@vzn/vx 0.0.100 → 0.0.102

package/src/util/errors.ts

@@ -49,6 +49,21 @@ export function isDiskFull(err: unknown): err is NodeJS.ErrnoException {
   return code === 'ENOSPC' || code === 'EDQUOT'
 }
 
+/**
+ * `EMFILE` or `ENFILE`: the process or the system is out of file
+ * descriptors. macOS starts a shell at 256, which a large workspace's
+ * config load and input walk can reach; the stack it printed named a file
+ * that was fine.
+ */
+export function isOutOfFds(err: unknown): err is NodeJS.ErrnoException {
+  if (!(err instanceof Error)) return false
+  const code = (err as NodeJS.ErrnoException).code
+  return code === 'EMFILE' || code === 'ENFILE'
+}
+
+export const OUT_OF_FDS_HINT =
+  'the process is out of file descriptors; raise the limit (ulimit -n 4096) and re-run'
+
 /** A file system refusing a write for a reason no code path caused: permission or space. */
 export function isFsRefusal(err: unknown): err is NodeJS.ErrnoException {
   return isPermissionError(err) || isDiskFull(err)

package/src/util/index.ts

@@ -14,6 +14,8 @@ export {
   UserError,
   gitSpawnRefusal,
   isExecutableMissing,
+  isOutOfFds,
+  OUT_OF_FDS_HINT,
 } from './errors.js'
 export { xxh3, xxh3hex } from './hash.js'
 export { mark, printTimings, span } from './timing.js'
@@ -47,5 +49,6 @@ export { splitTaskId } from './task-id.js'
 export { editDistance, nearMatches, nearest } from './edit-distance.js'
 export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
-export { executablePath } from './which.js'
+export { executablePath, shellArgv } from './which.js'
 export { procfsIsOwn } from './procfs.js'
+export { maskedCommand, maskedEmitter, MASKED, secretMask, type SecretMask } from './secret-mask.js'

