@vzn/vx 0.0.118 → 0.0.121

package/README.md

@@ -38,7 +38,7 @@ burns 35 s of CPU in vx, 73 s in Turborepo and 114 minutes in Nx; a
 fully cached run replays the graph in 510 ms.
 <!-- bench:end -->
 
-Measured on twelve real Turborepo, Nx and moon repos too: [tried on real repos](#tried-on-real-repos).
+Measured on fourteen real Turborepo, Nx, moon, wireit and lage repos too: [tried on real repos](#tried-on-real-repos).
 
 ## Install
 
@@ -145,25 +145,27 @@ Turbo and Nx feature is in vx, pinned by a test:
 
 ## Tried on real repos
 
-Twelve public monorepos, each run with its own `turbo.json`, Nx graph or moon config
+Fourteen public monorepos, each run with its own `turbo.json`, Nx graph, moon, wireit or lage config
 and nothing rewritten, against the tool it ships with. Both tools on the same machine and
 tasks per row, medians; vx first, theirs second. Where the other tool
 wins, the row says so.
 
-| Repo                                                                  | Against | Cold build            | Restore outputs | Nothing to do       |
-| --------------------------------------------------------------------- | ------- | --------------------- | --------------- | ------------------- |
-| [solidjs/solid](https://github.com/solidjs/solid)                     | Turbo   | 40.6 s / 45.5 s       | 66 ms / 127 ms  | 51 ms / 95 ms       |
-| [withastro/astro](https://github.com/withastro/astro)                 | Turbo   | 48.0 s / 57.9 s       | 478 ms / 1.43 s | 249 ms / 1.38 s     |
-| [payloadcms/payload](https://github.com/payloadcms/payload)           | Turbo   | 126.9 s / 127.5 s     | 3.44 s / 3.46 s | 256 ms / **237 ms** |
-| [medusajs/medusa](https://github.com/medusajs/medusa)                 | Turbo   | 308 s / 315 s         | 3.86 s / 7.16 s | 947 ms / 3.29 s     |
-| [n8n-io/n8n](https://github.com/n8n-io/n8n)                           | Turbo   | 137.2 s / **133.7 s** | 8.27 s / 12.5 s | 842 ms / 1.36 s     |
-| [calcom/cal.com](https://github.com/calcom/cal.com)                   | Turbo   | 245.7 s / 250.7 s     | 17.4 s / 19.9 s | 14.7 s / 18.5 s     |
-| [TanStack/query](https://github.com/TanStack/query)                   | Nx      | 47.4 s / 55.1 s       | 656 ms / 1.98 s | 174 ms / 1.88 s     |
-| [strapi/strapi](https://github.com/strapi/strapi)                     | Nx      | 238.2 s / 245.7 s     | 1.61 s / 3.94 s | 341 ms / 4.02 s     |
-| [novuhq/novu](https://github.com/novuhq/novu)                         | Nx      | 291.2 s / 299.4 s     | 3.10 s / 9.05 s | 655 ms / 8.55 s     |
-| [TanStack/router](https://github.com/TanStack/router)                 | Nx      | 199.9 s / 226.7 s     | 1.00 s / 3.33 s | 505 ms / 3.21 s     |
