@vzn/vx 0.0.102 → 0.0.104

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.102",
+  "version": "0.0.104",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.102",
-    "@vzn/vx-linux-arm64": "0.0.102",
-    "@vzn/vx-darwin-x64": "0.0.102",
-    "@vzn/vx-darwin-arm64": "0.0.102"
+    "@vzn/vx-linux-x64": "0.0.104",
+    "@vzn/vx-linux-arm64": "0.0.104",
+    "@vzn/vx-darwin-x64": "0.0.104",
+    "@vzn/vx-darwin-arm64": "0.0.104"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/help.ts

@@ -49,7 +49,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '  vx show [PROJECT[#TASK] | TASK] [--format pretty|json]',
     '  vx info [--format pretty|json] [--cache-dir <path>]',
     '  vx why [TASK | PKG#TASK] [--run <runId>] [--format pretty|json] [--cache-dir <path>]',
-    '  vx last [RUNID] [--list[=N]] [--format pretty|json] [--cache-dir <path>]',
+    '  vx last [RUNID] [--list[=N]] [--failed] [--format pretty|json] [--cache-dir <path>]',
     '  vx completions bash|zsh|fish',
     '  vx help [VERB]',
     '  vx version',
@@ -150,6 +150,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '                       header (command, when, branch, counts) plus the per-task',
     '                       table, failures first. No re-execution, no cache probe.',
     '      --list[=N]       List the N most recent runs (default 10) with run ids.',
+    '      --failed         Only failed runs: the latest one, or with --list the list.',
     '      --format <fmt>   pretty (default) | json.',
     '',
     'Migration:',

package/src/cli/last.ts

@@ -4,6 +4,7 @@
 // history in cache.db is the only replay surface, and this verb reads it.
 // Read-only — no config evaluation, no re-hash, no cache probe.
 
+import type { Database } from 'bun:sqlite'
 import { Cache, noteSchemaReset } from '../cache/index.js'
 import { formatBytes } from './format.js'
 import { flagHint, seeHelp } from './help.js'
@@ -11,6 +12,7 @@ import {
   exitSignal,
   getInvocation,
   getRun,
+  type InvocationDetail,
   listInvocations,
   type RunSummaryRow,
 } from '../orchestrator/index.js'
@@ -22,6 +24,8 @@ import { resolveRunId, shortRunId } from './run-id.js'
 interface LastArgs {
   runId?: string
   list?: number
+  /** Only runs that failed: the latest one replayed, or the list narrowed. */
+  failed?: boolean
   format: 'pretty' | 'json'
   /** `--cache-dir`: read the history a run with the same flag wrote. */
   cacheDir?: string
@@ -48,6 +52,10 @@ export function parseLastArgs(args: readonly string[]): LastArgs {
       out.list = n
       continue
     }
+    if (a === '--failed') {
+      out.failed = true
+      continue
+    }
     if (a === '--format' || a.startsWith('--format=')) {
       const fv = a === '--format' ? args[++i] : a.slice(9)
       if (fv !== 'pretty' && fv !== 'json') {
@@ -82,9 +90,20 @@ export function parseLastArgs(args: readonly string[]): LastArgs {
       error: `a run id and --list do not combine: replay ${out.runId}, or list runs`,
     }
   }
+  if (out.runId !== undefined && out.failed === true) {
+    return { ...out, error: `a run id and --failed do not combine: replay ${out.runId}` }
+  }
   return out
 }
 
+/** The `limit` most recent runs that failed, newest first. */
+function failedInvocations(db: Database, limit: number): InvocationDetail[] {
+  const ids = db
+    .query('SELECT run_id FROM invocations WHERE exit_ok = 0 ORDER BY rowid DESC LIMIT ?')
+    .all(limit) as Array<{ run_id: string }>
+  return ids.map((r) => getInvocation(db, r.run_id)).filter((i) => i !== null)
+}
+
 const fmtWhen = (ms: number): string => new Date(ms).toISOString()
 
 const fmtMs = (ms: number): string => formatElapsed(ms, true)
@@ -190,7 +209,10 @@ export async function lastCmd(args: readonly string[]): Promise<number> {
     const db = cache.dbHandle()
 
