@vzn/vx 0.0.21 → 0.0.22

package/src/workspace/config-cache.ts

@@ -28,13 +28,13 @@
 // `vx lock` both go through `JSON.stringify` — so a cached config derives
 // the same cache key as a live evaluation of the same bytes.
 
-import { realpathSync } from 'node:fs'
+import { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { xxh3 } from '../util/index.js'
 import { VERSION } from '../version.js'
 
 /** Bump when the key derivation or the stored shape changes. */
-export const CONFIG_EVAL_VERSION = 2
+export const CONFIG_EVAL_VERSION = 3
 
 /** Where cached evaluations live; `Cache` implements it over `cache.db`. */
 export interface ConfigEvalStore {
@@ -58,8 +58,25 @@ export interface ConfigEvalStore {
    * files through this in a single call when the store offers it.
    */
   hashFiles?(files: readonly string[]): Promise<Map<string, string>>
+  /**
+   * The identity `hashFile` would return for a file holding `bytes`, from
+   * the bytes alone — no stat, no memo row. The slow path has every
+   * closure file's bytes in hand (it reads them to scan for imports), and
+   * keying through `hashFile` there cost a memo upsert per file, each its
+   * own autocommit transaction (1,000 configs: 50 ms, item 615). The first
+   * warm load after it reads those files once for the memo, in one
+   * transaction. `nearPath` says which repo's object format applies.
+   */
+  hashBytes?(bytes: Uint8Array, nearPath: string): string
   getConfigClosures?(configPaths: readonly string[]): Map<string, string[]>
   putConfigClosure?(configPath: string, files: readonly string[]): void
+  /**
+   * A round's closures in one write (optional; a store without it is
+   * given them one by one). One transaction where the per-config put was
+   * one each: 1,000 autocommit inserts measured 180–240 ms against 2.5 in
+   * one transaction (item 615).
+   */
+  putConfigClosures?(entries: ReadonlyArray<readonly [string, readonly string[]]>): void
   getConfigEval(key: string): string | null
   /**
    * Many keys in one round-trip (optional; a store without it is asked per
@@ -68,6 +85,8 @@ export interface ConfigEvalStore {
    */
   getConfigEvals?(keys: readonly string[]): Map<string, string>
   putConfigEval(key: string, json: string): void
+  /** A round's evaluations in one write, as `putConfigClosures` (optional). */
+  putConfigEvals?(entries: ReadonlyArray<readonly [string, string]>): void
 }
 
 /** What `configEvalKey` learned besides the key, for the store's closure index. */
@@ -81,6 +100,8 @@ export interface ConfigEvalKeyResult {
 
 export interface ConfigEvalKeyArgs {
   configPath: string
+  /** The identity of a file from its bytes; preferred over `hashFile`, which stats and memoises. */
+  hashBytes?: (bytes: Uint8Array, nearPath: string) => string
   /**
    * Per-file identity, the same function the store's warm path uses. Absent
    * (tests, a store without one), the git blob id is computed from the
@@ -104,18 +125,98 @@ const MAX_CLOSURE_FILES = 32
 // they were listed (2026-09-03). `constructor` reaches `Function` through a
 // property name (`({}).constructor.constructor('return process')()`, the
 // body hidden in a literal the strip removes) and `localeCompare` answers
-// by the host locale; both listed 2026-09-09.
+// by the host locale; both listed 2026-09-09. The reflective primitives
+// reach `Function` with no denied word anywhere — a prototype's property
+// names hold `constructor` without the code spelling it
+// (`Object.getOwnPropertyNames(Object.getPrototypeOf(() => 0))`), and a
+// literal naming it was stripped before the test ran; listed 2026-09-27
+// (item 957). A key assembled at run time (`'constru' + 'ctor'`) still
+// passes: the gate stops accidental impurity, not a config written to
+// defeat it.
 const IMPURE_RE =
-  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*)\b|import\s*\.\s*meta|Math\s*\.\s*random|\bimport\s*\(/
+  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|constructor|localeCompare|await|toLocale\w*|Reflect|getPrototypeOf|setPrototypeOf|getOwnPropertyNames|getOwnPropertyDescriptor|getOwnPropertyDescriptors|__proto__|prototype|__defineGetter__|__defineSetter__|__lookupGetter__|__lookupSetter__)\b|import\s*\.\s*meta|Math\s*\.\s*random|\bimport\s*\(/
 
