ttsc 0.31.0 → 0.31.2

package/src/plugin/internal/source/pluginModuleReplaceDirectories.ts

@@ -2,12 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 
 import { resolvePhysicalPath } from "../../../internal/pathIdentity/resolvePhysicalPath";
-import { GoSourceInputs } from "./GoSourceInputs";
 import { GoToolResolution } from "./GoToolResolution";
 import type { IPluginModuleReplaceDirectory } from "./IPluginModuleReplaceDirectory";
+import { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { resolveGoCompiler } from "./resolveGoCompiler";
 import { selectPluginModuleReplaceDirectories } from "./selectPluginModuleReplaceDirectories";
-import { spawnGoTool } from "./spawnGoTool";
 
 /**
  * The local directories outside a plugin's Go module that its `go.mod`
@@ -38,19 +37,21 @@ import { spawnGoTool } from "./spawnGoTool";
  *   fails or supplies an unusable JSON result. A no-marker manifest skips Go
  *   parsing here; this is not general go.mod validation.
  * @evidence contracts/common.md#principled-implementation When the replace marker triggers a query, Go parses its grammar. Unversioned local targets selected outside best-effort root/target spellings are reported, resolving relative paths from the original module; unavailable identity resolution does not certify complete physical containment.
- * @evidence contracts/common.md#clear-and-simple-design A cheap no-replace scan avoids an unnecessary subprocess, while Go JSON parsing and physical containment stay in one owning operation.
+ * @evidence contracts/common.md#clear-and-simple-design A cheap no-replace scan avoids unnecessary parsing; the common selected-tool/load reader owns Go syntax, and this operation owns current physical containment.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts The implementation uses Go's supported mod-edit interface instead of a handwritten grammar or special-casing particular dependency names.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain external versus internal replacement ownership, original-directory resolution and returned spellings; failure behavior is documented.
  * @evidence contracts/portability.md#os-neutral-implementation Node path and physical-path resolution determine containment; Go local-path syntax accepts native absolute paths and Windows-relative backslashes only on Windows.
- * @evidence contracts/performance.md#efficient-algorithms Full manifest read/UTF-8 marker scan can skip Go parsing. Otherwise native tool/env/capture and full JSON work precede a pass over all parsed directives, not only returned ones; each selected local target uses native best-effort identity resolution, which can traverse ancestors/probe case. Sorting returned module/version strings processes their bytes, with complete manifest/output/path arrays retained transiently and no replacement content digest scan here.
+ * @evidence contracts/performance.md#efficient-algorithms Full manifest read/UTF-8 marker scan can skip Go parsing. Otherwise selected-tool reader acquisition and a current manifest read precede a pass over all parsed directives, not only returned ones. Equivalent bytes share Go JSON acquisition only in the supplied fixed-environment load registry; a new syntax record pays native tool/env/capture and full JSON costs; each selected local target uses native best-effort identity resolution, which can traverse ancestors/probe case. Sorting returned module/version strings processes their bytes, with complete manifest/output/path arrays retained transiently and no replacement content digest scan here.
  *
- * @evidenceExclude contracts/performance.md#reuse-equivalent-work This reader establishes the current module directives; callers share resulting source readings in computeCacheKey, not a stale directive memo here.
- * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This operation acquires no retained handle or historical registry; spawnGoTool owns synchronous capture and its cleanup attempts, which can fail. Manifest/JSON/native identity contexts are call-owned and selected records transfer to the caller without pinning future directory state.
+ * @evidence contracts/performance.md#reuse-equivalent-work The optional pinned-tool/load reader or registry shares Go parsing of identical current bytes with package observation and workspace creation. Physical replacement containment is recomputed every call, never borrowed from that syntax memo.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This operation acquires no retained handle; the supplied load registry retains syntax readers until its caller releases the load. Without it the reader is call-owned. Native capture cleanup remains delegated and can fail; current physical identity contexts are call-owned and returned directories do not pin future state.
  */
 export function pluginModuleReplaceDirectories(
   moduleRoot: string,
   env: NodeJS.ProcessEnv,
   goBinary?: string,
+  reader?: SourcePluginWorkspace.GoModReader,
+  readers?: Map<string, SourcePluginWorkspace.GoModReader>,
 ): IPluginModuleReplaceDirectory[] {
   const root = path.resolve(moduleRoot);
   let text: string;
@@ -70,27 +71,14 @@ export function pluginModuleReplaceDirectories(
       env,
       root,
     );
-  const result = spawnGoTool(go, ["mod", "edit", "-json"], {
-    cwd: root,
-    encoding: "utf8",
-    env: GoSourceInputs.goBuildEnv(go, undefined, env),
-    windowsHide: true,
-  });
-  if (result.error !== undefined || result.status !== 0)
-    throw new Error(
-      `ttsc: reading ${path.join(root, "go.mod")} failed: ${
-        result.error?.message ?? (result.stderr || result.stdout)
-      }`,
-    );
-  const parsed = JSON.parse(result.stdout) as {
-    Replace?: readonly {
-      New?: { Path?: string; Version?: string };
-      Old?: { Path?: string; Version?: string };
-    }[];
-  };
+  const parsed = (
+    reader ?? SourcePluginWorkspace.createGoModReader(go, root, env, readers)
+  ).read(root);
+  // Parsed syntax may be shared; physical containment is current native state
+  // and must be recomputed even when these manifest bytes are unchanged.
   return selectPluginModuleReplaceDirectories(
     root,
-    parsed.Replace ?? [],
+    parsed.directives,
     resolvePhysicalPath,
   );
 }

