@vzn/vx 0.0.18 → 0.0.22

package/src/workspace/affected.ts

@@ -1,20 +1,55 @@
 // `--affected` — git-relative project selection.
 //
 // Resolves the set of project names whose files have changed since a
-// given git ref. The diff is `<since>...HEAD` plus working-tree
-// changes (uncommitted edits), so it captures everything you've
-// touched on the current branch.
-//
-// We use `git diff --name-only <since>` which by default compares the
-// `<since>` commit to the working tree — i.e. commits-from-`<since>`
-// + index + unstaged. Matches Turbo's `[<since>]` filter semantics.
+// given git ref: `git diff --name-only <merge-base(since, HEAD)>`, which
+// compares that commit to the working tree — commits on this branch +
+// index + unstaged — so it captures everything you touched and nothing
+// the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
+import { realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
-import { UserError } from '../util/index.js'
+import {
+  asTrees,
+  executablePath,
+  UserError,
+  gitSpawnRefusal,
+  isExecutableMissing,
+  taskGlob,
+} from '../util/index.js'
 import { LOCKFILE_NAME } from './lockfile.js'
 import { configImportOwners } from './config-imports.js'
+import { configImports } from './config-cache.js'
+import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
-import type { ProjectMeta } from './workspace.js'
+import type { PackageJson, ProjectMeta } from './workspace.js'
+
+/**
+ * Every git call here goes through these two: a git that is not on PATH
+ * is one refusal naming the install (util `gitSpawnRefusal`), never the
+ * `ENOENT` stack `defaultAffectedBase` showed a minimal image
+ * (2026-09-16). A git that ran and failed is each caller's to read.
+ */
+function spawnGitSync(
+  args: string[],
+  cwd: string,
+  stderr: 'pipe' | 'ignore' = 'pipe',
+): ReturnType<typeof Bun.spawnSync> {
+  try {
+    return Bun.spawnSync({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr })
+  } catch (err) {
+    if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
+    throw err
+  }
+}
+
+function spawnGit(args: string[], cwd: string): Bun.Subprocess<'ignore', 'pipe', 'pipe'> {
+  try {
+    return Bun.spawn({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr: 'pipe' })
+  } catch (err) {
+    if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
+    throw err
+  }
+}
 
 export interface AffectedArgs {
   workspaceRoot: string
@@ -25,18 +60,35 @@ export interface AffectedArgs {
    * Which projects declare a `cache.inputs.workspaceFiles` glob matching one of
    * these workspace-relative paths.
    *
-   * A workspace-anchored glob is the documented escape hatch for shared files
-   * that belong to NO project, so mapping changed paths to project directories
-   * structurally cannot see it — the path resolves to no project and the run
-   * selects nothing for a change that re-keyed the task.
-   *
-   * Answering needs the RESOLVED configs, which selection runs before loading;
-   * that ordering is what left this open. It is resolved by asking only when
-   * the question can matter: this is called ONLY with paths that belong to no
-   * project, so a run whose every change is inside a project — the common case
-   * — never invokes it and pays nothing.
+   * A workspace-anchored glob is the documented escape hatch for inputs
+   * outside the project, so mapping changed paths to project directories
+   * structurally cannot see it. Answering needs the RESOLVED configs, which
+   * selection runs before loading, so it is a callback, asked only when
+   * something changed. It is asked about EVERY changed path, the ones a
+   * project owns included: the glob may name a file inside another project
+   * (`schema.md` allows it), and asking only the paths no project owns
+   * left the declaring project out of a run its key called stale
+   * (item 954). The `--affected` sugar's graph walk has already staged every
+   * config, so there it costs nothing more.
    */
-  workspaceGlobOwners?: (orphanPaths: readonly string[]) => Promise<Iterable<string>>
+  workspaceGlobOwners?: (changedPaths: readonly string[]) => Promise<Iterable<string>>
+  /**
+   * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
+   * answer for a change to one. Resolved lazily: loading the workspace
+   * file costs an evaluation, and a diff that touches no fingerprint file
+   * — the common one — never needs it.
+   */
+  fingerprintClaims?: () => Promise<FingerprintClaims>
+}
+
+export interface FingerprintClaims {
+  readonly files: ReadonlySet<string>
+  /** Project names a change to a claimed file affects; `undefined` = all. */
+  affected(change: {
+    file: string
+    before: Uint8Array | null
+    after: Uint8Array | null
+  }): Promise<ReadonlySet<string> | undefined>
 }
 
