ttsc 0.31.0 → 0.31.1

package/src/plugin/internal/load/loadProjectPlugins.ts

@@ -23,12 +23,12 @@ import { pluginDescriptorFailureReason } from "../pluginDescriptorFailureReason"
 import { pluginDescriptorProcessFailure } from "../pluginDescriptorProcessFailure";
 import { NativeSourcePackages } from "../source/NativeSourcePackages";
 import { SourcePluginWorkspace } from "../source/SourcePluginWorkspace";
-import { resolvePluginGoModule } from "../source/resolvePluginGoModule";
 import { buildSourcePlugin } from "../source/buildSourcePlugin";
 import { isPathWithin } from "../source/isPathWithin";
 import { pluginBuildVersions } from "../source/pluginBuildVersions";
 import { pluginModuleReplaceDirectories } from "../source/pluginModuleReplaceDirectories";
 import { pluginSourceState } from "../source/pluginSourceState";
+import { resolvePluginGoModule } from "../source/resolvePluginGoModule";
 import { COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE } from "./COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE";
 import { PLUGIN_DESCRIPTOR_SHIM_SOURCE } from "./PLUGIN_DESCRIPTOR_SHIM_SOURCE";
 import { PluginDescriptorAdmission } from "./PluginDescriptorAdmission";
@@ -61,19 +61,18 @@ import { visitImportMappedCandidates } from "./visitImportMappedCandidates";
  * under generic host manifests while preserving source-relative input layout.
  * Main proposals must agree in their full owning module; linked proposals must
  * agree inside every selected transform host. Errors or disagreement terminate
- * the load rather than changing the proposed kind.
- * Watch callers first receive structurally selected source/module/contributor
- * repair interests, before metadata can reject them. Valid records then narrow
- * those interests to the exact build directories; interests alone never admit
- * a plugin, certify a kind or supply reusable source-state proof.
- * Returns the ordered native plugins, parsed project config, recorded
- * JavaScript-host inputs and unresolved selection candidates, and the keyed
- * state of reported Go source directories supplied to the builds
- * (`pluginSources`): each plugin's module root and each contributor's source,
- * with its state (`pluginSourceState`), the sources as the build read them
- * together with the environment a build there is keyed on. Directories within
- * ttsc's installed package, including its overlays and the fallback
- * linked-plugin host, are keyed but omitted from this report under the
+ * the load rather than changing the proposed kind. Watch callers first receive
+ * structurally selected source/module/contributor repair interests, before
+ * metadata can reject them. Valid records then narrow those interests to the
+ * exact build directories; interests alone never admit a plugin, certify a kind
+ * or supply reusable source-state proof. Returns the ordered native plugins,
+ * parsed project config, recorded JavaScript-host inputs and unresolved
+ * selection candidates, and the keyed state of reported Go source directories
+ * supplied to the builds (`pluginSources`): each plugin's module root and each
+ * contributor's source, with its state (`pluginSourceState`), the sources as
+ * the build read them together with the environment a build there is keyed on.
+ * Directories within ttsc's installed package, including its overlays and the
+ * fallback linked-plugin host, are keyed but omitted from this report under the
  * installed-package/version ownership policy. That policy does not prove the
  * installation cannot be edited in place. Descriptor completeness relies on the
  * runtime recorder's status and the descriptor's explicit external-read
@@ -329,30 +328,41 @@ export function loadProjectPlugins(options: {
   const { ttsc: ttscVersion, tsgo: tsgoVersion } = pluginBuildVersions(
     context.projectRoot,
   );
-  const candidates = plugins.map((plugin, index) => {
-    const stage = PluginDescriptorAdmission.stage(plugin);
-    validatePluginSource(plugin);
-    const contributors = validatePluginContributors(plugin);
-    const source = resolvePluginSource(plugin.source, context.projectRoot);
-    const label = pluginLabel(plugin, entries[index]!.config, index);
-    requirePluginSource(source, label);
-    return { plugin, index, stage, contributors, source, label };
-  }).map((candidate) => ({
-    ...candidate,
-    ...resolvePluginGoModule(candidate.source, candidate.label),
-  }));
-  const watchReplacements = options.onWatchInputs === undefined
-    ? undefined
-    : new Map<string, readonly string[]>();
+  const candidates = plugins
+    .map((plugin, index) => {
+      const stage = PluginDescriptorAdmission.stage(plugin);
+      validatePluginSource(plugin);
+      const contributors = validatePluginContributors(plugin);
+      const source = resolvePluginSource(plugin.source, context.projectRoot);
+      const label = pluginLabel(plugin, entries[index]!.config, index);
+      requirePluginSource(source, label);
+      return { plugin, index, stage, contributors, source, label };
+    })
+    .map((candidate) => ({
+      ...candidate,
+      ...resolvePluginGoModule(candidate.source, candidate.label),
+    }));
+  // One fixed-effective-environment load owns manifest syntax sharing from the
+  // first watch query through metadata and builds. Do not allocate this after
+  // watch projection: that silently repeats selected-Go work (#1712).
