@williamthorsen/nmr 0.46.2 → 0.48.0

package/.meta/changelog.json

@@ -1,4 +1,89 @@
 [
+  {
+    "version": "0.48.0",
+    "date": "2026-10-17",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds the `--delegate <host>` flag to `nmr`, which runs a command whose result is its exit status, such as `ci`, `check`, or a `test` command, on that host over SSH against the local working tree with its uncommitted and untracked files, and exits 255 when the delegation fails outside the command. (#1058)",
+            "hash": "dbd1714d65a833a258ebcc859d6aed130a3d9910",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `NMR_DELEGATE` environment variable, which names the host on which `nmr` runs every command that can be delegated, and the `--no-delegate` flag, which runs a command on the local machine whatever `NMR_DELEGATE` names. (#1058)",
+            "hash": "dbd1714d65a833a258ebcc859d6aed130a3d9910",
+            "entry": 2
+          },
+          {
+            "description": "Adds the host to the verdict for a delegated command, as `passed on <host>` in the line and as a `host` field in the `--json` object. (#1058)",
+            "hash": "dbd1714d65a833a258ebcc859d6aed130a3d9910",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrades `@williamthorsen/eslint-config-typescript` from 18.0.0 to 19.0.0 and rewrites the code in `build-info`, `nmr-core`, `nmr`, and `release-kit` that its new and widened rules report, without changing behavior. (#1047)",
+            "hash": "610ee159fdc429681b1078b500a064c5df296724",
+            "entry": 1
+          },
+          {
+            "description": "Upgrades `readyup` from 0.40.0 to 0.41.0 and recompiles the kits in `nmr`, `release-kit`, and `v11y-check`, whose manifests now record each checklist's check names under `checklistChecks`. (#1047)",
+            "hash": "610ee159fdc429681b1078b500a064c5df296724",
+            "entry": 2
+          },
+          {
+            "description": "Upgrades `pnpm` to 12.11.2, `@types/node` to 24.19.2, `lefthook` to 2.2.1, `@williamthorsen/strict-lint` to 14.2.0, `@williamthorsen/tsconfig` to 0.11.0, `smol-toml` to 1.9.1, and `vite` to 8.3.4. (#1047)",
+            "hash": "610ee159fdc429681b1078b500a064c5df296724",
+            "entry": 3
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.47.0",
+    "date": "2026-10-15",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Sets `maxWorkers` on every project built by `defineVitestConfig` and `defineRootVitestConfig` to one worker per 4 GiB of total memory, bounded by one fewer than the core count, in place of Vitest's default of one fewer than the core count, which does not take memory into account; machines with 2 or fewer cores keep 3 workers. (#1044)",
+            "hash": "8c761e2b054daf91ba362d3f3e878329d35d2eb4",
+            "entry": 1
+          },
+          {
+            "description": "Applies the `--maxWorkers` (or `--max-workers`) flag to every project, which Vitest does not do itself, making the flag override both the derived count and a `maxWorkers` set through the `project` or `tiers` seam, while the `VITEST_MAX_WORKERS` environment variable still overrides the flag. (#1044)",
+            "hash": "8c761e2b054daf91ba362d3f3e878329d35d2eb4",
+            "entry": 2
+          },
+          {
+            "description": "Adds a machine lock that makes a heavy command (`check`, `ci`, and every `test` command except `test:watch`) wait, printing `nmr: waiting for …`, until the heavy command already running on the machine finishes; a nested command and a `-R` or `-F` fan-out take the lock once, and a cached pass does not wait. (#1045)",
+            "hash": "2797c36e73b431c848a5819909aae7f3de6e0af6",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `--no-lock` flag and the `NMR_NO_LOCK=1` environment variable, which run a command and the commands nested in it without waiting for the machine lock, for example on a self-hosted CI machine that runs several runners in parallel. (#1045)",
+            "hash": "2797c36e73b431c848a5819909aae7f3de6e0af6",
+            "entry": 2
+          },
+          {
+            "description": "Extends the `nmr` rulebook to state that a run printing `nmr: waiting for …` is waiting for the machine lock rather than stuck, and that an agent must neither kill it nor rerun it with `--no-lock`. (#1045)",
+            "hash": "2797c36e73b431c848a5819909aae7f3de6e0af6",
+            "entry": 3
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "0.46.2",
     "date": "2026-10-14",

