@vzn/vx 0.0.111 → 0.0.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.111",
+  "version": "0.0.113",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.111",
-    "@vzn/vx-linux-arm64": "0.0.111",
-    "@vzn/vx-darwin-x64": "0.0.111",
-    "@vzn/vx-darwin-arm64": "0.0.111"
+    "@vzn/vx-linux-x64": "0.0.113",
+    "@vzn/vx-linux-arm64": "0.0.113",
+    "@vzn/vx-darwin-x64": "0.0.113",
+    "@vzn/vx-darwin-arm64": "0.0.113"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -36,6 +36,8 @@ import {
   formatBytes,
   isDiskFull,
   isFsRefusal,
+  isOutOfFds,
+  OUT_OF_FDS_HINT,
   relPosix,
   span,
   splitTaskId,
@@ -1044,6 +1046,14 @@ export class Cache implements CacheLayer {
       // Same distinction for a tree the process cannot write into — a
       // `dist/` another user owns, a read-only checkout, a full disk: the
       // artifact is intact, the tree is not the process's to change.
+      // A refusal to READ the artifact is the cache directory's, not the
+      // outputs': the old line sent the reader to the wrong tree (A-40).
+      if (isFsRefusal(err) && err.path === src) {
+        throw new UserError(
+          `restore of ${hash} could not read its artifact (${code}: ${err.message}). ` +
+            `Make the cache directory readable by this user, or point cacheDir / --cache-dir at one that is.`,
+        )
+      }
       if (isFsRefusal(err)) {
         const remedy = isDiskFull(err)
           ? 'Free space on that disk and re-run.'
@@ -1052,6 +1062,13 @@ export class Cache implements CacheLayer {
           `restore of ${hash} into ${projectDir} could not write its outputs (${code}: ${err.message}). ${remedy}`,
         )
       }
+      // The process is out of descriptors: the artifact is fine, and
+      // calling it corrupt sent the reader after the cache (A-39).
+      if (isOutOfFds(err)) {
+        throw new UserError(
+          `restore of ${hash} into ${projectDir} could not open a file (${err.message}) — ${OUT_OF_FDS_HINT}`,
+        )
+      }
       // The artifact itself is gone: the read names its path (`bytes()`
       // opens it; a staged file's ENOENT names the temp below).
       if (code === 'ENOENT' && (err as NodeJS.ErrnoException).path === src) {
@@ -1127,7 +1144,18 @@ export class Cache implements CacheLayer {
     // again in `writeArtifactAndIndex` cost every save two thread-pool
     // round trips for an EEXIST and a stat (item 630).
     const endPack = span('save: pack')
-    const compressed = await this.packArtifactToTemp(this.tempPath(args.hash), args)
+    const compressed = await this.packArtifactToTemp(this.tempPath(args.hash), args).catch(
+      (err: unknown) => {
+        // A save that could not open an output names the limit, not only
+        // the file, which is fine (A-39).
+        if (isOutOfFds(err)) {
+          throw new UserError(
+            `save of ${args.hash} could not open a file (${err.message}) — ${OUT_OF_FDS_HINT}`,
+          )
+        }
+        throw err
+      },
+    )
     endPack()
     await this.guard(() =>
       this.writeArtifactAndIndex(args.hash, compressed, {

package/src/cli/help.ts

@@ -221,10 +221,10 @@ export function flagHint(verb: string, arg: string): string {
  * reading every flag on it put `--check` in the list, so `vx run --chek`
  * was told "did you mean --check?" and `--check` was then refused.
  */
-export function documentedFlags(verb: string): string[] {
+export function documentedFlags(verb: string, text = helpText()): string[] {
   const flags = new Set<string>()
   let inVerb = false
-  for (const line of helpText().split('\n')) {
+  for (const line of text.split('\n')) {
     if (/^[A-Z][A-Za-z ]*(?: \(for [a-z]+\))?:$/.test(line))
       inVerb = line.endsWith(`(for ${verb}):`)
     if (!inVerb) continue

package/src/cli/show.ts

@@ -154,7 +154,7 @@ function projectDir(root: string, meta: ProjectMeta): string {
 }
 
 /**
- * A task as `vx show` prints it: a secret-named variable's value masked
+ * A task as `vx show` prints it: a secret variable's value masked
  * wherever it appears, in `env.define` and in the command a TS config
  * built from `process.env` (L-11).
  */
@@ -162,7 +162,7 @@ function shownTask(task: TaskConfig): TaskConfig {
   const exec = task.exec
   if (exec === undefined) return task
   const define = exec.env?.define
-  const secrets = secretMask(process.env, define)
+  const secrets = secretMask([process.env, define], exec.env?.secret)
   if (secrets === null) return task
   return {
     ...task,

package/src/config.ts

@@ -399,6 +399,13 @@ export interface ExecEnv {
    * via the task config hash).
    */
   define?: Record<string, string>
+  /**
+   * Names whose values are masked (`***`) wherever vx prints, stores or
+   * exports the task's output or command, whatever the name. Names that
+   * hold `TOKEN`, `SECRET`, `KEY`, `PASSWORD`, `PASSWD` or `CREDENTIAL`
+   * are masked without it; this reaches `GH_PAT`, `NPM_AUTH`.
+   */
+  secret?: string[]
 }
 