+  const packageReaders = new Map<string, SourcePluginWorkspace.GoModReader>();
+  const watchReplacements =
+    options.onWatchInputs === undefined
+      ? undefined
+      : new Map<string, readonly string[]>();
   if (options.onWatchInputs !== undefined) {
     // The prospective context reads the admitted module layout and anchors its
     // tool there before kind exists. Keep both possible final-root baselines:
     // a linked package keeps packageDir, and an executable keeps moduleRoot.
-    const interests = new Set(candidates.flatMap((candidate) => [
-      candidate.moduleRoot,
-      candidate.packageDir,
-      ...(candidate.contributors ?? []).map((input) => input.source),
-    ]).filter(reportsPluginSource));
+    const interests = new Set(
+      candidates
+        .flatMap((candidate) => [
+          candidate.moduleRoot,
+          candidate.packageDir,
+          ...(candidate.contributors ?? []).map((input) => input.source),
+        ])
+        .filter(reportsPluginSource),
+    );
     options.onWatchInputs([...interests].sort());
     const initialSize = interests.size;
     for (const candidate of candidates) {
@@ -360,77 +370,102 @@ export function loadProjectPlugins(options: {
       // activate their irrelevant module graph just to discover watch inputs.
       if (candidate.stage === "transform" && candidate.entry !== ".") continue;
       for (const directory of pluginReplacementWatchDirectories(
-        candidate.moduleRoot, effectiveEnv, watchReplacements,
-      )) if (reportsPluginSource(directory)) interests.add(directory);
+        candidate.moduleRoot,
+        effectiveEnv,
+        watchReplacements,
+        packageReaders,
+      ))
+        if (reportsPluginSource(directory)) interests.add(directory);
     }
     if (interests.size !== initialSize)
       options.onWatchInputs([...interests].sort());
   }
-  const packageReaders = new Map<string, SourcePluginWorkspace.GoModReader>();
   const proposals = NativeSourcePackages.propose(
     candidates.map((candidate) => ({
-      ...candidate, ownModule: candidate.stage !== "transform",
-    })), effectiveEnv, packageReaders,
+      ...candidate,
+      ownModule: candidate.stage !== "transform",
+    })),
+    effectiveEnv,
+    packageReaders,
   );
-  const records = candidates.map(({ plugin, index, stage, contributors, source, packageDir }) => {
-    const { kind, moduleRoot } = resolveNativeSource(source, plugin, entries[index]!.config, index, {
-      env: effectiveEnv, observation: proposals[index]!.observation,
-    });
-    if (kind === "linked" && stage !== "transform") {
-      throw new Error(
-        `ttsc: plugin "${pluginLabel(plugin, entries[index]!.config, index)}" source is a linked Go package, but only transform-stage plugins can be linked into a compiler host`,
+  const records = candidates.map(
+    ({ plugin, index, stage, contributors, source, packageDir }) => {
+      const { kind, moduleRoot } = resolveNativeSource(
+        source,
+        plugin,
+        entries[index]!.config,
+        index,
+        {
+          env: effectiveEnv,
+          observation: proposals[index]!.observation,
+        },
       );
-    }
-    const linkedContributorName =
-      kind === "linked"
-        ? `linked_${String(index).padStart(6, "0")}`
-        : undefined;
-    const hostInputs = validatePluginHostInputs(plugin, index);
-    const pluginHostInputHashes = validatePluginHostInputHashes(
-      plugin,
-      index,
-      hostInputs,
-    );
-    const pluginHostInputRealpaths = validatePluginHostInputRealpaths(
-      plugin,
-      index,
-      hostInputs,
-    );
-    return {
-      capabilities: plugin.capabilities,