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.40.0";
+export const __readyupVersion = "0.41.0";
 import { createRequire as __rdyCreateRequire } from 'node:module';
 const require = __rdyCreateRequire(import.meta.url);
 
@@ -7442,10 +7442,11 @@ function findClosestName(name, candidates) {
   let shortestDistance = Infinity;
   for (const candidate of candidates) {
     const distance = measureDistance(name, candidate);
-    if (distance < shortestDistance) {
-      shortestDistance = distance;
-      closestName = candidate;
+    if (distance >= shortestDistance) {
+      continue;
     }
+    shortestDistance = distance;
+    closestName = candidate;
   }
   return shortestDistance <= ceiling ? closestName : void 0;
 }
@@ -8510,7 +8511,7 @@ var default_default = defineRdyKit({
         {
           name: ".config/nmr.config.ts uses defineConfig",
           severity: "recommend",
-          skip: () => !fileExists(".config/nmr.config.ts") ? "no nmr config file" : false,
+          skip: () => !fileExists(".config/nmr.config.ts") && "no nmr config file",
           check: () => fileContains(".config/nmr.config.ts", /defineConfig/),
           fix: "Wrap the config export with defineConfig() from @williamthorsen/nmr/config for type safety"
         },
@@ -8521,7 +8522,7 @@ var default_default = defineRdyKit({
             return `eslint >= ${MIN_ESLINT_VERSION}`;
           },
           severity: "error",
-          skip: () => !hasDevDependency("eslint") ? "eslint not installed" : false,
+          skip: () => !hasDevDependency("eslint") && "eslint not installed",
           check: hasSupportedEslintVersion,
           get fix() {
             return `pnpm add --save-dev eslint@^${MIN_ESLINT_VERSION}. Earlier releases resolve config from the working directory, so nmr's root lint and lint:check would apply the root config to every package`;
@@ -8532,7 +8533,7 @@ var default_default = defineRdyKit({
             return `@williamthorsen/strict-lint >= ${MIN_STRICT_LINT_VERSION}`;
           },
           severity: "error",
-          skip: () => !hasDevDependency("@williamthorsen/strict-lint") ? "strict-lint not installed" : false,
+          skip: () => !hasDevDependency("@williamthorsen/strict-lint") && "strict-lint not installed",
           check: hasSupportedStrictLintVersion,
           get fix() {
             return `pnpm add --save-dev @williamthorsen/strict-lint@^${MIN_STRICT_LINT_VERSION}. Earlier releases pin ESLint to one config and resolve ceilings from the working directory, so nmr's root lint:strict would report the wrong rules for every package`;
@@ -8939,7 +8940,7 @@ function formatPaths(paths) {
 ${paths.map((path7) => `      ${path7}`).join("\n")}`;
 }
 function getMinVersion() {
-  const pickedFields = { "version": "0.46.2" };
+  const pickedFields = { "version": "0.48.0" };
   if (typeof pickedFields["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -9133,7 +9134,7 @@ function testSuiteGatesTestFileConventions(cwd = process.cwd()) {
 }
 function describeConventionsGuardSkip() {
   const guard = findConventionsGuard(process.cwd());
-  return guard === void 0 ? false : `reported by checkTestFileConventions in ${guard}`;
+  return guard !== void 0 && `reported by checkTestFileConventions in ${guard}`;
 }
 function findConventionsGuard(cwd) {
   return findTestFiles(cwd).find(
@@ -9170,7 +9171,7 @@ var NEVER_INSTALLED_PROGRAMS = /* @__PURE__ */ new Set(["corepack", "gh"]);
 var statusByCwd = /* @__PURE__ */ new Map();
 async function describeSelfHostedRunnerSkip(cwd = process.cwd(), readFacts) {
   const status = await getSelfHostedRunnerStatus(cwd, readFacts);
-  return "skip" in status ? status.skip : false;
+  return "skip" in status && status.skip;
 }
 function findSelfHostedRunnerFailures(facts, cwd) {
   const failures = [];

