@vzn/vx-migrate 0.0.640 → 0.0.641

package/README.md

@@ -231,7 +231,7 @@ It is the one command a repo needs (`pnpx @vzn/vx-migrate` in a pnpm repo works
 - In a Turbo or Nx repo, in a terminal, it asks which adoption you want: **native** (the default, a `vx.config.ts` per package) or **keep** (a workspace file declaring `turbo()` or `nx()`). `--native` / `--keep` answer it; with no terminal (CI, a pipe) it is native. Elsewhere both are refused. A repo already set up (a workspace file declaring neither, and project configs) is said to be, exit 0, unless `--force`.
 - Native or keep, a remote cache the repo shows is declared: `turboCache()` for turbo.json's enabled `remoteCache`, a `turbo link`ed `.turbo/config.json` or a CI file (`.github/workflows/*`, `.gitlab-ci.yml`, `.circleci/config.yml`) setting `TURBO_TOKEN`; `nxCache()` for one setting `NX_SELF_HOSTED_REMOTE_CACHE_SERVER`. The report names the file that showed it. Nx Cloud (`nxCloudId`, `nxCloudAccessToken`, the `nx-cloud` runner) is named instead: vx does not speak its wire.
 - With no `.vx/workspace.*` yet, it writes one declaring the plugins the repo calls for (`src/workspace-plugins.ts`): the remote cache above, the `@vzn/vx-lockfile` factory for the lockfile (`pnpm()`, `bun()`, `npm()`, `yarn()`), `scheduleHistoryPlugin()`, and `github()` when `.github/workflows` exists, from `@vzn/vx-ci`, each installed beside `@vzn/vx` at vx-migrate's own version. Keep adds them to the file it writes, or to one already in that shape; any other workspace file is the user's and left alone. Native over a file vx wrote (a keep adoption's) rewrites it: `turbo()` and `nx()` go, since the configs written replace them, and the other plugins stay.
-- It installs what the written files import with the repo's own manager (`packageManager`, else the lockfile): `@vzn/vx`, the declared plugins' packages, and `@vzn/vx-migrate` for keep or when a written task runs its `nx-exec` or `nx-env` bin (`pnpm add -D -w`, `yarn add -D -W` on Yarn 1 and without `-W` on Yarn 2+, `bun add -d`, `npm install -D`). A package the root both lists and has installed at vx-migrate's own version is left alone; any other is installed at that version, and so is every other `@vzn/vx-*` plugin the root lists from the registry (one install moves them together, as `vx upgrade` does). Native removes a listed `@vzn/vx-migrate` when nothing written needs it (no `nx-exec` / `nx-env` task, no `turboCache()` or `nxCache()` left in the workspace file): `pnpm remove -w`, `yarn remove` (`-W` on Yarn 1), `bun remove`, `npm uninstall`. `--no-install` skips both. vx-migrate runs only with the `@vzn/vx` of its own release, which it installs: one of another release (a `bun x` install directory keeps the one it had) is refused, naming where it was loaded.
+- It installs what the written files import with the repo's own manager (`packageManager`, else the lockfile): `@vzn/vx`, every `@vzn/vx-*` package the workspace file imports (one an earlier init wrote included), and `@vzn/vx-migrate` for keep or when a written task runs its `nx-exec` or `nx-env` bin (`pnpm add -D -w`, `yarn add -D -W` on Yarn 1 and without `-W` on Yarn 2+, `bun add -d`, `npm install -D`). A package the root both lists and has installed at vx-migrate's own version is left alone; any other is installed at that version, and so is every other `@vzn/vx-*` plugin the root lists from the registry (one install moves them together, as `vx upgrade` does). Native removes a listed `@vzn/vx-migrate` when nothing written needs it (no `nx-exec` / `nx-env` task, no `turboCache()` or `nxCache()` left in the workspace file): `pnpm remove -w`, `yarn remove` (`-W` on Yarn 1), `bun remove`, `npm uninstall`. `--no-install` skips both. vx-migrate runs only with the `@vzn/vx` of its own release, which it installs: one of another release (a `bun x` install directory keeps the one it had) is refused, naming where it was loaded.
 - Native, once the files are written, it ends with `vx lock`: `.vx/projects.lock.json` is written and the graph rules are checked, its line the report's `lock` row. A refusal prints above the report and the configs stay written (exit 0). `--no-install` skips it, since the plugins the workspace file declares are not installed yet, and `next` then starts with `vx lock`.
 
