@vzn/vx-migrate 0.0.651 → 0.0.653

package/src/remote-refusal.ts

@@ -1,14 +1,57 @@
 /** How long the body's first chunk is waited for: a refusal is not held on a body that never comes. */
 const BODY_WAIT_MS = 1_000
 
+/**
+ * The most of the first chunk read: a token that starts within the line's
+ * 200 characters must end within it to be hidden whole (a JWT is ~1 KB).
+ */
+const READ_BYTES = 4096
+
+/** Shorter values are not hidden, as core masks none under 6 characters: each would blank common words. */
+const MIN_TOKEN_CHARS = 6
+
+/**
+ * `text` with each of `tokens` written `***`: a server that quoted a
+ * request's Authorization header printed the token to the CI log and
+ * cache.db, as core masks only secret-named variables.
+ */
+export function hideTokens(text: string, tokens: Iterable<string | undefined>): string {
+  let out = text
+  for (const token of tokens)
+    if (token !== undefined && token.length >= MIN_TOKEN_CHARS) out = out.replaceAll(token, '***')
+  return out
+}
+
+/** `work`, each error it throws with `hide` applied: a thrown fetch error can quote a request's header. */
+export async function hidingErrors<T>(
+  work: Promise<T>,
+  hide: (text: string) => string,
+): Promise<T> {
+  try {
+    return await work
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    const hidden = hide(message)
+    if (hidden === message) throw err
+    // The code is how core groups a failure (a reset connection), and a retry reads it.
+    const code = (err as { code?: unknown } | null)?.code
+    throw Object.assign(new Error(hidden), code === undefined ? {} : { code })
+  }
+}
+
 /**
  * A remote's refusal, named by its status and its own words: "HTTP 500"
  * alone said nothing, and a batch query Vercel refused with 400 "Too many
  * hashes. Limit is 100." read as no answer and was never seen (main
- * f71b377, 2026-10-23). One line of the body, bounded: it is remote text.
- * Shared by `turboCache()` and `nxCache()`.
+ * f71b377, 2026-10-23). One line of the body, bounded: it is remote text,
+ * each token `hide` knows written `***` before the cut, so none is left in
+ * part. Shared by `turboCache()` and `nxCache()`.
  */
-export async function refusal(res: Response, what = ''): Promise<Error> {
+export async function refusal(
+  res: Response,
+  hide: (text: string) => string,
+  what = '',
+): Promise<Error> {
   let said = ''
   try {
     const reader = res.body?.getReader()
@@ -22,7 +65,9 @@ export async function refusal(res: Response, what = ''): Promise<Error> {
       ]).finally(() => clearTimeout(timer))
       // quiet: read no further; a cancel that fails has nothing left to free
       void reader.cancel().catch(() => undefined)
-      said = new TextDecoder().decode(first?.value?.subarray(0, 512)).replace(/\s+/g, ' ').trim()
+      said = hide(new TextDecoder().decode(first?.value?.subarray(0, READ_BYTES)))
+        .replace(/\s+/g, ' ')
+        .trim()
     }
   } catch {
     // quiet: the status alone still names the refusal