package/.readyup/manifest.json

@@ -19,6 +19,51 @@
         "wrap-ansi": "10.0.2",
         "yaml": "2.9.1"
       },
+      "checklistChecks": [
+        {
+          "checklist": "nmr",
+          "checks": [
+            "@williamthorsen/nmr in devDependencies",
+            "@williamthorsen/nmr >= 0.48.0",
+            "pnpm-workspace.yaml exists",
+            "catalogued dependencies use catalog:",
+            "package.json has packageManager field",
+            ".tool-versions does not list pnpm",
+            "no package.json declares a pnpm field",
+            "no package.json declares a workspaces field",
+            ".config/nmr.config.ts uses defineConfig",
+            "eslint >= 10.0.0",
+            "@williamthorsen/strict-lint >= 9.3.0",
+            "root package.json has no nmr-provided scripts",
+            "no root install script runs lefthook install unguarded",
+            "all workspace packages can build",
+            "every bin target is a committed wrapper",
+            "every bin wrapper's build-output target is covered by files",
+            "no retired Vitest config variants",
+            "every vitest.config builds on @williamthorsen/nmr/vitest",
+            "vitest.root.config.ts builds on @williamthorsen/nmr/vitest",
+            "every workspace with a Vite config has a Vitest config",
+            "the test suite gates the test-file conventions",
+            "every test file names its isolation tier",
+            "every test file is under a __tests__ directory",
+            "no package re-exports the ancestor Vitest config",
+            "Prettier config builds on @williamthorsen/nmr/prettier",
+            "taze.config.ts builds on @williamthorsen/nmr/taze",
+            "taze config declares no option taze discards",
+            "v11y-check in devDependencies",
+            "scripts/run-workspace-script.ts does not exist",
+            "no workspace packages reference run-workspace-script or \"pnpm run ws\""
+          ]
+        },
+        {
+          "checklist": "self-hosted runner",
+          "checks": [
+            "GitHub reports the repo's runner settings",
+            "CI_RUNS_ON selects the self-hosted runner",
+            "the self-hosted runner can run CI"
+          ]
+        }
+      ],
       "checklists": [
         "nmr",
         "self-hosted runner"
@@ -41,7 +86,7 @@
           "path": "../../nmr-core/dist/esm/hasErrnoCode.js"
         },
         {
-          "hash": "211453c6",
+          "hash": "98509862",
           "kind": "module",
           "path": "../../nmr-core/dist/esm/hashWorkingTree.js"
         },
@@ -56,7 +101,7 @@
           "path": "../../nmr-core/dist/esm/index.js"
         },
         {
-          "hash": "2507870d",
+          "hash": "89d3e3b4",
           "kind": "module",
           "path": "../../nmr-core/dist/esm/parseArgs.js"
         },
@@ -81,12 +126,12 @@
           "path": "../../nmr-core/dist/esm/writeFileWithCheck.js"
         },
         {
-          "hash": "aaeb1a84",
+          "hash": "ffa13ccc",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "43858381",
+          "hash": "47f25de7",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -119,7 +164,7 @@
           "path": "../src/helpers/escapeControlCharacters.ts"
         },
         {
-          "hash": "47249ca4",
