@vzn/vx 0.0.21 → 0.0.22

package/src/util/size.ts

@@ -18,3 +18,36 @@ export function parseSize(input: string): number | null {
     u === '' ? 1 : u === 'K' ? 1024 : u === 'M' ? 1024 * 1024 : u === 'G' ? 1024 ** 3 : 1024 ** 4
   return n * mult
 }
+
+/**
+ * Parse `<n><unit>` where unit is s/m/h/d, case-insensitively (`parseSize`
+ * has always been case-insensitive; this matched only lowercase, so `30D`
+ * was rejected while `1GB` and `1gb` both worked).
+ */
+export function parseDuration(input: string): number | null {
+  const m = input.match(/^(\d+)([smhd])$/i)
+  if (!m) return null
+  const n = parseDecimalInt(m[1]!)
+  if (n === null) return null
+  // Lowercase before the switch: with the /i flag an uppercase `M` would
+  // otherwise fall through to the days branch.
+  const unit = m[2]!.toLowerCase()
+  const mult = unit === 's' ? 1000 : unit === 'm' ? 60_000 : unit === 'h' ? 3_600_000 : 86_400_000
+  return n * mult
+}
+
+/**
+ * Human-readable byte size with KB/MB/GB/TB/PB suffixes and one
+ * decimal of precision below 10 of any unit. Used by `vx info`, `vx cache prune` and the
+ * run's `cacheRetention` line.
+ */
+export function formatBytes(n: number): string {
+  if (n < 1024) return `${n} B`
+  const units = ['KB', 'MB', 'GB', 'TB']
+  let v = n / 1024
+  for (const u of units) {
+    if (v < 1024) return `${v.toFixed(v < 10 ? 1 : 0)} ${u}`
+    v /= 1024
+  }
+  return `${v.toFixed(0)} PB`
+}

package/src/util/task-id.ts

@@ -0,0 +1,20 @@
+/**
+ * The inverse of `taskId` (`graph/task-graph.ts`). Splits on the FIRST
+ * `#`, so a task name that itself contains one round-trips: `taskId('a', 'b#c')` → `'a#b#c'` → `['a', 'b#c']`.
+ *
+ * This exists because it kept being written by hand as `id.split('#', 2)`,
+ * which is NOT the inverse — it discards everything after the second segment,
+ * so `'a#b#c'` reads back as task `'b'`. Six call sites had that form while
+ * `parseDependencySpec` (the surface that decides what actually runs) has
+ * always split on the first `#`, so the query layer and the graph disagreed
+ * about the identity of the same task: a lookup either found nothing or, worse,
+ * answered with a different task's history.
+ *
+ * A `#`-containing task name is legal and pinned elsewhere in the suite, so
+ * this is reachable rather than theoretical. The cache's run history read
+ * the same rule from a private copy until item 646; one rule, one place.
+ */
+export function splitTaskId(id: string): [project: string, task: string] {
+  const i = id.indexOf('#')
+  return i < 0 ? [id, ''] : [id.slice(0, i), id.slice(i + 1)]
+}

package/src/util/timing.ts

@@ -3,7 +3,8 @@
 // The CPU profiler attributes a tight loop's cost unreliably and hides
 // where an `await` waited; a stage table answers "where did the warm run
 // go?" directly, and costs one boolean check per mark when off. Marks are
-// cumulative from process start; the table shows each stage's own share.
+// cumulative from this module's load — process start and the imports ahead
+// of it sit outside the table; the table shows each stage's own share.
 
 const enabled = process.env.VX_TIMING !== undefined && process.env.VX_TIMING !== ''
 const t0 = Bun.nanoseconds()
@@ -58,6 +59,15 @@ export function printTimings(): void {
         `             ${label.padEnd(24)}  ${(ns / 1e6).toFixed(1).padStart(8)}ms  ${String(count).padStart(6)}`,
       )
     }
+    // The trap this table sets, said where it is sprung: a span's total is
+    // WALL summed per call, and the run's spans are taken under the
+    // scheduler's concurrency, so a span that overlaps other work reads
+    // far larger than the work it names. `output dirs` at 124 µs a task is
+    // a handful of `lstat`s (items 254 and 407). Compare spans to each
+    // other, and measure a suspect one in isolation before chasing it.
+    lines.push(
+      '             (wall per call, summed; concurrent calls overlap — compare spans, not totals)',
+    )
   }
   process.stderr.write(lines.join('\n') + '\n')
 }

