@vzn/vx 0.0.16 → 0.0.18

package/src/workspace/config-eval.ts

@@ -0,0 +1,210 @@
+// Re-evaluating a project config, import closure included, inside a
+// long-lived process.
+//
+// The loader's query-string bust only changes the ENTRY's specifier.
+// Bun caches an evaluated module by its RESOLVED specifier, so an
+// `import './preset.js'` inside a config resolves to the same key no
+// matter what query the entry carries — a busted entry re-evaluates
+// against a STALE preset. Shared presets are the documented composition
+// mechanism (`vx migrate` generates one), so through a whole `vx watch`
+// session a preset edit was invisible; and because the resolved config
+// feeds the cache key, vx answered `up-to-date` for a command that had
+// changed on disk.
+//
+// A Worker gets its own module registry, so everything it imports is
+// read from disk NOW. It is the only mechanism for this that the
+// runtime exposes as public API: `globalThis.Loader.registry` — the
+// obvious place to evict from — exists on Bun 1.3.11 and is GONE on
+// 1.3.14, where an eviction-based fix degrades to no fix at all while
+// still reporting success.
+//
+// The worker source is an inline data: URL, not a sibling file, because
+// `bun build --compile` does NOT embed a Worker entry point — it
+// resolves the URL from disk at runtime, so a sibling file would make
+// the shipped standalone binary fail with ModuleNotFound.
+//
+// The config crosses back as JSON. That is already this project's
+// contract for a config object: `hashTaskConfig` derives the cache key
+// from `JSON.stringify(config)` and `vx lock` stores the same
+// round-trip, so a JSON round-trip cannot change how a config hashes,
+// locks or runs. `JSON.stringify(JSON.parse(s)) === s`, so a config
+// re-read through a worker derives the SAME cache key as the
+// in-process first load — which is why this needs no CACHE_VERSION bump.
+
+import path from 'node:path'
+import { MAX_TIMEOUT_MS } from '../util/index.js'
+
+const WORKER_SRC = `
+self.onmessage = async (e) => {
+  const { id, path } = e.data
+  try {
+    const ns = await import(path)
+    const mod = ns?.default
+    postMessage({
+      id,
+      ok: true,
+      json: mod !== null && typeof mod === 'object' ? JSON.stringify(mod) : null,
+    })
+  } catch (err) {
+    postMessage({
+      id,
+      ok: false,
+      name: err?.name ?? 'Error',
+      message: err?.message ?? String(err),
+      stack: err?.stack ?? null,
+    })
+  }
+}
+`
+
+const WORKER_URL = `data:text/javascript,${encodeURIComponent(WORKER_SRC)}`
+
+interface WorkerReply {
+  id: number
+  ok: boolean
+  json: string | null
+  name: string
+  message: string
+  stack: string | null
+}
+
+interface Pending {
+  resolve: (json: string | null) => void
+  reject: (err: Error) => void
+}
+
+/**
+ * How long a single config evaluation may take before we treat the worker as
+ * wedged. Real evaluations are ~10 ms; this exists only so a killed or hung
+ * worker cannot stall a long-lived process indefinitely. Read per call so a
+ * test can drive the deadline instead of waiting it out.
+ */
+function workerTimeoutMs(): number {
+  const raw = process.env['VX_CONFIG_WORKER_TIMEOUT_MS']
+  // Same kind of value as the teardown deadline, so the same treatment: a
+  // BOUND on a worker that may be wedged, with no "no limit" reading. Falls
+  // back rather than clamping, because honouring ~24.8 days would hang
+  // `vx watch` forever on a worker the OS killed — and unbounded makes it 1 ms,
+  // so EVERY config load times out instead. Both ends break the same feature.
+  if (raw !== undefined && /^[0-9]+$/.test(raw)) {
+    const n = Number(raw)
+    if (n <= MAX_TIMEOUT_MS) return n
+  }
+  return 30_000
+}
+
+const pending = new Map<number, Pending>()
+let worker: Worker | null = null
+let inFlight = 0
+let nextId = 0
+let workersCreated = 0
+
+/**
+ * Workers created so far. Exported solely so a test can pin that ONE
+ * worker serves a whole concurrent round — the property that keeps a
+ * 1000-project watch cycle at one worker instead of a thousand.
+ */