package/src/shared-outputs.ts

@@ -179,8 +179,8 @@ interface Cached {
 function cachedOutputs(t: GeneratedTask, index: number): Cached | null {
   const task = t.task
   if (task === null) return null
-  const cache = task['cache'] as { outputs?: { files?: unknown } } | undefined
-  const files = cache?.outputs?.files
+  const outputs = task['outputs'] as { files?: unknown } | undefined
+  const files = outputs?.files
   if (!Array.isArray(files)) return null
   // Where a task's outputs might land is its positive globs, as core reads
   // them: a `!` compiled as a glob is true of every other path.
@@ -267,9 +267,7 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
         for (const { k, gb } of pairs) {
           if (k.back.has(gb)) continue
           k.back.add(gb)
-          ;(tasks[k.index]!.task!['cache'] as { outputs: { files: string[] } }).outputs.files.push(
-            `!${gb}`,
-          )
+          ;(tasks[k.index]!.task!['outputs'] as { files: string[] }).files.push(`!${gb}`)
         }
         kept.push(c)
         continue
@@ -289,17 +287,18 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
         sharedFiles.every((g) => isLiteralPattern(g) && TSBUILDINFO.test(g))
       ) {
         c.files = c.files.filter((g) => !sharedFiles.includes(g))
-        const outputs = (t.task!['cache'] as { outputs: { files: string[] } }).outputs
+        const outputs = t.task!['outputs'] as { files: string[] }
         outputs.files = outputs.files.filter((g) => !sharedFiles.includes(g))
         kept.push(c)
         continue
       }
       dropped.add(c.index)
       const shared = c.files.find((gb) => clash.files.some((ga) => hits(clash, ga, gb)))!
-      delete t.task!['cache']
+      const theirs = clash.files.find((ga) => hits(clash, ga, shared))!
+      uncache(t.task!)
       t.todos.push(
-        `declares the output ${JSON.stringify(shared)} that ${JSON.stringify(clash.name)} also ` +
-          "declares — vx cleans a task's outputs before it runs and before a restore, so two " +
+        `declares the output ${sharing(shared, theirs, JSON.stringify(clash.name))} — ` +
+          "vx cleans a task's outputs before it runs and before a restore, so two " +
           "cached tasks on one path would delete each other's work; this one runs uncached. " +
           'Give it its own output path to cache it.',
       )
@@ -308,6 +307,13 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
   return tasks
 }
 
+/** `"<mine>" that <owner> also declares`, or both globs when they only overlap. */
+function sharing(mine: string, theirs: string, owner: string): string {
+  return mine === theirs
+    ? `${JSON.stringify(mine)} that ${owner} also declares`
+    : `${JSON.stringify(mine)}, which overlaps the output ${JSON.stringify(theirs)} that ${owner} declares`
+}
+
 /**
  * Two globs can match one path only when one's literal prefix is a
  * directory of the other's (`packages/*\/dist/**` and `packages/a/dist/**`),
@@ -369,10 +375,18 @@ export const isKeyedGroup = (t: { readonly task: Record<string, unknown> | null
  * alone, its incomplete key still let a dependant hit stale.
  */
 export function unkey(task: Record<string, unknown>): void {
-  delete task['cache']
+  uncache(task)
   delete task['inputs']
 }
 
+/** No cache: `outputs` and `inputs.stability` go with it, as they mean nothing without. */
+export function uncache(task: Record<string, unknown>): void {
+  delete task['cache']
+  delete task['outputs']
+  const inputs = task['inputs'] as Record<string, unknown> | undefined
+  if (inputs !== undefined) delete inputs['stability']
+}
+
 /** A task's `inputs` block, when it has one with a `files` list. */
 function inputsOf(t: GeneratedTask): { files: string[]; workspaceFiles?: unknown } | undefined {
   const inputs = t.task?.['inputs'] as { files?: unknown } | undefined
@@ -391,10 +405,17 @@ function inputsOf(t: GeneratedTask): { files: string[]; workspaceFiles?: unknown
  * files git tracks, and a build's outputs are not, so the adopted tool
  * never keyed them either. A literal input another task writes cannot be
  * taken back (core refuses a `!` over a literal input), so that task runs
- * uncached with a todo. A reader whose `!` hides a committed file is the
- * tracked pass's (`spareTrackedOutputs`).
+ * uncached with a todo. Under `walksGlobs` (Turbo) so does a glob that
+ * names the output's place (`gen/**` beside a `gen` writing `gen/**`)
+ * when no `dependsOn` path reaches the writer: Turbo walks an explicit
+ * glob on disk, and with no edge the writer's key does not reach the
+ * reader's either, so taken back it replayed the old output. A glob led
+ * by `**` walks the whole package, as the default does, and keeps the
+ * `!`. Nx hashes no gitignored file, and its mapper drops an input under
+ * an untracked output before this pass. A reader whose `!` hides a
+ * committed file is the tracked pass's (`spareTrackedOutputs`).
  */
-export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
+export function excludeSiblingOutputs(tasks: GeneratedTask[], walksGlobs = false): GeneratedTask[] {
   const writers = tasks.flatMap((t, index) => {
     const c = cachedOutputs(t, index)
     return c === null ? [] : [c]
@@ -421,6 +442,18 @@ export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
           )
           return
         }
+        const named = walksGlobs
+          ? read.find((g) => !g.replace(/^(\.\/)+/, '').startsWith('**'))
+          : undefined
+        if (named !== undefined && !isKeyedGroup(t) && !reaches(tasks, index, w.index)) {
+          unkey(t.task!)
+          t.todos.push(
+            `reads ${JSON.stringify(named)}, which ${JSON.stringify(w.name)} writes and no ` +
+              'dependsOn reaches — vx keys a task only on files no other task writes, so it runs ' +
+              'uncached; add the edge or read the source instead in a vx.config to cache it',
+          )
+          return
+        }
         inputs.files.push(`!${out}`)
       }
     }
@@ -428,6 +461,26 @@ export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
   return tasks
 }
 
