@vzn/vx 0.0.21 → 0.0.23

package/src/cache/zstd.ts

@@ -8,9 +8,10 @@ import { CorruptArtifactError } from './layer.js'
  * A decompressed artifact above this is refused as a zstd bomb rather than
  * expanded into memory. 2 GiB comfortably exceeds any real build output while
  * bounding a malicious/compromised remote's ability to OOM a victim who takes
- * a cache hit.
+ * a cache hit. The default of `Cache`'s `artifactCeiling`, the one seam that
+ * lowers it (for a test: no test can produce 2 GiB of output).
  */
-const MAX_DECOMPRESSED_ARTIFACT_BYTES = 2 * 1024 * 1024 * 1024
+export const MAX_DECOMPRESSED_ARTIFACT_BYTES = 2 * 1024 * 1024 * 1024
 
 /**
  * Read a zstd frame's declared Frame_Content_Size (RFC 8878 §3.1.1) WITHOUT
@@ -49,31 +50,43 @@ export function zstdContentSize(b: Uint8Array): bigint | null {
 /**
  * Decompress a zstd artifact that DECLARES its content size, with a hard
  * output ceiling: refused before a byte is allocated when the declaration
- * is over the cap, and again on the actual length. A frame with no
+ * is over the cap. The re-check on the actual length below is a backstop
+ * against a decoder that stops validating the declaration, NOT a second
+ * live layer — see its comment. A frame with no
  * declaration (a streamed producer's — vx's own, above 4 MiB) never comes
  * here: `decodedTar` decodes it as a stream under the running count, so
  * a sizeless bomb has nowhere to expand.
  */
-async function zstdDecompressBounded(compressed: Uint8Array, hash: string): Promise<Uint8Array> {
-  assertDeclaredSize(compressed, hash)
+async function zstdDecompressBounded(
+  compressed: Uint8Array,
+  hash: string,
+  cap: number = MAX_DECOMPRESSED_ARTIFACT_BYTES,
+): Promise<Uint8Array> {
+  assertDeclaredSize(compressed, hash, cap)
   const out = await Bun.zstdDecompress(compressed)
-  if (out.length > MAX_DECOMPRESSED_ARTIFACT_BYTES) {
-    throw new CorruptArtifactError(
-      hash,
-      `decompressed to ${out.length} bytes (> ${MAX_DECOMPRESSED_ARTIFACT_BYTES} cap)`,
-    )
+  // UNREACHABLE as written, and kept deliberately. `assertDeclaredSize`
+  // above refuses any frame DECLARING more than the cap, and Bun refuses a
+  // frame whose declaration disagrees with its body ("Decompression
+  // failed" on a forged Frame_Content_Size, measured item 487) — so a frame
+  // that gets here declared <= cap and produced exactly that. The only way
+  // this fires again is a decoder that stops validating the declaration.
+  // That is what it is for; it is not a second live layer, and no test can
+  // reach it.
+  if (out.length > cap) {
+    throw new CorruptArtifactError(hash, `decompressed to ${out.length} bytes (> ${cap} cap)`)
   }
   return out
 }
 
 /** The pre-decompress half of the ceiling: the frame header's own claim, when it makes one. */
-function assertDeclaredSize(compressed: Uint8Array, hash: string): bigint | null {
+function assertDeclaredSize(
+  compressed: Uint8Array,
+  hash: string,
+  cap: number = MAX_DECOMPRESSED_ARTIFACT_BYTES,
+): bigint | null {
   const declared = zstdContentSize(compressed)
-  if (declared !== null && declared > BigInt(MAX_DECOMPRESSED_ARTIFACT_BYTES)) {
-    throw new CorruptArtifactError(
-      hash,
-      `declares ${declared} decompressed bytes (> ${MAX_DECOMPRESSED_ARTIFACT_BYTES} cap)`,
-    )
+  if (declared !== null && declared > BigInt(cap)) {
+    throw new CorruptArtifactError(hash, `declares ${declared} decompressed bytes (> ${cap} cap)`)
   }
   return declared
 }
@@ -115,18 +128,29 @@ const oneChunk = (bytes: Uint8Array): ReadableStream<Uint8Array> =>
 export async function decodedTar(
   source: Uint8Array | Bun.BunFile,
   hash: string,
+  /**
+   * The decompression ceiling: `Cache` passes its `artifactCeiling`, whose
+   * default IS this module's. Reaching the real one needs an artifact that
+   * expands past 2 GiB, which no test can produce — so before item 487 the
+   * sizeless-bomb defense this module's comments promise had nothing
+   * asserting it, while the declared-size half was pinned by a forged
+   * header costing 20 bytes.
+   */
+  cap: number = MAX_DECOMPRESSED_ARTIFACT_BYTES,
 ): Promise<ReadableStream<Uint8Array>> {
   if (source instanceof Uint8Array) {
-    if (assertDeclaredSize(source, hash) === null) return zstdDecodeStream(new Blob([source]), hash)
-    return oneChunk(await zstdDecompressBounded(source, hash))
+    if (assertDeclaredSize(source, hash, cap) === null) {
+      return zstdDecodeStream(new Blob([source]), hash, cap)
+    }
+    return oneChunk(await zstdDecompressBounded(source, hash, cap))
   }
   if (source.size <= STREAM_DECODE_FROM) {
     const bytes = await source.bytes()
-    if (assertDeclaredSize(bytes, hash) === null) return zstdDecodeStream(source, hash)
-    return oneChunk(await zstdDecompressBounded(bytes, hash))
+    if (assertDeclaredSize(bytes, hash, cap) === null) return zstdDecodeStream(source, hash, cap)
+    return oneChunk(await zstdDecompressBounded(bytes, hash, cap))
   }
-  assertDeclaredSize(await source.slice(0, 32).bytes(), hash)
-  return zstdDecodeStream(source, hash)
+  assertDeclaredSize(await source.slice(0, 32).bytes(), hash, cap)
+  return zstdDecodeStream(source, hash, cap)
 }
 