-| [refinedev/refine](https://github.com/refinedev/refine)               | Nx      | 96.2 s / 105.9 s      | 1.06 s / 1.19 s | 303 ms / 1.16 s     |
-| [kindspells/astro-shield](https://github.com/kindspells/astro-shield) | moon    | 2.64 s / 3.78 s       | 125 ms / 2.46 s | 111 ms / 2.37 s     |
+| Repo                                                                    | Against | Cold build            | Restore outputs | Nothing to do       |
+| ----------------------------------------------------------------------- | ------- | --------------------- | --------------- | ------------------- |
+| [solidjs/solid](https://github.com/solidjs/solid)                       | Turbo   | 40.6 s / 45.5 s       | 66 ms / 127 ms  | 51 ms / 95 ms       |
+| [withastro/astro](https://github.com/withastro/astro)                   | Turbo   | 48.0 s / 57.9 s       | 478 ms / 1.43 s | 249 ms / 1.38 s     |
+| [payloadcms/payload](https://github.com/payloadcms/payload)             | Turbo   | 126.9 s / 127.5 s     | 3.44 s / 3.46 s | 256 ms / **237 ms** |
+| [medusajs/medusa](https://github.com/medusajs/medusa)                   | Turbo   | 308 s / 315 s         | 3.86 s / 7.16 s | 947 ms / 3.29 s     |
+| [n8n-io/n8n](https://github.com/n8n-io/n8n)                             | Turbo   | 137.2 s / **133.7 s** | 8.27 s / 12.5 s | 842 ms / 1.36 s     |
+| [calcom/cal.com](https://github.com/calcom/cal.com)                     | Turbo   | 245.7 s / 250.7 s     | 17.4 s / 19.9 s | 14.7 s / 18.5 s     |
+| [TanStack/query](https://github.com/TanStack/query)                     | Nx      | 47.4 s / 55.1 s       | 656 ms / 1.98 s | 174 ms / 1.88 s     |
+| [strapi/strapi](https://github.com/strapi/strapi)                       | Nx      | 238.2 s / 245.7 s     | 1.61 s / 3.94 s | 341 ms / 4.02 s     |
+| [novuhq/novu](https://github.com/novuhq/novu)                           | Nx      | 291.2 s / 299.4 s     | 3.10 s / 9.05 s | 655 ms / 8.55 s     |
+| [TanStack/router](https://github.com/TanStack/router)                   | Nx      | 199.9 s / 226.7 s     | 1.00 s / 3.33 s | 505 ms / 3.21 s     |
+| [refinedev/refine](https://github.com/refinedev/refine)                 | Nx      | 96.2 s / 105.9 s      | 1.06 s / 1.19 s | 303 ms / 1.16 s     |
+| [kindspells/astro-shield](https://github.com/kindspells/astro-shield)   | moon    | 2.64 s / 3.78 s       | 125 ms / 2.46 s | 111 ms / 2.37 s     |
+| [FormidableLabs/spectacle](https://github.com/FormidableLabs/spectacle) | wireit  | 21.5 s / 22.2 s       | 394 ms / 574 ms | 387 ms / 593 ms     |
+| [microsoft/lage](https://github.com/microsoft/lage)                     | lage    | 32.4 s / **29.4 s**   | 730 ms / 1.70 s | 284 ms / 1.56 s     |
 