+          "hash": "2d1cf397",
           "kind": "module",
           "path": "../src/helpers/findClosestName.ts"
         },
@@ -186,10 +231,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.40.0",
+      "readyupVersion": "0.41.0",
       "source": "kits/default.ts",
-      "sourceHash": "aaeb1a84",
-      "targetHash": "32ebc3f7"
+      "sourceHash": "ffa13ccc",
+      "targetHash": "6baed250"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.48.0 — 2026-10-17
+
+### 🎉 Features
+
+- Adds the `--delegate <host>` flag to `nmr`, which runs a command whose result is its exit status, such as `ci`, `check`, or a `test` command, on that host over SSH against the local working tree with its uncommitted and untracked files, and exits 255 when the delegation fails outside the command. (#1058)
+- Adds the `NMR_DELEGATE` environment variable, which names the host on which `nmr` runs every command that can be delegated, and the `--no-delegate` flag, which runs a command on the local machine whatever `NMR_DELEGATE` names. (#1058)
+- Adds the host to the verdict for a delegated command, as `passed on <host>` in the line and as a `host` field in the `--json` object. (#1058)
+
+### 📦 Dependencies
+
+- Upgrades `@williamthorsen/eslint-config-typescript` from 18.0.0 to 19.0.0 and rewrites the code in `build-info`, `nmr-core`, `nmr`, and `release-kit` that its new and widened rules report, without changing behavior. (#1047)
+- Upgrades `readyup` from 0.40.0 to 0.41.0 and recompiles the kits in `nmr`, `release-kit`, and `v11y-check`, whose manifests now record each checklist's check names under `checklistChecks`. (#1047)
+- Upgrades `pnpm` to 12.11.2, `@types/node` to 24.19.2, `lefthook` to 2.2.1, `@williamthorsen/strict-lint` to 14.2.0, `@williamthorsen/tsconfig` to 0.11.0, `smol-toml` to 1.9.1, and `vite` to 8.3.4. (#1047)
+
+## 0.47.0 — 2026-10-15
+
+### 🎉 Features
+
+- Sets `maxWorkers` on every project built by `defineVitestConfig` and `defineRootVitestConfig` to one worker per 4 GiB of total memory, bounded by one fewer than the core count, in place of Vitest's default of one fewer than the core count, which does not take memory into account; machines with 2 or fewer cores keep 3 workers. (#1044)
+- Applies the `--maxWorkers` (or `--max-workers`) flag to every project, which Vitest does not do itself, making the flag override both the derived count and a `maxWorkers` set through the `project` or `tiers` seam, while the `VITEST_MAX_WORKERS` environment variable still overrides the flag. (#1044)
+- Adds a machine lock that makes a heavy command (`check`, `ci`, and every `test` command except `test:watch`) wait, printing `nmr: waiting for …`, until the heavy command already running on the machine finishes; a nested command and a `-R` or `-F` fan-out take the lock once, and a cached pass does not wait. (#1045)
+- Adds the `--no-lock` flag and the `NMR_NO_LOCK=1` environment variable, which run a command and the commands nested in it without waiting for the machine lock, for example on a self-hosted CI machine that runs several runners in parallel. (#1045)
+- Extends the `nmr` rulebook to state that a run printing `nmr: waiting for …` is waiting for the machine lock rather than stuck, and that an agent must neither kill it nor rerun it with `--no-lock`. (#1045)
+
 ## 0.46.2 — 2026-10-14
 
