@williamthorsen/nmr 0.32.0 → 0.32.2

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat — @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.28.0";
+export const __readyupVersion = "0.29.0";
 
 
 // .readyup/kits/default.ts
@@ -43,9 +43,8 @@ var workspaceScripts = {
   "test:unit": "pnpm exec vitest --project unit",
   "test:watch": `pnpm exec vitest ${GATE_PROJECTS} --watch`,
   typecheck: "tsgo --noEmit",
-  // Without `--include-locked`, nothing would be reported in a repo that pins exact version numbers. The
-  // command is a string because neither half names an nmr command: both are binaries.
-  upgrade: "nmr-report-catalog && nmr-taze --include-locked",
+  // The command is a string because neither half names an nmr command: both are binaries.
+  upgrade: "nmr-report-catalog && nmr-taze",
   "view-coverage": "open coverage/index.html"
 };
 var rootScripts = {
@@ -81,7 +80,7 @@ var rootScripts = {
   "root:typecheck": "tsgo --noEmit",
   // Carries the override report for the same reason `upgrade` does: both end in the tool that rewrites a
   // `pnpm.overrides` block, so both need the reporter's rejection ahead of them.
-  "root:upgrade": "nmr-report-overrides && nmr-taze --include-locked",
+  "root:upgrade": "nmr-report-overrides && nmr-taze",
   test: ["root:test", "-R test"],
   "test:all": ["root:test:all", "-R test:all"],
   "test:coverage": ["root:test", "-R test:coverage"],
@@ -93,7 +92,7 @@ var rootScripts = {
   typecheck: [ROOT_TYPECHECK_STEP, { run: "-R typecheck", declinesArgs: true }],
   // The command is a string because neither half names an nmr command: both are binaries, and a composite
   // element can name only a command.
-  upgrade: "nmr-report-overrides && nmr-taze --include-locked --recursive"
+  upgrade: "nmr-report-overrides && nmr-taze --recursive"
 };
 
 // src/resolve-scripts.ts
@@ -272,6 +271,13 @@ var default_default = defineRdyKit({
           check: () => prettierConfigBuildsOnSharedConfig(),
           fix: "Replace the Prettier config with: import { definePrettierConfig } from '@williamthorsen/nmr/prettier'; export default definePrettierConfig();"
         },
+        // -- Shared upgrade policy -----------------------------------------------
+        {
+          name: "taze.config.ts builds on @williamthorsen/nmr/taze",
+          severity: "warn",
+          check: () => tazeConfigBuildsOnSharedConfig(),
+          fix: "Replace the taze config with: import { defineConfig } from '@williamthorsen/nmr/taze'; export default defineConfig(); \u2014 nmr's upgrade policy reaches a repo only through this file, so without it `nmr upgrade` reports nothing where dependencies are pinned to exact versions"
+        },
         // -- Audit dependency --------------------------------------------------------
         {
           name: "v11y-check in devDependencies",
@@ -303,6 +309,8 @@ var CONFIG_EXTENSIONS = "{ts,mts,cts,js,mjs,cjs}";
 var SHARED_VITEST_MODULE = "@williamthorsen/nmr/vitest";
 var SHARED_PRETTIER_MODULE = "@williamthorsen/nmr/prettier";
 var INERT_PRETTIER_CONFIGS = [".prettierrc", ".prettierrc.{json,json5,yaml,yml,toml}"];
+var SHARED_TAZE_MODULE = "@williamthorsen/nmr/taze";
+var INERT_TAZE_CONFIGS = [".tazerc", ".tazerc.json", "taze.config.json"];
 var RE_EXPORT_LINE_PATTERN = /^export\s*(?:\{\s*default\s*}|\*)\s*from\s*['"]\.\.\/[^'"]*['"];?$/;
 var MIN_ESLINT_VERSION = "10.0.0";
 var MIN_STRICT_LINT_VERSION = "9.3.0";
@@ -394,7 +402,7 @@ function formatPaths(paths) {
 ${paths.map((path2) => `      ${path2}`).join("\n")}`;
 }
 function getMinVersion() {
-  const picked = { "version": "0.32.0" };
+  const picked = { "version": "0.32.2" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -495,6 +503,22 @@ function readPnpmFieldKeys(content) {
 function resolvesVersionViaWorkspace(range) {
   return WORKSPACE_VERSION_MARKERS.some((marker) => range.startsWith(marker));
 }
+function tazeConfigBuildsOnSharedConfig(cwd = process.cwd()) {
+  const configs = findFiles([`taze.config.${CONFIG_EXTENSIONS}`], cwd);
+  if (configs.length === 0) {
+    return { ok: false, detail: describeMissingTazeConfig(cwd) };
+  }
+  const stale = configs.filter(
+    (relativePath) => !importsSharedExport(readFileIn(cwd, relativePath), "defineConfig", SHARED_TAZE_MODULE)
+  );
+  if (stale.length === 0) return true;
+  return { ok: false, detail: `does not import defineConfig from ${SHARED_TAZE_MODULE}: ${stale.join(", ")}` };
+}
+function describeMissingTazeConfig(cwd) {
+  const inert = findFiles(INERT_TAZE_CONFIGS, cwd);
+  if (inert.length > 0) return `holds no code to call the factory: ${inert.join(", ")}`;
+  return "taze.config.ts is missing";
+}
 function toolVersionsHasNoPnpm() {
   const content = readFile(".tool-versions");
   if (content === void 0) return true;
@@ -515,6 +539,7 @@ export {
   noReExportOnlyVitestConfigs,
   noRetiredVitestConfigs,
   prettierConfigBuildsOnSharedConfig,
+  tazeConfigBuildsOnSharedConfig,
   vitestConfigBuildsOnSharedConfig,
   vitestRootConfigBuildsOnSharedConfig
 };

