@vzn/vx 0.0.101 → 0.0.103

package/src/util/secret-mask.ts

@@ -0,0 +1,145 @@
+// Masking the values of secret-named variables in what vx prints, stores
+// or hands to telemetry (L-11). A task that echoes `$NPM_TOKEN`, or a
+// TS config that interpolates `process.env.API_KEY` into its command,
+// put the value in the terminal, the cached stdout every later hit
+// replays, and the spans a telemetry plugin exports. The masking is
+// GitHub Actions' kind: a known value is replaced wherever it appears.
+
+/** A variable whose value is masked, by the words its name holds. */
+const SECRET_NAME = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL/i
+
+/**
+ * Names that hold such a word but a value that is no secret: where a
+ * secret lives (`NPM_TOKEN_FILE`), or git's own config channel, whose
+ * `GIT_CONFIG_KEY_<n>` values are config names (`safe.directory`) that
+ * masking would blank out of ordinary output.
+ */
+const NOT_SECRET = /_(FILE|PATH|DIR)$|^GIT_CONFIG_KEY_\d+$/i
+
+/**
+ * Values shorter than this are not masked: `KEY=1` would mask every `1`
+ * in every line, and a value that short is no secret worth the noise.
+ */
+const MIN_SECRET_CHARS = 6
+
+export const MASKED = '***'
+
+export interface SecretMask {
+  /** `text` with every secret value replaced. */
+  mask(text: string): string
+  /**
+   * A mask for a stream of chunks: a value split across two chunks is
+   * still caught, by holding back only a tail that could begin one until
+   * the next chunk or `end`.
+   */
+  stream(): { push(chunk: string): string; end(): string }
+}
+
+/**
+ * The mask for these variables (a process's env, a task's `define`), or
+ * null when none is secret-named with a value worth masking: the common
+ * run pays one name test per variable and nothing per byte.
+ */
+export function secretMask(
+  ...sources: ReadonlyArray<Readonly<Record<string, string | undefined>> | undefined>
+): SecretMask | null {
+  const values = new Set<string>()
+  for (const source of sources) {
+    if (source === undefined) continue
+    for (const name in source) {
+      const value = source[name]
+      if (
+        value !== undefined &&
+        value.length >= MIN_SECRET_CHARS &&
+        SECRET_NAME.test(name) &&
+        !NOT_SECRET.test(name)
+      ) {
+        values.add(value)
+      }
+    }
+  }
+  if (values.size === 0) return null
+  // Longest first, so a value holding another is replaced whole.
+  const sorted = [...values].sort((a, b) => b.length - a.length)
+  const pattern = new RegExp(
+    sorted.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'),
+    'g',
+  )
+  const mask = (text: string): string => text.replace(pattern, MASKED)
+  /** The longest tail of `text` that is a proper prefix of a value. */
+  const partialTail = (text: string): number => {
+    let longest = 0
+    for (const v of sorted) {
+      for (let k = Math.min(v.length - 1, text.length); k > longest; k--) {
+        if (text.endsWith(v.slice(0, k))) {
+          longest = k
+          break
+        }
+      }
+    }
+    return longest
+  }
+  return {
+    mask,
+    stream() {
+      let carry = ''
+      return {
+        push(chunk) {
+          const text = carry + chunk
+          // Held back: only a tail that could begin a value, so output that
+          // cannot be one is never delayed (a `readyWhen` line, a marker).
+          let cut = text.length - partialTail(text)
+          pattern.lastIndex = 0
+          // Never cut through a value that is already whole.
+          for (let m = pattern.exec(text); m !== null; m = pattern.exec(text)) {
+            if (m.index < cut && m.index + m[0].length > cut) cut = m.index
+          }
+          carry = text.slice(cut)
+          return mask(text.slice(0, cut))
+        },
+        end() {
+          const rest = mask(carry)
+          carry = ''
+          return rest
+        },
+      }
+    },
+  }
+}
+
+/** A task's command as vx shows it: its secret-named values masked. */
+export function maskedCommand(command: string, define?: Readonly<Record<string, string>>): string {
+  return secretMask(process.env, define)?.mask(command) ?? command
+}
+
+/**
+ * `mask.stream()` driving `emit`: what it holds back (a tail that could
+ * begin a value) is emitted `idleMs` after the last chunk when none
+ * follows, so a long task's last characters do not wait for its exit. A
+ * value is written whole or in chunks that arrive together; one split by
+ * a pause longer than that is not caught.
+ */
+export function maskedEmitter(
+  mask: SecretMask,
+  emit: (text: string) => void,
+  idleMs = 25,
+): { push(chunk: string): void; end(): void } {
+  const s = mask.stream()
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const end = (): void => {
+    if (timer !== undefined) clearTimeout(timer)
+    timer = undefined
+    const rest = s.end()
+    if (rest) emit(rest)
+  }
+  return {
+    push(chunk) {
+      if (timer !== undefined) clearTimeout(timer)
+      const out = s.push(chunk)
+      if (out) emit(out)
+      timer = setTimeout(end, idleMs)
+      timer.unref?.()
+    },
+    end,
+  }
+}