 ### 🐛 Bug fixes

package/README.md

@@ -5,11 +5,13 @@
 Context-aware script runner for pnpm monorepos. Includes an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.46.2 (2026-10-14)
+## Release notes — v0.48.0 (2026-10-17)
 
-### 🐛 Bug fixes
+### 🎉 Features
 
-- Fixes the issue that `checkTestFileConventions` failed with a bare `TypeError` when `node_modules` contained a second `@vitest/runner` copy, and replaces that error with one that names the resolved `vitest` and gives `pnpm install --force` as the remedy. (#1041)
+- Adds the `--delegate <host>` flag to `nmr`, which runs a command whose result is its exit status, such as `ci`, `check`, or a `test` command, on that host over SSH against the local working tree with its uncommitted and untracked files, and exits 255 when the delegation fails outside the command. (#1058)
+- Adds the `NMR_DELEGATE` environment variable, which names the host on which `nmr` runs every command that can be delegated, and the `--no-delegate` flag, which runs a command on the local machine whatever `NMR_DELEGATE` names. (#1058)
+- Adds the host to the verdict for a delegated command, as `passed on <host>` in the line and as a `host` field in the `--json` object. (#1058)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -180,6 +182,28 @@ $ nmr ci
 
 [Check-result cache](docs/check-cache.md) covers what is cached, what a hit requires, replaying and reading a recorded run, and bypassing or configuring the cache.
 
+## Machine lock
+
+Tests and checks peak at several gigabytes, so nmr runs one heavy command at a time on a machine. A second `check`, `ci`, or `test` from any repository waits for the first rather than competing with it for memory:
+
+```console
+$ nmr check
+nmr: waiting for test in /Users/me/repos/other-repo (pid 41872) to finish
+```
+
+The lock lives in `/tmp/nmr-<uid>/`, or in `NMR_LOCK_DIR`; a sandboxed session needs write access to it. `nmr --no-lock <command>` or `NMR_NO_LOCK=1` runs without waiting. [Machine lock](docs/machine-lock.md) covers which commands take it, nesting and fan-outs, reclaiming a lock that its holder left behind, and CI.
+
+## Delegating to another machine
+
+`nmr --delegate <host> <command>` runs the command on another machine over SSH, against this working tree, and exits with its status. `NMR_DELEGATE=<host>` makes that the default:
+
+```console
+$ nmr --delegate imac2 ci
+✅ my-repo: ci: passed on imac2 in 1m 48s
+```
+
+[Delegating to another machine](docs/delegate.md) covers which commands can be delegated, what the host runs, how failures are reported, and setting up the host.
+
 ## Shared configs and helpers
 
 ### Shared Vitest config
@@ -283,6 +307,8 @@ rdy list --from npm:@williamthorsen/nmr  # what nmr publishes
 - [Scripts and configuration](docs/scripts.md): Override tiers, script values, hooks, `defineConfig` fields, `devBin`, and the default commands
 - [What nmr reports](docs/reporting.md): Verdicts, `--json`, output style, and verbosity
 - [Check-result cache](docs/check-cache.md): What is skipped, what a hit requires, and replaying, reading, and bypassing recorded runs
+- [Machine lock](docs/machine-lock.md): Which commands wait for one another, where the lock lives, and bypassing it
+- [Delegating to another machine](docs/delegate.md): `--delegate`, `NMR_DELEGATE`, what the host runs, and setting it up
 - [Dependency upgrades](docs/upgrades.md): `nmr upgrade`, the upgrade policy, `report-catalog`, `report-overrides`, and `nmr-taze`
 - [Standalone utilities](docs/utilities.md): `nmr-clean`, `nmr-compile`, `nmr-fmt`, and `ensure-prepublish-hooks`
 - [Shared Vitest config](docs/vitest.md): Test tiers, test selections, the conventions check, and customization