 /**
@@ -45,7 +97,36 @@ export interface AffectedArgs {
  * or `<since>` doesn't resolve to a commit.
  */
 export async function affectedProjects(args: AffectedArgs): Promise<Set<string>> {
+  // The base reaches git as an argument, never through a shell, so `$(…)`
+  // is opaque — but an option-like value is not: `--output=<path>` is a
+  // real `git diff` option and an arbitrary file write. This is a security
+  // boundary, so it is a check that knows it is one, before any spawn, and
+  // every git call below also ends its options (`--end-of-options`) so a
+  // second caller cannot lose the guard by accident.
+  if (args.since.length === 0 || args.since.startsWith('-')) {
+    throw new UserError(
+      `git ref "${args.since}" is not a ref: a base cannot be empty or start with "-".`,
+    )
+  }
+  // `A..B` / `A...B` reached `rev-parse --verify`, which refuses a range, and
+  // the user read "did not resolve" about refs that both exist. `..` is
+  // illegal in a ref name (git-check-ref-format), so this refuses no ref.
+  const range = args.since.indexOf('..')
+  if (range >= 0) {
+    throw new UserError(
+      `git ref "${args.since}" is a range: ranges are not supported — pass the base alone ` +
+        `("${args.since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
+    )
+  }
   await verifyRef(args.workspaceRoot, args.since)
+  // Diff from the MERGE BASE of `since` and HEAD, not from `since` itself:
+  // on a branch whose base has moved on, `git diff <base>` reports every
+  // file OTHER people changed on the base (over-selection that defeats a
+  // CI `--affected`), and hides your own edit when the base later landed
+  // byte-identical content. Turbo and Nx both diff from the merge base;
+  // when there is none (unrelated histories, a detached probe) the ref
+  // itself is the base, as before.
+  const base = await mergeBase(args.workspaceRoot, args.since)
 
   const [diffed, untracked] = await Promise.all([
     // `--no-renames` is crucial for project-affected detection: with
@@ -67,13 +148,20 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     // non-ASCII / `"` / `\` character — the quoted string then resolves to no
     // project, while the cache-input enumeration (which uses `-z`) sees the
     // real name and re-keys the task. The two surfaces must agree.
+    //
+    // `--ignore-submodules=none` because a repository may ask git to hide its
+    // submodules (`diff.ignoreSubmodules`, `submodule.<name>.ignore`), and
+    // then an edit inside one, or a committed bump, was no change here while
+    // the task's key moved (item 951).
     gitPaths(args.workspaceRoot, [
       'diff',
       '--no-renames',
+      '--ignore-submodules=none',
       '--relative',
       '--name-only',
       '-z',
-      args.since,
+      '--end-of-options',
+      base,
     ]),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
@@ -96,18 +184,61 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   // principle: "input hashing sees it, so `--affected` must too."
   //
   // Selection is not hashed, so widening it here changes no cache key.
-  if (changed.some((p) => FINGERPRINT_SET.has(p))) {
+  //
+  // A file a plugin CLAIMS is the exception: the key folds what the plugin
+  // says per project, so selection asks the plugin the same question, with
+  // the bytes at the base ref and in the working tree. Its answer is
+  // unioned with the path-owned projects below; only "cannot tell" widens.
+  if (await workspaceConfigChanged(args.workspaceRoot, changed)) {
     return new Set(args.projects.map((p) => p.name))
   }
+  const fingerprintChanged = changed.filter((p) => FINGERPRINT_SET.has(p))
+  const claimedOwned = new Set<string>()
+  // A claim may also name a root file core does not fold (`turbo.json`,
+  // read by `turbo()`'s stages): it re-keys tasks through their resolved
+  // configs and belongs to no project (item 961). Only a changed ROOT name
+  // can be one, so a diff inside the projects never loads the claims.
+  const rootNamesChanged = changed.filter((p) => !p.includes('/') && !FINGERPRINT_SET.has(p))
+  let claims: FingerprintClaims | undefined
+  if (
+    (fingerprintChanged.length > 0 || rootNamesChanged.length > 0) &&
+    args.fingerprintClaims !== undefined
+  ) {
+    claims = await args.fingerprintClaims()
+    for (const file of rootNamesChanged) if (claims.files.has(file)) fingerprintChanged.push(file)
+  }
+  if (fingerprintChanged.length > 0) {
+    for (const file of fingerprintChanged) {
+      if (claims === undefined || !claims.files.has(file)) {
+        return new Set(args.projects.map((p) => p.name))
+      }
+      const answer = await claims.affected({
+        file,
+        before: await gitBytesAt(args.workspaceRoot, base, file),
+        after: await bytesOrNull(path.join(args.workspaceRoot, file)),
+      })
+      if (answer === undefined) return new Set(args.projects.map((p) => p.name))
+      for (const name of answer) claimedOwned.add(name)
+    }
+  }
+
+  const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
+  for (const name of claimedOwned) owned.add(name)
 