package/src/util/which.ts

@@ -0,0 +1,48 @@
+// A spawn of a bare name walks PATH with a stat per entry — `sh` for every
+// task, `git` for every git call: 200 tasks paid ~2,000 stats on a 100-package
+// workspace for the same answer each time. The walk is done here once and
+// the spawn is handed the absolute path.
+//
+// The PATH walked is vx's OWN, never a task's. A task's PATH starts with its
+// project's and the workspace's `node_modules/.bin`, and `exec.env.define`
+// may set it outright; the shell that parses the command and the git that
+// enumerates the inputs are the machine's tools, not the task's, so a
+// dependency that ships a `sh` bin must not become the interpreter of every
+// command in its project. The task's PATH still decides what the COMMAND
+// resolves, inside that shell.
+//
+// Memoized per PATH value rather than for the process's life: nothing in vx
+// changes PATH mid-run, so a run pays one walk, and a process whose PATH does
+// change (an embedder, a test) is answered for the PATH it has. A miss is
+// not remembered: it ends the spawn that asked, and a long-lived process
+// (`vx watch`) finds the tool once the user installs it.
+
+let memoPath: string | undefined
+const found = new Map<string, string>()
+
+/**
+ * `name`'s absolute path on vx's own PATH. Throws Bun's own shape for a
+ * spawn that could not run (`code: 'ENOENT'`) when it is not there, so a
+ * call inside a spawn site's `try` reaches the same `isExecutableMissing`
+ * refusal the spawn's throw did.
+ */
+export function executablePath(name: string): string {
+  const PATH = process.env['PATH'] ?? ''
+  if (PATH !== memoPath) {
+    found.clear()
+    memoPath = PATH
+  }
+  const hit = found.get(name)
+  if (hit !== undefined) return hit
+  const at = Bun.which(name, { PATH })
+  if (at === null) {
+    throw Object.assign(new Error(`Executable not found in $PATH: "${name}"`), {
+      code: 'ENOENT',
+      path: name,
+    })
+  }
+  // Absolute even for a relative PATH entry (Bun.which resolves it against
+  // this process's cwd), so it holds in whatever cwd the spawn is given.
+  found.set(name, at)
+  return at
+}

package/src/workspace/affected.ts

@@ -6,12 +6,50 @@
 // index + unstaged — so it captures everything you touched and nothing
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
+import { realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
-import { UserError } from '../util/index.js'
+import {
+  asTrees,
+  executablePath,
+  UserError,
+  gitSpawnRefusal,
+  isExecutableMissing,
+  taskGlob,
+} from '../util/index.js'
 import { LOCKFILE_NAME } from './lockfile.js'
 import { configImportOwners } from './config-imports.js'
+import { configImports } from './config-cache.js'
+import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
-import type { ProjectMeta } from './workspace.js'
+import type { PackageJson, ProjectMeta } from './workspace.js'
+
+/**
+ * Every git call here goes through these two: a git that is not on PATH
+ * is one refusal naming the install (util `gitSpawnRefusal`), never the
+ * `ENOENT` stack `defaultAffectedBase` showed a minimal image
+ * (2026-09-16). A git that ran and failed is each caller's to read.
+ */
+function spawnGitSync(
+  args: string[],
+  cwd: string,
+  stderr: 'pipe' | 'ignore' = 'pipe',
+): ReturnType<typeof Bun.spawnSync> {
+  try {
+    return Bun.spawnSync({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr })
+  } catch (err) {
+    if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
+    throw err
+  }
+}
+
+function spawnGit(args: string[], cwd: string): Bun.Subprocess<'ignore', 'pipe', 'pipe'> {
+  try {
+    return Bun.spawn({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr: 'pipe' })
+  } catch (err) {
+    if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
+    throw err
+  }
+}
 