package/agents/guidance/rulebooks/nmr.md

@@ -14,4 +14,6 @@ delivery: ambient
 - `nmr --log <command>` prints the whole run behind that excerpt -- up to 256 KiB, led by when it was recorded, how long it ran, and the command string that produced it. Output that you need in full is a recording to read rather than a command to run again. It runs nothing, and it is held to the tree rather than to the terminal: A recording made by a piped run prints for a reader at one. A composite prints its constituents' excerpts, not their transcripts, so the transcript of one of them is `nmr -F <pkg> --log <command>` or that constituent's own name. When there is nothing to show, `--log` says so on one line, names which case it is, and exits non-zero.
 - Every command that nmr runs reports one line -- `PASS <scope>: <command>: passed in 12.4s`, `FAIL … failed in 1.2s (exit 1)`, `SKIP … passed 4m ago on this tree`, or `NOOP … skipped, the override is empty` -- and a composite reports alongside every command into which it expands. Those are the words that a pipe and a CI log get; a terminal gets ✅, ❌, ⏩, and ⚪ in their place, and `--output-style rich` or `NMR_OUTPUT_STYLE=rich` forces the emoji on any stream. The lines print in every verbosity, so `nmr -q <command>` is the low-noise way to run rather than a silent one: It withholds the output of the commands that nmr runs and keeps nmr's own verdicts, which is how a pass, a cached skip, and a `""`/`":"` override stay distinguishable. nmr reads its own flags only before the command name and passes everything after the name to the commands that run: `nmr ci -q` hands `-q` to `nmr-fmt`, which rejects it. Expect a run to be quiet already without the flag: nmr recognizes a known agent harness in the environment and takes quiet from that, as it does from `NMR_COMMAND_VERBOSITY` or the repo's `output.commandVerbosity`. A command whose output you need in full is one to run with `NMR_COMMAND_VERBOSITY=full`, which outranks both.
 - Every test file lives under a `__tests__` directory and names its isolation tier last: `<subject>[.<aspect>].<tier>.test.ts`, where any earlier segment is free-form documentation. A tier is the furthest thing that the test reaches -- `tool` (a process that the test starts, or a program other than the package's own code that the test makes do its work, including an embedded engine, which the package installs and the test runs in-process, such as PGlite), `localhost` (a service already running on this machine), `remote` (a machine that isn't this one), or `unit`, the residual claiming everything else. A file outside `__tests__`, or one whose tier segment is missing or misspelt, fails the test run in a repo that declares nmr's exported conventions check, which reports both. In a repo that has not, neither fails anything -- the first is collected by nothing and the second runs under `unit` -- and `rdy run --sources` reports both and warns that the check is missing.
-- The rest is in `node_modules/@williamthorsen/nmr/docs/`: `scripts.md` for pre/post hooks (every `nmr X` auto-wraps as `nmr X:pre && nmr X && nmr X:post`) and script overrides and their `""`/`":"` skip values; `upgrades.md` for `nmr upgrade` ceilings (report-only until `nmr upgrade --write`); `utilities.md` for the `nmr-compile` build (the repo does not define a build script of its own); `vitest.md` for the test tiers' timeout budgets, the `tiers` seam that raises one, and which script reaches which tier; and `check-cache.md` for the check-result cache's key, the retention key to which a replayed excerpt is additionally held, the retention ceiling within which `--log` prints, its `checkCache` config, and every condition that disables it.
+- A heavy command (`check`, `ci`, and the `test` commands but `test:watch`) may print `nmr: waiting for <command> in <dir> (pid <pid>) to finish` and wait: nmr runs one at a time on the machine, across every repository. The run is not stuck, and it continues once the holder ends. Do not kill it, and do not rerun it with `--no-lock` to get past the wait, which defeats the memory protection that the lock exists for. A warning that nmr is `running without the machine lock` names a directory that the sandbox cannot write.
+- A verdict reading `passed on <host>` or `failed on <host>` reports a command that ran on another machine, because `--delegate` or `NMR_DELEGATE` sent it there; the output above it is the host's. Exit 255 with `could not prepare <host>` inside a sandbox means that the sandbox refused `ssh`: Ask for network access to the host rather than treating the host as broken, or run the command here with `nmr --no-delegate <command>`.
+- The rest is in `node_modules/@williamthorsen/nmr/docs/`: `scripts.md` for pre/post hooks (every `nmr X` auto-wraps as `nmr X:pre && nmr X && nmr X:post`) and script overrides and their `""`/`":"` skip values; `upgrades.md` for `nmr upgrade` ceilings (report-only until `nmr upgrade --write`); `utilities.md` for the `nmr-compile` build (the repo does not define a build script of its own); `vitest.md` for the test tiers' timeout budgets, the `tiers` seam that raises one, and which script reaches which tier; `machine-lock.md` for which commands take the machine lock, where it lives, and its bypass; `delegate.md` for which commands `--delegate` runs on another machine, what the host runs, and its setup; and `check-cache.md` for the check-result cache's key, the retention key to which a replayed excerpt is additionally held, the retention ceiling within which `--log` prints, its `checkCache` config, and every condition that disables it.