-  const { owned, orphans } = projectsContaining(args.workspaceRoot, changed, args.projects)
+  // A package the change REMOVED is no project now, so containment maps its
+  // paths to nothing, and the dependents walk sees only today's graph: a
+  // `git rm -r pkgs/lib`, or `lib` dropped from `workspaces`, re-keyed and
+  // broke `app#build` while `--affected` said nothing affected (item 959).
+  const dependents = await dependentsOfRemoved(args.workspaceRoot, base, changed, args.projects)
+  if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
+  for (const name of dependents) owned.add(name)
 
   // THIRD CHANNEL: a project whose `vx.config.*` IMPORTS a changed file.
   // Resolved-config hashing folds those values into the key, so the same
   // sentence above applies — input hashing sees it, so selection must. This
-  // runs on the FULL changed set, not just `orphans`: the common shape is a
-  // config reaching into ANOTHER project (`../../src/index.ts`), whose target
-  // is owned and therefore never an orphan at all.
+  // runs on the FULL changed set, not just the paths no project owns: the
+  // common shape is a config reaching into ANOTHER project
+  // (`../../src/index.ts`), whose target is owned.
   for (const name of await configImportOwners({
     workspaceRoot: args.workspaceRoot,
     projects: args.projects,
@@ -117,11 +248,102 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     owned.add(name)
   }
 
-  if (orphans.length === 0 || args.workspaceGlobOwners === undefined) return owned
-  for (const name of await args.workspaceGlobOwners(orphans)) owned.add(name)
+  if (changed.length === 0 || args.workspaceGlobOwners === undefined) return owned
+  for (const name of await args.workspaceGlobOwners(changed)) owned.add(name)
   return owned
 }
 