+export function configEvalWorkerCount(): number {
+  return workersCreated
+}
+
+function rejectAll(err: Error): void {
+  for (const p of pending.values()) p.reject(err)
+  pending.clear()
+}
+
+/**
+ * The worker serving the current round. Every load that is in flight at
+ * the same moment shares it, and it is retired once the last of them
+ * settles — so a `Promise.all` round costs ONE worker, and the next
+ * round (the next watch cycle) still starts from an empty registry.
+ *
+ * Sharing within a round is also the more faithful semantics: two
+ * configs importing the same preset evaluate it once, exactly as they
+ * would in a fresh `vx run` process.
+ */
+function acquireWorker(): Worker {
+  if (worker !== null) return worker
+  const w = new Worker(WORKER_URL)
+  workersCreated++
+  w.onmessage = (event: MessageEvent): void => {
+    const msg = event.data as WorkerReply
+    const p = pending.get(msg.id)
+    if (p === undefined) return
+    pending.delete(msg.id)
+    if (msg.ok) {
+      p.resolve(msg.json)
+      return
+    }
+    // Rebuild the error the config actually threw. Name, message and
+    // stack all survive the hop, so a broken config reports the same
+    // text it would from an in-process import.
+    const err = new Error(msg.message)
+    err.name = msg.name
+    if (msg.stack !== null) err.stack = msg.stack
+    p.reject(err)
+  }
+  w.onerror = (event: ErrorEvent): void => {
+    rejectAll(new Error(`config worker failed: ${String(event.message)}`))
+  }
+  // A reply that cannot be deserialized would otherwise leave its caller
+  // awaiting forever — every path off this worker must settle its pending
+  // promises, including the ones that carry no usable payload.
+  w.addEventListener('messageerror', () => {
+    rejectAll(new Error('config worker sent an undeserializable reply'))
+  })
+  worker = w
+  return w
+}
+
+/**
+ * Evaluate `configPath` against a fresh module registry and return its
+ * default export, JSON round-tripped. `null` means the module had no
+ * object default export — the caller owns that error message so it
+ * reads identically whichever path produced it.
+ */
+export async function evaluateConfigFresh(configPath: string): Promise<unknown> {
+  const abs = path.resolve(configPath)
+  const id = nextId++
+  inFlight++
+  // Declared out here so the `finally` can clear it on EVERY exit, including a
+  // rejection. See the note at the clear itself.
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const w = acquireWorker()
+    // A worker thread the OS kills — memory pressure on a loaded CI box, a
+    // hard crash — fires no `error` event, so without a deadline this await
+    // never settles and `vx watch` hangs forever on a cycle that would
+    // otherwise take milliseconds. Nothing else bounds it: there is no
+    // run-level timeout. The budget is enormous next to the ~10 ms a real
+    // evaluation costs, so it can only fire on a genuine wedge.
+    const budget = workerTimeoutMs()
+    const json = await new Promise<string | null>((resolve, reject) => {
+      pending.set(id, { resolve, reject })
+      timer = setTimeout(() => {
+        rejectAll(new Error(`config worker did not answer within ${budget}ms`))
+        if (worker !== null) {
+          worker.terminate()
+          worker = null
+        }
+      }, budget)
+      timer.unref?.()
+      w.postMessage({ id, path: abs })
+    })
+    return json === null ? null : (JSON.parse(json) as unknown)
+  } finally {
+    // In the `finally`, not after the await: a REJECTED evaluation — a config
+    // with a typo, the common case while editing — would otherwise skip the
+    // clear and leave its timer armed for the whole budget. When that orphan
+    // later fired it ran `rejectAll()` and terminated whatever worker was
+    // current by then, killing an unrelated healthy round with a timeout
+    // message naming a budget nobody set for it.
+    clearTimeout(timer)
+    pending.delete(id)
+    inFlight--
+    if (inFlight === 0 && worker !== null) {
+      worker.terminate()
+      worker = null
+    }
+  }
+}