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.1",
       "inputs": [
         {
-          "hash": "67afdcb4",
+          "hash": "904ac753",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "2bd89ec9",
+          "hash": "cca25de2",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -21,7 +21,7 @@
           ]
         },
         {
-          "hash": "3dfc2ee7",
+          "hash": "94bb3c62",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -38,10 +38,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.28.0",
+      "readyupVersion": "0.29.0",
       "source": "kits/default.ts",
-      "sourceHash": "67afdcb4",
-      "targetHash": "b923a4b4"
+      "sourceHash": "904ac753",
+      "targetHash": "bc4d49d1"
     }
   ]
 }

package/README.md

@@ -3,31 +3,19 @@
 Context-aware script runner for pnpm monorepos. Ships an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.32.0 (2026-08-17)
+## Release notes — v0.32.2 (2026-08-19)
 
-### 🎉 Features
-
-- Carry the test-tier convention in the ambient rulebook (#689)
-
-  Adds the test-tier convention to `nmr.md`, the ambient rulebook `codeassembly sync` deploys to each consuming repo's agent guidance. The guidance describes the `<subject>[.<aspect>].<tier>.test.ts` grammar and the four tiers, and warns that tests outside a `__tests__` directory are ignored. Tests not explicitly attributed to a tier are flagged by the ReadyUp kit bundled with `nmr`.
-  
-  The previous guidance is removed from `AGENTS.md`.
-
-- Close each bin's output with a statement of what the run came to (#691)
-
-  Five nmr bins now end their output with a statement of the run's final result, rather than on whichever line the run happened to reach last, so the last line a reader sees carries the finding.
-
-  Separately, `ensure-prepublish-hooks` prints its whole report, including failure messages, on stdout, to avoid splitting the report across two streams. Failure still results in a non-zero exit code.
+### 🐛 Bug fixes
 
-- Reject a dead pnpm field in nmr's ReadyUp kit (#692)
+- Recognize nmr behind a quoted environment assignment (#709)
 
-  nmr's ReadyUp kit now checks for the presence of a `pnpm` field in any `package.json`. pnpm 11 no longer reads any key from that field, but taze (the engine underlying `nmr upgrade`) reads `pnpm.overrides`. To avoid confusion, the kit flags this as an error.
+  Fixes an issue where a `package.json` entry that re-invoked its own command from behind an environment assignment whose quoted value carried a space (e.g., `"build": "NODE_OPTIONS=\"--a --b\" nmr build"`) caused nmr to hang.
 
-### 🐛 Bug fixes
+- Restore upgrade reporting for repos that pin exact versions (#720)
 
-- Fold the running nmr's fingerprint into the build cache key (#693)
+  Fixes an issue where `nmr upgrade` reported nothing in a repo that pins dependencies to exact versions, however far behind the tree was. nmr's shared upgrade policy now supplies both settings the upgrade tool needs to report a bare pin -- locked dependencies are included, and the range searched is `minor` -- and the default `upgrade` scripts no longer pass `--include-locked`, which went inert on its own in taze 20.0.1. The policy reaches a repo only through a `taze.config.ts` calling `defineConfig`, and nmr's ReadyUp kit now warns when a repo carries none.
 
-  Fixes the issue that build output could be stale, but not reported to be stale, after an edit to `nmr-compile`'s own emit logic. The build cache key now folds a fingerprint of the `nmr` running the build alongside the TypeScript version it already carried. Any build keys generated against an `nmr` with a different fingerprint will be invalidated. Repos consuming `nmr` get the same behavior.
+  The `minor` range mode applies to every dependency, not only a pinned one: a `~` range is searched as `^`, so minor upgrades are proposed for it, and a `packageMode` entry other than `minor` drops its dependency from a default pass rather than narrowing it.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -115,6 +103,10 @@ If no per-package override exists, the highest-tier value that is set wins. Set
 
 > **Tip:** If your repo uses `eslint-plugin-package-json/valid-scripts`, empty strings are flagged as invalid. Use `":"` (the POSIX null command) instead — nmr treats it as a regular override that exits successfully and does nothing.
 