+/** Does a same-project `dependsOn` path lead from task `from` to task `to`? */
+function reaches(tasks: readonly GeneratedTask[], from: number, to: number): boolean {
+  const byName = new Map(tasks.map((t, i) => [t.name, i]))
+  const seen = new Set([from])
+  const queue = [from]
+  for (let i = queue.shift(); i !== undefined; i = queue.shift()) {
+    const deps = tasks[i]!.task?.['dependsOn']
+    if (!Array.isArray(deps)) continue
+    for (const d of deps) {
+      const next = typeof d === 'string' ? byName.get(d) : undefined
+      if (next === to) return true
+      if (next !== undefined && !seen.has(next)) {
+        seen.add(next)
+        queue.push(next)
+      }
+    }
+  }
+  return false
+}
+
 /**
  * The same across projects, for workspace outputs: cal.com's shared
  * `post-install` writes `../../node_modules/@prisma/client/**` from every
@@ -457,11 +510,11 @@ export function resolveSharedWorkspaceOutputs(
   for (const p of projects) {
     const rel = relPosix(root, p.dir)
     for (const t of p.tasks) {
-      const cache = t.task?.['cache'] as
-        | { outputs?: { files?: unknown; workspaceFiles?: unknown } }
+      const outputs = t.task?.['outputs'] as
+        | { files?: unknown; workspaceFiles?: unknown }
         | undefined
-      const ws = positive(cache?.outputs?.workspaceFiles)
-      const own = positive(cache?.outputs?.files).map((g) =>
+      const ws = positive(outputs?.workspaceFiles)
+      const own = positive(outputs?.files).map((g) =>
         rel === '' ? g.replace(/^(\.\/)+/, '') : `${rel}/${g.replace(/^(\.\/)+/, '')}`,
       )
       if (ws.length === 0 && own.length === 0) continue
@@ -470,11 +523,19 @@ export function resolveSharedWorkspaceOutputs(
         a.find((g) => b.some((h) => outputsOverlap(h, g)))
       let clash: (typeof kept)[number] | undefined
       let shared: string | undefined
+      let theirs: string | undefined
       for (const i of candidates([...ws, ...own])) {
         const k = kept[i]!
-        shared =
-          overlap(ws, [...k.ws, ...k.own]) ??
-          overlap(own, k.project === p.name ? k.ws : [...k.ws, ...k.own])
+        const pools: [string[], string[]][] = [
+          [ws, [...k.ws, ...k.own]],
+          [own, k.project === p.name ? k.ws : [...k.ws, ...k.own]],
+        ]
+        for (const [mine, other] of pools) {
+          shared = overlap(mine, other)
+          if (shared === undefined) continue
+          theirs = other.find((h) => outputsOverlap(h, shared!))
+          break
+        }
         if (shared !== undefined) {
           clash = k
           break
@@ -485,9 +546,9 @@ export function resolveSharedWorkspaceOutputs(
         kept.push({ id: `${p.name}#${t.name}`, project: p.name, ws, own })
         continue
       }
-      delete t.task!['cache']
+      uncache(t.task!)
       t.todos.push(
-        `declares the workspace output ${JSON.stringify(shared)} that ${clash.id} also declares — ` +
+        `declares the workspace output ${sharing(shared!, theirs!, clash.id)} — ` +
           "vx cleans a task's outputs before it runs and before a restore, so two cached tasks " +
           "on one path would delete each other's work; this one runs uncached. Give it its own " +
           'output path to cache it.',
@@ -525,9 +586,9 @@ export function excludeWorkspaceOutputs(
   for (const p of projects) {
     const rel = relPosix(root, p.dir)
     for (const t of p.tasks) {
-      const outputs = (
-        t.task?.['cache'] as { outputs?: { files?: unknown; workspaceFiles?: unknown } } | undefined
-      )?.outputs
+      const outputs = t.task?.['outputs'] as
+        | { files?: unknown; workspaceFiles?: unknown }
+        | undefined
       const globs = [
         ...positive(outputs?.workspaceFiles),
         ...positive(outputs?.files).map((g) =>