package/src/workspace/config-imports.ts

@@ -0,0 +1,161 @@
+// The third `changed file → project` channel for `--affected`.
+//
+// Directory containment answers "which project owns this file", and
+// `cache.inputs.workspaceFiles` answers "which project declared it". Neither
+// can see the one remaining way a file reaches a task: a project's
+// `vx.config.*` IMPORTS it. Resolved-config hashing folds the imported values
+// into the cache key (architecture principle #4), so editing such a file
+// re-keys the task — and `affected.ts` states the rule this exists to keep:
+// "input hashing sees it, so `--affected` must too."
+//
+// This is a STATIC scan. Nothing is evaluated: `Bun.Transpiler.scanImports`
+// reads the specifiers and `Bun.resolveSync` turns them into paths. The
+// `project-loader.ts` note that a bust "cannot reach the config's import
+// closure" is about `import()` at runtime, not about reading the source.
+//
+// Two rules keep the walk small, and the second is the one that makes it
+// affordable at all:
+//
+//   - RELATIVE specifiers only. A bare specifier is a package; it moves when
+//     the lockfile moves, which the workspace fingerprint already covers.
+//   - Descend only through files owned by NO project. A config reaching into
+//     another project (this repo's `apps/docs/vx.config.ts` imports
+//     `../../src/index.ts`) records that edge and STOPS there — following it
+//     would drag substantially all of core `src/` into the closure, and the
+//     containment channel already selects the project that owns it.
+
+import { realpath } from 'node:fs/promises'
+import path from 'node:path'
+import type { ProjectMeta } from './workspace.js'
+
+/**
+ * Absolute resolved targets of the RELATIVE specifiers in `source`.
+ *
+ * Paths come back realpath'd, because `Bun.resolveSync` realpaths them — see
+ * the caller, which realpaths everything it compares against for exactly that
+ * reason. `import type` is erased by `scanImports` and so contributes no edge,
+ * which is correct: an erased import cannot move a resolved value.
+ */
+function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'): string[] {
+  let specifiers: string[]
+  try {
+    specifiers = new Bun.Transpiler({ loader }).scanImports(source).map((i) => i.path)
+  } catch {
+    return [] // unparseable source contributes no edges
+  }
+  const out: string[] = []
+  for (const spec of specifiers) {
+    if (!spec.startsWith('./') && !spec.startsWith('../')) continue
+    try {
+      out.push(Bun.resolveSync(spec, fromDir))
+    } catch {
+      // Unresolvable (deleted, typo, extensionless miss) — a config that will
+      // not load cannot be shown to import anything, and failing selection
+      // over it would break a working build.
+    }
+  }
+  return out
+}
+
+export interface ConfigImportOwnersArgs {
+  /**
+   * Realpath'd HERE, not by the caller. `Bun.resolveSync` returns realpath'd
+   * targets, so a raw root silently fails every containment check and the
+   * scan reports "no imports" — indistinguishable from a clean tree. Owning
+   * the normalisation in one place makes that misuse unrepresentable.
+   */
+  workspaceRoot: string
+  projects: readonly ProjectMeta[]
+  /** Workspace-relative POSIX paths — the same list containment consumed. */
+  changed: readonly string[]
+  /** Already-selected projects; their configs need no scan. */
+  skip: ReadonlySet<string>