 **Bold** marks the other tool winning. Versions, revisions, scopes and
 harness per repo: [benchmarks](packages/vx/docs/benchmarks.md) (astro

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.118",
+  "version": "0.0.121",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.118",
-    "@vzn/vx-linux-arm64": "0.0.118",
-    "@vzn/vx-darwin-x64": "0.0.118",
-    "@vzn/vx-darwin-arm64": "0.0.118"
+    "@vzn/vx-linux-x64": "0.0.121",
+    "@vzn/vx-linux-arm64": "0.0.121",
+    "@vzn/vx-darwin-x64": "0.0.121",
+    "@vzn/vx-darwin-arm64": "0.0.121"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/watch-fs.ts

@@ -32,7 +32,7 @@ export interface ArmedWatcher {
 }
 
 /** How often the fallback re-walks a watched tree. */
-export const POLL_INTERVAL_MS = 250
+const POLL_INTERVAL_MS = 250
 
 /**
  * Directory names the fallback never descends into WHEN no better filter is
@@ -246,3 +246,94 @@ export function fsClockNow(dir: string): number {
     return Date.now()
   }
 }
+
+/** A handle that watches nothing: a slot a drop emptied, an arm not made. */
+export const CLOSED: WatchHandle = { close() {} }
+
+/**
+ * Every watcher `vx watch` arms. Each OS watcher proves delivery or is
+ * swapped for the poller in its slot; an OS watch limit (ENOSPC, EMFILE)
+ * goes straight to the poller; `VX_WATCH_POLL=1` polls from the start.
+ * `skip` is what the poller leaves unsampled, asked on each walk.
+ */
+export class WatcherPool {
+  private readonly watchers: WatchHandle[] = []
+  private readonly proofs: Promise<void>[] = []
+  // `VX_WATCH_POLL=1` skips the OS watcher entirely. Where it is known not
+  // to work — a sandbox with no `machLookup` for `com.apple.FSEvents`, a
+  // network mount, a container bind — the attempt costs a denied syscall
+  // and a two-second wait before the fallback takes over anyway.
+  private readonly forcePoll = (process.env['VX_WATCH_POLL'] ?? '') !== ''
+
+  constructor(private readonly skip: (dir: string, rel: string) => boolean) {
+    if (this.forcePoll)
+      process.stderr.write(`vx watch: polling every ${POLL_INTERVAL_MS} ms (VX_WATCH_POLL)\n`)
+  }
+
+  private poll(dir: string, recursive: boolean, onEvent: (filename: string) => void): WatchHandle {
+    return pollWatcher(dir, recursive, onEvent, POLL_INTERVAL_MS, (rel) => this.skip(dir, rel))
+  }
+
+  // By slot, not by handle: an OS watcher that never proves delivery is
+  // swapped for a poller in place, and a drop must close what is there.
+  arm(dir: string, recursive: boolean, onEvent: (filename: string) => void): WatchHandle {
+    const watchers = this.watchers
+    const at = watchers.length
+    const handle: WatchHandle = {
+      close: () => {
+        watchers[at]?.close()
+        watchers[at] = CLOSED
+      },
+    }
+    if (this.forcePoll) {
+      watchers.push(this.poll(dir, recursive, onEvent))
+      return handle
+    }
+    let armed: ArmedWatcher
+    try {
+      armed = armWatcher(dir, recursive, onEvent)
+    } catch (err) {
+      // The OS's watch limit, not the directory: the loop said "watching"
+      // and never fired. The poller needs no watch slot.
+      const code = (err as NodeJS.ErrnoException).code
+      if (code !== 'ENOSPC' && code !== 'EMFILE') throw err
+      watchers.push(this.poll(dir, recursive, onEvent))
+      process.stderr.write(
+        `vx watch: ${dir}: the OS watch limit is reached (${code}); polling every ${POLL_INTERVAL_MS} ms instead — raise it (Linux: sysctl fs.inotify.max_user_watches) to watch natively\n`,
+      )
+      return handle
+    }
+    watchers.push(armed.watcher)
+    this.proofs.push(
+      armed.ready.then((ok) => {
+        if (ok) return
+        armed.watcher.close()
+        // Dropped by a rearm before its proof settled: nothing to swap in.
+        if (watchers[at] !== armed.watcher) return
+        // The watcher never proved delivery, so it is not one: an FSEvents
+        // stream the OS refused, a filesystem that reports nothing. Swap in
+        // the poller rather than run a loop that silently never fires.
+        watchers[at] = this.poll(dir, recursive, onEvent)
+        process.stderr.write(
+          `vx watch: ${dir}: no OS watch events within ${WATCH_PROBE_TIMEOUT_MS} ms; polling every ${POLL_INTERVAL_MS} ms instead\n`,
+        )
+      }),
+    )
+    return handle
+  }
+
+  /** Settles once every arm so far has proved delivery or fallen back. */
+  async proved(): Promise<void> {
+    await Promise.all(this.proofs)
+  }
+
+  closeAll(): void {
+    for (const w of this.watchers) {
+      try {
+        w.close()
+      } catch {
+        // ignore
+      }
+    }
+  }
+}

package/src/cli/watch.ts

@@ -41,14 +41,7 @@ import {
   makeWatchIgnore,
   shapesWatchedSet,
 } from './watch-filter.js'
-import {
-  armWatcher,
-  fsClockNow,
-  pollWatcher,
-  POLL_INTERVAL_MS,
-  WATCH_PROBE_TIMEOUT_MS,
-  type WatchHandle,
-} from './watch-fs.js'
+import { CLOSED, fsClockNow, type WatchHandle, WatcherPool } from './watch-fs.js'
 import { ChangeJudge } from './watch-judge.js'
 import { memberEntries, sameMembers, sweepConfigs, watchedProjects } from './watch-set.js'
 