package/src/tracked-outputs.ts

@@ -72,6 +72,47 @@ export async function gitIgnored(root: string, rels: readonly string[]): Promise
   }
 }
 
+/**
+ * What git ignores under the fixed prefixes of the root-relative `globs`:
+ * each ignored file, and a directory ignored whole (or holding only
+ * ignored files) as one `dir/` entry (`--directory`: `dist/` is never
+ * walked). Entries under `node_modules` (the lockfile keys an install) or
+ * vx's own `.vx/` are left out. One spawn; empty outside a repo or
+ * without git.
+ */
+export async function gitIgnoredUnder(root: string, globs: readonly string[]): Promise<string[]> {
+  if (globs.length === 0) return []
+  const prefixes = [...new Set(globs.map((g) => literalPrefix(g) || '.'))].sort()
+  // A prefix under another adds nothing; `ls-files` takes no pathspec file.
+  const kept = prefixes.includes('.')
+    ? ['.']
+    : prefixes.filter((p, i) => !prefixes.slice(0, i).some((q) => p.startsWith(`${q}/`)))
+  try {
+    const p = Bun.spawn(
+      [
+        'git',
+        'ls-files',
+        '-z',
+        '--others',
+        '--ignored',
+        '--exclude-standard',
+        '--directory',
+        '--no-empty-directory',
+        '--',
+        ...kept,
+      ],
+      { cwd: root, stdout: 'pipe', stderr: 'ignore' },
+    )
+    const out = await new Response(p.stdout).text()
+    if ((await p.exited) !== 0) return []
+    return out
+      .split('\0')
+      .filter((f) => f !== '' && !f.startsWith('.vx/') && !f.split('/').includes('node_modules'))
+  } catch {
+    return []
+  }
+}
+
 /**
  * What a project's tracked files are: their extensions (lower case, no
  * dot), directory names at any depth, and top-level entry names.
@@ -165,18 +206,20 @@ function literalPrefix(glob: string): string {
   return out.join('/')
 }
 