+}
+
+/**
+ * Project dir → name, REALPATH'D — which is why this cannot reuse the index
+ * the containment pass builds. `Bun.resolveSync` hands back realpath'd
+ * targets, and on darwin a workspace under `os.tmpdir()` lives at
+ * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
+ * the two matches nothing and fails exactly like "found no imports".
+ */
+async function realDirIndex(projects: readonly ProjectMeta[]): Promise<Map<string, string>> {
+  const out = new Map<string, string>()
+  await Promise.all(
+    projects.map(async (p) => {
+      out.set(await realpath(p.dir).catch(() => p.dir), p.name)
+    }),
+  )
+  return out
+}
+
+const TS_EXT = new Set(['.ts', '.mts', '.cts'])
+
+/** The deepest project containing `file`, or undefined when none does. */
+function ownerOf(file: string, dirToName: ReadonlyMap<string, string>): string | undefined {
+  let dir = path.dirname(file)
+  for (;;) {
+    const name = dirToName.get(dir)
+    if (name !== undefined) return name
+    const parent = path.dirname(dir)
+    if (parent === dir) return undefined
+    dir = parent
+  }
+}
+
+/** Projects whose config file transitively imports one of `changed`. */
+export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set<string>> {
+  const selected = new Set<string>()
+  if (a.changed.length === 0 || a.skip.size === a.projects.length) return selected
+  const workspaceRoot = await realpath(a.workspaceRoot).catch(() => a.workspaceRoot)
+
+  const roots = new Map<string, string>() // abs config path → project name
+  await Promise.all(
+    a.projects.map(async (p) => {
+      const cfg = p.configPath
+      if (cfg === null || cfg === '' || a.skip.has(p.name)) return
+      roots.set(await realpath(cfg).catch(() => path.resolve(cfg)), p.name)
+    }),
+  )
+  if (roots.size === 0) return selected
+  const dirToName = await realDirIndex(a.projects)
+
+  // target → the files that import it. Reversed up front so one BFS from the
+  // changed set answers every root at once, instead of a walk per root.
+  const importedBy = new Map<string, string[]>()
+  const visited = new Set<string>()
+  const queue = [...roots.keys()]
+  while (queue.length > 0) {
+    const file = queue.pop()!
+    if (visited.has(file)) continue
+    visited.add(file)
+    let source: string
+    try {
+      source = await Bun.file(file).text()
+    } catch {
+      continue // unreadable: no edges, and not this pass's problem to report
+    }
+    const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
+    for (const target of scanLocalImports(source, path.dirname(file), loader)) {
+      if (!target.startsWith(workspaceRoot + path.sep)) continue
+      if (target.split(path.sep).includes('node_modules')) continue
+      const list = importedBy.get(target)
+      if (list) list.push(file)
+      else importedBy.set(target, [file])
+      // Descend ONLY through unowned files — see the header.
+      if (ownerOf(target, dirToName) === undefined) queue.push(target)
+    }
+  }
+
+  const seen = new Set<string>()
+  const walk = [...a.changed.map((rel) => path.resolve(workspaceRoot, rel))]
+  while (walk.length > 0) {
+    const file = walk.pop()!
+    if (seen.has(file)) continue
+    seen.add(file)
+    const owner = roots.get(file)
+    if (owner !== undefined) selected.add(owner)
+    for (const importer of importedBy.get(file) ?? []) walk.push(importer)
+  }
+  return selected
+}