package/src/plugin/internal/source/pluginSourceState.ts

@@ -1,8 +1,9 @@
 import crypto from "node:crypto";
 
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import { pluginBuildEnvironment } from "./pluginBuildEnvironment";
-import { pluginSourceDigest } from "./pluginSourceDigest";
 import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
+import { provenPluginSourceDigest } from "./provenPluginSourceDigest";
 
 /**
  * The state of one plugin source directory as a plugin binary is built from it:
@@ -25,7 +26,9 @@ import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
  * process's own environment the environment is read once per directory and set
  * of variables (`processPluginBuildEnvironment`), and a proof that must not
  * accept a stale one compares through `pluginSourceStateHolds`, which reads it
- * again before it refutes a state.
+ * again before it refutes a state. A caller that names its project proves the
+ * sources and the SDK from that project's plugin cache records instead of
+ * reading them in every new process (#1725).
  *
  * @param directory The source directory.
  * @param options.env An effective environment other than this process's, which
@@ -34,6 +37,7 @@ import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
  *   caller already read it.
  * @param options.environment The directory's `pluginBuildEnvironment`, when the
  *   caller already read it, as a plugin build's key does.
+ * @param options.projectRoot Project whose plugin cache root holds the records.
  * @returns The state, as lowercase hex.
  * @throws When a listed source file cannot be read, as the build itself would.
  * @evidence contracts/common.md#principled-implementation The state combines source and environment digests because both affect compiled plugin behavior; supplied readings preserve the exact inputs a build already keyed on.
@@ -42,7 +46,7 @@ import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain module-root versus overlay environment meaning and the provenance required for supplied digests.
  * @evidence contracts/portability.md#os-neutral-implementation Native source and toolchain identity are delegated to the shared filesystem/process readers; the final digest is platform-independent serialized text.
  * @evidence contracts/performance.md#efficient-algorithms Composition serializes/hashes supplied digest strings whose public inputs are not length-validated; owning generated digests are fixed-width hex. Missing readings delegate native source enumeration/full reads and environment variable/witness/tool/SDK work, without establishing an unmeasured dominant cost ranking.
- * @evidence contracts/performance.md#reuse-equivalent-work Supplied source/environment strings are trusted producer readings, not independently revalidated here. Process-environment memos require their owner's variable/path witness checks; explicit injected environments are read fresh. Equality inherits the selected-source and native metadata premises.
+ * @evidence contracts/performance.md#reuse-equivalent-work Supplied source/environment strings are trusted producer readings, not independently revalidated here. Process-environment memos require their owner's variable/path witness checks; explicit injected environments are read fresh. A named project lets missing source and SDK readings come from its record store across processes. Equality inherits the selected-source and native metadata premises.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This function retains no resource or state after returning; process-environment memo lifetime belongs to its separate owner.
  */
@@ -51,19 +55,31 @@ export function pluginSourceState(
   options: {
     env?: NodeJS.ProcessEnv;
     environment?: string;
+    projectRoot?: string;
     sourceDigest?: string;
   } = {},
 ): string {
+  const sourceDigest =
+    options.sourceDigest ??
+    provenPluginSourceDigest(directory, options.projectRoot, options.env);
+  const environment =
+    options.environment ??
+    (options.env === undefined
+      ? processPluginBuildEnvironment(directory, false, options.projectRoot)
+      : pluginBuildEnvironment(
+          directory,
+          options.env,
+          undefined,
+          options.projectRoot === undefined
+            ? undefined
+            : PluginContentIdentities.open({
+                projectRoot: options.projectRoot,
+                env: options.env,
+                sources: [directory],
+              }),
+        ));
   return crypto
     .createHash("sha256")
-    .update(
-      `source=${options.sourceDigest ?? pluginSourceDigest(directory)}\n` +
-        `environment=${
-          options.environment ??
-          (options.env === undefined
-            ? processPluginBuildEnvironment(directory)
-            : pluginBuildEnvironment(directory, options.env))
-        }\n`,
-    )
+    .update(`source=${sourceDigest}\nenvironment=${environment}\n`)
     .digest("hex");
 }