-      contributors,
-      config: entries[index]!.config,
-      kind,
-      label: pluginLabel(plugin, entries[index]!.config, index),
-      linkedContributorName,
-      name: plugin.name,
-      reportsTypeScriptDiagnostics:
-        plugin.reportsTypeScriptDiagnostics === true,
-      request: loadedEntries[index]!.request,
-      hostInputHashes: mergePluginHostInputHashes(
-        loadedEntries[index]!.hostInputHashes,
-        pluginHostInputHashes,
-        loadedEntries[index]!.hostInputs,
+      if (kind === "linked" && stage !== "transform") {
+        throw new Error(
+          `ttsc: plugin "${pluginLabel(plugin, entries[index]!.config, index)}" source is a linked Go package, but only transform-stage plugins can be linked into a compiler host`,
+        );
+      }
+      const linkedContributorName =
+        kind === "linked"
+          ? `linked_${String(index).padStart(6, "0")}`
+          : undefined;
+      const hostInputs = validatePluginHostInputs(plugin, index);
+      const pluginHostInputHashes = validatePluginHostInputHashes(
+        plugin,
+        index,
         hostInputs,
-      ),
-      hostInputRealpaths: mergePluginHostInputHashes(
-        loadedEntries[index]!.hostInputRealpaths,
-        pluginHostInputRealpaths,
-        loadedEntries[index]!.hostInputs,
+      );
+      const pluginHostInputRealpaths = validatePluginHostInputRealpaths(
+        plugin,
+        index,
         hostInputs,
-      ),
-      hostInputs: [...loadedEntries[index]!.hostInputs, ...hostInputs],
-      moduleRoot,
-      packageDir,
-      source,
-      stage,
-    };
-  });
-  const executableCandidates = candidates.filter((candidate) =>
-    records[candidate.index]!.kind === "executable" && !proposals[candidate.index]!.ownModule);
+      );
+      return {
+        capabilities: plugin.capabilities,
+        contributors,
+        config: entries[index]!.config,
+        kind,
+        label: pluginLabel(plugin, entries[index]!.config, index),
+        linkedContributorName,
+        name: plugin.name,
+        reportsTypeScriptDiagnostics:
+          plugin.reportsTypeScriptDiagnostics === true,
+        request: loadedEntries[index]!.request,
+        hostInputHashes: mergePluginHostInputHashes(
+          loadedEntries[index]!.hostInputHashes,
+          pluginHostInputHashes,
+          loadedEntries[index]!.hostInputs,
+          hostInputs,
+        ),
+        hostInputRealpaths: mergePluginHostInputHashes(
+          loadedEntries[index]!.hostInputRealpaths,
+          pluginHostInputRealpaths,
+          loadedEntries[index]!.hostInputs,
+          hostInputs,
+        ),
+        hostInputs: [...loadedEntries[index]!.hostInputs, ...hostInputs],
+        moduleRoot,
+        packageDir,
+        source,
+        stage,
+      };
+    },
+  );
+  const executableCandidates = candidates.filter(
+    (candidate) =>
+      records[candidate.index]!.kind === "executable" &&
+      !proposals[candidate.index]!.ownModule,
+  );
   // Admission can now narrow the provisional interests without restamping the
   // retained package/module baselines. Final host errors still keep these roots.
-  options.onWatchInputs?.(pluginBuildDirectories(records, effectiveEnv, watchReplacements));
+  options.onWatchInputs?.(
+    pluginBuildDirectories(
+      records,
+      effectiveEnv,
+      watchReplacements,
+      packageReaders,
+    ),
+  );
   const linkedContributors = records
     .filter((record) => record.stage === "transform")
     .flatMap((record) =>
@@ -448,59 +483,96 @@ export function loadProjectPlugins(options: {
   // a second executable host can select a genuinely different Go context.