 export interface CacheConfig {

package/src/exec/runner.ts

@@ -140,8 +140,11 @@ function trailingCommentStart(command: string): number {
 export function withForwardArgs(command: string, args: readonly string[] | undefined): string {
   if (!args || args.length === 0) return command
   const quoted = args.map(shellQuote).join(' ')
-  const comment = trailingCommentStart(command)
+  let comment = trailingCommentStart(command)
   if (comment < 0) return `${command} ${quoted}`
+  // A comment-only last line after a commented line: the args go before
+  // the earliest comment, or they land inside it (`echo one # c\n# two`).
+  for (let c = comment; c >= 0; c = trailingCommentStart(command.slice(0, c).trimEnd())) comment = c
   return `${command.slice(0, comment).trimEnd()} ${quoted} ${command.slice(comment)}`
 }
 

package/src/graph/scheduler.ts

@@ -1,4 +1,10 @@
-import { fsRefusalHint, isFsRefusal, isUserError } from '../util/index.js'
+import {
+  fsRefusalHint,
+  isFsRefusal,
+  isOutOfFds,
+  isUserError,
+  OUT_OF_FDS_HINT,
+} from '../util/index.js'
 import { computeReverseDepCount, mergePriorities, tieredReverseDepCount } from './priorities.js'
 import type { TaskNode } from './task-graph.js'
 
@@ -732,8 +738,12 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
             // `cache.inputs.runtime` command), not a vx bug — report it
             // plainly, never as an "internal error".
             let line: string
-            if (isUserError(err) || isFsRefusal(err)) {
-              const text = isUserError(err) ? message : `${message} — ${fsRefusalHint(err)}`
+            // Out of descriptors is the environment's limit too: a stack
+            // naming a file that was fine sent the user after the file.
+            if (isUserError(err) || isFsRefusal(err) || isOutOfFds(err)) {
+              const text = isUserError(err)
+                ? message
+                : `${message} — ${isOutOfFds(err) ? OUT_OF_FDS_HINT : fsRefusalHint(err)}`
               const first = refusedBy.get(text)
               if (first === undefined) refusedBy.set(text, id)
               line = `[vx] ${id}: ${first === undefined ? text : `as ${first} above`}\n`

package/src/orchestrator/events.ts

@@ -342,7 +342,7 @@ export function projectNode(node: TaskNode): TaskView {
     persistent: node.config.exec?.persistent !== undefined,
   }
   if (node.config.exec?.command !== undefined)
-    view.command = maskedCommand(node.config.exec.command, node.config.exec.env?.define)
+    view.command = maskedCommand(node.config.exec.command, node.config.exec.env)
   return view
 }
 

package/src/orchestrator/execute-task.ts

@@ -326,7 +326,7 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // A server's output masked as a one-shot task's is (L-11); `readyWhen`
   // is matched on the raw chunks, before this. Its held tail is flushed by
   // the idle timer: a server never ends on the way to a flush.
-  const serverSecrets = secretMask(process.env, env, step.env?.define)
+  const serverSecrets = secretMask([process.env, env, step.env?.define], step.env?.secret)
   const serverOut = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStdout(node, t))
   const serverErr = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStderr(node, t))
   const persistentOpts: Parameters<typeof runPersistent>[0] = {
@@ -892,7 +892,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
 
   // The values of secret-named variables, masked in what the task prints
   // and what the cache keeps of it (L-11); null when there are none.
-  const secrets = secretMask(process.env, env, step.env?.define)
+  const secrets = secretMask([process.env, env, step.env?.define], step.env?.secret)
   let flushMasked = (): void => {}
   // The entry's command is shown by `vx why` and sent with the entry to a
   // remote cache: a value a config interpolated stays out of both.

package/src/orchestrator/framed-output.ts

@@ -107,7 +107,7 @@ export function formatTaskBlock(
     // line under the header reads as the command on its own.
     lines.push(
       '',
-      corner(`$ ${maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env?.define)}`),
+      corner(`$ ${maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env)}`),
       '',
     )
   }
@@ -391,7 +391,7 @@ export function formatTaskSkippedLine(
  */
 export function formatFrameOpen(node: TaskNode, colors: ColorSupport = NO_COLOR): string {
   const corner = (t: string) => paint('', t, colors, { dim: true })
-  const cmd = maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env?.define)
+  const cmd = maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env)
   const mark = isPersistentNode(node) ? `${paint(ACCENT, '▸', colors)} ` : ''
   return `${corner('┌─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('>')} $ ${cmd}`
 }

package/src/orchestrator/hit-restore.ts

@@ -266,7 +266,10 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
   if (hit.stdout) {
     // An entry saved before masking, or by another machine, can hold a
     // secret-named variable's value (L-11). Asked only of a hit that prints.
-    const secrets = secretMask(process.env, node.config.exec?.env?.define)
+    const secrets = secretMask(
+      [process.env, node.config.exec?.env?.define],
+      node.config.exec?.env?.secret,
+    )
     log.taskStdout(node, secrets === null ? hit.stdout : secrets.mask(hit.stdout))
   }
   const status =

