ttsc 0.31.0 → 0.31.2

package/lib/plugin/internal/load/loadProjectPlugins.js

@@ -21,12 +21,15 @@ const spawnSyncResilient_1 = require("../../../internal/spawnSyncResilient");
 const pluginDescriptorFailureReason_1 = require("../pluginDescriptorFailureReason");
 const pluginDescriptorProcessFailure_1 = require("../pluginDescriptorProcessFailure");
 const NativeSourcePackages_1 = require("../source/NativeSourcePackages");
-const resolvePluginGoModule_1 = require("../source/resolvePluginGoModule");
+const PluginContentIdentities_1 = require("../source/PluginContentIdentities");
+const SourcePluginWorkspace_1 = require("../source/SourcePluginWorkspace");
 const buildSourcePlugin_1 = require("../source/buildSourcePlugin");
 const isPathWithin_1 = require("../source/isPathWithin");
+const pluginBuildEnvironment_1 = require("../source/pluginBuildEnvironment");
 const pluginBuildVersions_1 = require("../source/pluginBuildVersions");
 const pluginModuleReplaceDirectories_1 = require("../source/pluginModuleReplaceDirectories");
 const pluginSourceState_1 = require("../source/pluginSourceState");
+const resolvePluginGoModule_1 = require("../source/resolvePluginGoModule");
 const COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE_1 = require("./COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE");
 const PLUGIN_DESCRIPTOR_SHIM_SOURCE_1 = require("./PLUGIN_DESCRIPTOR_SHIM_SOURCE");
 const PluginDescriptorAdmission_1 = require("./PluginDescriptorAdmission");
@@ -58,19 +61,18 @@ const visitImportMappedCandidates_1 = require("./visitImportMappedCandidates");
  * under generic host manifests while preserving source-relative input layout.
  * Main proposals must agree in their full owning module; linked proposals must
  * agree inside every selected transform host. Errors or disagreement terminate
- * the load rather than changing the proposed kind.
- * Watch callers first receive structurally selected source/module/contributor
- * repair interests, before metadata can reject them. Valid records then narrow
- * those interests to the exact build directories; interests alone never admit
- * a plugin, certify a kind or supply reusable source-state proof.
- * Returns the ordered native plugins, parsed project config, recorded
- * JavaScript-host inputs and unresolved selection candidates, and the keyed
- * state of reported Go source directories supplied to the builds
- * (`pluginSources`): each plugin's module root and each contributor's source,
- * with its state (`pluginSourceState`), the sources as the build read them
- * together with the environment a build there is keyed on. Directories within
- * ttsc's installed package, including its overlays and the fallback
- * linked-plugin host, are keyed but omitted from this report under the
+ * the load rather than changing the proposed kind. Watch callers first receive
+ * structurally selected source/module/contributor repair interests, before
+ * metadata can reject them. Valid records then narrow those interests to the
+ * exact build directories; interests alone never admit a plugin, certify a kind
+ * or supply reusable source-state proof. Returns the ordered native plugins,
+ * parsed project config, recorded JavaScript-host inputs and unresolved
+ * selection candidates, and the keyed state of reported Go source directories
+ * supplied to the builds (`pluginSources`): each plugin's module root and each
+ * contributor's source, with its state (`pluginSourceState`), the sources as
+ * the build read them together with the environment a build there is keyed on.
+ * Directories within ttsc's installed package, including its overlays and the
+ * fallback linked-plugin host, are keyed but omitted from this report under the
  * installed-package/version ownership policy. That policy does not prove the
  * installation cannot be edited in place. Descriptor completeness relies on the
  * runtime recorder's status and the descriptor's explicit external-read
@@ -97,7 +99,7 @@ const visitImportMappedCandidates_1 = require("./visitImportMappedCandidates");
  * @evidence contracts/common.md#meaningful-documentation Native JSDoc explains result provenance, environment and path options; helper comments explain input races, conservative proof omission, fallback authority and cleanup. Member/tag spacing and separated concepts follow the documentation skill.