-// Static `import … from '…'` / `export … from '…'` / `import '…'` forms.
-// `[^;'"]*?` spans newlines, so multi-line specifier lists match.
+/** Literal text that names a way to `Function` when used as a computed key. */
+const IMPURE_LITERAL_RE = /constructor|__proto__|prototype/
+
+// Static `import … from '…'` / `export … from '…'` / `import '…'` forms,
+// matched on `stripLiterals` output with its strings kept as placeholders
+// (`\0<n>\0`): a comment is gone, so an import after `/* … */` on its line
+// is seen, and a string-named binding (`import { 'a-b' as x }`) is a
+// placeholder like any other. `[^;]*?` spans newlines, so multi-line
+// specifier lists match.
 const IMPORT_RE =
-  /(?:^|[\n;])\s*(?:import|export)\b[^;'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[\n;])\s*import\s*['"]([^'"]+)['"]/g
+  /(?:^|[\n;])\s*(?:import|export)\b[^;]*?\bfrom\s*\0(\d+)\0|(?:^|[\n;])\s*import\s*\0(\d+)\0/g
+
+/**
+ * Every static import in `source` as its specifier and statement, or `null`
+ * when the source cannot be lexed or holds an `import` no form above
+ * accounts for — a spelling this scan misses must fail closed: an unseen
+ * import is neither keyed nor gated for purity (item 952).
+ */
+function staticImports(
+  source: string,
+): { code: string; strings: string[]; imports: Array<{ spec: string; statement: string }> } | null {
+  const strings: string[] = []
+  const code = stripLiterals(source, strings)
+  if (code === null) return null
+  const imports: Array<{ spec: string; statement: string }> = []
+  let seen = 0
+  for (const m of code.matchAll(IMPORT_RE)) {
+    imports.push({ spec: strings[Number(m[1] ?? m[2])]!, statement: m[0] })
+    seen += m[0].match(/\bimport\b/g)?.length ?? 0
+  }
+  if (seen !== (code.match(/\bimport\b/g)?.length ?? 0)) return null
+  return { code, strings, imports }
+}
 
 /** The one bare specifier a pure config may import: core's identity helpers and types. */
 const PURE_PACKAGE = '@vzn/vx'
 
+/**
+ * The `@vzn/vx` values a pure config may import. Core exports far more, and
+ * some of it reads the machine: a config calling `machineParallelism()` was
+ * replayed from the store on a box with another core count, and its tasks
+ * kept the key the first box's answer gave them (item 888). Types are
+ * always fine; a name outside this list, a namespace or default import, or
+ * an `export *` of the package evaluates live.
+ */
+export const PURE_CORE_EXPORTS: ReadonlySet<string> = new Set([
+  'defineProject',
+  'defineWorkspace',
+  'splitTaskId',
+  'normalizeGlob',
+  'isLiteralPattern',
+  'PLUGIN_HOOKS',
+  'TASK_STATUSES',
+  'PERSISTENT_TASK_NAMES',
+])
+
+/** Whether an `import`/`export … from '@vzn/vx'` statement takes only pure values. */
+function importsOnlyPure(statement: string): boolean {
+  const clause = statement
+    .replace(/^[\s;]*(?:import|export)\s+/, '')
+    .replace(/\bfrom\s*\0\d+\0\s*$/, '')
+  if (/^type\b/.test(clause)) return true
+  if (clause.includes('*')) return false
+  const braces = /\{([^}]*)\}/.exec(clause)
+  // Anything outside the braces is a default import.
+  if (
+    clause
+      .replace(/\{[^}]*\}/, '')
+      .replace(/,/g, '')
+      .trim() !== ''
+  )
+    return false
+  for (const part of (braces?.[1] ?? '').split(',')) {
+    const spec = part.trim()
+    if (spec === '' || /^type\s/.test(spec)) continue
+    const name = spec.split(/\s+as\s+/)[0]!.trim()
+    if (!PURE_CORE_EXPORTS.has(name)) return false
+  }
+  return true
+}
+
 const decoder = new TextDecoder()
 
