@ttsc/lint 0.26.1 → 0.27.0

package/linthost/config.go

@@ -1294,10 +1294,12 @@ func loadConfigFile(location string) (any, error) {
 }
 
 type configDependencyFingerprint struct {
-  Path   string `json:"path"`
-  Digest string `json:"digest"`
-  Kind   string `json:"kind"`
-  Scope  string `json:"scope"`
+  Path           string  `json:"path"`
+  Digest         string  `json:"digest"`
+  IdentityStable bool    `json:"identityStable"`
+  Kind           string  `json:"kind"`
+  Realpath       *string `json:"realpath"`
+  Scope          string  `json:"scope"`
 }
 
 const (
@@ -1367,10 +1369,10 @@ func loadConfigFileEvaluationWithin(
 // configCacheVersion namespaces the on-disk config cache. Bump it whenever
 // the shape of a cached config object changes so that entries written by an
 // older @ttsc/lint binary are treated as a miss rather than silently reused.
-// v6 adds the `entry` dependency kind. A v5 cache records a resolution trace's
-// ancestors as directory digests, so reusing it would keep republishing the
-// filesystem root as a watch input for as long as the entry survives.
-const configCacheVersion = "v6"
+// v8 also rejects content-restoring A-B-A replacement during evaluation. A v7
+// cache can otherwise pair output from the transient state with the restored
+// state's equal digest and physical path.
+const configCacheVersion = "v8"
 
 // configEvalCache memoizes evaluated .ts/.js lint config objects for the
 // lifetime of one process; the on-disk cache (configCacheDir) extends the
@@ -1557,6 +1559,10 @@ func configDependencyDigestsAreCurrent(
   dependencies []configDependencyFingerprint,
 ) bool {
   for _, dependency := range dependencies {
+    if !dependency.IdentityStable ||
+      !sameConfigDependencyRealpath(dependency.Realpath, configDependencyRealpath(dependency.Path)) {
+      return false
+    }
     digest, err := configDependencyDigest(dependency)
     if err != nil {
       return false
@@ -1568,6 +1574,19 @@ func configDependencyDigestsAreCurrent(
   return true
 }
 
+func configDependencyRealpath(location string) *string {
+  absolute, err := filepath.Abs(location)
+  if err != nil {
+    return nil
+  }
+  resolved := realProjectPath(absolute)
+  if _, statErr := os.Stat(resolved); statErr != nil {
+    return nil
+  }
+  resolved = filepath.Clean(resolved)
+  return &resolved
+}
+
 func configDependencyDigest(
   dependency configDependencyFingerprint,
 ) (string, error) {
@@ -1848,7 +1867,8 @@ func normalizeConfigDependencyFingerprints(
   for _, dependency := range input {
     if strings.TrimSpace(dependency.Path) == "" ||
       !filepath.IsAbs(dependency.Path) ||
-      len(dependency.Digest) != sha256.Size*2 ||
+      (dependency.Realpath != nil && !filepath.IsAbs(*dependency.Realpath)) ||
+      (dependency.Digest != "" && len(dependency.Digest) != sha256.Size*2) ||
       strings.ToLower(dependency.Digest) != dependency.Digest ||
       (dependency.Kind != configDependencyFile &&
         dependency.Kind != configDependencyDir &&
@@ -1858,24 +1878,30 @@ func normalizeConfigDependencyFingerprints(
         dependency.Scope != configDependencyWatch) {
       return nil, false
     }
-    if _, err := hex.DecodeString(dependency.Digest); err != nil {
-      return nil, false
+    if dependency.Digest != "" {
+      if _, err := hex.DecodeString(dependency.Digest); err != nil {
+        return nil, false
+      }
     }
     absolute := filepath.Clean(dependency.Path)
     key := dependency.Kind + "\x00" + absolute
     if previous, exists := seen[key]; exists {
       if previous.Digest != dependency.Digest ||
+        previous.IdentityStable != dependency.IdentityStable ||
         previous.Kind != dependency.Kind ||
+        !sameConfigDependencyRealpath(previous.Realpath, dependency.Realpath) ||
         previous.Scope != dependency.Scope {
         return nil, false
       }
       continue
     }
     fingerprint := configDependencyFingerprint{
-      Path:   absolute,
-      Digest: dependency.Digest,
-      Kind:   dependency.Kind,
-      Scope:  dependency.Scope,
+      Path:           absolute,
+      Digest:         dependency.Digest,
+      IdentityStable: dependency.IdentityStable,
+      Kind:           dependency.Kind,
+      Realpath:       cloneConfigDependencyRealpath(dependency.Realpath),
+      Scope:          dependency.Scope,
     }
     seen[key] = fingerprint
     normalized = append(normalized, fingerprint)
@@ -1886,6 +1912,21 @@ func normalizeConfigDependencyFingerprints(
   return normalized, true
 }
 
