sandboxed recipe, git-ignored files hidden','sandbox-v3':'sandboxed recipe, git-ignored files and docs hidden'};
 export const recipeLabel=recipe=>recipes[recipe]??null;
 export function checkLabel(row) {
-  return row.result==='FAIL'?'FAILED':row.freshness;
+  return row.verifiable===false?'NOT VERIFIABLE':row.result==='FAIL'?'FAILED':row.freshness;
 }
 export function explanation(row) {
   const reason=row.reason||'No verification evidence is available.';
@@ -25,11 +25,12 @@ export function renderStatus(value,{short=false}={}) {
   const lines=[];
   for(const row of value.checks||[]) {
     const label=checkLabel(row),symbol=label==='CURRENT'&&row.result==='PASS'?'✓':label==='FAILED'?'✗':'?';
-    const mark=label==='STALE'?'⚠':symbol;
+    const mark=label==='STALE'?'⚠':label==='NOT VERIFIABLE'?'–':symbol;
     const historical=row.result?` / ${row.result}`:'';
     const recipe=label==='CURRENT'?recipeLabel(row.recipe):null;
     lines.push(`${mark} ${row.name}  ${label}${historical}${recipe?`  (${recipe})`:''}`);
-    if(label!=='CURRENT')lines.push(`  ${row.result==='FAIL'?`Historical failure; applicability ${row.freshness}. `:''}${explanation(row)}`);
+    if(label==='NOT VERIFIABLE')lines.push(`  Not verifiable: ${explanation(row)}`);
+    else if(label!=='CURRENT')lines.push(`  ${row.result==='FAIL'?`Historical failure; applicability ${row.freshness}. `:''}${explanation(row)}`);
   }
   if(!lines.length)lines.push('UNVERIFIED — observation is initializing; no check state is available yet.');
   if(!value.observation?.healthy)lines.push('Observation unavailable or pending. Previous results are not reusable.');

package/src/python-onboarding.mjs

@@ -20,9 +20,11 @@ export const pythonTools=[{tool:'mypy',kind:'typecheck',sub:[]},{tool:'pyright',
 const section=(text,header)=>{const at=text.split(/\r?\n/).findIndex(line=>line.trim()===header);
   if(at<0)return null;const rest=text.split(/\r?\n/).slice(at+1);const end=rest.findIndex(line=>/^\s*\[/.test(line));
   return (end<0?rest:rest.slice(0,end)).join('\n');};
-// Ways a project starts a tool: through uv, poetry or pdm, `python -m`, or from .venv/bin.
+// Ways a project starts a tool: through uv, poetry or pdm, `python -m`,
+// coverage (`coverage run -m pytest`), or from .venv/bin.
 const wrappers=[/^uv run(?: --(?:frozen|locked|no-sync|offline|quiet|all-extras|all-groups))*(?: --(?:group|extra|with|python|package) [^ ]+)* /,
   /^poetry run /,/^pdm run /,/^python3?(?:\.\d+)? -m /,/^(?:\.\/)?\.venv\/bin\//,
+  /^coverage run(?: --?[A-Za-z][\w-]*(?:=[^ "']+)?)* -m /,
   // A variable that names the environment's bin directory: `${PREFIX}mypy`.
   /^\$\{?[A-Za-z_]+\}?(?=[A-Za-z])/];
 // A tool's arguments in one line of a script or workflow, or null. The line
@@ -30,22 +32,51 @@ const wrappers=[/^uv run(?: --(?:frozen|locked|no-sync|offline|quiet|all-extras|
 // ones that change files or install packages, and pytest's that run a set
 // chosen from its cache (--lf, --ff, --sw, --nf), show the cache, loop
 // (-f), rewrite snapshots or add to earlier coverage data, are not taken.
+// A quoted argument (`-m "not slow"`) is one argument, and may hold spaces
+// and parentheses, nothing a shell would expand. Options that only write a
+// report (JUnit XML, HTML, durations) are left out: they change no result,
+// and a report written into the checkout would be an input the run changes.
+const reportOption=/^--(?:junit-?xml|html|self-contained-html|durations|durations-min|junit-prefix|report-log)(?:=|$)/;
+const reportValue=/^--(?:junit-?xml|html|durations|durations-min|junit-prefix|report-log)$/;
+function words(text){
+  const out=[];let current=null,quote=null;
+  for(const c of text){
+    if(quote){if(c===quote)quote=null;else current+=c;continue;}
+    if(c==='"'||c==="'"){quote=c;current??='';current+=`\u0000`;continue;}
+    if(c===' '){if(current!==null)out.push(current);current=null;continue;}
+    current=(current??'')+c;
+  }
+  if(quote)return null;
+  if(current!==null)out.push(current);
+  // A quoted word is marked with NUL while it is read: its text must be plain.