  * @evidence contracts/portability.md#os-neutral-implementation Native path/file-URL conversion, createRequire and hidden spawn with explicit argv/environment implement OS-neutral selection and process execution. Physical identities are preserved separately from lexical candidates; Bun-specific differences are capability decisions, not OS guesses.
  * @evidence contracts/performance.md#efficient-algorithms Input merging and conflicts use Sets/maps and sorted path populations, with path/key/value byte costs. Discovery can repeat config/manifest/candidate reads and full hashes; descriptor work includes runtime probes, full observation/JSON processing and possibly synchronous evaluation. Watch-only preliminary publication can temporarily digest/watch the full admitted module as well as its package before kind is known; callbacks delegate topology reconciliation. Load-local replacement readings serve preliminary and final publication. Package selection groups equivalent module contexts and batches entries through Go list without dependency compilation; per-load selected-tool manifest readers share overlay readings. Builds delegate source/environment hashing, copying, cold materialized ownership admission and Go execution; per-load digest maps share selected work. Composition can be quadratic in configured plugins/aliases, and native lookup/file/output bytes are not bounded by plugin count alone.
- * @evidence contracts/performance.md#reuse-equivalent-work Descriptor hits require the cache's context/environment/runtime/version identity and matching recorded projections, subject to producer declarations and sequential-observation limits. Per-load source/environment maps share directory-keyed digests and one selected transform host serves linked contributors; these identities do not certify every undeclared read or atomic filesystem stability.
+ * @evidence contracts/performance.md#reuse-equivalent-work Descriptor hits require the cache's context/environment/runtime/version identity and matching recorded projections, subject to producer declarations and sequential-observation limits. Per-load source/environment maps share directory-keyed digests between package selection and builds, and one selected transform host serves linked contributors. Across processes, the record store opened here proves unchanged sources, toolchain and runtime from separable metadata and answers equal package selections and runtime probes (#1721, #1722, #1723); a store whose root lies inside a plugin source is withdrawn before any source is proven. These identities do not certify every undeclared read or atomic filesystem stability.
  * @evidence contracts/performance.md#bound-retention-and-release-resources Finally restores injected environment locators, attempts evaluator directory removal and closes direct-evaluator diagnostic descriptors. Close/removal can fail; synchronous completion concerns the selected evaluator and does not certify arbitrary descendants are gone. Generation maps/results scale with observed data, and disk diagnostics/result/observation files have no independent byte ceiling here. Default disk pruning has its own interval/protection/failure policy; explicit roots remain caller-owned.
  */
 function loadProjectPlugins(options) {
@@ -143,8 +145,19 @@ function loadProjectPlugins(options) {
     };
     // Where isolated descriptor evaluations keep their answers across launches
     // (`PluginDescriptorEvaluationCache`).
+    // WARNING (#1721, #1722, #1723): a warm load must prove its unchanged inputs
+    // from this store, not re-read them. Every launch is a new process, so any
+    // module-level memo of this load's work dies with it; a 27 s warm typia
+    // launch whose native build took 0.28 s is what that looked like.
+    const identities = options.identities ??
+        PluginContentIdentities_1.PluginContentIdentities.open({
+            projectRoot: project.root,
+            cacheDir: options.cacheDir,
+            env: effectiveEnv,
+        });
     const descriptorCache = {
         cacheDir: options.cacheDir,
+        identities,
         version: (0, pluginBuildVersions_1.pluginBuildVersions)(project.root).ttsc,
     };
     const loadedEntries = withPluginLoaderEnv(() => entries.map((entry) => {
@@ -185,10 +198,11 @@ function loadProjectPlugins(options) {
             hostInputs: [...loaded.hostInputs, ...entryCandidates],
             request,
         };
-    }));
+    }), identities);
     const plugins = (0, composePluginSources_1.composePluginSources)(entries, loadedEntries.map((entry) => entry.plugin));
     const { ttsc: ttscVersion, tsgo: tsgoVersion } = (0, pluginBuildVersions_1.pluginBuildVersions)(context.projectRoot);
-    const candidates = plugins.map((plugin, index) => {
+    const candidates = plugins
+        .map((plugin, index) => {
         const stage = PluginDescriptorAdmission_1.PluginDescriptorAdmission.stage(plugin);
         (0, validatePluginSource_1.validatePluginSource)(plugin);
         const contributors = (0, validatePluginContributors_1.validatePluginContributors)(plugin);
@@ -196,10 +210,39 @@ function loadProjectPlugins(options) {
         const label = (0, pluginLabel_1.pluginLabel)(plugin, entries[index].config, index);
         (0, requirePluginSource_1.requirePluginSource)(source, label);
         return { plugin, index, stage, contributors, source, label };
-    }).map((candidate) => ({
+    })
+        .map((candidate) => ({
         ...candidate,
         ...(0, resolvePluginGoModule_1.resolvePluginGoModule)(candidate.source, candidate.label),
     }));
+    // One reading of each source directory, shared by package selection and
+    // every build below and reported as the state the binaries were keyed on.