     if (parsed.list !== undefined) {
-      const invocations = listInvocations(db, { limit: parsed.list })
+      const invocations =
+        parsed.failed === true
+          ? failedInvocations(db, parsed.list)
+          : listInvocations(db, { limit: parsed.list })
       if (parsed.format === 'json') {
         process.stdout.write(`${JSON.stringify(invocations)}\n`)
         return 0
@@ -213,12 +235,16 @@ export async function lastCmd(args: readonly string[]): Promise<number> {
     const inv =
       parsed.runId !== undefined
         ? getInvocation(db, resolveRunId(db, parsed.runId, 'vx last') ?? parsed.runId)
-        : (listInvocations(db, { limit: 1 })[0] ?? null)
+        : parsed.failed === true
+          ? (failedInvocations(db, 1)[0] ?? null)
+          : (listInvocations(db, { limit: 1 })[0] ?? null)
     if (inv === null || inv === undefined) {
       throw new UserError(
         parsed.runId !== undefined
           ? `vx last: no recorded run ${parsed.runId} (vx last --list shows recent runs)`
-          : 'vx last: no recorded runs yet — run something first',
+          : parsed.failed === true
+            ? 'vx last: no recorded run failed'
+            : 'vx last: no recorded runs yet — run something first',
       )
     }
     const detail = getRun(db, inv.runId)

package/src/exec/env.ts

@@ -40,6 +40,14 @@ export const ESSENTIAL_ENV: readonly string[] = [
   'PROGRAMFILES(X86)',
   'COMSPEC',
   'PATHEXT',
+  // Read on Windows by os.homedir(), npm and git, which break without them.
+  'SYSTEMDRIVE',
+  'WINDIR',
+  'USERPROFILE',
+  'HOMEDRIVE',
+  'HOMEPATH',
+  'NUMBER_OF_PROCESSORS',
+  'PROCESSOR_ARCHITECTURE',
 ]
 
 /**

package/src/exec/sandbox-runtime.ts

@@ -29,6 +29,7 @@ import {
   chmodSync,
   closeSync,
   lstatSync,
+  existsSync,
   mkdirSync,
   openSync,
   readlinkSync,
@@ -461,6 +462,21 @@ function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   return paths
 }
 
+/**
+ * Whether this Linux host speaks IPv6. SRT's in-sandbox network bridge is
+ * `socat TCP-LISTEN:3128`, and socat 1.8 opens that as an IPv6 socket: on
+ * a host without IPv6 it failed ("Address family not supported by
+ * protocol"), its error went to /dev/null, and every networked task met
+ * only "connection refused" on the proxy (J-33's lead, B-22). Without
+ * IPv6 the wrapped command sets `SOCAT_DEFAULT_LISTEN_IP=4`, socat's own
+ * switch for the listen family; with it nothing changes. Asked once.
+ */
+let hasIpv6: boolean | undefined
+function hostHasIpv6(): boolean {
+  hasIpv6 ??= existsSync('/proc/net/if_inet6')
+  return hasIpv6
+}
+
 /**
  * One-time SRT initialization per orchestrator run. Starts the proxy
  * servers + (on macOS) the violation log monitor. Safe to call repeatedly
@@ -922,6 +938,8 @@ export async function wrapSandboxedCommand(
   // the namespace goes with vx, a `setsid` daemon inside included, a
   // traced one-shot task too: its strace runs inside (B-11).
   if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped)) wrapped = `exec ${wrapped}`
+  if (process.platform === 'linux' && !hostHasIpv6())
+    wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) spawnHostBridges(ports, tag)
   return {

package/src/workspace/config-imports.ts

@@ -18,6 +18,8 @@
 //
 //   - RELATIVE specifiers only. A bare specifier is a package; it moves when
 //     the lockfile moves, which the workspace fingerprint already covers.
+//     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
+//     from disk (D-27).
 //   - Descend only through files owned by NO project. A config reaching into
 //     another project (say a site's `vx.config.ts` importing
 //     `../core/src/index.ts`) records that edge and STOPS there — following
@@ -25,7 +27,7 @@
 //     closure, and the containment channel already selects the project that
 //     owns it.
 