+A `package.json` entry that re-invokes the command it is declared under is never honored. Honoring `"build": "nmr build"` would spawn a shell running `nmr build` in the same directory, reaching the same entry again without bound, so nmr discards the entry and resolves the command from the tier below. An entry that carries only the self-reference, trailing arguments included, is discarded in silence: it declares no step to lose. An entry that chains anything else onto it — `"build": "nmr build && rdy compile"`, or `"build": "rdy compile && nmr build"` — would lose those steps, so nmr rejects the invocation instead, naming the file, the key, and where the steps belong. For an ordinary command that is a `<command>:pre` or `<command>:post` script: `"build:pre": "rdy verify"` and `"build:post": "rdy compile"` wrap nmr's own `build` rather than replacing it. For a hook entry it is the entry itself, since nmr wraps a `:pre` or `:post` script in no hooks of its own — `"build:post": "nmr build:post && rdy compile"` becomes `"build:post": "rdy compile"`.
+
+The re-invocation is recognized wherever it stands in the entry, on the grammar [the shelled-nmr line](#script-values) uses, and a segment carrying `-F` or `-R` is not one — it hands the command to other scopes rather than back to this one. Nor is `-w` from inside a package, which reaches the root's registry and the root's `package.json`. A filter that selects the declaring package is the hole in that exemption: `nmr -F own-pkg build` in `own-pkg`'s own `build` re-enters without bound, and nmr does not recognize it.
+
 ### Script values
 
 A script value is a string or an array of steps. Only the built-in defaults and `.config/nmr.config.ts` carry an array; a `package.json` script must be a string, and any other value is rejected when the scripts are read. Arrays expand to chained `nmr` sub-invocations:
@@ -145,9 +137,11 @@ An invocation carrying trailing arguments also serves no part of its work from t
 
 A string value is spawned through a shell as one command, so an `nmr` invocation inside it is invisible to the process above: a quiet failure surrenders the whole nested subtree rather than the failing step, and a loud run relays the nested tree through a forwarding pipe. nmr writes one line to stderr, in every verbosity, when a command resolves to a step reaching nmr through a shell.
 
-The line names the declaration it is an edit to — the file, the field, and the key — and its remedy follows from that site. A `.config/nmr.config.ts` entry keeps its nmr steps as a step list and moves anything else to a `<command>:pre` or `<command>:post` script: a step-list element is composed into `nmr <element>`, so it can name only an nmr command. A `package.json` entry has to go, since `package.json` holds no step list: delete it outright when it restates what nmr already runs for that command, and move the steps it adds to a `<command>:pre` or `<command>:post` script when they are the package's own. Where the registry defines no such command, both apply: name the command in `.config/nmr.config.ts`, and put the package-specific steps in a hook. The pair is named rather than `:post` alone because an entry's extra steps may run on either side of the chain: `rdy verify && nmr compile` puts them first.
+The line names the declaration it is an edit to — the file, the field, and the key — and its remedy follows from that site. A `.config/nmr.config.ts` entry keeps its nmr steps as a step list and moves anything else to a `<command>:pre` or `<command>:post` script: a step-list element is composed into `nmr <element>`, so it can name only an nmr command. A `package.json` entry has to go, since `package.json` holds no step list: delete it outright when it restates what nmr already runs for that command, and move the steps it adds to a `<command>:pre` or `<command>:post` script when they are the package's own. Where the registry defines no such command, both apply: name the command in `.config/nmr.config.ts`, and put the package-specific steps in a hook. The pair is named rather than `:post` alone because an entry's extra steps may run on either side of the chain: `rdy verify && nmr compile` puts them first. A hook is the exception at both tiers: nmr wraps a `:pre` or `:post` script in no hooks of its own, so a hook's other steps become a script of their own that the step list names.
 
-nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, or `|`, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. The line reports a boundary rather than enforcing a rule, and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
+nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, `|`, or a newline, past any leading `NAME=value` assignments, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. This line reports a boundary rather than enforcing a rule — it covers a step nmr runs as written, and only the reporting of the nested run is degraded — and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
+
+A [self-referential `package.json` entry](#three-tier-override-system) is the shape nmr cannot run as written, and it is rejected rather than reported. The same recognition finds it, so the same residuals apply — what goes unrecognized there re-enters nmr without bound, which hangs rather than passing quietly.
 
 ## Configuration
 
@@ -544,8 +538,8 @@ A `pnpm.overrides` block left in the root `package.json` fails the command inste
 The upgrade tool ([taze](https://github.com/antfu-collective/taze)) arrives with nmr, so your repo declares no dependency on it. Everything after the command name is passed through, including the range mode:
 
 ```bash
-nmr upgrade         # upgrades available within each package's version ceilings
-nmr upgrade major   # major upgrades, still inside the ceilings
+nmr upgrade         # minor and patch upgrades, regardless of the range each dependency declares
+nmr upgrade major   # major upgrades, for dependencies carrying no per-package ceiling
 nmr upgrade --write # apply the proposals to package.json
 ```
 