+func cloneConfigDependencyRealpath(value *string) *string {
+  if value == nil {
+    return nil
+  }
+  cloned := filepath.Clean(*value)
+  return &cloned
+}
+
+func sameConfigDependencyRealpath(left, right *string) bool {
+  if left == nil || right == nil {
+    return left == nil && right == nil
+  }
+  return filepath.Clean(*left) == filepath.Clean(*right)
+}
+
 // loadScriptConfigFile evaluates a .js/.cjs/.mjs config file by running a
 // Node subprocess that dynamic-imports the file, resolves the exported config
 // through the same 8-hop default/config normalization used by the TS loader,
@@ -1919,12 +1960,18 @@ func loadScriptConfigEvaluationWithin(
   cmd := exec.CommandContext(
     ctx,
     node,
-    "-e",
-    script,
+    "--input-type=commonjs",
+    "-",
     location,
     outputPath,
     resolutionRoot,
   )
+  // Windows limits the whole process command line to roughly 32 KiB. The
+  // dependency-tracking loader is intentionally larger than that, so keep only
+  // an explicit CommonJS stdin program and remove Node's stdin sentinel before
+  // the loader runs. This preserves the historical process.argv layout seen by
+  // both the loader and the imported user config without using string eval.
+  cmd.Stdin = strings.NewReader("process.argv.splice(1, 1);\n" + script)
   return runConfigLoaderCommand(cmd, location, "config file", outputPath)
 }
 
@@ -2104,19 +2151,78 @@ function isObject(value) {
   return value !== null && typeof value === "object";
 }
 
+function missingPathError(error) {
+  return error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+
+function dependencyMetadataSignature(location) {
+  const requested = path.resolve(location);
+  let current = requested;
+  for (;;) {
+    try {
+      const link = fs.lstatSync(current, { bigint: true });
+      let target = link;
+      if (link.isSymbolicLink()) {
+        try { target = fs.statSync(current, { bigint: true }); }
+        catch { return undefined; }
+      }
+      return [path.relative(current, requested), link.dev, link.ino, link.mode, link.size, link.mtimeNs, link.ctimeNs, target.dev, target.ino, target.mode, target.size, target.mtimeNs, target.ctimeNs].join(":");
+    } catch (error) {
+      if (!missingPathError(error)) return undefined;
+      const parent = path.dirname(current);
+      if (parent === current) return undefined;
+      current = parent;
+    }
+  }
+}
+
+function currentDependencyDigest(kind, location) {
+  try {
+    if (kind === "directory") return directoryDigest(location);
+    if (kind === "entry") return entryDigest(location);
+    if (kind === "optional-file") return optionalFileDigest(location);
+    return createHash("sha256").update(fs.readFileSync(location)).digest("hex");
+  } catch {
+    return "";
+  }
+}
+
 function recordDependency(kind, location, digest, owners) {
   const key = kind + "\0" + location;
   const previous = dependencies.get(key);
   const mergedOwners = previous ? previous.owners : new Set();
   for (const owner of owners) mergedOwners.add(owner);
+  const beforeSignature = dependencyMetadataSignature(location);
+  const observedDigest = currentDependencyDigest(kind, location);
+  const realpath = dependencyRealpath(location);
+  const afterSignature = dependencyMetadataSignature(location);
+  const identityStable =
+    (!previous || previous.identityStable) &&
+    beforeSignature !== undefined &&
+    afterSignature !== undefined &&
+    beforeSignature === afterSignature &&
+    digest === observedDigest &&
+    (!previous || previous.realpath === realpath) &&
+    (!previous || previous.signature === afterSignature);
   dependencies.set(key, {
-    digest: previous && previous.digest !== digest ? "" : digest,
+    digest: !identityStable || (previous && previous.digest !== digest) ? "" : digest,
+    identityStable,
     kind,
     owners: mergedOwners,
     path: location,
+    realpath,
+    signature: afterSignature,
   });
 }
 