+  return out.map(word=>word.includes('\u0000')?{quoted:true,text:word.replaceAll('\u0000','')}:{quoted:false,text:word});
+}
 export function toolArgs(line,{tool,sub}){
   let text=line.trim().replace(/^-\s+/,'').replace(/^run:\s*/,'').replace(/^[@-]+/,'');
   text=text.split(/\s(?:&&|\|\||;|\|)\s/)[0].replace(/\s+/g,' ').trim();
   for(let changed=true;changed;){changed=false;for(const wrapper of wrappers)if(wrapper.test(text)){text=text.replace(wrapper,'');changed=true;}}
-  const words=text.split(' ');
-  if(words[0]!==tool||JSON.stringify(words.slice(1,1+sub.length))!==JSON.stringify(sub))return null;
-  const args=words.slice(1+sub.length);
-  if(args.some(arg=>!/^[A-Za-z0-9_./:=,@+%-]+$/.test(arg)||/^--(?:fix|unsafe-fixes|write|install-types|watch|lf|last-failed|ff|failed-first|sw|sw-skip|sw-reset|stepwise|stepwise-skip|stepwise-reset|nf|new-first|cache-show|looponfail|snapshot-update|update-snapshots|inline-snapshot|cov-append)(?:=|$)/.test(arg)||arg==='-f'||arg.startsWith('..')||arg.startsWith('/')))return null;
+  const parsed=words(text);
+  if(!parsed)return null;
+  const names=parsed.map(word=>word.text);
+  if(parsed.slice(0,1+sub.length).some(word=>word.quoted)||names[0]!==tool||JSON.stringify(names.slice(1,1+sub.length))!==JSON.stringify(sub))return null;
+  const given=parsed.slice(1+sub.length);
+  if(given.some(({quoted,text:arg})=>!(quoted?/^[A-Za-z0-9_./:=,@+% ()-]+$/:/^[A-Za-z0-9_./:=,@+%-]+$/).test(arg)||
+    /^--(?:fix|unsafe-fixes|write|install-types|watch|lf|last-failed|ff|failed-first|sw|sw-skip|sw-reset|stepwise|stepwise-skip|stepwise-reset|nf|new-first|cache-show|looponfail|snapshot-update|update-snapshots|inline-snapshot|cov-append)(?:=|$)/.test(arg)||
+    arg==='-f'||arg.startsWith('..')||arg.startsWith('/')))return null;
+  const args=[];
+  for(let i=0;i<given.length;i++){
+    if(reportOption.test(given[i].text)){if(reportValue.test(given[i].text))i++;continue;}
+    args.push(given[i].text);
+  }
   return args;
 }
 // The places a project writes how it runs its tools, in order of preference.
+// A workflow that runs on pull requests is marked `pr`.
 function scriptTexts(root){
   const texts=[];
   const workflows=path.join(root,'.github','workflows');
   let files=[];try{files=fs.readdirSync(workflows).filter(file=>/\.ya?ml$/.test(file)).sort();}catch{}
-  for(const file of files)texts.push(read(path.join(workflows,file)));
+  for(const file of files){const text=read(path.join(workflows,file));texts.push({text,pr:/\bpull_request(?:_target)?\b/.test(text)});}
   for(const file of ['Makefile','makefile','justfile','tox.ini','noxfile.py'])texts.push(read(path.join(root,file)));
   // Shell scripts: *.sh, or a file whose #! line runs a shell (scripts/check).
   for(const dir of ['scripts','script','bin','ci']){let names=[];try{names=fs.readdirSync(path.join(root,dir)).sort();}catch{}
@@ -53,13 +84,24 @@ function scriptTexts(root){
       if(name.endsWith('.sh')||/^#!\S*(?:\/|env\s+)(?:ba|z|da)?sh\b/.test(text))texts.push(text);}}
   return texts;
 }
-// The arguments the project runs `tool` with, or its default.
+// The arguments the project runs `tool` with, or its default: the first line
+// that runs it, but a pull-request workflow's when it narrows the suite (-m,
+// -k, --ignore, --deselect), as a project's quick tests leave out slow ones.
+// A line continued with a backslash is one line.