@@ -313,8 +306,6 @@ interface Rediscovered {
   packageDirs: ReadonlySet<string>
 }
 
-const CLOSED: WatchHandle = { close() {} }
-
 async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
   const { opts, stop, workspaceRoot, projects, cacheDir } = args
   // The watched set as of the last cycle: `rearm` replaces these after an
@@ -414,73 +405,13 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
   /** Since the last cycle, a member came or went, or a file that shapes the watched set changed (`shapesWatchedSet`). */
   let reread = false
 
-  const watchers: WatchHandle[] = []
-  const proofs: Promise<void>[] = []
-  // `VX_WATCH_POLL=1` skips the OS watcher entirely. Where it is known not
-  // to work — a sandbox with no `machLookup` for `com.apple.FSEvents`, a
-  // network mount, a container bind — the attempt costs a denied syscall
-  // and a two-second wait before the fallback takes over anyway.
-  const forcePoll = (process.env['VX_WATCH_POLL'] ?? '') !== ''
-  if (forcePoll)
-    process.stderr.write(`vx watch: polling every ${POLL_INTERVAL_MS} ms (VX_WATCH_POLL)\n`)
   // The poller skips exactly what the event filter would drop: the
   // unconditional segments AND this run's declared output containers. Read
   // through `isIgnoredPath` rather than captured, because `rearm` replaces
   // the filter when the selection changes.
-  const skipUnder =
-    (dir: string) =>
-    (rel: string): boolean =>
-      isIgnoredPath(dir, rel)
-  // By slot, not by handle: an OS watcher that never proves delivery is
-  // swapped for a poller in place, and a drop must close what is there.
-  const arm = (
-    dir: string,
-    recursive: boolean,
-    onEvent: (filename: string) => void,
-  ): WatchHandle => {
-    const at = watchers.length
-    const handle: WatchHandle = {
-      close: () => {
-        watchers[at]?.close()
-        watchers[at] = CLOSED
-      },
-    }
-    if (forcePoll) {
-      watchers.push(pollWatcher(dir, recursive, onEvent, POLL_INTERVAL_MS, skipUnder(dir)))
-      return handle
-    }
-    let armed: ReturnType<typeof armWatcher>
-    try {
-      armed = armWatcher(dir, recursive, onEvent)
-    } catch (err) {
-      // The OS's watch limit, not the directory: the loop said "watching"
-      // and never fired. The poller needs no watch slot.
-      const code = (err as NodeJS.ErrnoException).code
-      if (code !== 'ENOSPC' && code !== 'EMFILE') throw err
-      watchers.push(pollWatcher(dir, recursive, onEvent, POLL_INTERVAL_MS, skipUnder(dir)))
-      process.stderr.write(
-        `vx watch: ${dir}: the OS watch limit is reached (${code}); polling every ${POLL_INTERVAL_MS} ms instead — raise it (Linux: sysctl fs.inotify.max_user_watches) to watch natively\n`,
-      )
-      return handle
-    }
-    watchers.push(armed.watcher)
-    proofs.push(
-      armed.ready.then((ok) => {
-        if (ok) return
-        armed.watcher.close()
-        // Dropped by a rearm before its proof settled: nothing to swap in.
-        if (watchers[at] !== armed.watcher) return
-        // The watcher never proved delivery, so it is not one: an FSEvents
-        // stream the OS refused, a filesystem that reports nothing. Swap in
-        // the poller rather than run a loop that silently never fires.
-        watchers[at] = pollWatcher(dir, recursive, onEvent, POLL_INTERVAL_MS, skipUnder(dir))
-        process.stderr.write(
-          `vx watch: ${dir}: no OS watch events within ${WATCH_PROBE_TIMEOUT_MS} ms; polling every ${POLL_INTERVAL_MS} ms instead\n`,
-        )
-      }),
-    )
-    return handle
-  }
+  const pool = new WatcherPool((dir, rel) => isIgnoredPath(dir, rel))
+  const arm = (dir: string, recursive: boolean, onEvent: (filename: string) => void): WatchHandle =>
+    pool.arm(dir, recursive, onEvent)
 