package/src/plugin/internal/source/pluginSourceStateHolds.ts

@@ -1,6 +1,6 @@
-import { pluginSourceDigest } from "./pluginSourceDigest";
 import { pluginSourceState } from "./pluginSourceState";
 import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
+import { provenPluginSourceDigest } from "./provenPluginSourceDigest";
 
 /**
  * Whether one plugin source directory still holds the state a transform
@@ -16,12 +16,16 @@ import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
  * is refuted. A compile keys its binaries on a fresh read, so a state it
  * reported after a change gets one comparison with a refreshed environment.
  * That retry does not guarantee equality for a changing or differently keyed
- * environment, and a supplied source digest remains the caller's premise.
+ * environment, and a supplied source digest remains the caller's premise. A
+ * caller that names its project proves the sources and the SDK from that
+ * project's plugin cache records instead of reading them in every new process
+ * (#1725).
  *
  * @param directory The source directory, as the envelope names it.
  * @param state The state the envelope reported.
  * @param options.sourceDigest The directory's `pluginSourceDigest`, when the
  *   caller holds one it can vouch for.
+ * @param options.projectRoot Project whose plugin cache root holds the records.
  * @throws When a listed source file cannot be read, as the build itself would.
  * @evidence contracts/common.md#principled-implementation Equality uses shared state composition and one real environment refresh after mismatch. This allows changed observations to be reconsidered without certifying the second comparison must match; supplied digest validity and native witness premises remain with their owners.
  * @evidence contracts/common.md#clear-and-simple-design One source reading is passed through both attempts and only the environment owner performs the refresh.
@@ -29,17 +33,20 @@ import { processPluginBuildEnvironment } from "./processPluginBuildEnvironment";
  * @evidence contracts/common.md#meaningful-documentation The prose states source-digest provenance, environment invalidation and the reason a mismatching state gets a fresh comparison.
  * @evidence contracts/portability.md#os-neutral-implementation Source reads and Go/environment witnesses use the same native boundary implementations as builds, rather than comparing OS names or guessed installation paths.
  * @evidence contracts/performance.md#efficient-algorithms At most one source digest computation is requested and reused by both comparisons; supplied strings bypass it. Native enumeration/file bytes, full environment identity/witness checks, optional tool/SDK refresh and digest-string hashing contribute work; mismatch repeats environment resolution once rather than bounding total cost by comparison count.
- * @evidence contracts/performance.md#reuse-equivalent-work A caller's proven source digest and the process owner's still-valid environment are reused; a mismatch forces the owning environment refresh before returning false.
+ * @evidence contracts/performance.md#reuse-equivalent-work A caller's proven source digest and the process owner's still-valid environment are reused; a mismatch forces the owning environment refresh before returning false. A named project lets the source and SDK readings come from its record store across processes.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no retained source buffer, process or watcher; its caller owns any saved source digest.
  */
 export function pluginSourceStateHolds(
   directory: string,
   state: string,
-  options: { sourceDigest?: string } = {},
+  options: { projectRoot?: string; sourceDigest?: string } = {},
 ): boolean {
-  const sourceDigest = options.sourceDigest ?? pluginSourceDigest(directory);
-  if (pluginSourceState(directory, { sourceDigest }) === state) return true;
-  processPluginBuildEnvironment(directory, true);
-  return pluginSourceState(directory, { sourceDigest }) === state;
+  const projectRoot = options.projectRoot;
+  const sourceDigest =
+    options.sourceDigest ?? provenPluginSourceDigest(directory, projectRoot);
+  if (pluginSourceState(directory, { projectRoot, sourceDigest }) === state)
+    return true;
+  processPluginBuildEnvironment(directory, true, projectRoot);
+  return pluginSourceState(directory, { projectRoot, sourceDigest }) === state;
 }