+const narrows=args=>args.some(arg=>/^(?:-m|-k|--ignore|--ignore-glob|--deselect)(?:=|$)/.test(arg));
 export function projectArgs(root,spec,texts=scriptTexts(root)){
-  for(const text of texts)for(const line of text.split(/\r?\n/)){
-    if(/^\s*#/.test(line))continue;
-    const args=toolArgs(line,spec);
-    if(args)return {args,source:'project'};
+  let first=null;
+  for(const entry of texts){
+    const {text,pr}=typeof entry==='string'?{text:entry,pr:false}:entry;
+    for(const line of text.replace(/\\\r?\n[ \t]*/g,' ').split(/\r?\n/)){
+      if(/^\s*#/.test(line))continue;
+      const args=toolArgs(line,spec);
+      if(!args)continue;
+      if(pr&&narrows(args))return {args,source:'project'};
+      first??={args,source:'project'};
+    }
   }
+  if(first)return first;
   if(spec.tool!=='mypy')return {args:[],source:'default'};
   // mypy without targets needs `files` in its configuration.
   const configured=[section(read(path.join(root,'pyproject.toml')),'[tool.mypy]'),section(read(path.join(root,'mypy.ini')),'[mypy]'),
@@ -83,7 +125,7 @@ export function discoverPythonProject(root){
     const several=found.filter(other=>other.kind===spec.kind).length>1;
     checks.push({config:{name:several?`${spec.kind}:${spec.tool}`:spec.kind,kind:spec.kind,qualification:sandboxQualification,
       command:[`.venv/bin/${spec.tool}`,...spec.sub,...args],...sandboxCheckInputs()},level:'ready',qualification:sandboxQualification,
-      reason:`sandboxed recipe: ${[spec.tool,...spec.sub,...args].join(' ')} from .venv${source==='project'?' as the project runs it':''}; the whole checkout is its input`});
+      reason:`sandboxed recipe: ${[spec.tool,...spec.sub,...args].map(arg=>/\s/.test(arg)?JSON.stringify(arg):arg).join(' ')} from .venv${source==='project'?' as the project runs it':''}; the whole checkout is its input`});
   }
   return {root,checks,skipped};
 }

package/src/sandbox.mjs

@@ -100,8 +100,15 @@ export function sandboxEnvironment(python=false,manager=null,kind=null){
 }
 
 // Whether this machine can sandbox a run: {mode} or {issue}. Asked once per process.
+// On Linux, `cache` (a file in REDUE's state) keeps a Landlock answer for the
+// same kernel, launcher Python and launcher, so a run does not start Python to
+// ask again. The launcher checks again when it starts a run, and a run it
+// cannot sandbox is not reused (launcherFailure).
 let support=null;
-export function sandboxSupport(){
+const launcherKey=python=>{try{const st=fs.statSync(fs.realpathSync(python),{bigint:true});
+  return digest(JSON.stringify([os.release(),python,...['dev','ino','size','mtimeNs'].map(key=>String(st[key])),digest(fs.readFileSync(landlockScript))]));}
+  catch{return null;}};
+export function sandboxSupport({cache=null}={}){
   if(support)return support;
   if(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_SANDBOX==='unavailable')
     return support={mode:null,issue:'the sandbox is turned off for this test'};
@@ -114,11 +121,15 @@ export function sandboxSupport(){
   if(process.platform==='linux'){
     const python=launcherPython();
     if(!python)return support={mode:null,issue:'the Landlock launcher needs Python 3'};
+    const key=cache?launcherKey(python):null;
+    if(key)try{const kept=JSON.parse(fs.readFileSync(cache,'utf8'));
+      if(kept?.key===key&&Number.isInteger(kept.abi)&&kept.abi>=4)return support={mode:'landlock',abi:kept.abi,python};}catch{}
     let abi=null;
     try{abi=JSON.parse(spawnSync(python,['-I','-W','ignore',landlockScript,'--probe'],{encoding:'utf8',timeout:10000}).stdout).abi;}catch{}
     if(!Number.isInteger(abi))return support={mode:null,issue:'Landlock is unavailable in this kernel'};
     // ABI 4 (Linux 6.7) is the first that can refuse TCP connections.
     if(abi<4)return support={mode:null,issue:`Landlock ABI ${abi} cannot keep a run off the network; it needs ABI 4 (Linux 6.7)`};
+    if(key)try{const temp=`${cache}.${process.pid}.tmp`;fs.writeFileSync(temp,JSON.stringify({key,abi}),{mode:0o600});fs.renameSync(temp,cache);}catch{}
     return support={mode:'landlock',abi,python};
   }
   return support={mode:null,issue:'the sandboxed recipe runs on macOS and Linux only'};
@@ -267,14 +278,19 @@ export function sandboxDirs(state,name){
 // git cannot list them. Only the project's rules count (.gitignore files and
 // .git/info/exclude), not a user's global excludes file, as on CI.
 const installedTree=/(?:^|\/)(?:node_modules|\.venv)(?:\/|$)/;
+// The outermost installed tree a checkout path is in (`a/node_modules`), or
+// null. Never hidden itself; the observer keeps such a tree as one entry in a
+// sandboxed run's files, `<tree>/:installed:` (compactKey).