   const admittedExecutables = new Set<string>();
   if (linkedContributors.length !== 0) {
-    const hosts = transformHosts.length === 0
-      ? [{ source: path.join(ttscPackageRoot(), "cmd", "utility-host"), label: "linked-plugin-host" }]
-      : transformHosts;
-    const contexts = new Map<string, { source: string; label: string; records: typeof transformHosts }>();
+    const hosts =
+      transformHosts.length === 0
+        ? [
+            {
+              source: path.join(ttscPackageRoot(), "cmd", "utility-host"),
+              label: "linked-plugin-host",
+            },
+          ]
+        : transformHosts;
+    const contexts = new Map<
+      string,
+      { source: string; label: string; records: typeof transformHosts }
+    >();
     for (const host of hosts) {
-      const moduleRoot = resolvePluginGoModule(host.source, host.label).moduleRoot;
+      const moduleRoot = resolvePluginGoModule(
+        host.source,
+        host.label,
+      ).moduleRoot;
       let context = contexts.get(moduleRoot);
       if (context === undefined) {
         context = { source: host.source, label: host.label, records: [] };
         contexts.set(moduleRoot, context);
       }
     }
-    for (const record of transformHosts) contexts.get(record.moduleRoot)!.records.push(record);
+    for (const record of transformHosts)
+      contexts.get(record.moduleRoot)!.records.push(record);
     for (const host of contexts.values()) {
       const moduleHosts = host.records;
       const hostEntries = moduleHosts.map((record) => ({
         entry: resolvePluginGoModule(record.source, record.label).entry,
       }));
       const observations = NativeSourcePackages.inspect({
-        source: host.source, pluginName: host.label, env: effectiveEnv,
+        source: host.source,
+        pluginName: host.label,
+        env: effectiveEnv,
         readers: packageReaders,
         packages: [
           ...hostEntries,
           ...linkedContributors.map((input) => ({
-            ...input, entry: `./contrib/${input.name}`,
+            ...input,
+            entry: `./contrib/${input.name}`,
           })),
         ],
       });
       moduleHosts.forEach((record, index) => {
-        NativeSourcePackages.kind(observations[index]!, record.label, "executable");
+        NativeSourcePackages.kind(
+          observations[index]!,
+          record.label,
+          "executable",
+        );
         admittedExecutables.add(record.source);
       });
       linkedContributors.forEach((input, index) => {
-        NativeSourcePackages.kind(observations[hostEntries.length + index]!, `${input.name} inside host ${host.label}`, "linked");
+        NativeSourcePackages.kind(
+          observations[hostEntries.length + index]!,
+          `${input.name} inside host ${host.label}`,
+          "linked",
+        );
       });
     }
   }
   // A nested main proposal still needs its actual owning manifests. Hosts
   // with linked contributors were admitted together above; other equivalent
   // entries share one standalone observation, with no repeated host copy.
-  const standaloneCandidates = executableCandidates.filter((candidate) =>
-    !admittedExecutables.has(candidate.source));
+  const standaloneCandidates = executableCandidates.filter(
+    (candidate) => !admittedExecutables.has(candidate.source),
+  );
   const executablePackages = NativeSourcePackages.ownPackages(
-    standaloneCandidates, effectiveEnv, packageReaders,
+    standaloneCandidates,
+    effectiveEnv,
+    packageReaders,
   );
   standaloneCandidates.forEach((candidate, index) => {
-    NativeSourcePackages.kind(executablePackages[index]!, candidate.label, "executable");
+    NativeSourcePackages.kind(
+      executablePackages[index]!,
+      candidate.label,
+      "executable",
+    );
   });
   const packageOwnership = (source: string, label: string, linked: boolean) => [
-    { entry: resolvePluginGoModule(source, label).entry, kind: "executable" as const },
-    ...(linked ? linkedContributors.map((input) => ({
-      entry: `./contrib/${input.name}`, kind: "linked" as const,
-    })) : []),
+    {
+      entry: resolvePluginGoModule(source, label).entry,
+      kind: "executable" as const,
+    },
+    ...(linked
+      ? linkedContributors.map((input) => ({
+          entry: `./contrib/${input.name}`,
+          kind: "linked" as const,
+        }))
+      : []),
   ];
   // One reading of each source directory, shared by every build below and
   // reported as the state the binaries were keyed on.