 /**
@@ -125,9 +226,10 @@ const decoder = new TextDecoder()
  * lexer can prove: a regex literal can contain a quote, and a lexer that
  * misreads one would swallow real code as a string — a false SAFE, the one
  * outcome this module must never produce. Configs do not need regexes;
- * such a config evaluates live.
+ * such a config evaluates live. Given `strings`, a quoted string becomes
+ * the placeholder `\0<n>\0` and its text `strings[n]`.
  */
-export function stripLiterals(source: string): string | null {
+export function stripLiterals(source: string, strings?: string[]): string | null {
   let out = ''
   let i = 0
   const n = source.length
@@ -149,15 +251,16 @@ export function stripLiterals(source: string): string | null {
     }
     if (c === '/') return null
     if (c === "'" || c === '"') {
-      i++
+      const start = ++i
       while (i < n && source[i] !== c) {
         if (source[i] === '\\') i++
         if (source[i] === '\n') return null
         i++
       }
       if (i >= n) return null
+      if (strings === undefined) out += ' '
+      else out += `\0${strings.push(source.slice(start, i)) - 1}\0`
       i++
-      out += ' '
       continue
     }
     if (c === '`') {
@@ -221,11 +324,6 @@ export function stripLiterals(source: string): string | null {
   return out
 }
 
-/**
- * The cache key for evaluating `configPath`, or `null` when the config is
- * not provably pure (or its closure cannot be read), in which case the
- * caller evaluates live and stores nothing.
- */
 /** `git hash-object` of `bytes` (sha1 domain), the identity `Cache.hashFile` returns for a sha1 repo. */
 export function blobOidOf(bytes: Uint8Array): string {
   const hasher = new Bun.CryptoHasher('sha1')
@@ -234,14 +332,72 @@ export function blobOidOf(bytes: Uint8Array): string {
   return hasher.digest('hex')
 }
 
+let transpileMemo: string | undefined
+
+/**
+ * What this process's transpiler was told besides the file bytes: the
+ * `bunfig.toml` Bun loaded at startup (the cwd's, and the global one) and
+ * the flags it ran with (`--define`, `--preload`, directly or through
+ * `BUN_OPTIONS`). A `[define]` value is a bare identifier to the config, so
+ * no deny word sees it, and flipping `BUILD_MODE` from `dev` to `prod`
+ * replayed the `dev` evaluation (item 956). Read once per process: a
+ * running Bun does not reload them either. A bunfig the process never
+ * loaded (a compiled binary's) only costs a miss when it changes.
+ */
+export function transpileInputs(): string {
+  if (transpileMemo !== undefined) return transpileMemo
+  const home = process.env['HOME']
+  const xdg = process.env['XDG_CONFIG_HOME']
+  const files = [
+    path.join(process.cwd(), 'bunfig.toml'),
+    ...(xdg !== undefined && xdg !== '' ? [path.join(xdg, '.bunfig.toml')] : []),
+    ...(home !== undefined && home !== '' ? [path.join(home, '.bunfig.toml')] : []),
+  ]
+  const parts = [process.execArgv.join('\0'), process.env['BUN_OPTIONS'] ?? '']
+  for (const file of files) {
+    try {
+      parts.push(`${file}\0${blobOidOf(readFileSync(file))}`)
+    } catch {
+      // Absent: nothing loaded from it.
+    }
+  }
+  return (transpileMemo = xxh3(parts.join('\0')).toString(16))
+}
+
 function keySeed(workspaceFingerprint: string): bigint {
   return xxh3(
-    `vx-config-eval-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${Bun.version}\0${workspaceFingerprint}\0`,
+    `vx-config-eval-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${Bun.version}\0${workspaceFingerprint}\0${transpileInputs()}\0`,
   )
 }
 