+function dependencyRealpath(location) {
+  try {
+    return realPath(location);
+  } catch {
+    return null;
+  }
+}
+
 function isLocalModuleSpecifier(specifier) {
   return specifier.startsWith(".") ||
     specifier.startsWith("/") ||
@@ -2874,10 +2980,22 @@ function realPath(location) {
 }
 
 function finalizeDependencies() {
+  for (const dependency of [...dependencies.values()]) {
+    recordDependency(
+      dependency.kind,
+      dependency.path,
+      currentDependencyDigest(dependency.kind, dependency.path),
+      [...dependency.owners],
+    );
+  }
   const watched = graphWatchReachability();
-  return [...dependencies.values()].map(({ owners, ...dependency }) => ({
-    ...dependency,
-    scope: [...owners].some((owner) => watched.has(owner))
+  return [...dependencies.values()].map((dependency) => ({
+    digest: dependency.digest,
+    identityStable: dependency.identityStable,
+    kind: dependency.kind,
+    path: dependency.path,
+    realpath: dependency.realpath,
+    scope: [...dependency.owners].some((owner) => watched.has(owner))
       ? "watch"
       : "cache",
   }));
@@ -3028,14 +3146,15 @@ func loadTypeScriptConfigEvaluationWithin(
     // ttsx build hermetic.
     "--no-plugins",
   }
-  if tsgo := os.Getenv("TTSC_TSGO_BINARY"); tsgo != "" {
+  anchors := configToolAnchors(location, resolutionRoot)
+  if tsgo := resolveConfigTsgo(anchors); tsgo != "" {
     args = append(args, "--binary", tsgo)
   }
   args = append(args, loader)
 
   ctx, cancel := context.WithCancel(context.Background())
   defer cancel()
-  cmd := ttsxCommandContext(ctx, args...)
+  cmd := ttsxCommandContext(ctx, anchors, args...)
   cmd.Env = nodeConfigLoaderEnv(location)
   return runConfigLoaderCommand(cmd, location, "TypeScript config file", outputPath)
 }
@@ -3120,9 +3239,12 @@ const resolutionRoot = path.resolve(%s);
 const CONFIG_KEYS = new Set<string>([%s]);
 const dependencies = new Map<string, {
   digest: string;
+  identityStable: boolean;
   kind: "directory" | "entry" | "file" | "optional-file";
   path: string;
   owners: Set<string>;
+  realpath: string | null;
+  signature: string | undefined;
 }>();
 const graphNodes = new Map<string, string>();
 const graphEdges: Array<{
@@ -3295,6 +3417,48 @@ function isObject(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object";
 }
 