@@ -517,6 +589,7 @@ export function loadProjectPlugins(options: {
         cacheDir: options.cacheDir,
         contributors: mergeContributors(record.contributors, hostContributors),
         env: effectiveEnv,
+        goModReaders: packageReaders,
         pluginName: record.label,
         packageOwnership: packageOwnership(record.source, record.label, true),
         source: record.source,
@@ -534,11 +607,14 @@ export function loadProjectPlugins(options: {
           cacheDir: options.cacheDir,
           contributors: linkedContributors,
           env: effectiveEnv,
+          goModReaders: packageReaders,
           label: "linked plugin host",
           pluginName: "linked-plugin-host",
           source: path.join(ttscPackageRoot(), "cmd", "utility-host"),
           packageOwnership: packageOwnership(
-            path.join(ttscPackageRoot(), "cmd", "utility-host"), "linked-plugin-host", true,
+            path.join(ttscPackageRoot(), "cmd", "utility-host"),
+            "linked-plugin-host",
+            true,
           ),
           environmentDigests,
           sourceDigests,
@@ -561,8 +637,13 @@ export function loadProjectPlugins(options: {
               cacheDir: options.cacheDir,
               contributors: record.contributors,
               env: effectiveEnv,
+              goModReaders: packageReaders,
               pluginName: record.label,
-              packageOwnership: packageOwnership(record.source, record.label, false),
+              packageOwnership: packageOwnership(
+                record.source,
+                record.label,
+                false,
+              ),
               source: record.source,
               environmentDigests,
               sourceDigests,
@@ -2136,6 +2217,7 @@ function pluginBuildDirectories(
   }[],
   env: NodeJS.ProcessEnv,
   replacements?: Map<string, readonly string[]>,
+  readers?: Map<string, SourcePluginWorkspace.GoModReader>,
 ): string[] {
   const directories = new Set<string>();
   for (const record of records) {
@@ -2146,8 +2228,12 @@ function pluginBuildDirectories(
     );
     if (record.kind === "executable") {
       for (const directory of pluginReplacementWatchDirectories(
-        record.moduleRoot, env, replacements,
-      )) directories.add(directory);
+        record.moduleRoot,
+        env,
+        replacements,
+        readers,
+      ))
+        directories.add(directory);
     }
     for (const contributor of record.contributors ?? [])
       directories.add(path.resolve(contributor.source));
@@ -2164,13 +2250,19 @@ function pluginReplacementWatchDirectories(
   moduleRoot: string,
   env: NodeJS.ProcessEnv,
   observed?: Map<string, readonly string[]>,
+  readers?: Map<string, SourcePluginWorkspace.GoModReader>,
 ): readonly string[] {
   const previous = observed?.get(moduleRoot);
   if (previous !== undefined) return previous;
   let directories: readonly string[];
   try {
-    directories = pluginModuleReplaceDirectories(moduleRoot, env)
-      .map((replacement) => replacement.directory);
+    directories = pluginModuleReplaceDirectories(
+      moduleRoot,
+      env,
+      undefined,
+      undefined,
+      readers,
+    ).map((replacement) => replacement.directory);
   } catch {
     // An unreadable manifest/tool is not valid metadata. The already observed
     // module retains its repair path; actual proposal/build refusal propagates.

package/src/plugin/internal/source/GoEnvironmentReading.ts

@@ -0,0 +1,109 @@
+import crypto from "node:crypto";
+
+import { GoSourceInputs } from "./GoSourceInputs";
+import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { spawnGoTool } from "./spawnGoTool";
+
+/**
+ * Acquire current Go values together with their environment-file evidence.
+ * Build digests and syntax readers share this owner; a file-location hint is
+ * never a retained positive environment verdict (#1516, #1712).
+ *
+ * @evidence contracts/common.md#principled-implementation The acquisition pairs actual Go output with native pre-read file evidence; callers retain their own completeness and reuse policy.
+ * @evidence contracts/common.md#clear-and-simple-design One namespace owns environment-file discovery and native acquisition for build and manifest clients.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No handwritten default GOENV path or process-permanent environment success replaces native Go.
+ * @evidence contracts/common.md#meaningful-documentation Prose distinguishes observation from a discovery hint and identifies both consumers.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation The read member owns native observation and execution.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms The read member owns acquisition and identity costs.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work The read member owns hint sharing; no result cache is exposed.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read member describes the private hint map and delegated native lifetime.
+ */
+export namespace GoEnvironmentReading {
+  /**
+   * The Go environment file each Go tool and environment was last seen to name,
+   * which lets a reading witness that file before `go env` reads it.