+export const installedTreeOf=rel=>rel.startsWith('external:')?null:/^(.*?(?:^|\/)(?:node_modules|\.venv))(?:\/|$)/.exec(rel)?.[1]??null;
+export const compactKey=tree=>`${tree}/:installed:`;
+const compactTree=key=>key.endsWith('/:installed:')?key.slice(0,-':installed:'.length):null;
 const runnerCache=picomatch(sandboxCaches,{dot:true});
 const projectGit=['-c','core.excludesFile=/dev/null'],gitEnv=()=>({...process.env,GIT_OPTIONAL_LOCKS:'0'});
+const hiddenArgs=[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory'];
+const hiddenOf=r=>r.status!==0?null:r.stdout.split('\0').filter(Boolean).filter(rel=>!installedTree.test(rel)&&
+  !runnerCache(rel)&&!runnerCache(rel.replace(/\/$/,'')+'/x'));
 export function hiddenEntries(root){
-  const r=spawnSync('git',[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory'],
-    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
-  if(r.status!==0)return null;
-  return r.stdout.split('\0').filter(Boolean).filter(rel=>!installedTree.test(rel)&&
-    !runnerCache(rel)&&!runnerCache(rel.replace(/\/$/,'')+'/x'));
+  return hiddenOf(spawnSync('git',hiddenArgs,{cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()}));
 }
 
 // The documentation files docPatterns names among the files git lists and
@@ -283,9 +299,11 @@ export function hiddenEntries(root){
 // Relative; null when git cannot tell. git filters by pathspec, so a large
 // checkout is not listed whole.
 const docMatch=picomatch(docPatterns,{dot:true});
+const docsArgs=()=>[...projectGit,'ls-files','-z','--cached','--others','--exclude-standard','--',...docPatterns.map(pattern=>`:(glob)${pattern}`)];
 export function hiddenDocs(root){
-  const r=spawnSync('git',[...projectGit,'ls-files','-z','--cached','--others','--exclude-standard','--',...docPatterns.map(pattern=>`:(glob)${pattern}`)],
-    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
+  return docsOf(root,spawnSync('git',docsArgs(),{cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()}));
+}
+function docsOf(root,r){
   if(r.status!==0)return null;
   const out=new Set();
   for(const rel of r.stdout.split('\0'))if(rel&&!out.has(rel)&&docMatch(rel))
@@ -343,7 +361,8 @@ export function visibleChange(root,hidden,before,current,paths,{during=false,doc
   const covered=changed.filter(beneath),fresh=changed.filter(file=>!(file in before)&&!beneath(file));
   if(covered.length){
     const tracked=trackedBeneath(root,entries.filter(entry=>covered.some(file=>file===entry||file.startsWith(entry+'/'))));
-    const found=covered.find(file=>!tracked||tracked.has(file));
+    // An installed tree kept as one entry counts when git tracks any file in it.
+    const found=covered.find(file=>!tracked||tracked.has(file)||compactTree(file)!==null&&[...tracked].some(rel=>rel.startsWith(compactTree(file))));
     if(found)return found;
   }
   if(!fresh.length)return null;
@@ -556,6 +575,11 @@ export function stopGroup(pid){
 export function endWithChild(child){
   child.on('exit',()=>{stopGroup(child.pid);setTimeout(()=>{child.stdout?.destroy();child.stderr?.destroy();},1000).unref();});
 }
+// The launcher's own line when it could not sandbox a run (Landlock
+// unavailable, or a rule it could not add), or null.
+// Only its refusals before the command starts, and only as the run's whole output.
+export const launcherFailure=text=>/^landlock\.py: (?:Landlock unavailable|Landlock ABI \d+ cannot|create_ruleset|add_rule|no_new_privs|restrict_self)[^\n]*$/
+  .exec(String(text).trim())?.[0].slice(0,200)??null;
 // Runs argv in its own process group to the end, with no terminal input:
 // {status, signal, error, timedOut, stdout, stderr}, each output kept up to
 // 64 MB and decoded at the end. `echo` also passes the output through.