package/src/util/which.ts

@@ -46,3 +46,15 @@ export function executablePath(name: string): string {
   found.set(name, at)
   return at
 }
+
+/**
+ * The argv that runs `script` in the task shell: `sh -c` on Linux and
+ * macOS, and Bun's own shell (`bun exec`) on Windows, which ships no `sh`
+ * (docs/design/windows-2026-09.md § Decisions 1). Bun's shell reads the
+ * same `&&`, `|`, `$(…)` and `VAR=x cmd` syntax that `bun run` uses there.
+ */
+export function shellArgv(script: string): string[] {
+  return process.platform === 'win32'
+    ? [process.execPath, 'exec', script]
+    : [executablePath('sh'), '-c', script]
+}

package/src/workspace/affected.ts

@@ -7,6 +7,7 @@
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
 import { realpathSync, statSync } from 'node:fs'
+import { realpath } from 'node:fs/promises'
 import path from 'node:path'
 import {
   asTrees,
@@ -240,7 +241,12 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     }
   }
 
-  const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
+  const realDirs = new Map(
+    await Promise.all(
+      args.projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
+    ),
+  )
+  const owned = projectsContaining(args.workspaceRoot, changed, args.projects, realDirs)
   for (const name of claimedOwned) owned.add(name)
 
   // A manifest edit can drop an edge today's graph no longer shows: a
@@ -277,6 +283,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     projects: args.projects,
     changed,
     skip: owned,
+    realDirs,
   })) {
     owned.add(name)
   }
@@ -659,6 +666,7 @@ function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
   projects: readonly ProjectMeta[],
+  realDirs: ReadonlyMap<string, string>,
 ): Set<string> {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
@@ -676,7 +684,7 @@ function projectsContaining(
   // too. One realpath per member, and only on an --affected run.
   const realRoot = realpathOr(workspaceRoot)
   for (const p of projects) {
-    const real = realpathOr(p.dir)
+    const real = realDirs.get(p.dir) ?? p.dir
     const rel = path.relative(realRoot, real)
     if (rel.startsWith('..') || path.isAbsolute(rel)) continue
     const spelled = path.resolve(workspaceRoot, rel)

package/src/workspace/config-cache.ts

@@ -141,8 +141,10 @@ const MAX_CLOSURE_FILES = 32
 // passes: the gate stops accidental impurity, not a config written to
 // defeat it. `random` is denied as a word, not as `Math.random`: a
 // destructured `const { random } = Math` was cached as pure (item 1036).
+// `prompt`, `confirm` and `alert` read the user's terminal, and a cached
+// evaluation replayed the first answer (D-25).
 const IMPURE_RE =
-  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*|Reflect|getPrototypeOf|setPrototypeOf|getOwnPropertyNames|getOwnPropertyDescriptor|getOwnPropertyDescriptors|__proto__|prototype|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__|random)\b|import\s*\.\s*meta|\bimport\s*\(/
+  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*|Reflect|getPrototypeOf|setPrototypeOf|getOwnPropertyNames|getOwnPropertyDescriptor|getOwnPropertyDescriptors|__proto__|prototype|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__|random|prompt|confirm|alert)\b|import\s*\.\s*meta|\bimport\s*\(/
 