+    const sourceDigests = new Map();
+    // And one reading of the environment each build directory is keyed on, which
+    // a plugin module root's state reports as it is.
+    const environmentDigests = new Map();
+    // With the witness of each such reading, so a build of a directory package
+    // selection already read keys on that reading instead of probing Go again.
+    const environmentWitnesses = new Map();
+    const readings = {
+        sources: sourceDigests,
+        environments: environmentDigests,
+        witnesses: environmentWitnesses,
+    };
+    // Records describing sources must never land inside one, so the store is
+    // admitted for source proofs only once every source of the load is known.
+    const sourceIdentities = PluginContentIdentities_1.PluginContentIdentities.outside(identities, [
+        ...candidates.flatMap((candidate) => [
+            candidate.moduleRoot,
+            candidate.packageDir,
+            ...(candidate.contributors ?? []).map((input) => input.source),
+        ]),
+        ...SourcePluginWorkspace_1.SourcePluginWorkspace.findTtscOverlayDirs(),
+    ]);
+    // One fixed-effective-environment load owns manifest syntax sharing from the
+    // first watch query through metadata and builds. Do not allocate this after
+    // watch projection: that silently repeats selected-Go work (#1712).
+    const packageReaders = new Map();
     const watchReplacements = options.onWatchInputs === undefined
         ? undefined
         : new Map();
@@ -207,11 +250,13 @@ function loadProjectPlugins(options) {
         // The prospective context reads the admitted module layout and anchors its
         // tool there before kind exists. Keep both possible final-root baselines:
         // a linked package keeps packageDir, and an executable keeps moduleRoot.
-        const interests = new Set(candidates.flatMap((candidate) => [
+        const interests = new Set(candidates
+            .flatMap((candidate) => [
             candidate.moduleRoot,
             candidate.packageDir,
             ...(candidate.contributors ?? []).map((input) => input.source),
-        ]).filter(reportsPluginSource));
+        ])
+            .filter(reportsPluginSource));
         options.onWatchInputs([...interests].sort());
         const initialSize = interests.size;
         for (const candidate of candidates) {
@@ -219,20 +264,21 @@ function loadProjectPlugins(options) {
             // activate their irrelevant module graph just to discover watch inputs.
             if (candidate.stage === "transform" && candidate.entry !== ".")