 export interface AffectedArgs {
   workspaceRoot: string
@@ -22,18 +60,18 @@ export interface AffectedArgs {
    * Which projects declare a `cache.inputs.workspaceFiles` glob matching one of
    * these workspace-relative paths.
    *
-   * A workspace-anchored glob is the documented escape hatch for shared files
-   * that belong to NO project, so mapping changed paths to project directories
-   * structurally cannot see it — the path resolves to no project and the run
-   * selects nothing for a change that re-keyed the task.
-   *
-   * Answering needs the RESOLVED configs, which selection runs before loading;
-   * that ordering is what left this open. It is resolved by asking only when
-   * the question can matter: this is called ONLY with paths that belong to no
-   * project, so a run whose every change is inside a project — the common case
-   * — never invokes it and pays nothing.
+   * A workspace-anchored glob is the documented escape hatch for inputs
+   * outside the project, so mapping changed paths to project directories
+   * structurally cannot see it. Answering needs the RESOLVED configs, which
+   * selection runs before loading, so it is a callback, asked only when
+   * something changed. It is asked about EVERY changed path, the ones a
+   * project owns included: the glob may name a file inside another project
+   * (`schema.md` allows it), and asking only the paths no project owns
+   * left the declaring project out of a run its key called stale
+   * (item 954). The `--affected` sugar's graph walk has already staged every
+   * config, so there it costs nothing more.
    */
-  workspaceGlobOwners?: (orphanPaths: readonly string[]) => Promise<Iterable<string>>
+  workspaceGlobOwners?: (changedPaths: readonly string[]) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
    * answer for a change to one. Resolved lazily: loading the workspace
@@ -70,6 +108,16 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
       `git ref "${args.since}" is not a ref: a base cannot be empty or start with "-".`,
     )
   }
+  // `A..B` / `A...B` reached `rev-parse --verify`, which refuses a range, and
+  // the user read "did not resolve" about refs that both exist. `..` is
+  // illegal in a ref name (git-check-ref-format), so this refuses no ref.
+  const range = args.since.indexOf('..')
+  if (range >= 0) {
+    throw new UserError(
+      `git ref "${args.since}" is a range: ranges are not supported — pass the base alone ` +
+        `("${args.since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
+    )
+  }
   await verifyRef(args.workspaceRoot, args.since)
   // Diff from the MERGE BASE of `since` and HEAD, not from `since` itself:
   // on a branch whose base has moved on, `git diff <base>` reports every
@@ -100,9 +148,15 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     // non-ASCII / `"` / `\` character — the quoted string then resolves to no
     // project, while the cache-input enumeration (which uses `-z`) sees the
     // real name and re-keys the task. The two surfaces must agree.
+    //
+    // `--ignore-submodules=none` because a repository may ask git to hide its
+    // submodules (`diff.ignoreSubmodules`, `submodule.<name>.ignore`), and
+    // then an edit inside one, or a committed bump, was no change here while
+    // the task's key moved (item 951).
     gitPaths(args.workspaceRoot, [
       'diff',
       '--no-renames',
+      '--ignore-submodules=none',
       '--relative',
       '--name-only',
       '-z',
@@ -135,10 +189,25 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   // says per project, so selection asks the plugin the same question, with
   // the bytes at the base ref and in the working tree. Its answer is
   // unioned with the path-owned projects below; only "cannot tell" widens.
+  if (await workspaceConfigChanged(args.workspaceRoot, changed)) {
+    return new Set(args.projects.map((p) => p.name))
+  }
   const fingerprintChanged = changed.filter((p) => FINGERPRINT_SET.has(p))
   const claimedOwned = new Set<string>()
+  // A claim may also name a root file core does not fold (`turbo.json`,
+  // read by `turbo()`'s stages): it re-keys tasks through their resolved
+  // configs and belongs to no project (item 961). Only a changed ROOT name
+  // can be one, so a diff inside the projects never loads the claims.
+  const rootNamesChanged = changed.filter((p) => !p.includes('/') && !FINGERPRINT_SET.has(p))
+  let claims: FingerprintClaims | undefined
+  if (
+    (fingerprintChanged.length > 0 || rootNamesChanged.length > 0) &&
+    args.fingerprintClaims !== undefined
+  ) {
+    claims = await args.fingerprintClaims()
+    for (const file of rootNamesChanged) if (claims.files.has(file)) fingerprintChanged.push(file)
+  }
   if (fingerprintChanged.length > 0) {
-    const claims = args.fingerprintClaims === undefined ? undefined : await args.fingerprintClaims()
     for (const file of fingerprintChanged) {
       if (claims === undefined || !claims.files.has(file)) {
         return new Set(args.projects.map((p) => p.name))
@@ -153,15 +222,23 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     }
   }
 