package/dist/esm/bin-path.js

@@ -9,10 +9,11 @@ export function prependBinDirs(options) {
     const additions = [];
     for (const dir of [anchorDir, monorepoRoot]) {
         const binDir = path.resolve(dir, 'node_modules', '.bin');
-        if (!seen.has(binDir)) {
-            seen.add(binDir);
-            additions.push(binDir);
+        if (seen.has(binDir)) {
+            continue;
         }
+        seen.add(binDir);
+        additions.push(binDir);
     }
     if (additions.length === 0) {
         return env;

package/dist/esm/commands/fmt.js

@@ -126,7 +126,7 @@ export function resolveFormatTargets(cwd, pathspecs = []) {
 function classifyListedFile(cwd, file) {
     try {
         const stats = lstatSync(path.resolve(cwd, file), { throwIfNoEntry: false });
-        return stats?.isFile() === true ? { kind: 'formattable' } : { kind: 'excluded' };
+        return { kind: stats?.isFile() === true ? 'formattable' : 'excluded' };
     }
     catch (error) {
         const code = UNREADABLE_CODES.find((candidate) => hasErrnoCode(error, candidate));

package/dist/esm/help.js

@@ -1,5 +1,6 @@
 import { isHookName } from "./helpers/hook-name.js";
 import { OUTPUT_STYLE_ENV_VAR, OUTPUT_STYLE_FLAG } from "./output-style.js";
+import { DELEGATE_ENV_VAR } from "./remote-run.js";
 import { buildRootRegistry, buildWorkspaceRegistry, describeScript, isSelfReferential, readPackageJsonScripts, } from "./resolver.js";
 const LIFECYCLE_SCRIPT_NAMES = new Set([
     'dependencies',
@@ -32,14 +33,18 @@ export function generateHelp(config, monorepoRoot, packageDir, shouldUseRoot) {
         '  -R, --recursive             Run command in all packages',
         '  -w, --workspace-root        Use root scripts, running at the monorepo root',
         "  -q, --quiet                 Suppress command output, keeping nmr's verdicts",
+        '      --delegate <host>       Run on <host> over SSH, against this working tree',
         '      --json                  Report one JSON object per command, withholding command output',
         '      --log                   Print the recorded run instead of running (up to 256 KiB)',
         '      --no-cache              Run even if this tree already passed; record the result',
+        '      --no-delegate           Run here, even when NMR_DELEGATE names a host',
+        '      --no-lock               Run without waiting for another heavy command on this machine',
         `      ${OUTPUT_STYLE_FLAG} <style>  Output style: auto (default), plain, or rich`,
         '  -?, --help                  Show this help',
         '  -V, --version               Show version number',
         '',
         'Environment:',
+        `  ${DELEGATE_ENV_VAR}                Host on which to run each command that can be delegated`,
         `  ${OUTPUT_STYLE_ENV_VAR}            Output style: auto (default), plain, or rich. auto prints`,
         '                              plain, without emoji, when CI is set or the stream is not a terminal.',
         '',

package/dist/esm/helpers/findClosestName.js

@@ -4,10 +4,11 @@ export function findClosestName(name, candidates) {
     let shortestDistance = Infinity;
     for (const candidate of candidates) {
         const distance = measureDistance(name, candidate);
-        if (distance < shortestDistance) {
-            shortestDistance = distance;
-            closestName = candidate;
+        if (distance >= shortestDistance) {
+            continue;
         }
+        shortestDistance = distance;
+        closestName = candidate;
     }
     return shortestDistance <= ceiling ? closestName : undefined;
 }