package/src/util/secret-mask.ts

@@ -0,0 +1,145 @@
+// Masking the values of secret-named variables in what vx prints, stores
+// or hands to telemetry (L-11). A task that echoes `$NPM_TOKEN`, or a
+// TS config that interpolates `process.env.API_KEY` into its command,
+// put the value in the terminal, the cached stdout every later hit
+// replays, and the spans a telemetry plugin exports. The masking is
+// GitHub Actions' kind: a known value is replaced wherever it appears.
+
+/** A variable whose value is masked, by the words its name holds. */
+const SECRET_NAME = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL/i
+
+/**
+ * Names that hold such a word but a value that is no secret: where a
+ * secret lives (`NPM_TOKEN_FILE`), or git's own config channel, whose
+ * `GIT_CONFIG_KEY_<n>` values are config names (`safe.directory`) that
+ * masking would blank out of ordinary output.
+ */
+const NOT_SECRET = /_(FILE|PATH|DIR)$|^GIT_CONFIG_KEY_\d+$/i
+
+/**
+ * Values shorter than this are not masked: `KEY=1` would mask every `1`
+ * in every line, and a value that short is no secret worth the noise.
+ */
+const MIN_SECRET_CHARS = 6
+
+export const MASKED = '***'
+
+export interface SecretMask {
+  /** `text` with every secret value replaced. */
+  mask(text: string): string
+  /**
+   * A mask for a stream of chunks: a value split across two chunks is
+   * still caught, by holding back only a tail that could begin one until
+   * the next chunk or `end`.
+   */
+  stream(): { push(chunk: string): string; end(): string }
+}
+
+/**
+ * The mask for these variables (a process's env, a task's `define`), or
+ * null when none is secret-named with a value worth masking: the common
+ * run pays one name test per variable and nothing per byte.
+ */
+export function secretMask(
+  ...sources: ReadonlyArray<Readonly<Record<string, string | undefined>> | undefined>
+): SecretMask | null {
+  const values = new Set<string>()
+  for (const source of sources) {
+    if (source === undefined) continue
+    for (const name in source) {
+      const value = source[name]
+      if (
+        value !== undefined &&
+        value.length >= MIN_SECRET_CHARS &&
+        SECRET_NAME.test(name) &&
+        !NOT_SECRET.test(name)
+      ) {
+        values.add(value)
+      }
+    }
+  }
+  if (values.size === 0) return null
+  // Longest first, so a value holding another is replaced whole.
+  const sorted = [...values].sort((a, b) => b.length - a.length)
+  const pattern = new RegExp(
+    sorted.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'),
+    'g',
+  )
+  const mask = (text: string): string => text.replace(pattern, MASKED)
+  /** The longest tail of `text` that is a proper prefix of a value. */
+  const partialTail = (text: string): number => {
+    let longest = 0
+    for (const v of sorted) {
+      for (let k = Math.min(v.length - 1, text.length); k > longest; k--) {
+        if (text.endsWith(v.slice(0, k))) {
+          longest = k
+          break
+        }
+      }
+    }
+    return longest
+  }
+  return {
+    mask,
+    stream() {
+      let carry = ''
+      return {
+        push(chunk) {
+          const text = carry + chunk
+          // Held back: only a tail that could begin a value, so output that
+          // cannot be one is never delayed (a `readyWhen` line, a marker).
+          let cut = text.length - partialTail(text)
+          pattern.lastIndex = 0
+          // Never cut through a value that is already whole.
+          for (let m = pattern.exec(text); m !== null; m = pattern.exec(text)) {
+            if (m.index < cut && m.index + m[0].length > cut) cut = m.index
+          }
+          carry = text.slice(cut)
+          return mask(text.slice(0, cut))
+        },
+        end() {
+          const rest = mask(carry)
+          carry = ''
+          return rest
+        },
+      }
+    },
+  }
+}
+
+/** A task's command as vx shows it: its secret-named values masked. */
+export function maskedCommand(command: string, define?: Readonly<Record<string, string>>): string {
+  return secretMask(process.env, define)?.mask(command) ?? command
+}
+
+/**
+ * `mask.stream()` driving `emit`: what it holds back (a tail that could
+ * begin a value) is emitted `idleMs` after the last chunk when none
+ * follows, so a long task's last characters do not wait for its exit. A
+ * value is written whole or in chunks that arrive together; one split by
+ * a pause longer than that is not caught.
+ */
+export function maskedEmitter(
+  mask: SecretMask,
+  emit: (text: string) => void,
+  idleMs = 25,
+): { push(chunk: string): void; end(): void } {
+  const s = mask.stream()
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const end = (): void => {
+    if (timer !== undefined) clearTimeout(timer)
+    timer = undefined
+    const rest = s.end()
+    if (rest) emit(rest)
+  }
+  return {
+    push(chunk) {
+      if (timer !== undefined) clearTimeout(timer)
+      const out = s.push(chunk)
+      if (out) emit(out)
+      timer = setTimeout(end, idleMs)
+      timer.unref?.()
+    },
+    end,
+  }
+}

package/src/util/which.ts

@@ -46,3 +46,15 @@ export function executablePath(name: string): string {
   found.set(name, at)
   return at
 }
+
+/**
+ * The argv that runs `script` in the task shell: `sh -c` on Linux and
+ * macOS, and Bun's own shell (`bun exec`) on Windows, which ships no `sh`
+ * (docs/design/windows-2026-09.md § Decisions 1). Bun's shell reads the
+ * same `&&`, `|`, `$(…)` and `VAR=x cmd` syntax that `bun run` uses there.
+ */
+export function shellArgv(script: string): string[] {
+  return process.platform === 'win32'
+    ? [process.execPath, 'exec', script]
+    : [executablePath('sh'), '-c', script]
+}

package/src/workspace/affected.ts

@@ -7,6 +7,7 @@
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
 import { realpathSync, statSync } from 'node:fs'
+import { realpath } from 'node:fs/promises'
 import path from 'node:path'
 import {
   asTrees,
@@ -240,7 +241,12 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     }
   }
 