 /** Literal text that names a way to `Function` when used as a computed key. */
 const IMPURE_LITERAL_RE = /constructor|__proto__|prototype/

package/src/workspace/config-imports.ts

@@ -18,6 +18,8 @@
 //
 //   - RELATIVE specifiers only. A bare specifier is a package; it moves when
 //     the lockfile moves, which the workspace fingerprint already covers.
+//     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
+//     from disk (D-27).
 //   - Descend only through files owned by NO project. A config reaching into
 //     another project (say a site's `vx.config.ts` importing
 //     `../core/src/index.ts`) records that edge and STOPS there — following
@@ -25,7 +27,7 @@
 //     closure, and the containment channel already selects the project that
 //     owns it.
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
 import { builtinModules } from 'node:module'
 import path from 'node:path'
@@ -130,11 +132,158 @@ export function unprovidedBareImports(
       if (up === dir) break
       dir = up
     }
-    if (!provided && !out.includes(spec)) out.push(spec)
+    if (!provided && tsconfigTarget(spec, fromDir) === undefined && !out.includes(spec)) {
+      out.push(spec)
+    }
   }
   return out
 }
 
+interface CompilerPaths {
+  paths?: Record<string, unknown>
+  /** What `paths` targets resolve against: `baseUrl`, else the config's own dir. */
+  pathsBase?: string
+  baseUrl?: string
+}
+
+/**
+ * `compilerOptions.paths` and `baseUrl` after `extends`, each resolved
+ * against the config that set it. A package `extends` is not followed: its
+ * paths are unseen, so a specifier only they map stays refused.
+ */
+function compilerPaths(file: string, memo?: TsconfigMemo, depth = 0): CompilerPaths {
+  const known = memo?.get(file)
+  if (known !== undefined) return known
+  let json: unknown
+  try {
+    json = Bun.JSONC.parse(readFileSync(file, 'utf8'))
+  } catch {
+    return {}
+  }
+  if (typeof json !== 'object' || json === null) return {}
+  const dir = path.dirname(file)
+  const out: CompilerPaths = {}
+  const ext = (json as { extends?: unknown }).extends
+  for (const base of typeof ext === 'string' ? [ext] : Array.isArray(ext) ? ext : []) {
+    if (depth > 8 || typeof base !== 'string' || !base.startsWith('.')) continue
+    const f = path.resolve(dir, base)
+    Object.assign(out, compilerPaths(f.endsWith('.json') ? f : f + '.json', memo, depth + 1))
+  }
+  const opts = (json as { compilerOptions?: unknown }).compilerOptions
+  if (typeof opts !== 'object' || opts === null) return out
+  const { baseUrl, paths } = opts as { baseUrl?: unknown; paths?: unknown }
+  if (typeof baseUrl === 'string') out.baseUrl = path.resolve(dir, baseUrl)
+  if (typeof paths === 'object' && paths !== null) {
+    out.paths = paths as Record<string, unknown>
+    out.pathsBase = out.baseUrl ?? dir
+  } else if (out.paths !== undefined && out.baseUrl !== undefined) {
+    out.pathsBase = out.baseUrl
+  }
+  memo?.set(file, out)
+  return out
+}
+
+/** The file Bun loads for an extensionless or extensioned path, or undefined. */
+function fileAt(target: string): string | undefined {
+  for (const f of [
+    target,
+    ...RESOLVED_EXTENSIONS.map((e) => target + e),
+    ...RESOLVED_EXTENSIONS.map((e) => path.join(target, 'index' + e)),
+  ]) {
+    try {
+      if (statSync(f).isFile()) return f
+    } catch {}
+  }
+  return undefined
+}
+
+/** Paths per directory and per tsconfig file, memoised across one walk. */
+type TsconfigMemo = Map<string, CompilerPaths>
+
+/**
+ * The paths of the nearest `tsconfig.json`, else `jsconfig.json`, at or
+ * above `dir`: Bun reads that one alone.
+ */
+function pathsAt(dir: string, memo?: TsconfigMemo): CompilerPaths {
+  const known = memo?.get(dir)
+  if (known !== undefined) return known
+  const file = ['tsconfig.json', 'jsconfig.json'].map((n) => path.join(dir, n)).find(existsSync)
+  const up = path.dirname(dir)
+  const cp = file !== undefined ? compilerPaths(file, memo) : up === dir ? {} : pathsAt(up, memo)
+  memo?.set(dir, cp)
+  return cp
+}
+
+/**
+ * Whether `source` quotes a bare specifier the nearest tsconfig maps: the
+ * textual pass that keeps a config importing only packages unscanned, as
+ * D-23's keeps one importing nothing relative (D-27).
+ */
+function hasAliasCandidate(source: string, fromDir: string, memo: TsconfigMemo): boolean {
+  SPECIFIER.lastIndex = 0
+  for (let m = SPECIFIER.exec(source); m !== null; m = SPECIFIER.exec(source)) {
+    const spec = m[1] ?? m[2] ?? ''
+    if (needsLookup(spec) && tsconfigBases(spec, fromDir, memo).length > 0) return true
+  }
+  return false
+}
+
+/**
+ * The paths a bare specifier names through the nearest tsconfig's `paths`