@@ -564,11 +558,16 @@ export default defineConfig({
 });
 ```
 
-`defineConfig` supplies nmr's shared upgrade policy — currently a seven-day quarantine on brand-new releases — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`.
+`defineConfig` supplies nmr's shared upgrade policy — a seven-day quarantine on brand-new releases, and the pair of settings that report a dependency pinned to an exact version: locked dependencies are included, and the range searched is `minor` — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`. `mode` is the exception: the upgrade tool carries a default of its own for it, and clearing nmr's leaves no valid range to search, so name a mode instead.
 
 Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here.
 
-> **Note:** `--include-locked` is part of both registry entries because a repo that pins dependencies to exact versions (pnpm's `savePrefix: ''`) has no dependency the tool would otherwise consider — without it, an upgrade pass reports nothing at all. Drop it via `.config/nmr.config.ts` if your repo declares version ranges instead.
+> **Note:** This file is what activates nmr's upgrade policy at all. A repo without one gets neither the release quarantine nor the settings that report a dependency pinned to an exact version, and `nmr upgrade` reports nothing in a repo using pnpm's `savePrefix: ''`. nmr's ReadyUp kit warns when the file is missing.
+
+Two consequences of the `minor` range mode the policy declares:
+
+- A `packageMode` entry is honored only by the pass whose mode matches it, or by a `default` pass; every other pass drops that dependency rather than narrowing it. Under the policy's `minor` mode, a `patch` ceiling hides its dependency until you run `nmr upgrade patch`, and a `minor` ceiling hides it from `nmr upgrade major`.
+- A `~` range is searched as `^`, so minor upgrades are proposed for it and `--write` applies them under the original `~`. To hold one dependency to patches, give it a `packageMode` entry of `patch` and read it from `nmr upgrade patch`; to hold the whole repo there, declare `mode: 'patch'`.
 
 ## Default script registries
 
@@ -598,7 +597,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | `test:unit`      | `pnpm exec vitest --project unit`                           |
 | `test:watch`     | `pnpm exec vitest --project unit --project tool --watch`    |
 | `typecheck`      | `tsgo --noEmit`                                             |
-| `upgrade`        | `nmr-report-catalog && nmr-taze --include-locked`           |
+| `upgrade`        | `nmr-report-catalog && nmr-taze`                            |
 | `view-coverage`  | `open coverage/index.html`                                  |
 
 `fmt` and `fmt:check` select their files through git rather than by walking the directory, which is what makes a package-level run and a root-level run apply the same ignore rules — see [file selection](#file-selection).
@@ -712,9 +711,9 @@ A file git ignores is never formatted, even when named directly. Trailing argume
 
 #### Dependencies
 
-| Command   | Runs                                                            |
-| --------- | --------------------------------------------------------------- |
-| `upgrade` | `nmr-report-overrides && nmr-taze --include-locked --recursive` |
+| Command   | Runs                                           |
+| --------- | ---------------------------------------------- |
+| `upgrade` | `nmr-report-overrides && nmr-taze --recursive` |
 
 See [dependency upgrades](#dependency-upgrades) for the workflow and its configuration.
 
@@ -733,7 +732,7 @@ These scripts operate on root-level code only (not workspace packages):
 | `root:test:tool`   | `vitest --config ./vitest.root.config.ts --project tool`                |
 | `root:test:unit`   | `vitest --config ./vitest.root.config.ts --project unit`                |
 | `root:typecheck`   | `tsgo --noEmit`                                                         |
-| `root:upgrade`     | `nmr-report-overrides && nmr-taze --include-locked`                     |
+| `root:upgrade`     | `nmr-report-overrides && nmr-taze`                                      |
 
 #### Utilities
 
@@ -885,7 +884,7 @@ Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool
 Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree nmr controls.
 