   /** The instant the watchers go live, on the mtime clock (see `fsClockNow`): a path last modified before it is the initial run's, not an edit. */
   const armedAt = fsClockNow(cacheDir)
@@ -704,7 +635,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
     armImports()
     // A new arm proves delivery like the first ones: an edit in the new
     // package right after this cycle is seen, not lost in the gap.
-    await Promise.all(proofs)
+    await pool.proved()
     process.stdout.write(`${watchingLine(next.projects.length)}\n`)
   }
 
@@ -763,19 +694,13 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
 
   // "watching" is a promise that an edit from now on is seen; every
   // watcher has proved (or been given 2 s to prove) delivery first.
-  await Promise.all(proofs)
+  await pool.proved()
 
   process.stdout.write(`\n${watchingLine(projects.length)}; press Ctrl+C to stop\n`)
 
   return await new Promise<number>((resolve) => {
     const cleanup = async (): Promise<void> => {
-      for (const w of watchers) {
-        try {
-          w.close()
-        } catch {
-          // ignore
-        }
-      }
+      pool.closeAll()
       if (debounceTimer) clearTimeout(debounceTimer)
       // The aborted cycle is tearing its children down; resolve only once
       // it has returned, so the process never exits over a live child.

package/src/workspace/migrate-scripts.ts

@@ -23,8 +23,8 @@
 // hook is usually `rimraf dist`); and a script that is nothing but
 // `<pm> run <other>` becomes a GROUP over `<other>`, so the graph sees the
 // dependency instead of a package-manager subprocess it cannot cache.
-// Yarn 2+ runs no such hooks (probed: `yarn run build` printed BUILD alone),
-// so under it `prebuild` is a script like any other (D-31).
+// Where the manager runs no such hooks (Yarn 2+, D-31; npm or pnpm told
+// not to, D-33) `prebuild` is a script like any other.
 
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
@@ -95,39 +95,90 @@ const OWN_COMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
 }
 