+function missingPathError(error: unknown): boolean {
+  const code = (error as { code?: unknown } | undefined)?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+
+function dependencyMetadataSignature(
+  location: string,
+): string | undefined {
+  const requested = path.resolve(location);
+  let current = requested;
+  for (;;) {
+    try {
+      const link = fs.lstatSync(current, { bigint: true });
+      let target = link;
+      if (link.isSymbolicLink()) {
+        try { target = fs.statSync(current, { bigint: true }); }
+        catch { return undefined; }
+      }
+      return [path.relative(current, requested), link.dev, link.ino, link.mode, link.size, link.mtimeNs, link.ctimeNs, target.dev, target.ino, target.mode, target.size, target.mtimeNs, target.ctimeNs].join(":");
+    } catch (error) {
+      if (!missingPathError(error)) return undefined;
+      const parent = path.dirname(current);
+      if (parent === current) return undefined;
+      current = parent;
+    }
+  }
+}
+
+function currentDependencyDigest(
+  kind: "directory" | "entry" | "file" | "optional-file",
+  location: string,
+): string {
+  try {
+    if (kind === "directory") return directoryDigest(location);
+    if (kind === "entry") return entryDigest(location);
+    if (kind === "optional-file") return optionalFileDigest(location);
+    return createHash("sha256").update(fs.readFileSync(location)).digest("hex");
+  } catch {
+    return "";
+  }
+}
+
 function recordDependency(
   kind: "directory" | "entry" | "file" | "optional-file",
   location: string,
@@ -3305,14 +3469,41 @@ function recordDependency(
   const previous = dependencies.get(key);
   const mergedOwners = previous?.owners ?? new Set<string>();
   for (const owner of owners) mergedOwners.add(owner);
+  const beforeSignature = dependencyMetadataSignature(location);
+  const observedDigest = currentDependencyDigest(kind, location);
+  const realpath = dependencyRealpath(location);
+  const afterSignature = dependencyMetadataSignature(location);
+  const identityStable =
+    previous?.identityStable !== false &&
+    beforeSignature !== undefined &&
+    afterSignature !== undefined &&
+    beforeSignature === afterSignature &&
+    digest === observedDigest &&
+    (previous === undefined || previous.realpath === realpath) &&
+    (previous === undefined || previous.signature === afterSignature);
   dependencies.set(key, {
-    digest: previous !== undefined && previous.digest !== digest ? "" : digest,
+    digest:
+      !identityStable ||
+      (previous !== undefined && previous.digest !== digest)
+        ? ""
+        : digest,
+    identityStable,
     kind,
     owners: mergedOwners,
     path: location,
+    realpath,
+    signature: afterSignature,
   });
 }
 
+function dependencyRealpath(location: string): string | null {
+  try {
+    return realPath(location);
+  } catch {
+    return null;
+  }
+}
+
 function isLocalModuleSpecifier(specifier: string): boolean {
   return specifier.startsWith(".") ||
     specifier.startsWith("/") ||
@@ -4114,10 +4305,20 @@ function realPath(location: string): string {
 
 function finalizeDependencies(): Array<{
   digest: string;
+  identityStable: boolean;
   kind: "directory" | "entry" | "file" | "optional-file";
   path: string;
+  realpath: string | null;
   scope: "cache" | "watch";
 }> {
+  for (const dependency of [...dependencies.values()]) {
+    recordDependency(
+      dependency.kind,
+      dependency.path,
+      currentDependencyDigest(dependency.kind, dependency.path),
+      [...dependency.owners],
+    );
+  }
   const watched = graphWatchReachability();
   // Opt-in diagnostics for a graph that comes back empty. The only channel this
   // loader may use is stderr, because the result travels through a private file
@@ -4135,9 +4336,13 @@ function finalizeDependencies(): Array<{
         "\n",
     );
   }
-  return [...dependencies.values()].map(({ owners, ...dependency }) => ({
-    ...dependency,
-    scope: [...owners].some((owner) => watched.has(owner))
+  return [...dependencies.values()].map((dependency) => ({
+    digest: dependency.digest,
+    identityStable: dependency.identityStable,
+    kind: dependency.kind,
+    path: dependency.path,
+    realpath: dependency.realpath,
+    scope: [...dependency.owners].some((owner) => watched.has(owner))
       ? "watch"
       : "cache",
   }));
@@ -4250,6 +4455,7 @@ func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
       // resolving either way.
       "module":                          configModuleOption(location),
       "moduleResolution":                "bundler",
+      "jsx":                             "preserve",
       "noImplicitAny":                   false,
       "outDir":                          filepath.ToSlash(filepath.Join(outDir, "out")),
       "rewriteRelativeImportExtensions": true,
@@ -4276,6 +4482,23 @@ func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
   return string(body)
 }
 