 ```bash
-nmr-taze --include-locked --recursive
+nmr-taze --recursive
 ```
 
 ### `ensure-prepublish-hooks`

package/dist/esm/default-scripts.js

@@ -22,7 +22,7 @@ export const workspaceScripts = {
     'test:unit': 'pnpm exec vitest --project unit',
     'test:watch': `pnpm exec vitest ${GATE_PROJECTS} --watch`,
     typecheck: 'tsgo --noEmit',
-    upgrade: 'nmr-report-catalog && nmr-taze --include-locked',
+    upgrade: 'nmr-report-catalog && nmr-taze',
     'view-coverage': 'open coverage/index.html',
 };
 export const rootScripts = {
@@ -52,7 +52,7 @@ export const rootScripts = {
     'root:test:tool': 'vitest --config ./vitest.root.config.ts --project tool',
     'root:test:unit': 'vitest --config ./vitest.root.config.ts --project unit',
     'root:typecheck': 'tsgo --noEmit',
-    'root:upgrade': 'nmr-report-overrides && nmr-taze --include-locked',
+    'root:upgrade': 'nmr-report-overrides && nmr-taze',
     test: ['root:test', '-R test'],
     'test:all': ['root:test:all', '-R test:all'],
     'test:coverage': ['root:test', '-R test:coverage'],
@@ -60,5 +60,5 @@ export const rootScripts = {
     'test:unit': ['root:test:unit', '-R test:unit'],
     'test:watch': `vitest ${GATE_PROJECTS} --watch`,
     typecheck: [ROOT_TYPECHECK_STEP, { run: '-R typecheck', declinesArgs: true }],
-    upgrade: 'nmr-report-overrides && nmr-taze --include-locked --recursive',
+    upgrade: 'nmr-report-overrides && nmr-taze --recursive',
 };

package/dist/esm/help.js

@@ -43,7 +43,7 @@ function collectOverrides(packageDir) {
     for (const [name, value] of Object.entries(scripts)) {
         if (isHookName(name))
             continue;
-        if (isSelfReferential(value, name))
+        if (isSelfReferential(value, name, packageDir))
             continue;
         filtered[name] = value;
     }

package/dist/esm/resolver.d.ts

@@ -20,5 +20,6 @@ export declare function describeScript(script: ScriptValue): string;
 export declare function readPackageJsonScripts(packageDir: string): Record<string, string> | undefined;
 export declare function buildWorkspaceRegistry(config: NmrConfig): ScriptRegistry;
 export declare function buildRootRegistry(config: NmrConfig): ScriptRegistry;
-export declare function isSelfReferential(script: string, commandName: string): boolean;
+export declare function findChainedSelfReference(packageDir: string | undefined, commandName: string): string | undefined;
+export declare function isSelfReferential(script: string, commandName: string, packageDir: string): boolean;
 export declare function resolveScript(commandName: string, registry: ScriptRegistry, packageDir: string | undefined, workspaceRoot: boolean): ResolvedScript | undefined;

package/dist/esm/resolver.js

@@ -4,7 +4,8 @@ import { hasErrnoCode } from '@williamthorsen/nmr-core';
 import { parsePackageJson, readScriptRecord, resolvePackageJsonPath } from "./helpers/package-json.js";
 import { isObject } from "./helpers/type-guards.js";
 import { getDefaultRootScripts, getDefaultWorkspaceScripts } from "./resolve-scripts.js";
-import { composeNmrStep } from "./steps.js";
+import { composeNmrStep, readSelfReference } from "./steps.js";
+import { isMonorepoRoot } from "./workspace.js";
 export function applyDevBin(command, devBin, monorepoRoot) {
     if (!devBin) {
         return command;
@@ -88,16 +89,31 @@ export function buildRootRegistry(config) {
         ...config.rootScripts,
     };
 }
-export function isSelfReferential(script, commandName) {
-    const prefix = `nmr ${commandName}`;
-    return script === prefix || script.startsWith(`${prefix} `);
+export function findChainedSelfReference(packageDir, commandName) {
+    if (packageDir === undefined) {
+        return undefined;
+    }
+    const scripts = readPackageJsonScripts(packageDir);
+    if (scripts === undefined || !Object.hasOwn(scripts, commandName)) {
+        return undefined;
+    }
+    const script = scripts[commandName];
+    if (script === undefined) {
+        return undefined;
+    }
+    return readSelfReference({ anchoredAtRoot: isMonorepoRoot(packageDir), commandName, script }) === 'chained'
+        ? script
+        : undefined;
+}
+export function isSelfReferential(script, commandName, packageDir) {
+    return readSelfReference({ anchoredAtRoot: isMonorepoRoot(packageDir), commandName, script }) !== undefined;
 }
 export function resolveScript(commandName, registry, packageDir, workspaceRoot) {
     if (packageDir) {
         const pkgScripts = readPackageJsonScripts(packageDir);
         if (pkgScripts && Object.hasOwn(pkgScripts, commandName)) {
             const override = pkgScripts[commandName];
-            if (override !== undefined && !isSelfReferential(override, commandName)) {
+            if (override !== undefined && !isSelfReferential(override, commandName, packageDir)) {
                 return {
                     origin: { tier: 'package', file: resolvePackageJsonPath(packageDir), key: commandName },
                     steps: [{ kind: 'opaque', command: override }],

package/dist/esm/runCli.js

@@ -7,17 +7,24 @@ import { resolveContext } from "./context.js";