package/src/plugin/internal/source/processPluginBuildEnvironment.ts

@@ -21,20 +21,26 @@ import { PluginBuildEnvironmentReadings } from "./PluginBuildEnvironmentReadings
  * possible metadata-restored change. The build itself never reads through here:
  * it keys each binary on a fresh read.
  *
+ * A caller that names its project lets a reading this process does not hold
+ * prove the SDK and executables from that project's plugin cache records
+ * (#1725) instead of reading the whole GOROOT in every new process.
+ *
  * @param directory The directory a build runs `go` in.
  * @param refresh Whether to read the environment again rather than reuse it.
+ * @param projectRoot Project whose plugin cache root holds the records.
  * @evidence contracts/common.md#principled-implementation Variable serialization is sorted and length-delimited; reuse additionally requires unchanged pre-read metadata for every external dependency, including all contributing GOROOT directories and files, under the witness's documented metadata-distinguishability premise.
  * @evidence contracts/common.md#clear-and-simple-design One process-local map owns environment memoization; fresh construction and witness validation remain separate operations shared with build verification.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Refresh performs the real environment read rather than assuming that a stable compiler path or quiet source tree implies a stable toolchain.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain why environment probing is retained, its variable/path invalidation, and why builds still read fresh; descriptive prose and tags are separated.
  * @evidence contracts/portability.md#os-neutral-implementation Native environment and filesystem identity are delegated to the shared platform-aware probe and metadata witness rather than inferred from an OS name.
  * @evidence contracts/performance.md#efficient-algorithms The delegated owner serializes/hashes variable names/values after text-sensitive sorting and validates witnessed native paths. A qualified hit avoids cold tool/content preparation but not native lookup/path/link/text costs. Misses/refresh delegate actual Go/toolchain/SDK readings; V/P counts alone do not bound all bytes or native work.
- * @evidence contracts/performance.md#reuse-equivalent-work Directory and all effective variables identify a candidate reading; the complete external-path witness must hold, otherwise the environment is read and its record replaced.
+ * @evidence contracts/performance.md#reuse-equivalent-work Directory and all effective variables identify a candidate reading; the complete external-path witness must hold, otherwise the environment is read and its record replaced. A miss naming a project proves the SDK and executables from that project's record store across processes.
  * @evidence contracts/performance.md#bound-retention-and-release-resources PluginBuildEnvironmentReadings owns the process-shared map and asynchronous worker/request lifetimes, not this forwarding call. Existing keys are replaced, but distinct directory/variable combinations retain historical witnesses without an eviction bound; consumers and the owner govern that retention.
  */
 export function processPluginBuildEnvironment(
   directory: string,
   refresh = false,
+  projectRoot?: string,
 ): string {
-  return PluginBuildEnvironmentReadings.read(directory, refresh);
+  return PluginBuildEnvironmentReadings.read(directory, refresh, projectRoot);
 }