 /**
- * Whether the package manager that owns `dir` is Yarn 2+: the nearest
- * `packageManager: yarn@<2+>`, or the nearest lockfile being a Berry
- * `yarn.lock` (it opens with `__metadata:`). Another lockfile, or none,
- * is a manager that runs `pre` / `post` hooks.
+ * Whether the package manager that owns `dir` runs `pre` / `post` hooks
+ * around a script. The manager is the nearest `packageManager` field or
+ * lockfile, and its settings are read beside it, as each reads them for a
+ * member too. Probed with a `prebuild` / `build` / `postbuild` trio: Yarn
+ * 2+ runs none (D-31); npm runs none under `ignore-scripts=true` in
+ * `.npmrc`; pnpm runs none under `enable-pre-post-scripts=false` there or
+ * `enablePrePostScripts: false` in `pnpm-workspace.yaml` (D-33); Bun and
+ * Yarn 1 run them whatever those say. No manager found is npm's default.
  */
-function isYarnBerry(dir: string, memo: Map<string, boolean>): boolean {
+function runsScriptHooks(dir: string, memo: Map<string, boolean>): boolean {
   const known = memo.get(dir)
   if (known !== undefined) return known
-  let answer: boolean | undefined
-  const manifest = path.join(dir, 'package.json')
+  const read = (f: string): string | undefined => {
+    try {
+      return readFileSync(path.join(dir, f), 'utf8')
+    } catch {
+      return undefined
+    }
+  }
+  let manager: string | undefined
   try {
-    const pm = (JSON.parse(readFileSync(manifest, 'utf8')) as { packageManager?: unknown })
+    const pm = (JSON.parse(read('package.json') ?? '') as { packageManager?: unknown })
       .packageManager
-    if (typeof pm === 'string') answer = /^yarn@([2-9]|\d{2,})/.test(pm)
+    if (typeof pm === 'string')
+      manager = /^yarn@([2-9]|\d{2,})/.test(pm) ? 'berry' : pm.split('@')[0]
   } catch {}
-  if (answer === undefined) {
-    const lock = path.join(dir, 'yarn.lock')
-    if (existsSync(lock)) answer = readFileSync(lock, 'utf8').includes('\n__metadata:')
-    else if (
-      ['package-lock.json', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb'].some((f) =>
-        existsSync(path.join(dir, f)),
-      )
-    )
-      answer = false
+  if (manager === undefined) {
+    const yarnLock = read('yarn.lock')
+    if (yarnLock !== undefined) manager = yarnLock.includes('\n__metadata:') ? 'berry' : 'yarn'
+    else if (existsSync(path.join(dir, 'pnpm-lock.yaml'))) manager = 'pnpm'
+    else if (existsSync(path.join(dir, 'package-lock.json'))) manager = 'npm'
+    else if (['bun.lock', 'bun.lockb'].some((f) => existsSync(path.join(dir, f)))) manager = 'bun'
   }
-  if (answer === undefined) {
+  let answer: boolean
+  if (manager === undefined) {
     const up = path.dirname(dir)
-    answer = up === dir ? false : isYarnBerry(up, memo)
+    answer = up === dir ? true : runsScriptHooks(up, memo)
+  } else {
+    const npmrc = read('.npmrc') ?? ''
+    const set = (key: string, value: string): boolean =>
+      new RegExp(`^\\s*${key}\\s*=\\s*${value}\\s*$`, 'm').test(npmrc)
+    answer =
+      manager === 'berry'
+        ? false
+        : manager === 'npm'
+          ? !set('ignore-scripts', 'true')
+          : manager === 'pnpm'
+            ? !set('enable-pre-post-scripts', 'false') &&
+              !/^enablePrePostScripts:\s*false\s*$/m.test(read('pnpm-workspace.yaml') ?? '')
+            : true
   }
   memo.set(dir, answer)
   return answer
 }
 
+const MANIFEST_IMPORT = "import pkg from './package.json' with { type: 'json' }"
+
+/**
+ * The `$npm_*` variables a command reads. Every manager sets them for a
+ * script (probed: npm, pnpm, bun and yarn printed the version, the name
+ * and the script's name) and vx sets none, so a migrated `echo
+ * $npm_package_version` printed nothing (D-34). The name and version are
+ * read from the manifest at evaluation, so a bump reaches them; the event
+ * is the script's own name, which a folded hook does not share.
+ */
+function npmEnv(
+  command: string,
+  script: string,
+  folded: boolean,
+): { define: Record<string, unknown>; unset: string[]; readsManifest: boolean } {
+  const define: Record<string, unknown> = {}
+  const unset: string[] = []
+  let readsManifest = false
+  for (const [, v] of command.matchAll(/\$\{?(npm_[A-Za-z0-9_]+)/g)) {
+    if (v! in define || unset.includes(v!)) continue
+    if (v === 'npm_package_name' || v === 'npm_package_version') {
+      define[v] = { raw: v === 'npm_package_name' ? 'pkg.name' : 'pkg.version' }
+      readsManifest = true
+    } else if (v === 'npm_lifecycle_event' && !folded) define[v] = script
+    else unset.push(v!)
+  }
+  return { define, unset, readsManifest }
+}
+
 function scriptsOf(meta: ProjectMeta): Record<string, unknown> {
   // package.json is a boundary: `scripts` is whatever the file holds. A
   // string or an array would enumerate its indices as script names.
@@ -178,10 +229,10 @@ function upstreamBuildOnWorker(tasks: GeneratedTask[]): void {
 
 export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
   const projects: GeneratedProject[] = []
-  const berry = new Map<string, boolean>()
+  const hookMemo = new Map<string, boolean>()
   for (const meta of metas) {
     const scripts = scriptsOf(meta)
-    const runsHooks = !isYarnBerry(meta.dir, berry)
+    const runsHooks = runsScriptHooks(meta.dir, hookMemo)
     const runnable = Object.keys(scripts).filter(
       (n) => typeof scripts[n] === 'string' && scripts[n] !== '',
     )
@@ -205,6 +256,7 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
       return hookOf === null || !has(hookOf[2]!) || LIFECYCLE.test(hookOf[2]!)
     }
     const tasks: GeneratedTask[] = []
+    let readsManifest = false
     for (const name of names) {
       if (!isTask(name)) continue
 