                 continue;
-            for (const directory of pluginReplacementWatchDirectories(candidate.moduleRoot, effectiveEnv, watchReplacements))
+            for (const directory of pluginReplacementWatchDirectories(candidate.moduleRoot, effectiveEnv, watchReplacements, packageReaders))
                 if (reportsPluginSource(directory))
                     interests.add(directory);
         }
         if (interests.size !== initialSize)
             options.onWatchInputs([...interests].sort());
     }
-    const packageReaders = new Map();
     const proposals = NativeSourcePackages_1.NativeSourcePackages.propose(candidates.map((candidate) => ({
-        ...candidate, ownModule: candidate.stage !== "transform",
-    })), effectiveEnv, packageReaders);
+        ...candidate,
+        ownModule: candidate.stage !== "transform",
+    })), effectiveEnv, packageReaders, sourceIdentities, readings);
     const records = candidates.map(({ plugin, index, stage, contributors, source, packageDir }) => {
         const { kind, moduleRoot } = (0, resolveNativeSource_1.resolveNativeSource)(source, plugin, entries[index].config, index, {
-            env: effectiveEnv, observation: proposals[index].observation,
+            env: effectiveEnv,
+            observation: proposals[index].observation,
         });
         if (kind === "linked" && stage !== "transform") {
             throw new Error(`ttsc: plugin "${(0, pluginLabel_1.pluginLabel)(plugin, entries[index].config, index)}" source is a linked Go package, but only transform-stage plugins can be linked into a compiler host`);
@@ -262,10 +308,11 @@ function loadProjectPlugins(options) {
             stage,
         };
     });
-    const executableCandidates = candidates.filter((candidate) => records[candidate.index].kind === "executable" && !proposals[candidate.index].ownModule);
+    const executableCandidates = candidates.filter((candidate) => records[candidate.index].kind === "executable" &&
+        !proposals[candidate.index].ownModule);
     // Admission can now narrow the provisional interests without restamping the
     // retained package/module baselines. Final host errors still keep these roots.
-    options.onWatchInputs?.(pluginBuildDirectories(records, effectiveEnv, watchReplacements));
+    options.onWatchInputs?.(pluginBuildDirectories(records, effectiveEnv, watchReplacements, packageReaders));
     const linkedContributors = records
         .filter((record) => record.stage === "transform")
         .flatMap((record) => record.kind === "linked"
@@ -279,7 +326,12 @@ function loadProjectPlugins(options) {
     const admittedExecutables = new Set();
     if (linkedContributors.length !== 0) {
         const hosts = transformHosts.length === 0
-            ? [{ source: node_path_1.default.join(ttscPackageRoot(), "cmd", "utility-host"), label: "linked-plugin-host" }]
+            ? [
+                {
+                    source: node_path_1.default.join(ttscPackageRoot(), "cmd", "utility-host"),
+                    label: "linked-plugin-host",
+                },
+            ]
             : transformHosts;
         const contexts = new Map();
         for (const host of hosts) {
@@ -298,12 +350,17 @@ function loadProjectPlugins(options) {
                 entry: (0, resolvePluginGoModule_1.resolvePluginGoModule)(record.source, record.label).entry,
             }));
             const observations = NativeSourcePackages_1.NativeSourcePackages.inspect({
-                source: host.source, pluginName: host.label, env: effectiveEnv,
+                source: host.source,
+                pluginName: host.label,
+                env: effectiveEnv,
                 readers: packageReaders,
+                identities: sourceIdentities,
+                readings,
                 packages: [
                     ...hostEntries,
                     ...linkedContributors.map((input) => ({
-                        ...input, entry: `./contrib/${input.name}`,
+                        ...input,
+                        entry: `./contrib/${input.name}`,
                     })),
                 ],
             });
@@ -320,22 +377,22 @@ function loadProjectPlugins(options) {
     // with linked contributors were admitted together above; other equivalent
     // entries share one standalone observation, with no repeated host copy.
     const standaloneCandidates = executableCandidates.filter((candidate) => !admittedExecutables.has(candidate.source));
-    const executablePackages = NativeSourcePackages_1.NativeSourcePackages.ownPackages(standaloneCandidates, effectiveEnv, packageReaders);
+    const executablePackages = NativeSourcePackages_1.NativeSourcePackages.ownPackages(standaloneCandidates, effectiveEnv, packageReaders, sourceIdentities, readings);
     standaloneCandidates.forEach((candidate, index) => {
         NativeSourcePackages_1.NativeSourcePackages.kind(executablePackages[index], candidate.label, "executable");
     });
     const packageOwnership = (source, label, linked) => [
-        { entry: (0, resolvePluginGoModule_1.resolvePluginGoModule)(source, label).entry, kind: "executable" },
-        ...(linked ? linkedContributors.map((input) => ({
-            entry: `./contrib/${input.name}`, kind: "linked",
-        })) : []),
+        {
+            entry: (0, resolvePluginGoModule_1.resolvePluginGoModule)(source, label).entry,
+            kind: "executable",
+        },
+        ...(linked
+            ? linkedContributors.map((input) => ({
+                entry: `./contrib/${input.name}`,
+                kind: "linked",
+            }))
+            : []),
     ];
-    // One reading of each source directory, shared by every build below and
-    // reported as the state the binaries were keyed on.