 A Lerna repo is an Nx one: Lerna 6+ runs `lerna run` on Nx's task runner over the graph `nx graph` exports, nx.json or not, so a `lerna.json` with no nx.json and no turbo.json is mapped from that graph, and keep writes the workspace file declaring `nx()`. Lerna is the installed one, else the root manifest's range; with neither, the lerna.json is another tool's (lerna-lite reads it too, and runs no Nx). A root whose scripts never `lerna run` runs its tasks another way and publishes with Lerna (webdriverio: `run-s`, `pnpm -r`), so its scripts stay the source. Not where Lerna runs its own runner: `useNx: false`, or Lerna 5 without `useNx: true`; those map their scripts. Beside turbo.json, Turbo runs the tasks and Lerna only publishes: turbo.json is the source.
@@ -600,7 +600,7 @@ The Nx spec has no existence probe, so `has` (the `--dry` prediction; the prefet
 - Three outages in a row (no connection, no answer within the deadline, or a `5xx` once the resends are spent) open Turbo's outage breaker: no request is sent for 30 s, each lookup is a miss at once, then one request probes and its answer closes or reopens it. A hit is judged when its body ends, so a server that sends headers and then stalls the body counts the same way. A hung server costs three deadlines, not one per task.
 - A refused token (`401`/`403`) warns **once** and turns the layer off for the rest of the process (a `403` on an upload is a read-only token — Nx's spec, or turborepo-remote-cache's `READ_ONLY` and write-less JWTs: it turns off uploads alone, and reads go on) — including the requests already in flight when the refusal lands, which degrade in silence rather than repeating it (a six-project run printed five identical lines before 2026-09-20).
 - Policy (`--cache-policy=remote:r`, `VX_CACHE_POLICY`, `cache.policy`) is enforced by core, which layers each plugin's remote over the local cache — a read-only token pairs naturally with `remote:r`.
-- Each tool's own switches narrow that policy, never widen it, as they do for the tool: `TURBO_CACHE` (`--cache-policy`'s syntax, an omitted source off) and `TURBO_REMOTE_CACHE_READ_ONLY` for `turboCache()`, `NX_SKIP_REMOTE_CACHE` / `NX_DISABLE_REMOTE_CACHE` (`true`) for `nxCache()`. A CI that keeps untrusted pull requests off the shared cache that way keeps vx off it too.
+- Core's policy alone decides reads and writes: the plugins read none of Turbo's or Nx's own switches (`TURBO_CACHE`, `TURBO_REMOTE_CACHE_READ_ONLY`, `NX_SKIP_REMOTE_CACHE`, `NX_DISABLE_REMOTE_CACHE`). A CI that keeps untrusted pull requests off the shared cache sets `cache.policy` or `--cache-policy=local:rw,remote:r` for them.
 
 ## Testing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-migrate",
-  "version": "0.0.640",
+  "version": "0.0.641",
   "license": "MIT",
   "description": "Adopt @vzn/vx from Turborepo, Nx or package.json scripts: run the repo unchanged, migrate it to vx.config.ts, and keep your Turbo or Nx remote cache",
   "keywords": [
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.640"
+    "@vzn/vx": "^0.0.641"
   },
   "repository": {
     "type": "git",

package/src/adopt.ts

@@ -175,6 +175,21 @@ export function listedPlugins(root: string): string[] {
   return [...plugins].sort()
 }
 
+/**
+ * The `@vzn/vx*` packages a workspace file imports, parsed, not matched (a
+ * formatter's quotes hid a match). Each is installed with core: a file an
+ * earlier init wrote imports @vzn/vx-lockfile that package.json need not
+ * list, and the lock could not find it (M, 2026-10-16).
+ */
+export function importedPackages(text: string): string[] {
+  const out = new Set<string>()
+  for (const i of new Bun.Transpiler({ loader: 'ts' }).scanImports(text)) {
+    const m = /^(@vzn\/vx(?:-[^/]+)?)(?:\/|$)/.exec(i.path)
+    if (m !== null) out.add(m[1]!)
+  }
+  return [...out].sort()
+}
+
 /** Install `packages` (at `version`, given one) with the repo's manager; its output only on failure. */
 export function install(
   root: string,

package/src/migrate.ts

@@ -45,6 +45,7 @@ import { exportGraph, nxBin } from './nx/export-graph.js'
 import { readNxJson } from './nx/nx-map.js'
 import {
   type AdoptionMode,
+  importedPackages,
   install,
   installArgv,
   listedPackages,
@@ -358,11 +359,8 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
   const finalWorkspace = workspaceText ?? readFileSync(path.join(root, existingWorkspace!), 'utf8')
   // Imports parsed, not matched: a formatter's double quotes hid it, and
   // the file still imported the package removed (owner, 2026-10-16).
-  const needsSelf =
-    runsBins ||
-    new Bun.Transpiler({ loader: 'ts' })
-      .scanImports(finalWorkspace)
-      .some((i) => i.path === '@vzn/vx-migrate')
+  const imported = importedPackages(finalWorkspace)
+  const needsSelf = runsBins || imported.includes('@vzn/vx-migrate')
   const cacheNote =
     runner === 'vite-task'
       ? undefined
@@ -381,6 +379,7 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
                 '@vzn/vx',
                 ...(needsSelf ? ['@vzn/vx-migrate'] : []),
                 ...plugins.map((p) => p.pkg),
+                ...imported,
               ]),
             ],
             parsed,
@@ -544,7 +543,14 @@ async function keep(
   const declares = before === undefined || extended !== null
   const steps = await prepareRepo(
     root,
-    [...new Set(['@vzn/vx', '@vzn/vx-migrate', ...(declares ? all.map((p) => p.pkg) : [])])],
+    [
+      ...new Set([
+        '@vzn/vx',
+        '@vzn/vx-migrate',
+        ...(declares ? all.map((p) => p.pkg) : []),
+        ...importedPackages(text),
+      ]),
+    ],
     args,
   )
   if (args.json)
@@ -633,8 +639,8 @@ function lockRow(lock: { code: number; said: string }): ui.FieldRow {
   ]
 }
 