package/src/plugin/internal/source/provenPluginSourceDigest.ts

@@ -0,0 +1,45 @@
+import { PluginContentIdentities } from "./PluginContentIdentities";
+
+/**
+ * The `pluginSourceDigest` of a plugin source directory, proven from the
+ * records of `projectRoot`'s plugin cache when the caller names its project.
+ *
+ * WARNING (#1725): a consumer that proves a reported plugin-source state in a
+ * new process, such as a bundler worker, a capability host or the language
+ * server, read every source byte again because its own memo starts empty. The
+ * load that reported the state already recorded this digest
+ * (`PluginContentIdentities`), so a process that names the same project reuses
+ * it while the files' metadata still holds. Without a project, or when no store
+ * can be opened, the bytes are read as before.
+ *
+ * @param directory The source directory.
+ * @param projectRoot Project whose plugin cache root holds the records.
+ * @param env Environment selecting that cache root; this process's by default.
+ * @returns The digest, as lowercase hex.
+ * @throws When a listed source file cannot be read, as `pluginSourceDigest`
+ *   does.
+ * @evidence contracts/common.md#principled-implementation The record store applies its separable-signature rule to exactly the files the digest reads; every unproved premise falls back to the content reader.
+ * @evidence contracts/common.md#clear-and-simple-design Store opening and the population proof stay with PluginContentIdentities; this entry only names the project for consumers outside the loader.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No path, timestamp or process memo stands for content; the store refuses a root inside the source.
+ * @evidence contracts/common.md#meaningful-documentation The paragraphs state the regression, the reuse premise and the fallback.
+ * @evidence contracts/portability.md#os-neutral-implementation Cache-root selection and device-keyed references are delegated to the shared owners.
+ * @evidence contracts/performance.md#efficient-algorithms A proven digest stats the selected files; an unproven one also reads their bytes once. Opening the store writes two reference probes.
+ * @evidence contracts/performance.md#reuse-equivalent-work The digest the load recorded is reused across processes under the same project's store.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources The store lives for this call; records belong to the cache root's single-file pruning.
+ */
+export function provenPluginSourceDigest(
+  directory: string,
+  projectRoot?: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  return PluginContentIdentities.sourceDirectory(
+    projectRoot === undefined
+      ? undefined
+      : PluginContentIdentities.open({
+          projectRoot,
+          env,
+          sources: [directory],
+        }),
+    directory,
+  );
+}

package/src/plugin/internal/source/pruneCacheFileRoot.ts

@@ -8,8 +8,9 @@ import { SourceBuildCacheLayout } from "./SourceBuildCacheLayout";
 /**
  * Opportunistically bound a part of the cache root whose entries are single
  * files: the descriptor evaluations under `descriptors/`, the capability
- * answers under `capabilities/`, and the lowered orphan sources under
- * `ttsx-orphan/`.
+ * answers under `capabilities/`, the plugin content identities under
+ * `identities/`, the plugin-load answers under `answers/`, and the lowered
+ * orphan sources under `ttsx-orphan/`.
  *
  * The policy is the plugin cache's (`CachePrunePolicy`). An entry's last use is
  * its modification time: a write sets it, and every hit records a use by