-    const sourceDigests = new Map();
-    // And one reading of the environment each build directory is keyed on, which
-    // a plugin module root's state reports as it is.
-    const environmentDigests = new Map();
     const builtTransformHosts = new Map();
     for (const record of transformHosts) {
         builtTransformHosts.set(record, (0, buildSourcePlugin_1.buildSourcePlugin)({
@@ -343,10 +400,13 @@ function loadProjectPlugins(options) {
             cacheDir: options.cacheDir,
             contributors: mergeContributors(record.contributors, hostContributors),
             env: effectiveEnv,
+            goModReaders: packageReaders,
+            identities: sourceIdentities,
             pluginName: record.label,
             packageOwnership: packageOwnership(record.source, record.label, true),
             source: record.source,
             environmentDigests,
+            environmentWitnesses,
             sourceDigests,
             ttscVersion,
             tsgoVersion,
@@ -358,11 +418,14 @@ function loadProjectPlugins(options) {
             cacheDir: options.cacheDir,
             contributors: linkedContributors,
             env: effectiveEnv,
+            goModReaders: packageReaders,
+            identities: sourceIdentities,
             label: "linked plugin host",
             pluginName: "linked-plugin-host",
             source: node_path_1.default.join(ttscPackageRoot(), "cmd", "utility-host"),
             packageOwnership: packageOwnership(node_path_1.default.join(ttscPackageRoot(), "cmd", "utility-host"), "linked-plugin-host", true),
             environmentDigests,
+            environmentWitnesses,
             sourceDigests,
             ttscVersion,
             tsgoVersion,
@@ -381,10 +444,13 @@ function loadProjectPlugins(options) {
                     cacheDir: options.cacheDir,
                     contributors: record.contributors,
                     env: effectiveEnv,
+                    goModReaders: packageReaders,
+                    identities: sourceIdentities,
                     pluginName: record.label,
                     packageOwnership: packageOwnership(record.source, record.label, false),
                     source: record.source,
                     environmentDigests,
+                    environmentWitnesses,
                     sourceDigests,
                     ttscVersion,
                     tsgoVersion,
@@ -420,6 +486,7 @@ function loadProjectPlugins(options) {
         ...collectHostInputSnapshot(project, context, records, projectHostInputs, revalidateHostInputHashes(projectHostInputHashes, projectHostInputs), revalidateHostInputRealpaths(projectHostInputRealpaths, projectHostInputs)),
         descriptorReadsDeclared: loadedEntries.every((entry) => entry.observationsComplete && (0, declaresHostInputReads_1.declaresHostInputReads)(entry.plugin)),
         discoveryInputsComplete: project.configInputsComplete === true,
+        ...(identities === undefined ? {} : { identities }),
         nativePlugins: orderNativePlugins(nativePlugins),
         ...(loadedEntries.some((entry) => !entry.observationsComplete)
             ? { observationsComplete: false }
@@ -434,9 +501,8 @@ function loadProjectPlugins(options) {
             (0, pluginSourceState_1.pluginSourceState)(directory, {
                 env: effectiveEnv,
                 sourceDigest,
-                ...(environmentDigests.has(directory)
-                    ? { environment: environmentDigests.get(directory) }
-                    : {}),
+                environment: environmentDigests.get(directory) ??