+// ttsc:config-loader-shared begin
+//
+// One policy in three Go copies: everything between these markers is
+// duplicated verbatim in packages/lint/linthost/config.go,
+// packages/banner/driver/banner.go and packages/strip/driver/config.go. #1169
+// decided against extracting it — the only home the three modules could share
+// is the public `packages/ttsc/driver` seam, and packages/lint's go.mod
+// deliberately requires no in-tree ttsc module — and replaced the checklist
+// with a gate: `scripts/ci/config-loader-copies.cjs` compares every function
+// between these markers across all three copies on every pull request, so
+// editing one and not the others fails by name. That file's header carries the
+// full decision and the rules for changing this block.
+//
+// The code between the markers must stay identical. Comments may differ, the
+// `@ttsc/<pkg>:` error prefix may differ, and @ttsc/strip spells each name with
+// a `strip` prefix. Anything package-specific belongs outside the markers.
+
 // configModuleOption returns the loader tsconfig's "module" for a config file:
 // the module kind Node itself would give that file.
 //
@@ -4406,21 +4629,235 @@ func resolveDirLink(dir string) string {
   return dir
 }
 
+// Both tools the TypeScript config evaluator needs — the `ttsx` launcher it
+// spawns and the native compiler it hands that launcher — are resolved from the
+// project being linted, with an explicit environment variable winning and a
+// last resort that invents no path.
+//
+// The three Go copies are held identical by the gate named at the top of this
+// block. The JS original — `resolveConfigTsgo` / `resolveTtsxLauncher` in
+// packages/lint/src/index.ts — is a fourth copy in another language that no Go
+// gate can reach; the two evaluators must keep one policy, because it was a
+// divergence between them that made a TypeScript lint config unevaluable
+// outside a `ttsx`-launched host.
+//
+// The environment alone is the wrong place to ask. `ttsx` exports
+// TTSC_TSGO_BINARY and TTSC_TTSX_BINARY to its own descendants, so a host
+// launched under `ttsx` inherited both and a host launched any other way
+// inherited neither. The shipped `ttscserver` binary invoked with its
+// documented `--tsgo <path>` flag keeps that path in a local and exports
+// nothing, and an embedder of the driver package exports nothing either. For
+// those the evaluator spawned a bare `ttsx` that only a global install puts on
+// PATH, and, past that, a compiler-less child that aborted with
+// `ttsc: typescript is required` before a line of the config was read.
+//
+// configToolAnchors lists the file paths those resolutions walk upward from,
+// in order: the config file being evaluated, then the resolution root's
+// manifest. The config comes first because it is the file whose own
+// installation decides which toolchain the config's imports were written
+// against; the resolution root answers for a config that lives outside the
+// project tree (an `extends` target, or a `configFile` pointed at a shared
+// package).
+//
+// The JS evaluator carries a third anchor, the loaded descriptor's own
+// directory. It has no counterpart here: this host is a compiled binary rather
+// than a module some `node_modules` copy of `@ttsc/lint` was loaded from, so
+// there is no third installation to ask.
+func configToolAnchors(configPath, resolutionRoot string) []string {
+  anchors := make([]string, 0, 2)
+  if strings.TrimSpace(configPath) != "" {
+    anchors = append(anchors, configPath)
+  }
+  if strings.TrimSpace(resolutionRoot) != "" {
+    anchors = append(anchors, filepath.Join(resolutionRoot, "package.json"))
+  }
+  return anchors
+}
+
+// resolveConfigTsgo returns the native TypeScript compiler the evaluator hands
+// its ttsx child through `--binary`, or "" to leave the child resolving for
+// itself.
+//
+// The child runs with `--cwd <ephemeral loader dir>`, so it cannot discover
+// `typescript` the way an ordinary invocation does: linkNearestNodeModules is