package/src/plugin/internal/source/ttscPackageVersion.ts

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * The version of this ttsc package, read from its own manifest once per
+ * process, or `"0.0.0"` when the manifest cannot be read or names none.
+ *
+ * WARNING (#1726): a reader that only needs ttsc's own version must take it
+ * here, never from `pluginBuildVersions`, which also resolves the project's
+ * `typescript` package. A plugin descriptor evaluator opens a record store
+ * while its module resolution recorder runs, and on a runtime whose
+ * `require.resolve` consults resolve hooks every such lookup became an input of
+ * the descriptor: absent `typescript` candidates below the cache root's
+ * ancestors, whose proofs the system temporary directory's metadata then
+ * withdrew. Reading a file here resolves no module.
+ *
+ * The host installation is assumed stable for the process lifetime; changing
+ * its manifest does not refresh the label.
+ *
+ * @evidence contracts/common.md#principled-implementation The label is this package's manifest version, the same value plugin keys and record identities have always named; an unreadable manifest yields the documented default instead of a guess.
+ * @evidence contracts/common.md#clear-and-simple-design One reader owns the host label; `pluginBuildVersions` composes it with the project's compiler version.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The manifest beside the compiled module is read directly; no module resolution or fixture version stands in for it.
+ * @evidence contracts/common.md#meaningful-documentation The paragraphs state the value, the regression that motivates a resolution-free reader and the process-stable premise.
+ * @evidence contracts/portability.md#os-neutral-implementation The manifest path is joined with Node path APIs relative to this module, without separator or case assumptions.
+ * @evidence contracts/performance.md#efficient-algorithms The first call reads and parses one small manifest; later calls return the retained label.
+ * @evidence contracts/performance.md#reuse-equivalent-work Every caller in the process shares one reading of an installation assumed stable for that process.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources One label string is retained for the process lifetime; the synchronous read leaves no descriptor open.
+ */
+export function ttscPackageVersion(): string {
+  if (version !== undefined) return version;
+  try {
+    const manifest = JSON.parse(
+      fs.readFileSync(
+        path.resolve(__dirname, "..", "..", "..", "..", "package.json"),
+        "utf8",
+      ),
+    ) as { version?: string };
+    version = manifest.version ?? "0.0.0";
+  } catch {
+    version = "0.0.0";
+  }
+  return version;
+}
+
+let version: string | undefined;

package/src/plugin/internal/writeCapabilityResolution.ts

@@ -8,8 +8,8 @@ import { CapabilityResolutionFormat } from "./CapabilityResolutionFormat";
 import type { ITtscCapabilityPluginSource } from "./ITtscCapabilityPluginSource";
 import type { ITtscCapabilityResolutionEntry } from "./ITtscCapabilityResolutionEntry";
 import type { ITtscCapabilityResolutionPlugin } from "./ITtscCapabilityResolutionPlugin";
+import { PluginContentIdentities } from "./source/PluginContentIdentities";
 import { SourceBuildCacheLayout } from "./source/SourceBuildCacheLayout";
-import { pluginSourceDigest } from "./source/pluginSourceDigest";
 import { pluginSourceFilesSignature } from "./source/pluginSourceFilesSignature";
 import { pluginSourceState } from "./source/pluginSourceState";
 