package/src/workspace/filter.ts

@@ -1,6 +1,6 @@
-// Filter DSL — pnpm-style selectors for `-F / --filter`.
+// Filter DSL — pnpm-style selectors for `--filter`.
 //
-//   <pattern>        name glob (e.g. foo, @scope/*)
+//   <pattern>        name glob, `*` = any characters (e.g. foo, @scope/*)
 //   ./<dir>          packages whose dir is at or under <dir> (relative to workspace root)
 //   {<dir>}          same as ./<dir>
 //   <pattern>...     pattern + its transitive workspace dependencies
@@ -107,13 +107,24 @@ function matchProjects(
     }
     return out
   }
-  const glob = new Bun.Glob(filter.matcher)
+  const re = compileNameGlob(filter.matcher)
   for (const p of projects) {
-    if (glob.match(p.name)) out.push(p.name)
+    if (re.test(p.name)) out.push(p.name)
   }
   return out
 }
 
+/**
+ * Compile a name pattern where `*` is the sole metacharacter and means "any
+ * characters" — pnpm's rule. A path glob would treat `/` as a separator, so
+ * `*` could never cross the `@scope/` boundary: `--filter '*'` would select
+ * only UNSCOPED packages, and `*core*` would match nothing at all.
+ */
+function compileNameGlob(pattern: string): RegExp {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')
+  return new RegExp(`^${escaped}$`)
+}
+
 export interface ApplyFiltersOptions {
   filters: ParsedFilter[]
   projects: ProjectMeta[]
@@ -125,6 +136,12 @@ export interface ApplyFiltersOptions {
    * stays pure + sync.
    */
   affectedByFilter?: Map<ParsedFilter, Set<string>>
+  /**
+   * Called once per filter that matched zero projects, before expansion.
+   * Only the TOTAL empty selection is an error, so without this a typo among
+   * several filters silently under-selects.
+   */
+  onNoMatch?: (filter: ParsedFilter) => void
 }
 
 export function applyFilters(opts: ApplyFiltersOptions): Set<string> {
@@ -134,6 +151,7 @@ export function applyFilters(opts: ApplyFiltersOptions): Set<string> {
 
   for (const f of opts.filters) {
     const matched = matchProjects(f, opts.projects, opts.affectedByFilter)
+    if (matched.length === 0) opts.onNoMatch?.(f)
     const expanded = new Set<string>()
     for (const name of matched) {
       if (!f.onlyDeps) expanded.add(name)

package/src/workspace/fingerprint.ts

@@ -8,7 +8,11 @@ import { xxh3 } from '../util/index.js'
 // for projects that have that file present, which is fine: that's the
 // whole point of bumping CACHE_VERSION when the fingerprint surface
 // expands.
-const WORKSPACE_FINGERPRINT_FILES = [
+// Exported so `--affected` can consult the SAME list. A change to any of
+// these re-keys every task in the workspace, so selection has to widen to
+// match — two copies of this list would silently drift into a run that
+// rebuilds everything while selecting nothing.
+export const WORKSPACE_FINGERPRINT_FILES = [
   // Lockfiles
   'pnpm-lock.yaml',
   'package-lock.json',
@@ -21,6 +25,17 @@ const WORKSPACE_FINGERPRINT_FILES = [
   'pnpm-workspace.yaml',
 ]
 
+// DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs}`. Everything it can
+// declare — `concurrency`, `cacheDir`, `timeout`, and the
+// plugin list — is placement, storage or observability, never what a
+// command produces; core's three seams may change WHERE a task runs, not
+// WHAT it runs (architecture principle #3). Folding it in would also do
+// active harm: a laptop declaring only the local plugins and a CI runner
+// declaring `reapi()` would compute different fingerprints and share not
+// one cache entry — the same split the rejected `NODE_OPTIONS` non-goal
+// describes. A per-task input that genuinely varies belongs in
+// `cache.inputs`, which is the surface built for it.
+
 /**
  * One hash for the workspace as a whole, derived from whichever
  * lockfile + workspace-definition files exist at the root. Folded

package/src/workspace/index.ts

@@ -1,9 +1,9 @@
 // Module contract. Cross-module imports must come through here; see
 // docs/design/module-isolation-2026-06.md and tests/module-boundaries.test.ts.
 