+// the only thing that puts the project's modules within its reach, and it links
+// nothing when the config's ancestry carries no node_modules. An explicit
+// TTSC_TSGO_BINARY still wins, so an embedder that pins a compiler keeps
+// pinning it. "" is the unchanged last resort: a project that cannot answer
+// here could not answer inside the child either, and the child's own diagnostic
+// is the one that names the missing package.
+func resolveConfigTsgo(anchors []string) string {
+  if explicit := strings.TrimSpace(os.Getenv("TTSC_TSGO_BINARY")); explicit != "" {
+    return explicit
+  }
+  for _, anchor := range anchors {
+    if binary := tsgoBinaryFrom(anchor); binary != "" {
+      return binary
+    }
+  }
+  return ""
+}
+
+// tsgoBinaryFrom returns the platform compiler executable of the `typescript`
+// install `anchor` can see, or "" when this anchor reaches neither the package
+// nor its platform dependency.
+//
+// Mirrors resolveTsgo.ts so the Go host and the JS launcher name one file: the
+// `typescript` manifest, then `@typescript/typescript-<platform>-<arch>`
+// resolved from that manifest, then `lib/tsc` inside it.
+//
+// The install is chased to its real directory before the second hop, because
+// Node resolves a module's own dependencies from its real location. pnpm keeps
+// the real `typescript` directory in its content-addressed store with the
+// platform package beside it and leaves a link in the project's node_modules,
+// so a walk that started at the link would climb straight past the platform
+// package. NTFS junctions defeat filepath.EvalSymlinks, so the link component
+// is chased by hand first, the same order loaderTempBase uses.
+func tsgoBinaryFrom(anchor string) string {
+  manifest := nodePackageManifestFrom(anchor, "typescript")
+  if manifest == "" {
+    return ""
+  }
+  packageDir := realpathIfPossible(resolveDirLink(filepath.Dir(manifest)))
+  platform, arch := nodePlatformPair()
+  platformManifest := nodePackageManifestFrom(
+    filepath.Join(packageDir, "package.json"),
+    "@typescript/typescript-"+platform+"-"+arch,
+  )
+  if platformManifest == "" {
+    return ""
+  }
+  name := "tsc"
+  if runtime.GOOS == "windows" {
+    name = "tsc.exe"
+  }
+  binary := filepath.Join(filepath.Dir(platformManifest), "lib", name)
+  if stat, err := os.Stat(binary); err != nil || stat.IsDir() {
+    return ""
+  }
+  return binary
+}
+
+// resolveTtsxLauncher returns the launcher ttsxCommandContext spawns.
+//
+// An explicit TTSC_TTSX_BINARY wins. Otherwise the launcher is derived from the
+// `ttsc` installation one of the anchors can see, because a bare command name
+// only works when a bin link happens to be on PATH — which it is for a global
+// install and is not for the ordinary project-local one. The bare `"ttsx"` name
+// remains the unchanged last resort for an installation no anchor reaches.
+func resolveTtsxLauncher(anchors []string) string {
+  if explicit := strings.TrimSpace(os.Getenv("TTSC_TTSX_BINARY")); explicit != "" {
+    return explicit
+  }
+  for _, anchor := range anchors {
+    if launcher := ttsxLauncherFrom(anchor); launcher != "" {
+      return launcher
+    }
+  }
+  return "ttsx"
+}
+
+// ttsxLauncherFrom returns `lib/launcher/ttsx.js` of the `ttsc` install
+// `anchor` can see, or "" when this anchor reaches no such install. Only the
+// manifest is an exported subpath, so the launcher is derived from where the
+// manifest resolved rather than requested as a subpath of its own.
+func ttsxLauncherFrom(anchor string) string {
+  manifest := nodePackageManifestFrom(anchor, "ttsc")
+  if manifest == "" {
+    return ""
+  }
+  launcher := filepath.Join(filepath.Dir(manifest), "lib", "launcher", "ttsx.js")
+  if stat, err := os.Stat(launcher); err != nil || stat.IsDir() {
+    return ""
+  }
+  return launcher
+}
+
+// nodePackageManifestFrom resolves `<pkg>/package.json` the way Node's
+// require.resolve does from the FILE `anchor`: walk upward from the anchor's