 import { generateHelp } from "./help.js";
 import { deriveExcerpt } from "./helpers/deriveExcerpt.js";
 import { isHookName } from "./helpers/hook-name.js";
+import { resolvePackageJsonPath } from "./helpers/package-json.js";
 import { composeTranscript } from "./helpers/transcript.js";
 import { renderRecording, renderRefusal, resolveRecording } from "./recording.js";
 import { assembleReplay } from "./replay-assembly.js";
 import { readReportFormatEnv, REPORT_FORMAT_ENV_VAR, resolveReportFormat } from "./report-format.js";
-import { applyDevBinToSteps, buildRootRegistry, buildWorkspaceRegistry, expandScript, resolveScript, } from "./resolver.js";
+import { applyDevBinToSteps, buildRootRegistry, buildWorkspaceRegistry, expandScript, findChainedSelfReference, resolveScript, } from "./resolver.js";
 import { resolveChannel, runSteps } from "./runner.js";
 import { composeNmrStep, findNmrCrossing, renderChain } from "./steps.js";
+import { UserError } from "./UserError.js";
 import { COMMAND_VERBOSITY_ENV_VAR, readVerbosityEnv, resolveVerbosity } from "./verbosity.js";
 import { writeVerdict } from "./verdict.js";
 const VERSION = readPackageVersion(import.meta.url);
 const CROSSING_CONSEQUENCE = "so nmr handles the nested run's output as a tool's.";
+const NAMED_ESCAPES = new Map([
+    ['\n', String.raw `\n`],
+    ['\r', String.raw `\r`],
+    ['\t', String.raw `\t`],
+]);
 export const RUN_IF_PRESENT_ENV_VAR = 'NMR_RUN_IF_PRESENT';
 export async function runCli(options) {
     const { args, cwd, env, stdout, stderr } = options;
@@ -84,6 +91,14 @@ export async function runCli(options) {
         return runSteps([delegation.step], context.monorepoRoot, { ...runOptions, env: delegation.env });
     }
     const registry = useRoot ? buildRootRegistry(context.config) : buildWorkspaceRegistry(context.config);
+    assertNoSelfReference({
+        anchorDir,
+        command,
+        isReading: parsed.log,
+        monorepoRoot: context.monorepoRoot,
+        registry,
+        workspaceRoot: parsed.workspaceRoot,
+    });
     const resolved = resolveScript(command, registry, anchorDir, parsed.workspaceRoot);
     if (!resolved) {
         if (env[RUN_IF_PRESENT_ENV_VAR] === '1') {
@@ -255,8 +270,7 @@ function describeCrossingRemedy(options) {
             };
         case 'config':
             return {
-                remedy: `Write the nmr steps as a step list, and move any others to a \`${origin.key}:pre\` or ` +
-                    `\`${origin.key}:post\` script.`,
+                remedy: `Write the nmr steps as a step list, and move any others to ${describeStepDestination(origin.key)}.`,
                 subject: `${configSite}: \`${origin.field}.${origin.key}\``,
             };
         case 'package':
@@ -270,6 +284,12 @@ function describeCrossingRemedy(options) {
         }
     }
 }
+function describeStepDestination(key) {
+    if (isHookName(key)) {
+        return 'a script of their own that the step list names, because a hook has no `:pre` or `:post` of its own';
+    }
+    return `a \`${key}:pre\` or \`${key}:post\` script`;
+}
 function describeOrigin(origin, config, useRoot) {
     if (origin.tier === 'package') {
         return origin;
@@ -280,9 +300,17 @@ function describeOrigin(origin, config, useRoot) {
         ? { tier: 'config', field, key: origin.key }
         : { tier: 'default', key: origin.key };
 }
+function escapeControlCharacters(text) {
+    let escaped = text;
+    for (const [char, escape] of NAMED_ESCAPES) {
+        escaped = escaped.split(char).join(escape);
+    }
+    return escaped;
+}
 function formatNmrCrossingWarning(options) {
     const { remedy, subject } = describeCrossingRemedy(options);
-    return `⚠️ ${subject} reaches nmr through a shell (\`${options.crossing}\`), ${CROSSING_CONSEQUENCE} ${remedy}`;
+    return (`⚠️ ${subject} reaches nmr through a shell (\`${escapeControlCharacters(options.crossing)}\`), ` +
+        `${CROSSING_CONSEQUENCE} ${remedy}`);
 }
 function formatOverrideNotice(resolved, registry, command, anchorDir, quiet) {
     const registryEntry = Object.hasOwn(registry, command) ? registry[command] : undefined;
@@ -291,18 +319,26 @@ function formatOverrideNotice(resolved, registry, command, anchorDir, quiet) {
     }
     return `📦 ${path.basename(anchorDir)}: Using override script: ${renderChain(resolved.steps)}\n`;
 }
+function formatSelfReferenceRemedy(options) {
+    const { command, monorepoRoot, registry, script, workspaceRoot } = options;
+    if (isHookName(command)) {
+        return `Delete the re-invocation: \`${command}\` runs the steps standing beside it.`;
+    }
+    const configSite = path.relative(monorepoRoot, resolveConfigPath(monorepoRoot));
+    return formatPackageRemedy({ configSite, crossing: script, key: command, registry, workspaceRoot });
+}
 function formatPackageRemedy(options) {
     const { configSite, crossing, key, registry, workspaceRoot } = options;
     const registryEntry = Object.hasOwn(registry, key) ? registry[key] : undefined;
     if (registryEntry === undefined) {