-  const { owned, orphans } = projectsContaining(args.workspaceRoot, changed, args.projects)
+  const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
   for (const name of claimedOwned) owned.add(name)
 
+  // A package the change REMOVED is no project now, so containment maps its
+  // paths to nothing, and the dependents walk sees only today's graph: a
+  // `git rm -r pkgs/lib`, or `lib` dropped from `workspaces`, re-keyed and
+  // broke `app#build` while `--affected` said nothing affected (item 959).
+  const dependents = await dependentsOfRemoved(args.workspaceRoot, base, changed, args.projects)
+  if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
+  for (const name of dependents) owned.add(name)
+
   // THIRD CHANNEL: a project whose `vx.config.*` IMPORTS a changed file.
   // Resolved-config hashing folds those values into the key, so the same
   // sentence above applies — input hashing sees it, so selection must. This
-  // runs on the FULL changed set, not just `orphans`: the common shape is a
-  // config reaching into ANOTHER project (`../../src/index.ts`), whose target
-  // is owned and therefore never an orphan at all.
+  // runs on the FULL changed set, not just the paths no project owns: the
+  // common shape is a config reaching into ANOTHER project
+  // (`../../src/index.ts`), whose target is owned.
   for (const name of await configImportOwners({
     workspaceRoot: args.workspaceRoot,
     projects: args.projects,
@@ -171,11 +248,102 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     owned.add(name)
   }
 
-  if (orphans.length === 0 || args.workspaceGlobOwners === undefined) return owned
-  for (const name of await args.workspaceGlobOwners(orphans)) owned.add(name)
+  if (changed.length === 0 || args.workspaceGlobOwners === undefined) return owned
+  for (const name of await args.workspaceGlobOwners(changed)) owned.add(name)
   return owned
 }
 