-  const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
+  const realDirs = new Map(
+    await Promise.all(
+      args.projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
+    ),
+  )
+  const owned = projectsContaining(args.workspaceRoot, changed, args.projects, realDirs)
   for (const name of claimedOwned) owned.add(name)
 
   // A manifest edit can drop an edge today's graph no longer shows: a
@@ -277,6 +283,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     projects: args.projects,
     changed,
     skip: owned,
+    realDirs,
   })) {
     owned.add(name)
   }
@@ -659,6 +666,7 @@ function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
   projects: readonly ProjectMeta[],
+  realDirs: ReadonlyMap<string, string>,
 ): Set<string> {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
@@ -676,7 +684,7 @@ function projectsContaining(
   // too. One realpath per member, and only on an --affected run.
   const realRoot = realpathOr(workspaceRoot)
   for (const p of projects) {
-    const real = realpathOr(p.dir)
+    const real = realDirs.get(p.dir) ?? p.dir
     const rel = path.relative(realRoot, real)
     if (rel.startsWith('..') || path.isAbsolute(rel)) continue
     const spelled = path.resolve(workspaceRoot, rel)

package/src/workspace/config-cache.ts

@@ -141,8 +141,10 @@ const MAX_CLOSURE_FILES = 32
 // passes: the gate stops accidental impurity, not a config written to
 // defeat it. `random` is denied as a word, not as `Math.random`: a
 // destructured `const { random } = Math` was cached as pure (item 1036).
+// `prompt`, `confirm` and `alert` read the user's terminal, and a cached
+// evaluation replayed the first answer (D-25).
 const IMPURE_RE =
-  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*|Reflect|getPrototypeOf|setPrototypeOf|getOwnPropertyNames|getOwnPropertyDescriptor|getOwnPropertyDescriptors|__proto__|prototype|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__|random)\b|import\s*\.\s*meta|\bimport\s*\(/
+  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*|Reflect|getPrototypeOf|setPrototypeOf|getOwnPropertyNames|getOwnPropertyDescriptor|getOwnPropertyDescriptors|__proto__|prototype|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__|random|prompt|confirm|alert)\b|import\s*\.\s*meta|\bimport\s*\(/
 
 /** Literal text that names a way to `Function` when used as a computed key. */
 const IMPURE_LITERAL_RE = /constructor|__proto__|prototype/

package/src/workspace/config-imports.ts

@@ -25,7 +25,7 @@
 //     closure, and the containment channel already selects the project that
 //     owns it.
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
 import { builtinModules } from 'node:module'
 import path from 'node:path'
@@ -130,11 +130,118 @@ export function unprovidedBareImports(
       if (up === dir) break
       dir = up
     }
-    if (!provided && !out.includes(spec)) out.push(spec)
+    if (!provided && tsconfigTarget(spec, fromDir) === undefined && !out.includes(spec)) {
+      out.push(spec)
+    }
   }
   return out
 }
 
