@vzn/vx 0.0.140 → 0.0.142

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.140",
+  "version": "0.0.142",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.140",
-    "@vzn/vx-linux-arm64": "0.0.140",
-    "@vzn/vx-darwin-x64": "0.0.140",
-    "@vzn/vx-darwin-arm64": "0.0.140"
+    "@vzn/vx-linux-x64": "0.0.142",
+    "@vzn/vx-linux-arm64": "0.0.142",
+    "@vzn/vx-darwin-x64": "0.0.142",
+    "@vzn/vx-darwin-arm64": "0.0.142"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/archive.ts

@@ -38,7 +38,7 @@
 // otherwise silently loses the claim rather than acting on it.
 
 import { chmodSync, renameSync, statSync, utimesSync } from 'node:fs'
-import { mkdir, readlink, realpath, rmdir, stat, unlink, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, readlink, realpath, rmdir, stat, unlink, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import { UserError } from '../util/index.js'
 import { TarFormatError, type TarInput, tarEntries, tarPack, tarSize } from './tar-stream.js'
@@ -193,6 +193,13 @@ export interface PackArgs {
   outputs: ReadonlyMap<string, string>
   /** The producing execution's usage, when the runner reported it. */
   exec?: ExecUsage | undefined
+  /**
+   * The project directory a symlinked output must resolve inside. vx reads
+   * outputs outside the task's sandbox, so a link a sandboxed task planted
+   * to a file it could not read (another project's, the user's home) packed
+   * that file into the artifact and the remote (L-23).
+   */
+  within?: string
 }
 
 /** A packed artifact's plan: its entries with their stats, and the tar's exact size. */
@@ -206,11 +213,12 @@ export interface ArtifactPlan {
  * mtime) and lay out the tar — stdout first, the outputs, the sidecar
  * last — with its exact size, so the caller can choose the one-call pack
  * for a small artifact and the streamed one for a large one before a
- * byte is read. A symlinked output is stored as its target's content, as
- * it always was.
+ * byte is read. A symlinked output is stored as its target's content,
+ * when that target is inside `within`.
  */
 export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
   const meta: MetaFile = { version: 1, files: {} }
+  let withinReal: Promise<string> | undefined
   if (args.key !== undefined) meta.key = args.key
   const exec = usageOf(args.exec)
   if (exec !== undefined) meta.exec = exec
@@ -221,14 +229,31 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
       // directory, or a dangling one, has no bytes to pack: refuse loudly
       // rather than store an entry that restores to nothing.
       const shown = name.startsWith('outputs/') ? name.slice('outputs/'.length) : name
-      const st = await stat(abs).catch((err: NodeJS.ErrnoException) => {
+      const dangling = (err: NodeJS.ErrnoException): never => {
         if (err.code === 'ENOENT') {
           throw new UserError(
             `output ${shown} is a dangling symlink: vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
           )
         }
         throw err
-      })
+      }
+      // lstat, so a regular file costs no second call; only a link is
+      // resolved, and its body is read from the path this check resolved.
+      let src = abs
+      let st = await lstat(abs)
+      if (st.isSymbolicLink()) {
+        src = await realpath(abs).catch(dangling)
+        if (args.within !== undefined) {
+          withinReal ??= realpath(args.within)
+          const root = await withinReal
+          if (!src.startsWith(root + path.sep)) {
+            throw new UserError(
+              `output ${shown} is a symlink to ${src}, outside the project: vx packs a symlinked output as its target's bytes, and a project's outputs come from its own directory — emit a file there, or take it back with a '!' entry`,
+            )
+          }
+        }
+        st = await stat(src).catch(dangling)
+      }
       if (!st.isFile()) {
         throw new UserError(
           `output ${shown} is not a regular file (a symlink to a directory?): vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
@@ -240,7 +265,7 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
       meta.files[name] = [mode, Math.floor(st.mtimeMs)]
       return {
         name,
-        abs,
+        abs: src,
         size: st.size,
         mode,
         // ustar's octal field holds no sign: an mtime before 1970 made the

package/src/cache/cache.ts

@@ -1304,6 +1304,7 @@ export class Cache implements CacheLayer {
       stdout: args.entry.stdout ?? '',
       outputs: this.outputsOf(args),
       exec: usageOfEntry(args.entry),
+      within: args.projectDir,
     })
     if (plan.size > this.artifactCeiling) {
       throw new Error(

package/src/workspace/filter.ts

@@ -8,7 +8,8 @@
 //   <pattern>^...    only the transitive deps of pattern (excluding the matched package)
 //   ...^<pattern>    only the transitive dependents of pattern (excluding the matched package)
 //   !<pattern>       exclude packages matching pattern from the selection
-//   [<since>]        projects affected since the given git ref
+//   [<since>]        projects affected since the given git ref; after a name
+//                    or {dir} selector, the selected ones only (D-44)
 //                    (Turbo-style; resolved upstream of applyFilters via
 //                    `affectedProjects` since it needs FS + git access)
 //
@@ -34,8 +35,9 @@ export interface ParsedFilter {
   matcher: string
   /**
    * When non-undefined, this filter is a git-relative `[<since>]`
-   * selector. The matcher field is unused; the CLI resolves the ref
-   * to a concrete set of project names before calling applyFilters.
+   * selector: bare (`matcher` empty), or narrowing a name or `{dir}`
+   * selector (`@scope/*[main]`, D-44). The CLI resolves the ref to a
+   * concrete set of project names before calling applyFilters.
    */
   gitSince?: string
   /** A path form carrying a glob (`./packages/*`): matched over the root-relative project dir. */
@@ -82,6 +84,18 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     }
   }
 
+  // `<selector>[<since>]`: the selected packages that changed since the
+  // ref (D-44). Turbo and pnpm read `@scope/*[HEAD]` and `{./apps/*}[main]`
+  // so; vx read the whole as one name glob and matched nothing.
+  let gitSince: string | undefined
+  // An unbraced path keeps its brackets: `./packages/[abc]` is a glob
+  // class, and Turbo takes a directory with a ref only as `{dir}[ref]`.
+  const scoped = /^(.+)\[([^\]]+)\]$/.exec(s)
+  if (scoped !== null && !scoped[1]!.startsWith('./') && scoped[1] !== '.') {
+    s = scoped[1]!
+    gitSince = scoped[2]!
+  }
+
   // `...`, `!`, `^...`: the operators with no project between them. An
   // empty name glob matched nothing and was hinted "Did you mean a?", and
   // an empty exclude (`!$UNSET`) excluded nothing, so every project ran
@@ -120,6 +134,7 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     isPath,
     matcher,
     ...(pathGlob !== undefined ? { pathGlob, pathRoot: workspaceRoot } : {}),
+    ...(gitSince !== undefined ? { gitSince } : {}),
   }
 }
 
@@ -132,8 +147,15 @@ function matchProjects(
   // is pure; git access happens upstream). Use the provided set as
   // the match set for this filter.
   if (filter.gitSince !== undefined) {
-    return [...(affectedByFilter?.get(filter) ?? new Set())]
+    const changed = affectedByFilter?.get(filter) ?? new Set<string>()
+    if (filter.matcher === '') return [...changed]
+    return matchSelector(filter, projects).filter((name) => changed.has(name))
   }
+  return matchSelector(filter, projects)
+}
+
+/** The projects a name or path selector names, git ranges aside. */
+function matchSelector(filter: ParsedFilter, projects: ProjectMeta[]): string[] {
   const out: string[] = []
   if (filter.isPath) {
     // A path naming a project's own directory is that project, as Turbo and