-/** `.vx/.gitignore`'s text, as core writes it: the machine-local cache stays out of git. */
-const DOT_VX_GITIGNORE = '/cache\n'
+/** `.vx/.gitignore`'s text, as core writes it: the machine-local cache and restore staging stay out of git. */
+const DOT_VX_GITIGNORE = '/cache\n/tmp\n'
 
 // npx and bunx name the package: their bare `vx` is a stranger's npm package.
 const EXEC: Record<PackageManager, string> = {

package/src/nx-cache/index.ts

@@ -46,10 +46,6 @@ export function resolveNxCacheConfig(
   options: NxCacheOptions,
   env: Record<string, string | undefined> = Bun.env,
 ): NxCacheConfig | undefined {
-  // Nx's own off switches (`skipRemoteCache`): a CI that sets one for an
-  // untrusted pull request kept Nx off the shared cache and not vx.
-  if (env['NX_SKIP_REMOTE_CACHE'] === 'true' || env['NX_DISABLE_REMOTE_CACHE'] === 'true')
-    return undefined
   const server = (options.server ?? env['NX_SELF_HOSTED_REMOTE_CACHE_SERVER'])?.replace(/\/+$/, '')
   if (!server) return undefined
   // The URL is printed in every refusal line, so a `user:pass@` in it would

package/src/turbo-cache/index.ts

@@ -393,8 +393,6 @@ export class TurboRemoteCache implements RemoteCacheLayer {
   private readonly absent = new Set<string>()
   private readonly key: Uint8Array | undefined
   readonly endpoint: string
-  /** What `TURBO_REMOTE_CACHE_READ_ONLY` and friends leave this run (`turboRemoteAccess`). */
-  access?: { read: boolean; write: boolean }
   constructor(
     private readonly config: TurboCacheConfig,
     private readonly fetchImpl: typeof fetch = fetch,
@@ -653,37 +651,6 @@ export class TurboRemoteCache implements RemoteCacheLayer {
   }
 }
 
-/**
- * What Turbo's own switches leave of the remote cache: `TURBO_CACHE`
- * (`--cache-policy`'s syntax, where an omitted source is off) and
- * `TURBO_REMOTE_CACHE_READ_ONLY`. A CI that sets either for an untrusted
- * pull request kept Turbo from writing the shared cache and not vx. They
- * only narrow what `--cache-policy` allows, never widen it.
- */
-export function turboRemoteAccess(env: Record<string, string | undefined>): {
-  read: boolean
-  write: boolean
-} {
-  let read = true
-  let write = true
-  const spec = env['TURBO_CACHE']
-  if (spec !== undefined && spec !== '') {
-    read = write = false
-    for (const part of spec.split(',')) {
-      const m = /^(local|remote):([rw]*)$/.exec(part.trim())
-      if (m === null)
-        throw new Error(
-          `vx/turbo-cache: TURBO_CACHE ${JSON.stringify(spec)} is not --cache-policy's syntax (e.g. local:rw,remote:r)`,
-        )
-      if (m[1] !== 'remote') continue
-      read = m[2]!.includes('r')
-      write = m[2]!.includes('w')
-    }
-  }
-  if (/^(1|true)$/i.test(env['TURBO_REMOTE_CACHE_READ_ONLY'] ?? '')) write = false
-  return { read, write }
-}
-
 /**
  * The repo's `.turbo/config.json`, by Turbo's field names and their
  * aliases (`apiurl`, `ApiUrl`, `APIURL`, …); `{}` when absent or unreadable.
@@ -757,14 +724,10 @@ export function turboCache(options: TurboCacheOptions = {}): VxPlugin {
         localConfigOf(ctx.workspaceRoot),
       )
       if (config === undefined) return undefined
-      const access = turboRemoteAccess(Bun.env)
-      if (!access.read && !access.write) return undefined
       // A signed download waits in a temp until its tag checks: in vx's
       // cache directory, which the sandbox walls, not the shared temp dir a
       // sandboxed task may read (L-45).
-      const remote = new TurboRemoteCache(config, fetch, ctx.cacheDir)
-      remote.access = access
-      return remote
+      return new TurboRemoteCache(config, fetch, ctx.cacheDir)
     },
   })
 }