@@ -71,6 +71,12 @@ export function writeCapabilityResolution(
 
     /** Pre-load authority key; a moved evaluation authority refuses the write. */
     expectedAuthority?: string;
+
+    /**
+     * Record store of the project's plugin cache, which proves the runtime and
+     * the plugin sources and SDK from metadata instead of their bytes (#1725).
+     */
+    identities?: PluginContentIdentities.Store;
   },
   answer: {
     /**
@@ -180,8 +186,8 @@ export function writeCapabilityResolution(
       return null;
     }
   }
-  const evidence = CapabilityResolutionFormat.sourceEvidence(
-    CapabilityResolutionFormat.clockReference(file),
+  const evidence = PluginContentIdentities.sourceEvidence(
+    PluginContentIdentities.mintReference(path.dirname(file)),
   );
   const entry: ITtscCapabilityResolutionEntry = {
     hostInputHashes,
@@ -191,7 +197,13 @@ export function writeCapabilityResolution(
     pluginSources: Object.fromEntries(
       Object.entries(answer.pluginSources).map(([directory, state]) => [
         directory,
-        recordPluginSource(directory, state, evidence),
+        recordPluginSource(
+          directory,
+          state,
+          evidence,
+          path.resolve(options.cwd),
+          options.identities,
+        ),
       ]),
     ),
     plugins: answer.plugins.map((plugin) => ({
@@ -239,23 +251,32 @@ export function writeCapabilityResolution(
  * when both signatures agree, every stamp was separable from a reference minted
  * before the read, and the digest gives the very state the load reported, so
  * the entry never vouches for sources the binary was not built from. Anything
- * else records the state alone, which a read proves in full.
+ * else records the state alone, which a read proves in full. The digest comes
+ * from the project's record store when its metadata still holds there, which
+ * places it inside the same two signatures, so a new process does not read
+ * every source byte again (#1725).
  */
 function recordPluginSource(
   directory: string,
   state: string,
-  evidence: ReturnType<typeof CapabilityResolutionFormat.sourceEvidence>,
+  evidence: ReturnType<typeof PluginContentIdentities.sourceEvidence>,
+  projectRoot: string,
+  identities: PluginContentIdentities.Store | undefined,
 ): ITtscCapabilityPluginSource {
   try {
     const before = pluginSourceFilesSignature(directory, evidence);
-    const digest = pluginSourceDigest(directory);
+    const digest = PluginContentIdentities.sourceDirectory(
+      identities,
+      directory,
+    );
     const after = pluginSourceFilesSignature(directory, evidence);
     if (
       before !== undefined &&
       after !== undefined &&
       before.signature === after.signature &&
       after.separable &&
-      pluginSourceState(directory, { sourceDigest: digest }) === state
+      pluginSourceState(directory, { projectRoot, sourceDigest: digest }) ===
+        state
     ) {
       return { digest, signature: after.signature, state };
     }

package/src/plugin/resolveCapabilityPlugins.ts

@@ -15,6 +15,7 @@ import { CapabilityResolutionFormat } from "./internal/CapabilityResolutionForma
 import type { ITtscCapabilityResolutionEntry } from "./internal/ITtscCapabilityResolutionEntry";
 import { loadProjectPlugins } from "./internal/load/loadProjectPlugins";
 import { readCapabilityResolution } from "./internal/readCapabilityResolution";
+import { PluginContentIdentities } from "./internal/source/PluginContentIdentities";
 import { writeCapabilityResolution } from "./internal/writeCapabilityResolution";
 
 /**
@@ -102,12 +103,26 @@ export function resolveCapabilityPluginResolution(options: {
   // the same cwd. NUL cannot occur in a filename, so this discovery key cannot
   // collide with an explicitly supplied path.
   const tsconfig = options.tsconfig ?? `${String.fromCharCode(0)}discovered`;
-  const runtimeProved = capabilityRuntimeAuthorityComplete(cwd);
+  // WARNING (#1725): every lookup proved the runtime by streaming it, and a hit
+  // proved the plugin sources and the whole GOROOT by their bytes, in each
+  // process. One store of the project's plugin cache serves every proof of
+  // this resolution, opened only once the runtime may be cached at all.
+  const identities = capabilityRecordStore(cwd);
+  const runtimeProved = capabilityRuntimeAuthorityComplete(cwd, identities);
   const authority = runtimeProved
-    ? CapabilityResolutionFormat.resolutionFile({ cwd, tsconfig })
+    ? CapabilityResolutionFormat.resolutionFile({
+        cwd,
+        tsconfig,
+        identities: identities(),
+      })
     : null;
   const cached = runtimeProved
-    ? readCapabilityResolution({ cwd, tsconfig, version })
+    ? readCapabilityResolution({
+        cwd,
+        tsconfig,
+        version,
+        identities: identities(),
+      })
     : null;
   E2ETrace.capabilityResolution("lookup", {
     cwd,
@@ -118,7 +133,14 @@ export function resolveCapabilityPluginResolution(options: {
     cacheHit: cached !== null,
   });
   if (cached !== null)
-    return resolved(cached, options.capability, cwd, tsconfig, authority);
+    return resolved(
+      cached,
+      options.capability,
+      cwd,
+      tsconfig,
+      authority,
+      identities,
+    );
 