         return (`A \`package.json\` script holds no step list: define \`${key}\` in \`${configSite}\` and move the ` +
-            `package-specific steps to a \`${key}:pre\` or \`${key}:post\` script.`);
+            `package-specific steps to ${describeStepDestination(key)}.`);
     }
     const registryChain = renderChain(expandScript(registryEntry, workspaceRoot));
     if (registryChain === crossing) {
-        return `Delete the entry: nmr's own \`${key}\` already runs \`${registryChain}\`.`;
+        return `Delete the entry: nmr's own \`${key}\` already runs \`${escapeControlCharacters(registryChain)}\`.`;
     }
-    return `Delete the entry and move the steps it adds to a \`${key}:pre\` or \`${key}:post\` script.`;
+    return `Delete the entry and move the steps it adds to ${describeStepDestination(key)}.`;
 }
 function findArgError(parsed) {
     if (parsed.log && parsed.command === undefined && !parsed.help && !parsed.version) {
@@ -319,7 +355,24 @@ function findNoOpReason(resolvedCommand) {
     }
     return undefined;
 }
+function assertNoSelfReference(options) {
+    const { anchorDir, command, isReading, monorepoRoot, registry, workspaceRoot } = options;
+    if (isReading) {
+        return;
+    }
+    const script = findChainedSelfReference(anchorDir, command);
+    if (script === undefined) {
+        return;
+    }
+    const remedy = formatSelfReferenceRemedy({ command, monorepoRoot, registry, script, workspaceRoot });
+    const site = path.relative(monorepoRoot, resolvePackageJsonPath(anchorDir));
+    throw new UserError(`${site}: \`scripts.${command}\` re-invokes \`nmr ${command}\` (\`${escapeControlCharacters(script)}\`), ` +
+        `so nmr cannot run the steps it chains. ${remedy}`);
+}
 function hasRunnableHook(hookName, registry, anchorDir, workspaceRoot) {
+    if (findChainedSelfReference(anchorDir, hookName) !== undefined) {
+        return true;
+    }
     const resolved = resolveScript(hookName, registry, anchorDir, workspaceRoot);
     if (!resolved)
         return false;

package/dist/esm/steps.d.ts

@@ -11,8 +11,14 @@ export interface NmrStepTarget {
     isDelegate: boolean;
     isWorkspaceRoot: boolean;
 }
+export type SelfReference = 'chained' | 'sole';
 export declare function composeNmrStep(element: string, workspaceRoot: boolean, declinesArgs?: boolean): Step;
 export declare function findNmrCrossing(steps: readonly Step[]): string | undefined;
 export declare function findUnexpressibleToken(element: string): string | undefined;
 export declare function readNmrStep(step: Step): NmrStepTarget | undefined;
+export declare function readSelfReference(options: {
+    anchoredAtRoot: boolean;
+    commandName: string;
+    script: string;
+}): SelfReference | undefined;
 export declare function renderChain(steps: readonly Step[]): string;

package/dist/esm/steps.js

@@ -8,15 +8,16 @@ const LAUNCHERS = new Map([
     ['yarn', new Set(['dlx', 'exec'])],
 ]);
 const QUOTES = new Set(['"', "'"]);
-const SEGMENT_SEPARATORS = new Set([';', '|', '&']);
+const SEGMENT_SEPARATORS = new Set([';', '|', '&', '\n', '\r']);
 const SHELL_SAFE_TOKEN = /^[\w@%+=:,./-]+$/;
+const TOKEN_SEPARATORS = new Set([' ', '\t', '\n', '\r']);
 export function composeNmrStep(element, workspaceRoot, declinesArgs = false) {
     const flags = workspaceRoot ? ['-w'] : [];
     return { kind: 'structural', argv: ['nmr', ...flags, ...tokenize(element)], ...(declinesArgs && { declinesArgs }) };
 }
 export function findNmrCrossing(steps) {
     for (const step of steps) {
-        if (step.kind === 'opaque' && splitSegments(step.command).some(reachesNmr)) {
+        if (step.kind === 'opaque' && splitSegments(step.command).some((segment) => readNmrTail(segment) !== undefined)) {
             return step.command;
         }
     }
@@ -30,14 +31,65 @@ export function readNmrStep(step) {
         return undefined;
     }
     const [file, ...rest] = step.argv;
-    if (file !== 'nmr') {
+    return file === 'nmr' ? readNmrTarget(rest) : undefined;
+}
+export function readSelfReference(options) {
+    const { anchoredAtRoot, commandName, script } = options;
+    const segments = splitSegments(script).filter((segment) => segment.trim() !== '');
+    const reenters = segments.some((segment) => {
+        const tail = readNmrTail(segment);
+        const target = tail === undefined ? undefined : readNmrTarget(tail);
+        return target?.command === commandName && !target.isDelegate && (anchoredAtRoot || !target.isWorkspaceRoot);
+    });
+    if (!reenters) {
+        return undefined;
+    }
+    return segments.length === 1 ? 'sole' : 'chained';
+}
+export function renderChain(steps) {
+    return steps.map(renderStep).join(' && ');
+}
+function dropLeadingAssignments(tokens) {
+    const start = tokens.findIndex((token) => !ENV_ASSIGNMENT.test(token));
+    return start === -1 ? [] : tokens.slice(start);
+}
+function isRedirectionOperator(char, precedingText, nextChar) {
+    if (char !== '&' && char !== '|') {
+        return false;
+    }
+    return (char === '&' && nextChar === '>') || /[<>]\s*$/.test(precedingText);
+}
+function quoteToken(token) {