-/** The tracked `files` (relative to the same base as `globs`) the positive globs cover and no `!` takes back. */
+/**
+ * The tracked `files` (relative to the same base as `globs`) the positive
+ * globs cover, even one the globs' own `!` takes back: a reader's take-back
+ * is of the positives alone (`excludeSiblingOutputs`), so its `!*\/**`
+ * beside a `*\/**` minus `!src/**` output still hid src.
+ */
 function coveredTracked(globs: readonly string[], files: readonly string[]): string[] {
-  const positive = globs.filter((g) => !g.startsWith('!'))
-  const taken = globs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
   const hit = new Set<string>()
-  for (const g of positive) {
+  for (const g of globs) {
+    if (g.startsWith('!')) continue
     const prefix = literalPrefix(g)
     for (const f of files) {
       if (prefix !== '' && f !== prefix && !f.startsWith(`${prefix}/`)) continue
-      if (!outputsOverlap(g, f)) continue
-      if (taken.some((t) => outputsOverlap(t, f))) continue
-      hit.add(f)
+      if (outputsOverlap(g, f)) hit.add(f)
     }
   }
   return [...hit].sort()
@@ -266,7 +309,7 @@ export function spareTrackedOutputs(
     const rel = relPosix(root, p.dir)
     const own = rel === '' ? tracked : filesUnder(tracked, rel).map((f) => f.slice(rel.length + 1))
     for (const t of p.tasks) {
-      const outputs = (t.task?.['cache'] as { outputs?: Outputs } | undefined)?.outputs
+      const outputs = t.task?.['outputs'] as Outputs | undefined
       if (outputs === undefined) continue
       const hits: [key: 'files' | 'workspaceFiles', hit: string[]][] = []
       for (const [key, base] of [
@@ -275,20 +318,16 @@ export function spareTrackedOutputs(
       ] as const) {
         const globs = outputs[key]
         if (!Array.isArray(globs) || globs.length === 0) continue
-        let strings = globs.filter((g): g is string => typeof g === 'string')
+        const strings = globs.filter((g): g is string => typeof g === 'string')
         // An output naming one committed file (eslint's
-        // `eslint-suppressions.json`) is a source: the entry goes, and so
-        // does the `!` a reader's inputs got for it, or every reader ran
-        // uncached (hono).
+        // `eslint-suppressions.json`, a codegen's `gen.ts`) is also a
+        // source: the `!` a reader's inputs got for it goes, or every
+        // reader ran uncached (hono). The entry stays: dropped, a task
+        // that rewrites the file never saved.
         const rootedOf = (g: string) => (key === 'files' && rel !== '' ? `${rel}/${g}` : g)
-        const sources = new Set(
-          strings.filter((g) => isLiteralPattern(g) && trackedSet.has(rootedOf(g))),
-        )
-        if (sources.size > 0) {
-          strings = strings.filter((g) => !sources.has(g.startsWith('!') ? g.slice(1) : g))
-          outputs[key] = strings
-          for (const g of sources) unhide(key === 'files' ? p : null, rootedOf(g))
-        }
+        for (const g of strings)
+          if (isLiteralPattern(g) && trackedSet.has(rootedOf(g)))
+            unhide(key === 'files' ? p : null, rootedOf(g))
         const hit = coveredTracked(strings, base)
         if (hit.length > 0) hits.push([key, hit])
       }

package/src/turbo/index.ts

@@ -18,7 +18,7 @@ import { refuseUnknownOptions, UserError, type PluginOptionKinds } from '@vzn/vx
 import { type AdoptionRun, adoptionPlugin } from '../adoption-plugin.js'
 import type { AdoptionMapping } from '../mapping-cache.js'
 import { collectGaps } from '../plugin-gaps.js'
-import { gitIgnored, trackedKinds } from '../tracked-outputs.js'
+import { gitIgnored, gitIgnoredUnder, trackedKinds } from '../tracked-outputs.js'
 import { packageScripts, relPosix } from '../paths.js'
 import { onceReader, type ReadText, tscBuildInfo } from '../tsc-buildinfo.js'
 import type * as TurboMap from './turbo-map.js'
@@ -317,6 +317,7 @@ async function mapAll(
     ...(tracked === null ? {} : { tracked: trackedKinds(tracked) }),
     ownConfig: (rel) => configs.get(rel === '.' ? '' : rel) ?? null,
     ignored: (rels) => gitIgnored(root, rels),
+    ignoredUnder: (globs) => gitIgnoredUnder(root, globs),
     buildInfo: (rel, command) => tscBuildInfo(read, path.join(root, rel), command),
   })
   const byName = new Map<string, TurboMappedProject>()