 const EXPLICIT_EXT = /\.(?:m?[jt]s|cjs|cts)$/
 
+/**
+ * The canonical directory Bun resolves `file`'s imports from: its REAL
+ * path's, so a config linked in from elsewhere imports its neighbours
+ * there, not beside the link (item 950). The directory is real-pathed
+ * rather than the file, whose realpath opens it: a config is opened once
+ * per run (`read-once.unsafe.test.ts`).
+ */
+function realDirOf(file: string): string {
+  if (lstatSync(file).isSymbolicLink()) return path.dirname(realpathSync(file))
+  return realpathSync(path.dirname(file))
+}
+
+/** A regular file reached through no symlink: the path IS the file. */
+function isCanonicalFile(file: string): boolean {
+  try {
+    return realpathSync(file) === file && statSync(file).isFile()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * The cache key for evaluating `configPath`, or `null` when the config is
+ * not provably pure (or its closure cannot be read), in which case the
+ * caller evaluates live and stores nothing.
+ */
 export async function configEvalKey(a: ConfigEvalKeyArgs): Promise<ConfigEvalKeyResult | null> {
   let h = keySeed(a.workspaceFingerprint)
   const hashOf = a.hashFile ?? (async (_file: string, bytes?: Uint8Array) => blobOidOf(bytes!))
@@ -251,30 +407,59 @@ export async function configEvalKey(a: ConfigEvalKeyArgs): Promise<ConfigEvalKey
   const queue: Array<{ file: string; bytes: Uint8Array }> = [{ file: a.configPath, bytes: a.bytes }]
   while (queue.length > 0) {
     const { file, bytes } = queue.shift()!
-    const source = decoder.decode(bytes)
-    const code = stripLiterals(source)
+    // Asked of the first relative import only: a config with none costs no
+    // syscall for it.
+    let dir: string | undefined
+    const scanned = staticImports(decoder.decode(bytes))
+    if (scanned === null) return null
+    const { code } = scanned
     // A backslash in code position is an identifier escape (`\u0070rocess`
     // IS `process`) — the one spelling the deny-list cannot see. Refuse it.
-    if (code === null || code.includes('\\') || IMPURE_RE.test(code)) return null
-    const identity = a.hashFile ? await a.hashFile(file) : await hashOf(file, bytes)
+    if (code.includes('\\') || IMPURE_RE.test(code)) return null
+    if (scanned.strings.some((t) => IMPURE_LITERAL_RE.test(t))) return null
+    const identity = a.hashBytes
+      ? a.hashBytes(bytes, file)
+      : a.hashFile
+        ? await a.hashFile(file)
+        : await hashOf(file, bytes)
     h = xxh3(`${file}\0${identity}`, h)
     closure.push(file)
-    for (const m of source.matchAll(IMPORT_RE)) {
-      const spec = m[1] ?? m[2]!
-      if (spec === PURE_PACKAGE) continue
+    for (const { spec, statement } of scanned.imports) {
+      if (spec === PURE_PACKAGE) {
+        if (/\bfrom\s*\0\d+\0\s*$/.test(statement) && !importsOnlyPure(statement)) return null
+        continue
+      }
       if (!spec.startsWith('./') && !spec.startsWith('../')) return null
-      if (!EXPLICIT_EXT.test(spec)) indexable = false
-      let resolved: string
+      // The warm path re-hashes the files this resolution found and never
+      // resolves again, so it holds only when the specifier names its file
+      // outright: an explicit extension, no symlink on the way. A link
+      // retargeted without touching a listed file, or Bun's `.js` → `.ts`
+      // fallback (a `preset.js` created beside `preset.ts` takes over),