-import { existsSync, readFileSync, statSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
 import { builtinModules } from 'node:module'
 import path from 'node:path'
@@ -137,18 +139,6 @@ export function unprovidedBareImports(
   return out
 }
 
-/** The nearest `tsconfig.json`, else `jsconfig.json`, at or above `dir`: Bun reads that one alone. */
-function nearestTsconfig(dir: string): string | undefined {
-  for (let d = path.resolve(dir); ;) {
-    for (const name of ['tsconfig.json', 'jsconfig.json']) {
-      if (existsSync(path.join(d, name))) return path.join(d, name)
-    }
-    const up = path.dirname(d)
-    if (up === d) return undefined
-    d = up
-  }
-}
-
 interface CompilerPaths {
   paths?: Record<string, unknown>
   /** What `paths` targets resolve against: `baseUrl`, else the config's own dir. */
@@ -161,7 +151,9 @@ interface CompilerPaths {
  * against the config that set it. A package `extends` is not followed: its
  * paths are unseen, so a specifier only they map stays refused.
  */
-function compilerPaths(file: string, depth = 0): CompilerPaths {
+function compilerPaths(file: string, memo?: TsconfigMemo, depth = 0): CompilerPaths {
+  const known = memo?.get(file)
+  if (known !== undefined) return known
   let json: unknown
   try {
     json = Bun.JSONC.parse(readFileSync(file, 'utf8'))
@@ -175,7 +167,7 @@ function compilerPaths(file: string, depth = 0): CompilerPaths {
   for (const base of typeof ext === 'string' ? [ext] : Array.isArray(ext) ? ext : []) {
     if (depth > 8 || typeof base !== 'string' || !base.startsWith('.')) continue
     const f = path.resolve(dir, base)
-    Object.assign(out, compilerPaths(f.endsWith('.json') ? f : f + '.json', depth + 1))
+    Object.assign(out, compilerPaths(f.endsWith('.json') ? f : f + '.json', memo, depth + 1))
   }
   const opts = (json as { compilerOptions?: unknown }).compilerOptions
   if (typeof opts !== 'object' || opts === null) return out
@@ -187,6 +179,7 @@ function compilerPaths(file: string, depth = 0): CompilerPaths {
   } else if (out.paths !== undefined && out.baseUrl !== undefined) {
     out.pathsBase = out.baseUrl
   }
+  memo?.set(file, out)
   return out
 }
 
@@ -204,15 +197,45 @@ function fileAt(target: string): string | undefined {
   return undefined
 }
 
+/** Paths per directory and per tsconfig file, memoised across one walk. */
+type TsconfigMemo = Map<string, CompilerPaths>
+
+/**
+ * The paths of the nearest `tsconfig.json`, else `jsconfig.json`, at or
+ * above `dir`: Bun reads that one alone.
+ */
+function pathsAt(dir: string, memo?: TsconfigMemo): CompilerPaths {
+  const known = memo?.get(dir)
+  if (known !== undefined) return known
+  const file = ['tsconfig.json', 'jsconfig.json'].map((n) => path.join(dir, n)).find(existsSync)
+  const up = path.dirname(dir)
+  const cp = file !== undefined ? compilerPaths(file, memo) : up === dir ? {} : pathsAt(up, memo)
+  memo?.set(dir, cp)
+  return cp
+}
+
 /**
- * The local file a bare specifier names through the nearest tsconfig's
- * `paths` or `baseUrl`, as Bun resolves it (D-26): an alias whose target
- * exists loads from disk and never reaches the registry.
+ * Whether `source` quotes a bare specifier the nearest tsconfig maps: the
+ * textual pass that keeps a config importing only packages unscanned, as
+ * D-23's keeps one importing nothing relative (D-27).
  */
-function tsconfigTarget(spec: string, fromDir: string): string | undefined {
-  const cfg = nearestTsconfig(fromDir)
-  if (cfg === undefined) return undefined
-  const { paths, pathsBase, baseUrl } = compilerPaths(cfg)
+function hasAliasCandidate(source: string, fromDir: string, memo: TsconfigMemo): boolean {
+  SPECIFIER.lastIndex = 0
+  for (let m = SPECIFIER.exec(source); m !== null; m = SPECIFIER.exec(source)) {
+    const spec = m[1] ?? m[2] ?? ''
+    if (needsLookup(spec) && tsconfigBases(spec, fromDir, memo).length > 0) return true
+  }
+  return false
+}
+
+/**
+ * The paths a bare specifier names through the nearest tsconfig's `paths`
+ * (each matching target, in order) or `baseUrl`, before extensions: Bun
+ * tries them ahead of `node_modules`.
+ */
+function tsconfigBases(spec: string, fromDir: string, memo?: TsconfigMemo): string[] {
+  const { paths, pathsBase, baseUrl } = pathsAt(path.resolve(fromDir), memo)
+  const out: string[] = []
   for (const [key, targets] of Object.entries(paths ?? {})) {
     const star = key.indexOf('*')
     let hole: string
@@ -226,12 +249,39 @@ function tsconfigTarget(spec: string, fromDir: string): string | undefined {
       hole = spec.slice(head.length, spec.length - tail.length)
     }
     for (const t of Array.isArray(targets) ? targets : []) {
-      if (typeof t !== 'string') continue
-      const hit = fileAt(path.resolve(pathsBase!, t.replace('*', hole)))
-      if (hit !== undefined) return hit
+      if (typeof t === 'string') out.push(path.resolve(pathsBase!, t.replace('*', hole)))
     }
   }
-  return baseUrl === undefined ? undefined : fileAt(path.resolve(baseUrl, spec))
+  if (baseUrl !== undefined) out.push(path.resolve(baseUrl, spec))
+  return out
+}
+
+/**
+ * The local file a bare specifier names through the nearest tsconfig, as
+ * Bun resolves it (D-26): an alias whose target exists loads from disk and
+ * never reaches the registry.
+ */
+function tsconfigTarget(spec: string, fromDir: string, memo?: TsconfigMemo): string | undefined {
+  for (const base of tsconfigBases(spec, fromDir, memo)) {
+    const hit = fileAt(base)
+    if (hit !== undefined) return hit
+  }
+  return undefined
+}
+
+/** A path as Bun names it: realpath'd when it exists. */
+function realpathOr(file: string): string {
+  try {
+    return realpathSync(file)
+  } catch {
+    return file
+  }
+}
+
+/** A path and, bare of an extension, the files Bun would try for it. */
+function expansions(named: string): string[] {
+  if (path.extname(named) !== '') return [named]
+  return [named, ...RESOLVED_EXTENSIONS.flatMap((e) => [named + e, path.join(named, 'index' + e)])]
 }
 