+/**
+ * The projects that depend on a package the change removed: a
+ * `<dir>/package.json` the base had and the tree does not, read at the base
+ * for its name. `undefined` (every project) when the root manifest's
+ * `workspaces` moved: which packages left is a discovery at the base, and
+ * selection cannot tell cheaply. Only DELETED manifests are read at the
+ * base, one `git show` each; an edited one stays a project and is owned.
+ */
+async function dependentsOfRemoved(
+  workspaceRoot: string,
+  base: string,
+  changed: readonly string[],
+  projects: readonly ProjectMeta[],
+): Promise<Set<string> | undefined> {
+  const out = new Set<string>()
+  const removed = new Set<string>()
+  for (const rel of changed) {
+    if (rel === 'package.json') {
+      const workspacesOf = (bytes: Uint8Array | null): string => {
+        if (bytes === null) return ''
+        try {
+          return JSON.stringify(
+            (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).workspaces ?? null,
+          )
+        } catch {
+          return 'unreadable'
+        }
+      }
+      const before = workspacesOf(await gitBytesAt(workspaceRoot, base, rel))
+      const after = workspacesOf(await bytesOrNull(path.join(workspaceRoot, rel)))
+      if (before !== after) return undefined
+      continue
+    }
+    if (path.posix.basename(rel) !== 'package.json') continue
+    if ((await bytesOrNull(path.join(workspaceRoot, rel))) !== null) continue
+    const bytes = await gitBytesAt(workspaceRoot, base, rel)
+    if (bytes === null) continue
+    try {
+      const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
+      if (typeof name === 'string' && name !== '') removed.add(name)
+    } catch {
+      // A manifest that did not parse at the base named no package.
+    }
+  }
+  if (removed.size === 0) return out
+  for (const p of projects) {
+    const pkg = p.packageJson
+    for (const deps of [
+      pkg.dependencies,
+      pkg.devDependencies,
+      pkg.peerDependencies,
+      pkg.optionalDependencies,
+    ]) {
+      if (deps !== undefined && Object.keys(deps).some((d) => removed.has(d))) out.add(p.name)
+    }
+  }
+  return out
+}
+
+/**
+ * Whether `changed` holds the workspace config or a file it imports by
+ * relative specifier. Its plugins' `config` and `project` stages shape
+ * every project's resolved config, so such an edit can re-key any task,
+ * and selection cannot tell which: an edit that changed every key
+ * selected nothing (item 953). The fingerprint leaves the file out (its
+ * placement plugins must not split a cache between machines); a stage it
+ * installs re-keys through the resolved configs instead. Selection is not
+ * hashed, so widening here changes no key.
+ */
+async function workspaceConfigChanged(
+  workspaceRoot: string,
+  changed: readonly string[],
+): Promise<boolean> {
+  if (changed.length === 0) return false
+  const set = new Set(changed)
+  if (WORKSPACE_CONFIG_FILENAMES.some((n) => set.has(n))) return true
+  const config = WORKSPACE_CONFIG_FILENAMES.map((n) => path.join(workspaceRoot, n)).find((f) => {
+    try {
+      return statSync(f).isFile()
+    } catch {
+      return false
+    }
+  })
+  if (config === undefined) return false
+  const root = realpathSync(workspaceRoot)
+  for (const file of await configImports(config)) {
+    if (set.has(path.relative(root, file).split(path.sep).join('/'))) return true
+  }
+  return false
+}
+
 /**
  * Does any `cache.inputs.workspaceFiles` entry in `globs` match `rel`?
  *
@@ -129,17 +351,27 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
  * with no positive glob nothing matches. Paths are workspace-root-relative and
  * POSIX-separated, which is the form both git enumeration and the glob
  * resolver already speak.
+ *
+ * `asTrees` on BOTH sides, because the resolver runs it on both and this
+ * has to answer the same question the KEY answers. It did not, and the
+ * gap decided whether a changed file rebuilt anything: with
+ * `workspaceFiles: ['./generated/**']` or the literal `['generated']` —
+ * five spellings in all — the resolver folds `generated/x.txt` into the
+ * project's key while a raw `Bun.Glob` matched none of them, so
+ * `--affected` left the project out of a run its own key says is stale
+ * (item 445). A mirror that normalizes differently from what it mirrors
+ * is not a mirror.
  */
 export function workspaceGlobsMatch(globs: readonly string[], rel: string): boolean {
-  const positive: Bun.Glob[] = []
-  const negative: Bun.Glob[] = []
+  const positive: string[] = []
+  const negative: string[] = []
   for (const entry of globs) {
-    if (entry.startsWith('!')) negative.push(new Bun.Glob(entry.slice(1)))
-    else positive.push(new Bun.Glob(entry))
+    if (entry.startsWith('!')) negative.push(entry.slice(1))
+    else positive.push(entry)
   }
   if (positive.length === 0) return false
-  if (!positive.some((g) => g.match(rel))) return false
-  return !negative.some((g) => g.match(rel))
+  if (!asTrees(positive).some((g) => taskGlob(g).match(rel))) return false
+  return !asTrees(negative).some((g) => taskGlob(g).match(rel))
 }
 
 /**
@@ -149,14 +381,37 @@ export function workspaceGlobsMatch(globs: readonly string[], rel: string): bool
  */
 const FINGERPRINT_SET: ReadonlySet<string> = new Set(WORKSPACE_FINGERPRINT_FILES)
 
+/**
+ * A root file's bytes at `ref`, or null when the ref has no such file.
+ * `./` anchors the path to the cwd (the workspace root) rather than the
+ * repository root, for a workspace that is a subdirectory of its repo.
+ */
+async function gitBytesAt(
+  workspaceRoot: string,
+  ref: string,
+  file: string,
+): Promise<Uint8Array | null> {
+  const proc = spawnGit(['show', '--end-of-options', `${ref}:./${file}`], workspaceRoot)
+  const [bytes, stderr, exit] = await Promise.all([
+    new Response(proc.stdout).bytes(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  if (exit === 0) return bytes
+  // "exists on disk but not in <ref>" and "path does not exist in <ref>"
+  // are the file being absent at the ref; anything else is git failing.
+  if (/does not exist in|exists on disk, but not in/.test(stderr)) return null
+  throw new UserError(`git show ${ref}:./${file} failed (exit ${exit}): ${stderr.trim()}`)
+}
+
+async function bytesOrNull(file: string): Promise<Uint8Array | null> {
+  const f = Bun.file(file)
+  return (await f.exists()) ? await f.bytes() : null
+}
+
 /** Run a NUL-separated path-listing git command from the workspace root. */
 async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
-  const proc = Bun.spawn({
-    cmd: ['git', ...cmd],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGit([...cmd], workspaceRoot)
   const stdout = await new Response(proc.stdout).text()
   const stderr = await new Response(proc.stderr).text()
   const exit = await proc.exited
@@ -169,28 +424,63 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
- * etc.), then falls back to `HEAD~1` which always exists once there
- * are at least two commits.
+ * etc.), then falls back to `HEAD~1`. A clone with no `origin/HEAD` and
+ * no parent commit — a CI checkout at `fetch-depth: 1` — has no base at
+ * all, and says so here rather than failing on a ref nobody typed.
  */
 export async function defaultAffectedBase(workspaceRoot: string): Promise<string> {
-  const probe = Bun.spawnSync({
-    cmd: ['git', 'symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'ignore',
-  })
+  const probe = spawnGitSync(
+    ['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
+    workspaceRoot,
+    'ignore',
+  )
   const out = new TextDecoder().decode(probe.stdout).trim()
   if (probe.exitCode === 0 && out.length > 0) return out
+  if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
+    throw new UserError(
+      '--affected has no base here: origin/HEAD is not set and HEAD has no parent to compare ' +
+        'with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0) or name the ' +
+        'base: --affected=origin/main',
+    )
+  }
   return 'HEAD~1'
 }
 