+/**
+ * The projects that depend on a package the change removed: a
+ * `<dir>/package.json` the base had and the tree does not, read at the base
+ * for its name. `undefined` (every project) when the root manifest's
+ * `workspaces` moved: which packages left is a discovery at the base, and
+ * selection cannot tell cheaply. Only DELETED manifests are read at the
+ * base, one `git show` each; an edited one stays a project and is owned.
+ */
+async function dependentsOfRemoved(
+  workspaceRoot: string,
+  base: string,
+  changed: readonly string[],
+  projects: readonly ProjectMeta[],
+): Promise<Set<string> | undefined> {
+  const out = new Set<string>()
+  const removed = new Set<string>()
+  for (const rel of changed) {
+    if (rel === 'package.json') {
+      const workspacesOf = (bytes: Uint8Array | null): string => {
+        if (bytes === null) return ''
+        try {
+          return JSON.stringify(
+            (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).workspaces ?? null,
+          )
+        } catch {
+          return 'unreadable'
+        }
+      }
+      const before = workspacesOf(await gitBytesAt(workspaceRoot, base, rel))
+      const after = workspacesOf(await bytesOrNull(path.join(workspaceRoot, rel)))
+      if (before !== after) return undefined
+      continue
+    }
+    if (path.posix.basename(rel) !== 'package.json') continue
+    if ((await bytesOrNull(path.join(workspaceRoot, rel))) !== null) continue
+    const bytes = await gitBytesAt(workspaceRoot, base, rel)
+    if (bytes === null) continue
+    try {
+      const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
+      if (typeof name === 'string' && name !== '') removed.add(name)
+    } catch {
+      // A manifest that did not parse at the base named no package.
+    }
+  }
+  if (removed.size === 0) return out
+  for (const p of projects) {
+    const pkg = p.packageJson
+    for (const deps of [
+      pkg.dependencies,
+      pkg.devDependencies,
+      pkg.peerDependencies,
+      pkg.optionalDependencies,
+    ]) {
+      if (deps !== undefined && Object.keys(deps).some((d) => removed.has(d))) out.add(p.name)
+    }
+  }
+  return out
+}
+
+/**
+ * Whether `changed` holds the workspace config or a file it imports by
+ * relative specifier. Its plugins' `config` and `project` stages shape
+ * every project's resolved config, so such an edit can re-key any task,
+ * and selection cannot tell which: an edit that changed every key
+ * selected nothing (item 953). The fingerprint leaves the file out (its
+ * placement plugins must not split a cache between machines); a stage it
+ * installs re-keys through the resolved configs instead. Selection is not
+ * hashed, so widening here changes no key.
+ */
+async function workspaceConfigChanged(
+  workspaceRoot: string,
+  changed: readonly string[],
+): Promise<boolean> {
+  if (changed.length === 0) return false
+  const set = new Set(changed)
+  if (WORKSPACE_CONFIG_FILENAMES.some((n) => set.has(n))) return true
+  const config = WORKSPACE_CONFIG_FILENAMES.map((n) => path.join(workspaceRoot, n)).find((f) => {
+    try {
+      return statSync(f).isFile()
+    } catch {
+      return false
+    }
+  })
+  if (config === undefined) return false
+  const root = realpathSync(workspaceRoot)
+  for (const file of await configImports(config)) {
+    if (set.has(path.relative(root, file).split(path.sep).join('/'))) return true
+  }
+  return false
+}
+
 /**
  * Does any `cache.inputs.workspaceFiles` entry in `globs` match `rel`?
  *
@@ -183,17 +351,27 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
  * with no positive glob nothing matches. Paths are workspace-root-relative and
  * POSIX-separated, which is the form both git enumeration and the glob
  * resolver already speak.
+ *
+ * `asTrees` on BOTH sides, because the resolver runs it on both and this
+ * has to answer the same question the KEY answers. It did not, and the
+ * gap decided whether a changed file rebuilt anything: with
+ * `workspaceFiles: ['./generated/**']` or the literal `['generated']` —
+ * five spellings in all — the resolver folds `generated/x.txt` into the
+ * project's key while a raw `Bun.Glob` matched none of them, so
+ * `--affected` left the project out of a run its own key says is stale
+ * (item 445). A mirror that normalizes differently from what it mirrors
+ * is not a mirror.
  */
 export function workspaceGlobsMatch(globs: readonly string[], rel: string): boolean {
-  const positive: Bun.Glob[] = []
-  const negative: Bun.Glob[] = []
+  const positive: string[] = []
+  const negative: string[] = []
   for (const entry of globs) {
-    if (entry.startsWith('!')) negative.push(new Bun.Glob(entry.slice(1)))
-    else positive.push(new Bun.Glob(entry))
+    if (entry.startsWith('!')) negative.push(entry.slice(1))
+    else positive.push(entry)
   }
   if (positive.length === 0) return false
-  if (!positive.some((g) => g.match(rel))) return false
-  return !negative.some((g) => g.match(rel))
+  if (!asTrees(positive).some((g) => taskGlob(g).match(rel))) return false
+  return !asTrees(negative).some((g) => taskGlob(g).match(rel))
 }
 
 /**
@@ -213,12 +391,7 @@ async function gitBytesAt(
   ref: string,
   file: string,
 ): Promise<Uint8Array | null> {
-  const proc = Bun.spawn({
-    cmd: ['git', 'show', '--end-of-options', `${ref}:./${file}`],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGit(['show', '--end-of-options', `${ref}:./${file}`], workspaceRoot)
   const [bytes, stderr, exit] = await Promise.all([
     new Response(proc.stdout).bytes(),
     new Response(proc.stderr).text(),
@@ -238,12 +411,7 @@ async function bytesOrNull(file: string): Promise<Uint8Array | null> {
 
 /** Run a NUL-separated path-listing git command from the workspace root. */
 async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
-  const proc = Bun.spawn({
-    cmd: ['git', ...cmd],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGit([...cmd], workspaceRoot)
   const stdout = await new Response(proc.stdout).text()
   const stderr = await new Response(proc.stderr).text()
   const exit = await proc.exited
@@ -256,41 +424,63 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
- * etc.), then falls back to `HEAD~1` which always exists once there
- * are at least two commits.
+ * etc.), then falls back to `HEAD~1`. A clone with no `origin/HEAD` and
+ * no parent commit — a CI checkout at `fetch-depth: 1` — has no base at
+ * all, and says so here rather than failing on a ref nobody typed.
  */
 export async function defaultAffectedBase(workspaceRoot: string): Promise<string> {
-  const probe = Bun.spawnSync({
-    cmd: ['git', 'symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'ignore',
-  })
+  const probe = spawnGitSync(
+    ['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
+    workspaceRoot,
+    'ignore',
+  )
   const out = new TextDecoder().decode(probe.stdout).trim()
   if (probe.exitCode === 0 && out.length > 0) return out
+  if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
+    throw new UserError(
+      '--affected has no base here: origin/HEAD is not set and HEAD has no parent to compare ' +
+        'with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0) or name the ' +
+        'base: --affected=origin/main',
+    )
+  }
   return 'HEAD~1'
 }
 