+/** The nearest `tsconfig.json`, else `jsconfig.json`, at or above `dir`: Bun reads that one alone. */
+function nearestTsconfig(dir: string): string | undefined {
+  for (let d = path.resolve(dir); ;) {
+    for (const name of ['tsconfig.json', 'jsconfig.json']) {
+      if (existsSync(path.join(d, name))) return path.join(d, name)
+    }
+    const up = path.dirname(d)
+    if (up === d) return undefined
+    d = up
+  }
+}
+
+interface CompilerPaths {
+  paths?: Record<string, unknown>
+  /** What `paths` targets resolve against: `baseUrl`, else the config's own dir. */
+  pathsBase?: string
+  baseUrl?: string
+}
+
+/**
+ * `compilerOptions.paths` and `baseUrl` after `extends`, each resolved
+ * against the config that set it. A package `extends` is not followed: its
+ * paths are unseen, so a specifier only they map stays refused.
+ */
+function compilerPaths(file: string, depth = 0): CompilerPaths {
+  let json: unknown
+  try {
+    json = Bun.JSONC.parse(readFileSync(file, 'utf8'))
+  } catch {
+    return {}
+  }
+  if (typeof json !== 'object' || json === null) return {}
+  const dir = path.dirname(file)
+  const out: CompilerPaths = {}
+  const ext = (json as { extends?: unknown }).extends
+  for (const base of typeof ext === 'string' ? [ext] : Array.isArray(ext) ? ext : []) {
+    if (depth > 8 || typeof base !== 'string' || !base.startsWith('.')) continue
+    const f = path.resolve(dir, base)
+    Object.assign(out, compilerPaths(f.endsWith('.json') ? f : f + '.json', depth + 1))
+  }
+  const opts = (json as { compilerOptions?: unknown }).compilerOptions
+  if (typeof opts !== 'object' || opts === null) return out
+  const { baseUrl, paths } = opts as { baseUrl?: unknown; paths?: unknown }
+  if (typeof baseUrl === 'string') out.baseUrl = path.resolve(dir, baseUrl)
+  if (typeof paths === 'object' && paths !== null) {
+    out.paths = paths as Record<string, unknown>
+    out.pathsBase = out.baseUrl ?? dir
+  } else if (out.paths !== undefined && out.baseUrl !== undefined) {
+    out.pathsBase = out.baseUrl
+  }
+  return out
+}
+
+/** The file Bun loads for an extensionless or extensioned path, or undefined. */
+function fileAt(target: string): string | undefined {
+  for (const f of [
+    target,
+    ...RESOLVED_EXTENSIONS.map((e) => target + e),
+    ...RESOLVED_EXTENSIONS.map((e) => path.join(target, 'index' + e)),
+  ]) {
+    try {
+      if (statSync(f).isFile()) return f
+    } catch {}
+  }
+  return undefined
+}
+
+/**
+ * The local file a bare specifier names through the nearest tsconfig's
+ * `paths` or `baseUrl`, as Bun resolves it (D-26): an alias whose target
+ * exists loads from disk and never reaches the registry.
+ */
+function tsconfigTarget(spec: string, fromDir: string): string | undefined {
+  const cfg = nearestTsconfig(fromDir)
+  if (cfg === undefined) return undefined
+  const { paths, pathsBase, baseUrl } = compilerPaths(cfg)
+  for (const [key, targets] of Object.entries(paths ?? {})) {
+    const star = key.indexOf('*')
+    let hole: string
+    if (star === -1) {
+      if (spec !== key) continue
+      hole = ''
+    } else {
+      const head = key.slice(0, star)
+      const tail = key.slice(star + 1)
+      if (spec.length < key.length - 1 || !spec.startsWith(head) || !spec.endsWith(tail)) continue
+      hole = spec.slice(head.length, spec.length - tail.length)
+    }
+    for (const t of Array.isArray(targets) ? targets : []) {
+      if (typeof t !== 'string') continue
+      const hit = fileAt(path.resolve(pathsBase!, t.replace('*', hole)))
+      if (hit !== undefined) return hit
+    }
+  }
+  return baseUrl === undefined ? undefined : fileAt(path.resolve(baseUrl, spec))
+}
+
+/**
+ * A textual pass before the scan: a relative specifier opens with a quoted
+ * `./` or `../`, or spells one with an escape, and most configs hold
+ * neither, so the scan is skipped for them (D-23). A candidate in a comment
+ * or string still goes to the scan, which decides.
+ */
+const RELATIVE_CANDIDATE = /["'`](?:\.\.?\/|[^"'`\n]*\\)/
+
 /**
  * Absolute resolved targets of the RELATIVE specifiers in `source`; one that
  * does not resolve contributes the paths it names.
@@ -145,6 +252,7 @@ export function unprovidedBareImports(
  * which is correct: an erased import cannot move a resolved value.
  */
 function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'): string[] {
+  if (!RELATIVE_CANDIDATE.test(source)) return []
   let specifiers: string[]
   try {
     specifiers = scanner(loader)
@@ -189,6 +297,12 @@ export interface ConfigImportOwnersArgs {
   changed: readonly string[]
   /** Already-selected projects; their configs need no scan. */
   skip: ReadonlySet<string>
+  /**
+   * Each project dir's realpath, when the caller already has them: the
+   * containment pass needs the same answers, and asking twice cost 5,000
+   * realpaths at 5,000 projects (D-24).
+   */
+  realDirs?: ReadonlyMap<string, string>
 }
 