@@ -239,9 +291,18 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
           `npm ran ${hooks.map((h) => `\`${h}\``).join(' and ')} around this script without being asked; folded into the command in that order`,
         )
       }
-      const task: Record<string, unknown> = { exec: { command } }
+      const exec: Record<string, unknown> = { command }
+      const npm = npmEnv(command, name, hooks.length > 0)
+      if (Object.keys(npm.define).length > 0) exec['env'] = { define: npm.define }
+      if (npm.readsManifest) readsManifest = true
+      for (const v of npm.unset) {
+        todos.push(
+          `the script reads $${v}, which the package manager sets and vx does not: define it under exec.env.define or drop it`,
+        )
+      }
+      const task: Record<string, unknown> = { exec }
       if (PERSISTENT_TASK_NAMES.has(name)) {
-        task['exec'] = { command, persistent: {} }
+        exec['persistent'] = {}
         todos.push(PERSISTENT_TODO)
       }
       if (name === 'build') {
@@ -262,7 +323,10 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
       })
     }
     upstreamBuildOnWorker(tasks)
-    if (tasks.length > 0) projects.push({ name: meta.name, dir: meta.dir, importLines: [], tasks })
+    if (tasks.length > 0) {
+      const importLines = readsManifest ? [MANIFEST_IMPORT] : []
+      projects.push({ name: meta.name, dir: meta.dir, importLines, tasks })
+    }
   }
   return {
     headerNotes: [

package/src/workspace/project-loader.ts

@@ -345,8 +345,9 @@ export async function loadProjectConfigs(
       const hit = cacheKey === null ? undefined : hits.get(cacheKey)
       // Stored AFTER validation, so a hit needs none; the key covers every
       // byte the evaluation could have read.
-      if (hit !== undefined) {
-        out.push(JSON.parse(hit) as ProjectConfig)
+      const cached = hit === undefined ? undefined : storedConfig(hit)
+      if (cached !== undefined) {
+        out.push(cached)
         continue
       }
       // A fast key that missed: the closure is stale or the file changed.
@@ -365,9 +366,10 @@ export async function loadProjectConfigs(
         })
         key = keyed?.key ?? null
         closure = keyed !== null && keyed.indexable ? keyed.closure : undefined
-        const slowHit = key === null ? null : (store!.getConfigEval(key) ?? null)
-        if (slowHit !== null) {
-          out.push(JSON.parse(slowHit) as ProjectConfig)
+        const slowRow = key === null ? null : (store!.getConfigEval(key) ?? null)
+        const slowHit = slowRow === null ? undefined : storedConfig(slowRow)
+        if (slowHit !== undefined) {
+          out.push(slowHit)
           if (closure !== undefined) learnedClosures.push([configPath, closure])
           continue
         }
@@ -488,3 +490,20 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
   }
   return null
 }
+
+/**
+ * A stored evaluation, or undefined when the row is not one: a row cut
+ * short (a crash mid-write, a bad disk) failed every later run with a
+ * `SyntaxError` stack from this loader until the cache was wiped
+ * (fuzzed, L-17). As a miss it is evaluated again and the row replaced.
+ */
+function storedConfig(json: string): ProjectConfig | undefined {
+  try {
+    const v: unknown = JSON.parse(json)
+    return typeof v === 'object' && v !== null && !Array.isArray(v)
+      ? (v as ProjectConfig)
+      : undefined
+  } catch {
+    return undefined
+  }
+}