+   */
+  const goEnvironmentFiles = new Map<string, string | null>();
+
+  /**
+   * Run `go env -json` for the requested keys and `GOENV`, the file `go env -w`
+   * writes, witnessing that file before the run reads it.
+   *
+   * The file decides the reading without being part of it, so only its metadata
+   * is kept, and it must be taken before the read: metadata taken after would
+   * describe an edit that landed between the two, and a reading of the old
+   * content would pass as proven. Which file `go env` reads is known only from
+   * its answer, so the file this Go tool and environment named last is
+   * witnessed first, and a reading that names another is taken again with that
+   * one witnessed. A file that keeps moving between runs leaves the reading
+   * unwitnessable, so a kept reading or a build keyed on it never holds.
+   *
+   * @returns The parsed object, or `undefined` when native acquisition or JSON
+   *   object decoding failed.
+   * @evidence contracts/common.md#principled-implementation Actual Go supplies values and the environment-file path; pre-read metadata and bounded rediscovery preserve the earliest file witness instead of attaching a later state to an earlier read.
+   * @evidence contracts/common.md#clear-and-simple-design One acquisition serves build hashing and manifest syntax qualification; callers choose keys and own interpretation and cache admission.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts A remembered file name is only a discovery hint. Every call executes Go, and unresolved movement marks its witness unproven rather than lending a historical positive verdict.
+   * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain why file discovery can repeat and distinguish unavailable acquisition from current authority.
+   * @evidence contracts/portability.md#os-neutral-implementation Go reports its actual environment-file location; native path metadata and the existing Go process owner supply observation and execution semantics.
+   * @evidence contracts/performance.md#efficient-algorithms Hashing the complete tool/environment identity and up to three native Go queries process full name/value/output bytes. Requested keys contribute argument bytes; file discovery uses metadata rather than an SDK walk.
+   * @evidence contracts/performance.md#reuse-equivalent-work Only file-location discovery hints are shared across equal selected-tool/environment identities. Current Go values and file authority are reacquired for every call.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The module retains one file-location hint per historical tool/environment identity, without eviction, but no positive reading or native handle. Command capture/retirement belongs to spawnGoTool and the caller owns the transferred witness.
+   */
+  export function read(
+    goBinary: string,
+    cwd: string,
+    env: NodeJS.ProcessEnv,
+    keys: readonly string[],
+    witness: PluginBuildEnvironmentWitness.Record | undefined,
+  ): Record<string, unknown> | undefined {
+    const memo = crypto.createHash("sha256").update(goBinary);
+    for (const [key, value] of Object.entries(env).sort(([left], [right]) =>
+      left < right ? -1 : left > right ? 1 : 0,
+    )) {
+      if (value !== undefined)
+        memo.update(`\0${key.length}:${key}${value.length}:${value}`);
+    }
+    const memoKey = memo.digest("hex");
+    let named = goEnvironmentFiles.get(memoKey);
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      if (named !== undefined && named !== null)
+        PluginBuildEnvironmentWitness.add(witness, named);
+      const result = spawnGoTool(goBinary, ["env", "-json", ...keys, "GOENV"], {
+        cwd,
+        encoding: "utf8",
+        env: GoSourceInputs.goBuildEnv(goBinary, undefined, env),
+        windowsHide: true,
+      });
+      if (result.error !== undefined || result.status !== 0) return undefined;
+      let parsed: Record<string, unknown>;
+      try {
+        const decoded: unknown = JSON.parse(result.stdout);
+        if (
+          decoded === null ||
+          typeof decoded !== "object" ||
+          Array.isArray(decoded)
+        )
+          return undefined;
+        parsed = decoded as Record<string, unknown>;
+      } catch {
+        return undefined;
+      }
+      const reported =
+        typeof parsed.GOENV === "string" &&
+        parsed.GOENV !== "" &&
+        parsed.GOENV !== "off"
+          ? parsed.GOENV
+          : null;
+      if (reported === named) return parsed;
+      if (named !== undefined && named !== null) witness?.delete(named);
+      named = reported;
+      goEnvironmentFiles.set(memoKey, named);
+      // No file to witness: the reading depends on none.
+      if (named === null) return parsed;
+      if (witness === undefined) return parsed;
+    }
+    if (named !== undefined && named !== null)
+      PluginBuildEnvironmentWitness.refuse(witness, named);
+    return undefined;
+  }
+}