+      // moves the answer; such a closure is keyed but never indexed
+      // (item 950). The named file is taken without `Bun.resolveSync`,
+      // whose directory cache answers a retargeted link with its old
+      // target for the rest of the process.
       try {
-        // Real-pathed: `Bun.resolveSync` answers with the symlinked spelling
-        // on one call and the real one on another (a tmp workspace under
-        // /var vs /private/var), and the key folds the path — a spelling
-        // that drifts between runs is a spurious miss and a duplicated
-        // memo row.
-        resolved = realpathSync(Bun.resolveSync(spec, path.dirname(file)))
+        dir ??= realDirOf(file)
       } catch {
         return null
       }
+      const named = path.resolve(dir, spec)
+      let resolved: string
+      if (EXPLICIT_EXT.test(spec) && isCanonicalFile(named)) resolved = named
+      else {
+        indexable = false
+        try {
+          // Real-pathed: `Bun.resolveSync` answers with the symlinked
+          // spelling on one call and the real one on another (a tmp
+          // workspace under /var vs /private/var), and the key folds the
+          // path — a spelling that drifts between runs is a spurious miss
+          // and a duplicated memo row.
+          resolved = realpathSync(Bun.resolveSync(spec, dir))
+        } catch {
+          return null
+        }
+      }
       if (visited.has(resolved)) continue
       if (resolved.split(path.sep).includes('node_modules')) return null
       visited.add(resolved)
@@ -311,3 +496,48 @@ export async function configEvalKeyFromClosure(a: {
   for (let i = 0; i < a.closure.length; i++) h = xxh3(`${a.closure[i]}\0${identities[i]}`, h)
   return h.toString(16).padStart(16, '0')
 }
+
+/**
+ * Every file a config imports by relative specifier, transitively, outside
+ * `node_modules`, the config itself excluded. `vx watch` watches these: a
+ * shared preset outside the project (`../../shared/preset.mjs`, the way
+ * configs compose) changed what a run evaluates and no watcher saw it
+ * (item 949). A file that cannot be read or resolved ends its branch.
+ */
+export async function configImports(configPath: string): Promise<string[]> {
+  const seen = new Set<string>([configPath])
+  const out: string[] = []
+  const queue = [configPath]
+  while (queue.length > 0) {
+    const file = queue.shift()!
+    let source: string
+    try {
+      source = await Bun.file(file).text()
+    } catch {
+      continue
+    }
+    let dir: string | undefined
+    // A source the scan cannot read keeps the imports it can see: watching
+    // too few files is what this list exists to prevent.
+    const specs =
+      staticImports(source)?.imports.map((i) => i.spec) ??
+      [...source.matchAll(/\bfrom\s*['"]([^'"]+)['"]|\bimport\s*['"]([^'"]+)['"]/g)].map(
+        (m) => (m[1] ?? m[2])!,
+      )
+    for (const spec of specs) {
+      if (!spec.startsWith('./') && !spec.startsWith('../')) continue
+      let resolved: string
+      try {
+        dir ??= realDirOf(file)
+        resolved = realpathSync(Bun.resolveSync(spec, dir))
+      } catch {
+        continue
+      }
+      if (seen.has(resolved) || resolved.split(path.sep).includes('node_modules')) continue
+      seen.add(resolved)
+      out.push(resolved)
+      queue.push(resolved)
+    }
+  }
+  return out
+}