+/**
+ * Does `ref` name the commit HEAD is on? A base that IS HEAD can never
+ * mark anything affected — the shape of a single-branch clone whose
+ * `origin/HEAD` is the branch under test.
+ */
+export function refIsHead(workspaceRoot: string, ref: string): boolean {
+  const head = revParse(workspaceRoot, 'HEAD')
+  return head !== undefined && head === revParse(workspaceRoot, ref)
+}
+
+/** The commit `ref` names, or undefined when it does not resolve here. */
+function revParse(workspaceRoot: string, ref: string): string | undefined {
+  const proc = spawnGitSync(
+    ['rev-parse', '--verify', '--quiet', '--end-of-options', `${ref}^{commit}`],
+    workspaceRoot,
+    'ignore',
+  )
+  const sha = new TextDecoder().decode(proc.stdout).trim()
+  return proc.exitCode === 0 && sha.length > 0 ? sha : undefined
+}
+
 /** `git merge-base <ref> HEAD`, or `ref` itself when the two share no ancestor. */
 async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
-  const proc = Bun.spawn({
-    cmd: ['git', 'merge-base', '--end-of-options', ref, 'HEAD'],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGit(['merge-base', '--end-of-options', ref, 'HEAD'], workspaceRoot)
   const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
   const sha = out.trim()
   return exit === 0 && sha.length > 0 ? sha : ref
 }
 
 async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
-  const proc = Bun.spawnSync({
-    cmd: ['git', 'rev-parse', '--verify', '--quiet', '--end-of-options', ref],
-    cwd: workspaceRoot,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
+  const proc = spawnGitSync(
+    ['rev-parse', '--verify', '--quiet', '--end-of-options', ref],
+    workspaceRoot,
+    'pipe',
+  )
   if (proc.exitCode === 0) return
   // `--verify --quiet` exits 1 for "that ref does not exist" and 128 for
   // "git could not run here at all" (not a repository, corrupt objects,
@@ -307,11 +497,19 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   throw new UserError(`git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`)
 }
 
+function isDirectory(abs: string): boolean {
+  try {
+    return statSync(abs).isDirectory()
+  } catch {
+    return false
+  }
+}
+
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
   projects: readonly ProjectMeta[],
-): { owned: Set<string>; orphans: string[] } {
+): Set<string> {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
   // the DEEPEST containing project — so a nested project still wins over its
@@ -322,9 +520,6 @@ function projectsContaining(
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir, p.name)
   const owned = new Set<string>()
-  // Paths that belong to no project. Only these can reach a task through a
-  // workspace-anchored glob, so they are the exact set worth asking about.
-  const orphans: string[] = []
   for (const rel of changedRelPaths) {
     let dir = path.resolve(workspaceRoot, rel)
     let hit = false
@@ -339,7 +534,20 @@ function projectsContaining(
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
-    if (!hit) orphans.push(rel)
+    if (hit) continue
+    // A changed path that is a DIRECTORY on disk is a nested repository —
+    // a submodule whose checkout moved or is dirty (`vendor/sub`), an
+    // embedded repository left untracked (`vendor/nested/`) — because git
+    // reports nothing else as a directory. The workspace repository sees
+    // the nested one as that single path, so a change inside is a change
+    // to it, and every project under it is affected. Its own enumeration
+    // already keys those projects on their files (git-inputs.ts); without
+    // this, `--affected` after an edit inside selected none of them.
+    const abs = path.resolve(workspaceRoot, rel)
+    if (isDirectory(abs)) {
+      const prefix = abs + path.sep
+      for (const [dir, name] of dirToName) if (dir.startsWith(prefix)) owned.add(name)
+    }
   }
-  return { owned, orphans }
+  return owned
 }