+    if (SHELL_SAFE_TOKEN.test(token)) {
+        return token;
+    }
+    return "'" + token.replaceAll("'", String.raw `'\''`) + "'";
+}
+function readNmrTail(segment) {
+    const [head, ...rest] = dropLeadingAssignments(tokenizeSegment(segment));
+    if (head === undefined) {
         return undefined;
     }
+    if (head === 'nmr') {
+        return rest;
+    }
+    const subcommands = LAUNCHERS.get(head);
+    if (subcommands === undefined) {
+        return undefined;
+    }
+    if (subcommands.size === 0) {
+        const nameIndex = rest.findIndex((token) => !token.startsWith('-'));
+        return nameIndex !== -1 && rest[nameIndex] === 'nmr' ? rest.slice(nameIndex + 1) : undefined;
+    }
+    const subcommandIndex = rest.findIndex((token) => subcommands.has(token));
+    return subcommandIndex !== -1 && rest[subcommandIndex + 1] === 'nmr' ? rest.slice(subcommandIndex + 2) : undefined;
+}
+function readNmrTarget(tokens) {
     let isDelegate = false;
     let isWorkspaceRoot = false;
     let index = 0;
-    while (index < rest.length) {
-        const token = rest[index] ?? '';
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
         switch (token) {
             case '-F':
             case '--filter':
@@ -63,37 +115,6 @@ export function readNmrStep(step) {
     }
     return undefined;
 }
-export function renderChain(steps) {
-    return steps.map(renderStep).join(' && ');
-}
-function dropLeadingAssignments(tokens) {
-    const start = tokens.findIndex((token) => !ENV_ASSIGNMENT.test(token));
-    return start === -1 ? [] : tokens.slice(start);
-}
-function quoteToken(token) {
-    if (SHELL_SAFE_TOKEN.test(token)) {
-        return token;
-    }
-    return "'" + token.replaceAll("'", String.raw `'\''`) + "'";
-}
-function reachesNmr(segment) {
-    const [head, ...rest] = dropLeadingAssignments(tokenize(segment));
-    if (head === undefined) {
-        return false;
-    }
-    if (head === 'nmr') {
-        return true;
-    }
-    const subcommands = LAUNCHERS.get(head);
-    if (subcommands === undefined) {
-        return false;
-    }
-    if (subcommands.size === 0) {
-        return rest.find((token) => !token.startsWith('-')) === 'nmr';
-    }
-    const subcommandIndex = rest.findIndex((token) => subcommands.has(token));
-    return subcommandIndex !== -1 && rest[subcommandIndex + 1] === 'nmr';
-}
 function renderStep(step) {
     return step.kind === 'opaque' ? step.command : step.argv.map(quoteToken).join(' ');
 }
@@ -128,6 +149,11 @@ function splitSegments(command) {
             continue;
         }
         if (SEGMENT_SEPARATORS.has(char)) {
+            if (isRedirectionOperator(char, current, command[index + 1])) {
+                current += char;
+                index += 1;
+                continue;
+            }
             index += command[index + 1] === char ? 2 : 1;
             segments.push(current);
             current = '';
@@ -142,3 +168,49 @@ function splitSegments(command) {
 function tokenize(element) {
     return element.split(/\s+/).filter((token) => token.length > 0);
 }
+function tokenizeSegment(segment) {
+    const tokens = [];
+    let current = '';
+    let quote;
+    let index = 0;
+    while (index < segment.length) {
+        const char = segment[index] ?? '';
+        if (quote !== undefined) {
+            if (char === '\\' && quote === '"') {
+                current += char + (segment[index + 1] ?? '');
+                index += 2;
+                continue;
+            }
+            current += char;
+            if (char === quote)
+                quote = undefined;
+            index += 1;
+            continue;
+        }
+        if (char === '\\') {
+            current += char + (segment[index + 1] ?? '');
+            index += 2;
+            continue;
+        }
+        if (QUOTES.has(char)) {
+            quote = char;
+            current += char;
+            index += 1;
+            continue;
+        }
+        if (TOKEN_SEPARATORS.has(char)) {
+            if (current !== '') {
+                tokens.push(current);
+            }
+            current = '';
+            index += 1;
+            continue;
+        }
+        current += char;
+        index += 1;
+    }
+    if (current !== '') {
+        tokens.push(current);
+    }
+    return tokens;
+}

package/dist/esm/taze.js

@@ -1,5 +1,7 @@
 const SHARED_POLICY = {
+    includeLocked: true,
     maturityPeriod: 7,
+    mode: 'minor',
 };
 export function defineConfig(config) {
     return { ...SHARED_POLICY, ...config };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -73,13 +73,14 @@
     "prettier-plugin-sh": "0.19.0",
     "taze": "20.0.1",
     "yaml": "2.9.0",
-    "@williamthorsen/nmr-core": "0.10.1"
+    "@williamthorsen/nmr-core": "0.10.2"
   },
   "devDependencies": {
+    "@williamthorsen/toolbelt.filesystem": "0.6.0",
     "@williamthorsen/toolbelt.testing": "0.3.0",
     "@williamthorsen/toolbelt.vitest": "0.4.0",
     "prettier": "3.9.6",
-    "readyup": "0.28.0",
+    "readyup": "0.29.0",
     "tinyglobby": "0.2.17",
     "typescript": "6.0.3",
     "vitest": "4.1.10"