+// directory and return the first `<dir>/node_modules/<pkg>/package.json` that
+// exists. The anchor is treated as a file path, so its own directory is the
+// first candidate's parent, and it need not exist — Node derives the search
+// paths from the string alone.
+//
+// A directory already named `node_modules` contributes no candidate of its own,
+// matching Module._nodeModulePaths, so nothing ever resolves through
+// `node_modules/node_modules`.
+//
+// A relative anchor is resolved against the process directory before the walk,
+// again matching Node. Walking a relative path instead would terminate at "."
+// after one step and silently answer nothing for a config named relatively.
+func nodePackageManifestFrom(anchor, pkg string) string {
+  if strings.TrimSpace(anchor) == "" || pkg == "" {
+    return ""
+  }
+  if absolute, err := filepath.Abs(anchor); err == nil {
+    anchor = absolute
+  }
+  dir := filepath.Dir(filepath.Clean(anchor))
+  for {
+    if filepath.Base(dir) != "node_modules" {
+      candidate := filepath.Join(dir, "node_modules", filepath.FromSlash(pkg), "package.json")
+      if stat, err := os.Stat(candidate); err == nil && !stat.IsDir() {
+        return candidate
+      }
+    }
+    parent := filepath.Dir(dir)
+    if parent == dir {
+      return ""
+    }
+    dir = parent
+  }
+}
+
+// nodePlatformPair is nodePlatformPairFor applied to this build's own target.
+func nodePlatformPair() (string, string) {
+  return nodePlatformPairFor(runtime.GOOS, runtime.GOARCH)
+}
+
+// nodePlatformPairFor maps a Go build target onto the `process.platform` and
+// `process.arch` pair npm spells a platform package with, so the package name
+// this host resolves is the same one the JS launcher resolves.
+//
+// Only the members whose two vocabularies disagree are mapped. Every other
+// value is identical on both sides and passes through, which keeps a target
+// neither side publishes yet resolvable rather than silently wrong, and keeps
+// this from becoming a list that has to grow with every new port.
+func nodePlatformPairFor(goos, goarch string) (string, string) {
+  platform := goos
+  switch platform {
+  case "windows":
+    platform = "win32"
+  case "solaris":
+    platform = "sunos"
+  }
+  arch := goarch
+  switch arch {
+  case "amd64":
+    arch = "x64"
+  case "386":
+    arch = "ia32"
+  case "ppc64le":
+    arch = "ppc64"
+  }
+  return platform, arch
+}
+
 // ttsxCommand returns a ttsx exec.Cmd bound to a background context. Use
 // ttsxCommandContext when the caller owns a cancellable context.
-func ttsxCommand(args ...string) *exec.Cmd {
-  return ttsxCommandContext(context.Background(), args...)
+func ttsxCommand(anchors []string, args ...string) *exec.Cmd {
+  return ttsxCommandContext(context.Background(), anchors, args...)
 }
 
 // ttsxCommandContext is the cancellable variant, used by the config loaders so
 // their subprocess is torn down with the call that started it. It carries no
 // deadline: evaluating a user config is the user's own code running, and how
 // long that is allowed to take is not this binary's decision.
-func ttsxCommandContext(ctx context.Context, args ...string) *exec.Cmd {
-  ttsx := os.Getenv("TTSC_TTSX_BINARY")
-  if ttsx == "" {
-    ttsx = "ttsx"
-  }
+//
+// `anchors` are the file paths the launcher is resolved from; see
+// resolveTtsxLauncher.
+func ttsxCommandContext(ctx context.Context, anchors []string, args ...string) *exec.Cmd {
+  ttsx := resolveTtsxLauncher(anchors)
   if shouldRunTtsxThroughNode(ttsx) {
     node := os.Getenv("TTSC_NODE_BINARY")
     if node == "" {
@@ -4531,6 +4968,8 @@ func setEnv(env []string, key, value string) []string {
   return append(env, prefix+value)
 }
 
+// ttsc:config-loader-shared end
+
 // parseExternalRuleEntry delegates to parseRuleEntry. It is kept under this
 // name because test files in the same package call it directly.
 func parseExternalRuleEntry(v any) (Severity, json.RawMessage, error) {