-export { affectedProjects, defaultAffectedBase } from './affected.js'
+export { affectedProjects, defaultAffectedBase, workspaceGlobsMatch } from './affected.js'
 export { applyFilters, parseFilter } from './filter.js'
-export { computeWorkspaceFingerprint } from './fingerprint.js'
+export { computeWorkspaceFingerprint, WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
 export { computeNestedProjectDirs } from './nested-dirs.js'
 export { buildPackageGraph, type PackageGraph } from './package-graph.js'
 export {
@@ -16,7 +16,19 @@ export {
   type Lockfile,
   type LockfileEntry,
 } from './lockfile.js'
-export { loadProjectConfig, loadWorkspaceConfig } from './project-loader.js'
+export {
+  loadProjectConfig,
+  loadProjectConfigs,
+  loadWorkspaceConfig,
+  validateProjectConfig,
+} from './project-loader.js'
+export type { LoadProjectConfigOptions } from './project-loader.js'
+export {
+  blobOidOf,
+  configEvalKey,
+  configEvalKeyFromClosure,
+  type ConfigEvalStore,
+} from './config-cache.js'
 export {
   findWorkspaceRoot,
   listProjects,

package/src/workspace/lockfile.ts

@@ -52,7 +52,14 @@ export async function readLockfile(root: string): Promise<Lockfile | null> {
   } catch {
     throw new UserError(`${LOCKFILE_NAME} is not valid JSON — re-run \`vx lock\` or delete it`)
   }
-  if (typeof parsed !== 'object' || parsed === null) {
+  // `Array.isArray` is not redundant with the `typeof` check: `typeof [] ===
+  // 'object'` and `[] !== null`, so an array sails through and the NEXT check
+  // reports `unsupported version undefined` — a version diagnostic for what is
+  // actually a shape problem, sending the reader to re-run `vx lock` for a file
+  // that was never the right shape. `validateProjectConfig` one layer down
+  // already guards this explicitly, which is what makes the omission here an
+  // inconsistency rather than an oversight.
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
     throw new UserError(`${LOCKFILE_NAME} must be a JSON object — re-run \`vx lock\``)
   }
   const lock = parsed as { version?: unknown; projects?: unknown }
@@ -62,7 +69,11 @@ export async function readLockfile(root: string): Promise<Lockfile | null> {
         `(this vx expects ${LOCKFILE_VERSION}) — re-run \`vx lock\``,
     )
   }
-  if (typeof lock.projects !== 'object' || lock.projects === null) {
+  // Same trap, and this one is worse than a bad message: an ARRAY of entries is
+  // ACCEPTED, because `Object.entries` happily walks it — yielding a project
+  // literally named "0". `--frozen` then looks up real project names against a
+  // lock that declares none of them.
+  if (typeof lock.projects !== 'object' || lock.projects === null || Array.isArray(lock.projects)) {
     throw new UserError(`${LOCKFILE_NAME}: \`projects\` must be an object — re-run \`vx lock\``)
   }
   for (const [name, entry] of Object.entries(lock.projects)) {