package/src/workspace/config-eval.ts

@@ -30,20 +30,29 @@
 // locks or runs. `JSON.stringify(JSON.parse(s)) === s`, so a config
 // re-read through a worker derives the SAME cache key as the
 // in-process first load — which is why this needs no CACHE_VERSION bump.
+// What JSON would drop or rewrite never makes the trip: the worker runs
+// `nonJsonPaths` (json-data.ts) on the live object first, embedded by its
+// source so the rule has one copy, and the parent refuses what it names
+// with the message the first load gives (item 701).
 
 import path from 'node:path'
-import { MAX_TIMEOUT_MS } from '../util/index.js'
+import { MAX_TIMEOUT_MS, UserError } from '../util/index.js'
+import { nonJsonMessage, nonJsonPaths, type NonJsonValue } from './json-data.js'
 
 const WORKER_SRC = `
+const nonJsonPaths = ${nonJsonPaths.toString()}
 self.onmessage = async (e) => {
   const { id, path } = e.data
   try {
     const ns = await import(path)
     const mod = ns?.default
+    const isObject = mod !== null && typeof mod === 'object'
+    const nonJson = isObject ? nonJsonPaths(mod) : []
     postMessage({
       id,
       ok: true,
-      json: mod !== null && typeof mod === 'object' ? JSON.stringify(mod) : null,
+      nonJson,
+      json: isObject && nonJson.length === 0 ? JSON.stringify(mod) : null,
     })
   } catch (err) {
     postMessage({
@@ -67,6 +76,7 @@ interface WorkerReply {
   id: number
   ok: boolean
   json: string | null
+  nonJson: NonJsonValue[]
   name: string
   message: string
   stack: string | null
@@ -75,7 +85,7 @@ interface WorkerReply {
 }
 
 interface Pending {
-  resolve: (json: string | null) => void
+  resolve: (reply: WorkerReply) => void
   reject: (err: Error) => void
 }
 
@@ -139,7 +149,7 @@ function acquireWorker(): Worker {
     if (p === undefined) return
     pending.delete(msg.id)
     if (msg.ok) {
-      p.resolve(msg.json)
+      p.resolve(msg)
       return
     }
     // Rebuild the error the config actually threw. Name, message, stack
@@ -164,11 +174,40 @@ function acquireWorker(): Worker {
   return w
 }
 
+/**
+ * Hold the round open across evaluations the caller runs one after another.
+ * `loadProjectConfigs` awaits each repeat load in turn, so without this the
+ * in-flight count reached zero after every config and each one paid for a
+ * worker of its own: a round of 5 configs made 5 workers (item 694). The
+ * worker is still created lazily, so a round that evaluates nothing costs
+ * nothing, and it is retired when the round ends, so the next round starts
+ * from an empty registry.
+ */
+export function beginEvalRound(): () => void {
+  inFlight++
+  let ended = false
+  return () => {
+    if (ended) return
+    ended = true
+    retireIfIdle()
+  }
+}
+
+function retireIfIdle(): void {
+  inFlight--
+  if (inFlight === 0 && worker !== null) {
+    worker.terminate()
+    worker = null
+  }
+}
+
 /**
  * Evaluate `configPath` against a fresh module registry and return its
  * default export, JSON round-tripped. `null` means the module had no
  * object default export — the caller owns that error message so it
- * reads identically whichever path produced it.
+ * reads identically whichever path produced it. A default export holding
+ * a value JSON cannot carry is refused here, with `validateProjectConfig`'s
+ * message, since the round trip would have dropped the evidence.
  */
 export async function evaluateConfigFresh(configPath: string): Promise<unknown> {
   const abs = path.resolve(configPath)
@@ -186,7 +225,7 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
     // run-level timeout. The budget is enormous next to the ~10 ms a real
     // evaluation costs, so it can only fire on a genuine wedge.
     const budget = workerTimeoutMs()
-    const json = await new Promise<string | null>((resolve, reject) => {
+    const reply = await new Promise<WorkerReply>((resolve, reject) => {
       pending.set(id, { resolve, reject })
       timer = setTimeout(() => {
         rejectAll(new Error(`config worker did not answer within ${budget}ms`))
@@ -198,7 +237,9 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
       timer.unref?.()
       w.postMessage({ id, path: abs })
     })
-    return json === null ? null : (JSON.parse(json) as unknown)
+    const [nonJson] = reply.nonJson
+    if (nonJson !== undefined) throw new UserError(nonJsonMessage(configPath, nonJson))
+    return reply.json === null ? null : (JSON.parse(reply.json) as unknown)
   } finally {
     // In the `finally`, not after the await: a REJECTED evaluation — a config
     // with a typo, the common case while editing — would otherwise skip the
@@ -208,10 +249,6 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
     // message naming a budget nobody set for it.
     clearTimeout(timer)
     pending.delete(id)
-    inFlight--
-    if (inFlight === 0 && worker !== null) {
-      worker.terminate()
-      worker = null
-    }
+    retireIfIdle()
   }
 }