package/src/orchestrator/telemetry.ts

@@ -439,7 +439,7 @@ export function createTelemetrySource(args: {
           ts,
         }
         if (node.config.exec.command !== undefined)
-          rec.command = maskedCommand(node.config.exec.command, node.config.exec.env?.define)
+          rec.command = maskedCommand(node.config.exec.command, node.config.exec.env)
         deliver(rec)
         return
       }

package/src/util/secret-mask.ts

@@ -38,25 +38,23 @@ export interface SecretMask {
 /**
  * The mask for these variables (a process's env, a task's `define`), or
  * null when none is secret-named with a value worth masking: the common
- * run pays one name test per variable and nothing per byte.
+ * run pays one name test per variable and nothing per byte. `named` are
+ * the task's `env.secret`: masked whatever the name.
  */
 export function secretMask(
-  ...sources: ReadonlyArray<Readonly<Record<string, string | undefined>> | undefined>
+  sources: ReadonlyArray<Readonly<Record<string, string | undefined>> | undefined>,
+  named: readonly string[] = [],
 ): SecretMask | null {
   const values = new Set<string>()
+  const add = (value: string | undefined): void => {
+    if (value !== undefined && value.length >= MIN_SECRET_CHARS) values.add(value)
+  }
   for (const source of sources) {
     if (source === undefined) continue
     for (const name in source) {
-      const value = source[name]
-      if (
-        value !== undefined &&
-        value.length >= MIN_SECRET_CHARS &&
-        SECRET_NAME.test(name) &&
-        !NOT_SECRET.test(name)
-      ) {
-        values.add(value)
-      }
+      if (SECRET_NAME.test(name) && !NOT_SECRET.test(name)) add(source[name])
     }
+    for (const name of named) add(source[name])
   }
   if (values.size === 0) return null
   // Longest first, so a value holding another is replaced whole.
@@ -107,9 +105,15 @@ export function secretMask(
   }
 }
 
-/** A task's command as vx shows it: its secret-named values masked. */
-export function maskedCommand(command: string, define?: Readonly<Record<string, string>>): string {
-  return secretMask(process.env, define)?.mask(command) ?? command
+/** A task's command as vx shows it: its secret values masked. */
+export function maskedCommand(command: string, env?: TaskEnvSecrets): string {
+  return secretMask([process.env, env?.define], env?.secret)?.mask(command) ?? command
+}
+
+/** What of a task's `exec.env` names its secrets. */
+export interface TaskEnvSecrets {
+  readonly define?: Readonly<Record<string, string>>
+  readonly secret?: readonly string[]
 }
 
 /**

package/src/workspace/config-imports.ts

@@ -171,10 +171,11 @@ function compilerPaths(file: string, memo?: TsconfigMemo, depth = 0): CompilerPa
   if (typeof json !== 'object' || json === null) return {}
   const dir = path.dirname(file)
   const out: CompilerPaths = {}
+  // A string only: Bun follows no array `extends` (TS 5's form), and an
+  // alias only an array maps went to the registry (D-30).
   const ext = (json as { extends?: unknown }).extends
-  for (const base of typeof ext === 'string' ? [ext] : Array.isArray(ext) ? ext : []) {
-    if (depth > 8 || typeof base !== 'string' || !base.startsWith('.')) continue
-    const f = path.resolve(dir, base)
+  if (typeof ext === 'string' && ext.startsWith('.') && depth <= 8) {
+    const f = path.resolve(dir, ext)
     Object.assign(out, compilerPaths(f.endsWith('.json') ? f : f + '.json', memo, depth + 1))
   }
   const opts = (json as { compilerOptions?: unknown }).compilerOptions

package/src/workspace/config-schema.ts

@@ -347,6 +347,16 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
             )
           }
         }
+        const secret = (env as { secret?: unknown }).secret
+        if (
+          secret !== undefined &&
+          (!Array.isArray(secret) ||
+            secret.some((n) => !isEnvName(n) || BUN_GLOB_WILDCARDS.test(n)))
+        ) {
+          throw new UserError(
+            `${where}.exec.env.secret must be an array of env var names (non-empty, no '=', NUL or wildcard)`,
+          )
+        }
         const define = (env as { define?: unknown }).define
         if (define !== undefined) {
           if (typeof define !== 'object' || define === null || Array.isArray(define)) {
@@ -641,7 +651,7 @@ const EXEC_FIELDS = new Set([
   'sandbox',
 ])
 const PERSISTENT_FIELDS = new Set(['readyWhen'])
-const ENV_FIELDS = new Set(['passThrough', 'define'])
+const ENV_FIELDS = new Set(['passThrough', 'define', 'secret'])
 const CACHE_FIELDS = new Set(['inputs', 'outputs'])
 const CACHE_INPUT_FIELDS = new Set([
   'files',