+                    (0, pluginBuildEnvironment_1.pluginBuildEnvironment)(directory, effectiveEnv, undefined, sourceIdentities),
             }),
         ])),
         project,
@@ -852,7 +918,7 @@ function loadPluginDescriptor(request, context, effectiveEnv, descriptorCache) {
             !error.retryWithTtsx) {
             throw error;
         }
-        const loaded = loadDescriptorViaTtsx(request, context, effectiveEnv);
+        const loaded = loadDescriptorViaTtsx(request, context, effectiveEnv, descriptorCache.identities);
         if (loaded === undefined) {
             throw error;
         }
@@ -885,20 +951,22 @@ class CommonJsDescriptorLoadError extends Error {
 function loadCommonJsDescriptor(request, context, effectiveEnv, descriptorCache) {
     const runtime = pluginDescriptorRuntimeBinary(effectiveEnv);
     const ttsx = effectiveEnv.TTSC_TTSX_BINARY ?? process.env.TTSC_TTSX_BINARY;
-    const runtimeCapabilities = (0, javascriptRuntimeCapabilities_1.javascriptRuntimeCapabilities)(runtime, effectiveEnv, context.projectRoot);
+    const runtimeCapabilities = (0, javascriptRuntimeCapabilities_1.javascriptRuntimeCapabilities)(runtime, effectiveEnv, context.projectRoot, descriptorCache.identities);
     const node = !runtimeCapabilities.bun &&
         runtimeCapabilities.registerHooks &&
         runtimeCapabilities.executable !== undefined
         ? runtimeCapabilities.executable
-        : (0, resolveNodeBinary_1.resolveNodeBinary)(effectiveEnv, context.projectRoot);
+        : (0, resolveNodeBinary_1.resolveNodeBinary)(effectiveEnv, context.projectRoot, descriptorCache.identities);
     const cacheAuthority = {
         additionalRuntime: node,
         cacheDir: descriptorCache.cacheDir,
+        identities: descriptorCache.identities,
         context,
         // Everything the child receives besides the per-evaluation output paths.
         env: {
             ...effectiveEnv,
             ...(node === undefined ? {} : { TTSC_NODE_BINARY: node }),
+            ...descriptorRecordRoot(descriptorCache.identities),
             TTSC_TTSX_BINARY: ttsx,
         },
         projectRoot: context.projectRoot,
@@ -973,6 +1041,7 @@ function loadCommonJsDescriptor(request, context, effectiveEnv, descriptorCache)
                     // The direct evaluator may be Bun, but ttsx and native config
                     // loaders require a real Node runtime with synchronous hooks.
                     ...(node === undefined ? {} : { TTSC_NODE_BINARY: node }),
+                    ...descriptorRecordRoot(descriptorCache.identities),
                     TTSC_TTSX_BINARY: ttsx,
                     TTSC_PLUGIN_CONTEXT: JSON.stringify(context),
                     TTSC_PLUGIN_DESCRIPTOR_LOAD: "1",
@@ -1229,11 +1298,11 @@ const TS_SOURCE_PATTERN = /\.(?:[cm]?ts|tsx)$/i;
  * shim with plugins disabled across the whole graph. Returns `undefined` when
  * `ttsx` is unavailable, so the caller can rethrow the original load error.
  */
-function loadDescriptorViaTtsx(request, context, effectiveEnv) {
+function loadDescriptorViaTtsx(request, context, effectiveEnv, identities) {
     // Binary discovery prefers the instance environment, then the ambient
     // process.env (where `withPluginLoaderEnv` injects ttsc's own node/ttsx paths
     // just before this runs), then the running interpreter.
-    const node = (0, resolveNodeBinary_1.resolveNodeBinary)(effectiveEnv, context.projectRoot);
+    const node = (0, resolveNodeBinary_1.resolveNodeBinary)(effectiveEnv, context.projectRoot, identities);
     const ttsx = effectiveEnv.TTSC_TTSX_BINARY ?? process.env.TTSC_TTSX_BINARY;
     if (node === undefined || ttsx === undefined || ttsx.length === 0) {
         return undefined;
@@ -1264,6 +1333,7 @@ function loadDescriptorViaTtsx(request, context, effectiveEnv) {
                 // may recurse into further descriptor loads) finds them even when the
                 // instance-env snapshot predates `withPluginLoaderEnv`.