 /**
@@ -251,8 +301,14 @@ const RELATIVE_CANDIDATE = /["'`](?:\.\.?\/|[^"'`\n]*\\)/
  * reason. `import type` is erased by `scanImports` and so contributes no edge,
  * which is correct: an erased import cannot move a resolved value.
  */
-function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'): string[] {
-  if (!RELATIVE_CANDIDATE.test(source)) return []
+function scanLocalImports(
+  source: string,
+  fromDir: string,
+  loader: 'ts' | 'js',
+  memo: TsconfigMemo,
+): string[] {
+  const aliased = hasAliasCandidate(source, fromDir, memo)
+  if (!aliased && !RELATIVE_CANDIDATE.test(source)) return []
   let specifiers: string[]
   try {
     specifiers = scanner(loader)
@@ -263,7 +319,16 @@ function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'):
   }
   const out: string[] = []
   for (const spec of specifiers) {
-    if (!spec.startsWith('./') && !spec.startsWith('../')) continue
+    if (!spec.startsWith('./') && !spec.startsWith('../')) {
+      // A tsconfig alias is a local import Bun resolves by path (D-27); a
+      // target the change deleted still names its paths, as below.
+      if (!aliased || spec.startsWith('.') || spec.startsWith('/') || !needsLookup(spec)) continue
+      const bases = tsconfigBases(spec, fromDir, memo)
+      const hit = bases.map(fileAt).find((f) => f !== undefined)
+      if (hit !== undefined) out.push(realpathOr(hit))
+      else out.push(...bases.flatMap(expansions))
+      continue
+    }
     try {
       out.push(Bun.resolveSync(spec, fromDir))
     } catch {
@@ -273,12 +338,7 @@ function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'):
       // of an extension, the files Bun would have tried), so the deleted
       // path in the diff still reaches its importer (item 958). Selection
       // may widen; it is never hashed.
-      const named = path.resolve(fromDir, spec)
-      out.push(named)
-      if (path.extname(spec) === '') {
-        for (const ext of RESOLVED_EXTENSIONS)
-          out.push(named + ext, path.join(named, 'index' + ext))
-      }
+      out.push(...expansions(path.resolve(fromDir, spec)))
     }
   }
   return out
@@ -361,6 +421,7 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
+  const tsconfigs: TsconfigMemo = new Map()
   const importedBy = new Map<string, string[]>()
   const visited = new Set<string>()
   // A level at a time, its files read together: one awaited read per
@@ -383,7 +444,7 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
-      for (const target of scanLocalImports(source, path.dirname(file), loader)) {
+      for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)