+/**
+ * Does `ref` name the commit HEAD is on? A base that IS HEAD can never
+ * mark anything affected — the shape of a single-branch clone whose
+ * `origin/HEAD` is the branch under test.
+ */
+export function refIsHead(workspaceRoot: string, ref: string): boolean {
+  const head = revParse(workspaceRoot, 'HEAD')
+  return head !== undefined && head === revParse(workspaceRoot, ref)
+}
+
+/** The commit `ref` names, or undefined when it does not resolve here. */
+function revParse(workspaceRoot: string, ref: string): string | undefined {
+  const proc = spawnGitSync(
+    ['rev-parse', '--verify', '--quiet', '--end-of-options', `${ref}^{commit}`],
+    workspaceRoot,
+    'ignore',
+  )
+  const sha = new TextDecoder().decode(proc.stdout).trim()
+  return proc.exitCode === 0 && sha.length > 0 ? sha : undefined
+}
+
+/** `git merge-base <ref> HEAD`, or `ref` itself when the two share no ancestor. */
+async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
+  const proc = spawnGit(['merge-base', '--end-of-options', ref, 'HEAD'], workspaceRoot)
+  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  const sha = out.trim()
+  return exit === 0 && sha.length > 0 ? sha : ref
+}
+
 async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
-  const proc = Bun.spawnSync({
-    cmd: ['git', 'rev-parse', '--verify', '--quiet', ref],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGitSync(
+    ['rev-parse', '--verify', '--quiet', '--end-of-options', ref],
+    workspaceRoot,
+    'pipe',
+  )
   if (proc.exitCode === 0) return
   // `--verify --quiet` exits 1 for "that ref does not exist" and 128 for
   // "git could not run here at all" (not a repository, corrupt objects,
@@ -207,11 +497,19 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   throw new UserError(`git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`)
 }
 
+function isDirectory(abs: string): boolean {
+  try {
+    return statSync(abs).isDirectory()
+  } catch {
+    return false
+  }
+}
+
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
   projects: readonly ProjectMeta[],
-): { owned: Set<string>; orphans: string[] } {
+): Set<string> {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
   // the DEEPEST containing project — so a nested project still wins over its
@@ -222,9 +520,6 @@ function projectsContaining(
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir, p.name)
   const owned = new Set<string>()
-  // Paths that belong to no project. Only these can reach a task through a
-  // workspace-anchored glob, so they are the exact set worth asking about.
-  const orphans: string[] = []
   for (const rel of changedRelPaths) {
     let dir = path.resolve(workspaceRoot, rel)
     let hit = false
@@ -239,7 +534,20 @@ function projectsContaining(
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
-    if (!hit) orphans.push(rel)
+    if (hit) continue
+    // A changed path that is a DIRECTORY on disk is a nested repository —
+    // a submodule whose checkout moved or is dirty (`vendor/sub`), an
+    // embedded repository left untracked (`vendor/nested/`) — because git
+    // reports nothing else as a directory. The workspace repository sees
+    // the nested one as that single path, so a change inside is a change
+    // to it, and every project under it is affected. Its own enumeration
+    // already keys those projects on their files (git-inputs.ts); without
+    // this, `--affected` after an edit inside selected none of them.
+    const abs = path.resolve(workspaceRoot, rel)
+    if (isDirectory(abs)) {
+      const prefix = abs + path.sep
+      for (const [dir, name] of dirToName) if (dir.startsWith(prefix)) owned.add(name)
+    }
   }
-  return { owned, orphans }
+  return owned
 }