+ * (each matching target, in order) or `baseUrl`, before extensions: Bun
+ * tries them ahead of `node_modules`.
+ */
+function tsconfigBases(spec: string, fromDir: string, memo?: TsconfigMemo): string[] {
+  const { paths, pathsBase, baseUrl } = pathsAt(path.resolve(fromDir), memo)
+  const out: string[] = []
+  for (const [key, targets] of Object.entries(paths ?? {})) {
+    const star = key.indexOf('*')
+    let hole: string
+    if (star === -1) {
+      if (spec !== key) continue
+      hole = ''
+    } else {
+      const head = key.slice(0, star)
+      const tail = key.slice(star + 1)
+      if (spec.length < key.length - 1 || !spec.startsWith(head) || !spec.endsWith(tail)) continue
+      hole = spec.slice(head.length, spec.length - tail.length)
+    }
+    for (const t of Array.isArray(targets) ? targets : []) {
+      if (typeof t === 'string') out.push(path.resolve(pathsBase!, t.replace('*', hole)))
+    }
+  }
+  if (baseUrl !== undefined) out.push(path.resolve(baseUrl, spec))
+  return out
+}
+
+/**
+ * The local file a bare specifier names through the nearest tsconfig, as
+ * Bun resolves it (D-26): an alias whose target exists loads from disk and
+ * never reaches the registry.
+ */
+function tsconfigTarget(spec: string, fromDir: string, memo?: TsconfigMemo): string | undefined {
+  for (const base of tsconfigBases(spec, fromDir, memo)) {
+    const hit = fileAt(base)
+    if (hit !== undefined) return hit
+  }
+  return undefined
+}
+
+/** A path as Bun names it: realpath'd when it exists. */
+function realpathOr(file: string): string {
+  try {
+    return realpathSync(file)
+  } catch {
+    return file
+  }
+}
+
+/** A path and, bare of an extension, the files Bun would try for it. */
+function expansions(named: string): string[] {
+  if (path.extname(named) !== '') return [named]
+  return [named, ...RESOLVED_EXTENSIONS.flatMap((e) => [named + e, path.join(named, 'index' + e)])]
+}
+
 /**
  * A textual pass before the scan: a relative specifier opens with a quoted
  * `./` or `../`, or spells one with an escape, and most configs hold
@@ -152,8 +301,14 @@ const RELATIVE_CANDIDATE = /["'`](?:\.\.?\/|[^"'`\n]*\\)/
  * reason. `import type` is erased by `scanImports` and so contributes no edge,
  * which is correct: an erased import cannot move a resolved value.
  */
-function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'): string[] {
-  if (!RELATIVE_CANDIDATE.test(source)) return []
+function scanLocalImports(
+  source: string,
+  fromDir: string,
+  loader: 'ts' | 'js',
+  memo: TsconfigMemo,
+): string[] {
+  const aliased = hasAliasCandidate(source, fromDir, memo)
+  if (!aliased && !RELATIVE_CANDIDATE.test(source)) return []
   let specifiers: string[]
   try {
     specifiers = scanner(loader)
@@ -164,7 +319,16 @@ function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'):
   }
   const out: string[] = []
   for (const spec of specifiers) {
-    if (!spec.startsWith('./') && !spec.startsWith('../')) continue
+    if (!spec.startsWith('./') && !spec.startsWith('../')) {
+      // A tsconfig alias is a local import Bun resolves by path (D-27); a
+      // target the change deleted still names its paths, as below.
+      if (!aliased || spec.startsWith('.') || spec.startsWith('/') || !needsLookup(spec)) continue
+      const bases = tsconfigBases(spec, fromDir, memo)
+      const hit = bases.map(fileAt).find((f) => f !== undefined)
+      if (hit !== undefined) out.push(realpathOr(hit))
+      else out.push(...bases.flatMap(expansions))
+      continue
+    }
     try {
       out.push(Bun.resolveSync(spec, fromDir))
     } catch {
@@ -174,12 +338,7 @@ function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'):
       // of an extension, the files Bun would have tried), so the deleted
       // path in the diff still reaches its importer (item 958). Selection
       // may widen; it is never hashed.
-      const named = path.resolve(fromDir, spec)
-      out.push(named)
-      if (path.extname(spec) === '') {
-        for (const ext of RESOLVED_EXTENSIONS)
-          out.push(named + ext, path.join(named, 'index' + ext))
-      }
+      out.push(...expansions(path.resolve(fromDir, spec)))
     }
   }
   return out
@@ -198,6 +357,12 @@ export interface ConfigImportOwnersArgs {
   changed: readonly string[]
   /** Already-selected projects; their configs need no scan. */
   skip: ReadonlySet<string>
+  /**
+   * Each project dir's realpath, when the caller already has them: the
+   * containment pass needs the same answers, and asking twice cost 5,000
+   * realpaths at 5,000 projects (D-24).
+   */
+  realDirs?: ReadonlyMap<string, string>
 }
 