package/dist/esm/helpers/quoteForShell.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Shell-escapes a single argument by wrapping in single quotes
+ * and escaping any embedded single quotes.
+ */
+export declare function quoteForShell(arg: string): string;

package/dist/esm/helpers/quoteForShell.js

@@ -0,0 +1,3 @@
+export function quoteForShell(arg) {
+    return "'" + arg.replace(/'/g, String.raw `'\''`) + "'";
+}

package/dist/esm/machine-lock.d.ts

@@ -0,0 +1,64 @@
+import type { Writable } from 'node:stream';
+import { type OutputStyle } from '@williamthorsen/nmr-core';
+/** How often a holder refreshes the lock file's mtime. */
+export declare const HEARTBEAT_INTERVAL_MS = 10000;
+/**
+ * The commands that take the machine lock: the ones whose memory peak makes two concurrent runs slower than two in
+ * sequence. `test:watch` is absent because it runs until it is stopped, and holding the lock would block every other
+ * run for as long.
+ */
+export declare const HEAVY_COMMANDS: ReadonlySet<string>;
+/** Overrides the directory that contains the lock file. */
+export declare const LOCK_DIR_ENV_VAR = "NMR_LOCK_DIR";
+/** Passes the holder's token to the processes below it, which run under its hold rather than waiting on it. */
+export declare const LOCK_TOKEN_ENV_VAR = "NMR_MACHINE_LOCK_TOKEN";
+/** Set to `1` to run without the lock, for the whole chain. */
+export declare const NO_LOCK_ENV_VAR = "NMR_NO_LOCK";
+/** How often a waiter checks the lock again. */
+export declare const POLL_INTERVAL_MS = 1000;
+/**
+ * Age at which an unrefreshed lock file is abandoned. It covers a holder whose pid was reused by another process,
+ * and a file left half-written, neither of which a liveness check detects.
+ */
+export declare const STALE_AFTER_MS = 60000;
+/** A taken lock, or the hold-free stand-in for a run that does not take one. */
+export interface MachineLock {
+    /**
+     * Whether the chain runs without the lock: the bypass is set, or the lock directory cannot be written. The processes
+     * below then skip the lock rather than each trying it again and repeating the warning.
+     */
+    isChainUnlocked: boolean;
+    release: () => Promise<void>;
+    /** The token in the lock file, when this call took the lock. */
+    token: string | undefined;
+    /** Whether the call waited for another holder before returning. */
+    waited: boolean;
+}
+/**
+ * Takes the machine lock, waiting while another process holds it. Resolves to a hold-free lock without waiting when
+ * the bypass is set, when this process runs under an ancestor's hold, or when the lock directory cannot be written.
+ */
+export declare function acquireMachineLock(options: {
+    command: string;
+    dir: string;
+    env: NodeJS.ProcessEnv;
+    stderr: Writable;
+    heartbeatIntervalMs?: number;
+    lockDir?: string;
+    pollIntervalMs?: number;
+    staleAfterMs?: number;
+}): Promise<MachineLock>;
+/**
+ * Renders the warning for a `--no-lock` that appears after the command name, which makes it an argument to the
+ * command rather than a flag to nmr.
+ */
+export declare function formatMisplacedNoLockWarning(command: string, style: OutputStyle): string;
+/**
+ * Returns the directory that contains the lock file: one per user under `/tmp`, which a sandboxed session and a
+ * terminal resolve alike, where `TMPDIR` does not. Windows does not have `/tmp` or a uid.
+ */
+export declare function resolveLockDir(options: {
+    env: NodeJS.ProcessEnv;
+    platform: NodeJS.Platform;
+    uid: number | undefined;
+}): string;