 /**
@@ -198,11 +312,14 @@ export interface ConfigImportOwnersArgs {
  * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
  * the two matches nothing and fails exactly like "found no imports".
  */
-async function realDirIndex(projects: readonly ProjectMeta[]): Promise<Map<string, string>> {
+async function realDirIndex(
+  projects: readonly ProjectMeta[],
+  known: ReadonlyMap<string, string> | undefined,
+): Promise<Map<string, string>> {
   const out = new Map<string, string>()
   await Promise.all(
     projects.map(async (p) => {
-      out.set(await realpath(p.dir).catch(() => p.dir), p.name)
+      out.set(known?.get(p.dir) ?? (await realpath(p.dir).catch(() => p.dir)), p.name)
     }),
   )
   return out
@@ -240,32 +357,41 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
     }),
   )
   if (roots.size === 0) return selected
-  const dirToName = await realDirIndex(a.projects)
+  const dirToName = await realDirIndex(a.projects, a.realDirs)
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
   const importedBy = new Map<string, string[]>()
   const visited = new Set<string>()
-  const queue = [...roots.keys()]
-  while (queue.length > 0) {
-    const file = queue.pop()!
-    if (visited.has(file)) continue
-    visited.add(file)
-    let source: string
-    try {
-      source = await Bun.file(file).text()
-    } catch {
-      continue // unreadable: no edges, and not this pass's problem to report
-    }
-    const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
-    for (const target of scanLocalImports(source, path.dirname(file), loader)) {
-      if (!target.startsWith(workspaceRoot + path.sep)) continue
-      if (target.split(path.sep).includes('node_modules')) continue
-      const list = importedBy.get(target)
-      if (list) list.push(file)
-      else importedBy.set(target, [file])
-      // Descend ONLY through unowned files — see the header.
-      if (ownerOf(target, dirToName) === undefined) queue.push(target)
+  // A level at a time, its files read together: one awaited read per
+  // config put 5,000 of them 200 ms behind (D-23).
+  let frontier = [...roots.keys()]
+  while (frontier.length > 0) {
+    const read = await Promise.all(
+      frontier.map(async (file) => {
+        if (visited.has(file)) return null
+        visited.add(file)
+        try {
+          return { file, source: await Bun.file(file).text() }
+        } catch {
+          return null // unreadable: no edges, and not this pass's problem to report
+        }
+      }),
+    )
+    frontier = []
+    for (const entry of read) {
+      if (entry === null) continue
+      const { file, source } = entry
+      const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
+      for (const target of scanLocalImports(source, path.dirname(file), loader)) {
+        if (!target.startsWith(workspaceRoot + path.sep)) continue
+        if (target.split(path.sep).includes('node_modules')) continue
+        const list = importedBy.get(target)
+        if (list) list.push(file)
+        else importedBy.set(target, [file])
+        // Descend ONLY through unowned files — see the header.
+        if (ownerOf(target, dirToName) === undefined) frontier.push(target)
+      }
     }
   }