 /**
@@ -207,11 +372,14 @@ export interface ConfigImportOwnersArgs {
  * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
  * the two matches nothing and fails exactly like "found no imports".
  */
-async function realDirIndex(projects: readonly ProjectMeta[]): Promise<Map<string, string>> {
+async function realDirIndex(
+  projects: readonly ProjectMeta[],
+  known: ReadonlyMap<string, string> | undefined,
+): Promise<Map<string, string>> {
   const out = new Map<string, string>()
   await Promise.all(
     projects.map(async (p) => {
-      out.set(await realpath(p.dir).catch(() => p.dir), p.name)
+      out.set(known?.get(p.dir) ?? (await realpath(p.dir).catch(() => p.dir)), p.name)
     }),
   )
   return out
@@ -249,10 +417,11 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
     }),
   )
   if (roots.size === 0) return selected
-  const dirToName = await realDirIndex(a.projects)
+  const dirToName = await realDirIndex(a.projects, a.realDirs)
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
+  const tsconfigs: TsconfigMemo = new Map()
   const importedBy = new Map<string, string[]>()
   const visited = new Set<string>()
   // A level at a time, its files read together: one awaited read per
@@ -275,7 +444,7 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
-      for (const target of scanLocalImports(source, path.dirname(file), loader)) {
+      for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)