package/src/workspace/nested-dirs.ts

@@ -7,11 +7,18 @@ import type { ProjectEntry } from './workspace.js'
  * project's task cannot see files inside another project, even if its
  * globs would otherwise match.
  *
- * Sort once, then scan: nested projects of `p` form a contiguous run
- * immediately after `p` in the sorted order (any non-descendant breaks
- * the prefix-match). O(P log P) instead of the naive O(P²) cross
- * product. Stable for any project set with no dir collisions, which
- * the workspace loader already enforces.
+ * Sort once, then scan forward: every dir sharing `p.dir` as a STRING
+ * prefix is contiguous in sorted order, and `p`'s nested descendants
+ * (`p.dir + sep + …`) are a sub-run within that block. But a SIBLING whose
+ * name extends `p.dir` by a char that sorts BELOW `sep` (`-`, `.`, `+`, a
+ * space; `/` is 0x2F) lands BETWEEN `p.dir` and `p.dir + sep` — so a plain
+ * `break` on the first non-descendant would stop before reaching the nested
+ * children (e.g. `foo`, `foo-utils`, `foo/nested` → `foo/nested` missed,
+ * silently breaking the project-boundary invariant). So: collect descendants,
+ * SKIP interlopers that merely share the `p.dir` string prefix, and break only
+ * once we leave the `p.dir` block entirely. The inner loop is still bounded by
+ * that block (near-O(P log P) on real trees; interlopers are few), not the
+ * full tail.
  */
 export function computeNestedProjectDirs(
   entries: Array<Pick<ProjectEntry, 'name' | 'dir'>>,
@@ -25,8 +32,15 @@ export function computeNestedProjectDirs(
     const nested: string[] = []
     for (let j = i + 1; j < sorted.length; j++) {
       const other = sorted[j]!
-      if (!other.dir.startsWith(prefix)) break
-      nested.push(other.dir)
+      if (other.dir.startsWith(prefix)) {
+        nested.push(other.dir)
+      } else if (!other.dir.startsWith(p.dir)) {
+        // Past every dir sharing `p.dir`'s string prefix — no descendant can
+        // follow (they'd sort inside this block), so stop.
+        break
+      }
+      // else: an interloping sibling (`foo-utils` for `foo`) that shares the
+      // string prefix but isn't nested — skip it, descendants may follow.
     }
     result.set(p.name, nested)
   }

package/src/workspace/package-graph.ts

@@ -51,7 +51,7 @@ export function buildPackageGraph(projects: ProjectMeta[]): PackageGraph {
   // per-call sort. Package graphs (unlike task graphs) may legally
   // contain cycles; the bitset sweep requires a DAG, so a cycle
   // (detected by the Kahn pass not draining) falls back wholesale to
-  // the legacy DFS — byte-identical behavior for that rare case.
+  // a per-query reachability search for that rare case.
   const names = [...byName.keys()].sort()
   const index = new Map<string, number>()
   for (let i = 0; i < names.length; i++) index.set(names[i]!, i)
@@ -92,32 +92,35 @@ export function buildPackageGraph(projects: ProjectMeta[]): PackageGraph {
     return closure
   }
 
-  function legacyTransitive(
-    name: string,
-    edges: Map<string, string[]>,
-    cache: Map<string, string[]>,
-    stack: Set<string> = new Set(),
-  ): string[] {
-    const cached = cache.get(name)
-    if (cached) return cached
-    if (stack.has(name)) return []
-    stack.add(name)
-    const out = new Set<string>()
-    for (const d of edges.get(name) ?? []) {
-      out.add(d)
-      for (const t of legacyTransitive(d, edges, cache, stack)) out.add(t)
+  // Cyclic fallback: everything reachable from `name` via ≥1 edge (so a
+  // node inside a cycle includes itself). Deliberately a self-contained
+  // per-query search rather than a memoized recursion over sub-results:
+  // in a cycle the back-edge contributes nothing, so a shared recursion
+  // computes TRUNCATED closures for the nodes below it and caching those
+  // makes every later answer depend on which node was asked for first.
+  function reachableFrom(name: string, edges: Map<string, string[]>): string[] {
+    const seen = new Set<string>()
+    const stack = [...(edges.get(name) ?? [])]
+    while (stack.length > 0) {
+      const cur = stack.pop()!
+      if (seen.has(cur)) continue
+      seen.add(cur)
+      for (const d of edges.get(cur) ?? []) stack.push(d)
     }
-    stack.delete(name)
-    const result = [...out].sort()
-    cache.set(name, result)
-    return result
+    return [...seen].sort()
   }
 
   function makeAccessor(edges: Map<string, string[]>): (name: string) => string[] {
     const closures = bitsetClosures(edges)
     const memo = new Map<string, string[]>()
     if (closures === null) {
-      return (name) => legacyTransitive(name, edges, memo)
+      return (name) => {
+        const cached = memo.get(name)
+        if (cached) return cached
+        const result = reachableFrom(name, edges)
+        memo.set(name, result)
+        return result
+      }
     }
     const words = (names.length + 31) >>> 5
     return (name) => {