                 TTSC_NODE_BINARY: node,
+                ...descriptorRecordRoot(identities),
                 TTSC_TTSX_BINARY: ttsx,
                 TTSC_PLUGIN_CONTEXT: JSON.stringify({
                     binary: context.binary,
@@ -1328,6 +1398,17 @@ ${reason}`);
         removeEvaluationTempDir(dir);
     }
 }
+/**
+ * The private variable that hands a descriptor evaluator the plugin cache root
+ * this load's record store selected, so the child proves the compiler it runs
+ * from that root's records instead of streaming it (#1726) and never selects a
+ * cache root of its own. Absent without a store.
+ */
+function descriptorRecordRoot(identities) {
+    return identities === undefined
+        ? {}
+        : { TTSC_PLUGIN_RECORD_ROOT: identities.root };
+}
 /**
  * Expand the ttsx runtime's selected module edges into the same exact and
  * missing resolution inputs used by the direct isolated evaluator.
@@ -1388,6 +1469,11 @@ function readTtsxDescriptorInputs(file, request, observation) {
             if (typeof record.signature !== "string" ||
                 (signatures.has(resolved) &&
                     signatures.get(resolved) !== record.signature)) {
+                E2ETrace_1.E2ETrace.capabilityResolution("plugin-descriptor-input-signature-moved", {
+                    resolved,
+                    first: signatures.get(resolved),
+                    later: typeof record.signature === "string" ? record.signature : null,
+                });
                 hashes.delete(resolved);
                 realpaths.delete(resolved);
                 signatures.delete(resolved);
@@ -1452,10 +1538,10 @@ function readTtsxDescriptorInputs(file, request, observation) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-function withPluginLoaderEnv(run) {
+function withPluginLoaderEnv(run, identities) {
     const previousNode = process.env.TTSC_NODE_BINARY;
     const previousTtsx = process.env.TTSC_TTSX_BINARY;
-    const node = (0, resolveNodeBinary_1.resolveNodeBinary)({}, process.cwd());
+    const node = (0, resolveNodeBinary_1.resolveNodeBinary)({}, process.cwd(), identities);
     if (process.env.TTSC_NODE_BINARY === undefined && node !== undefined) {
         process.env.TTSC_NODE_BINARY = node;
     }
@@ -1530,12 +1616,12 @@ function resolvePluginSource(source, projectRoot) {
  * that it replaces a module with, which the build compiles in place
  * (`pluginModuleReplaceDirectories`).
  */
-function pluginBuildDirectories(records, env, replacements) {
+function pluginBuildDirectories(records, env, replacements, readers) {
     const directories = new Set();
     for (const record of records) {
         directories.add(node_path_1.default.resolve(record.kind === "linked" ? record.packageDir : record.moduleRoot));
         if (record.kind === "executable") {
-            for (const directory of pluginReplacementWatchDirectories(record.moduleRoot, env, replacements))
+            for (const directory of pluginReplacementWatchDirectories(record.moduleRoot, env, replacements, readers))
                 directories.add(directory);
         }
         for (const contributor of record.contributors ?? [])
@@ -1548,14 +1634,13 @@ function pluginBuildDirectories(records, env, replacements) {
  * The load shares this best-effort watch projection, not package validity or a
  * cross-load manifest cache. Go metadata/build admission still owns errors.
  */
-function pluginReplacementWatchDirectories(moduleRoot, env, observed) {
+function pluginReplacementWatchDirectories(moduleRoot, env, observed, readers) {
     const previous = observed?.get(moduleRoot);
     if (previous !== undefined)
         return previous;
     let directories;
     try {
-        directories = (0, pluginModuleReplaceDirectories_1.pluginModuleReplaceDirectories)(moduleRoot, env)
-            .map((replacement) => replacement.directory);
+        directories = (0, pluginModuleReplaceDirectories_1.pluginModuleReplaceDirectories)(moduleRoot, env, undefined, undefined, readers).map((replacement) => replacement.directory);
     }
     catch {
         // An unreadable manifest/tool is not valid metadata. The already observed