   const binary = resolveBinary();
   if (binary === null || binary === undefined)
@@ -178,12 +200,21 @@ export function resolveCapabilityPluginResolution(options: {
       runtimeProved &&
       authority !== null &&
       (authorityUnchanged =
-        CapabilityResolutionFormat.resolutionFile({ cwd, tsconfig }) ===
-        authority) &&
+        CapabilityResolutionFormat.resolutionFile({
+          cwd,
+          tsconfig,
+          identities: identities(),
+        }) === authority) &&
       loaded.descriptorReadsDeclared &&
       loaded.discoveryInputsComplete
         ? writeCapabilityResolution(
-            { cwd, tsconfig, version, expectedAuthority: authority },
+            {
+              cwd,
+              tsconfig,
+              version,
+              expectedAuthority: authority,
+              identities: identities(),
+            },
             answer,
           )
         : null;
@@ -213,10 +244,40 @@ export function resolveCapabilityPluginResolution(options: {
           plugins: CapabilityPluginResult.select(answer, options.capability),
           status: "resolved",
         }
-      : resolved(recorded, options.capability, cwd, tsconfig, authority);
+      : resolved(
+          recorded,
+          options.capability,
+          cwd,
+          tsconfig,
+          authority,
+          identities,
+        );
   });
 }
 
+/**
+ * The record store of `cwd`'s plugin cache, opened on first use and kept for
+ * the resolution and its later freshness queries, or `undefined` when none can
+ * be opened. A kept store's references only grow older, which can make fewer
+ * stamps separable but never more.
+ */
+function capabilityRecordStore(
+  cwd: string,
+): () => PluginContentIdentities.Store | undefined {
+  let opened = false;
+  let store: PluginContentIdentities.Store | undefined;
+  return () => {
+    if (!opened) {
+      opened = true;
+      store = PluginContentIdentities.open({
+        projectRoot: cwd,
+        env: process.env,
+      });
+    }
+    return store;
+  };
+}
+
 /**
  * Whether the keyed executable is the actual sole descriptor runtime.
  *
@@ -228,7 +289,10 @@ export function resolveCapabilityPluginResolution(options: {
  * operation's existing decision and preserves short-circuited comparisons as
  * unobserved, without repeating native queries.
  */
-function capabilityRuntimeAuthorityComplete(cwd: string): boolean {
+function capabilityRuntimeAuthorityComplete(
+  cwd: string,
+  identities: () => PluginContentIdentities.Store | undefined,
+): boolean {
   if (SidecarEnvironment.read(process.env, "NODE_OPTIONS")?.trim()) {
     E2ETrace.capabilityResolution("runtime-authority", {
       cwd,
@@ -254,6 +318,7 @@ function capabilityRuntimeAuthorityComplete(cwd: string): boolean {
       runtime,
       process.env,
       cwd,
+      identities(),
     );
     let executableMatches: boolean | undefined;
     const proved =
@@ -291,6 +356,7 @@ function resolved(
   cwd: string,
   tsconfig: string,
   authority: string | null,
+  identities: () => PluginContentIdentities.Store | undefined,
 ): ITtscCapabilityPluginResolution {
   const proof = JSON.stringify(entry);
   return {
@@ -298,12 +364,20 @@ function resolved(
       try {
         if (
           authority === null ||
-          !capabilityRuntimeAuthorityComplete(cwd) ||
-          CapabilityResolutionFormat.resolutionFile({ cwd, tsconfig }) !==
-            authority
+          !capabilityRuntimeAuthorityComplete(cwd, identities) ||
+          CapabilityResolutionFormat.resolutionFile({
+            cwd,
+            tsconfig,
+            identities: identities(),
+          }) !== authority
         )
           return false;
-        const current = readCapabilityResolution({ cwd, tsconfig, version });
+        const current = readCapabilityResolution({
+          cwd,
+          tsconfig,
+          version,
+          identities: identities(),
+        });
         return current !== null && JSON.stringify(current) === proof;
       } catch {
         return false;