 /**
@@ -135,7 +159,11 @@ export async function decodedTar(
  * past the cap here either — the count runs as bytes are produced, before
  * any of them reach the reader's next entry.
  */
-function zstdDecodeStream(source: Blob, hash: string): ReadableStream<Uint8Array> {
+function zstdDecodeStream(
+  source: Blob,
+  hash: string,
+  cap: number = MAX_DECOMPRESSED_ARTIFACT_BYTES,
+): ReadableStream<Uint8Array> {
   let total = 0
   return source
     .stream()
@@ -144,13 +172,8 @@ function zstdDecodeStream(source: Blob, hash: string): ReadableStream<Uint8Array
       new TransformStream<Uint8Array, Uint8Array>({
         transform(chunk, controller) {
           total += chunk.byteLength
-          if (total > MAX_DECOMPRESSED_ARTIFACT_BYTES) {
-            controller.error(
-              new CorruptArtifactError(
-                hash,
-                `decompresses past ${MAX_DECOMPRESSED_ARTIFACT_BYTES} bytes (cap)`,
-              ),
-            )
+          if (total > cap) {
+            controller.error(new CorruptArtifactError(hash, `decompresses past ${cap} bytes (cap)`))
             return
           }
           controller.enqueue(chunk)

package/src/cli/cache.ts

@@ -1,13 +1,42 @@
 import { Cache, noteSchemaReset } from '../cache/index.js'
 import { seeHelp } from './help.js'
-import { parseDecimalInt, parseSize } from '../util/index.js'
+import { nearest, parseDuration, parseSize } from '../util/index.js'
+import { acquireRunLock } from '../orchestrator/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { cliCacheDir, parseCacheDirFlag, warnToStderr } from './workspace-config.js'
 import { formatBytes } from './format.js'
 
 // parseSize moved to `util` (the orchestrator's resource resolver needs it
 // and can't import cli); re-exported here so existing callers are unchanged.
-export { parseSize } from '../util/index.js'
+export { parseDuration, parseSize } from '../util/index.js'
+
+/**
+ * `vx cache stats` is a habit from the other runners, and vx's answer is a
+ * different VERB rather than a missing one — saying so where the user typed
+ * it beats sending them to a help screen that lists only `prune` (walked the
+ * first-run path, 2026-09-20). A typo of `prune` itself gets the same
+ * nearest-neighbour hint a task, flag or project name gets.
+ */
+const CACHE_ELSEWHERE: Record<string, string> = {
+  stats: '`vx info` reports the cache directory, its entry count and its size',
+  status: '`vx info` reports the cache directory, its entry count and its size',
+  size: '`vx info` reports the cache directory, its entry count and its size',
+  entries: '`vx info` reports the cache directory, its entry count and its size',
+  dir: '`vx info` prints the cache directory this workspace uses',
+  path: '`vx info` prints the cache directory this workspace uses',
+  clean: '`vx cache prune` is the eviction verb (`--older-than`, `--max-size`)',
+  clear: '`vx cache prune` is the eviction verb (`--older-than`, `--max-size`)',
+  rm: '`vx cache prune` is the eviction verb (`--older-than`, `--max-size`)',
+  delete: '`vx cache prune` is the eviction verb (`--older-than`, `--max-size`)',
+  evict: '`vx cache prune` is the eviction verb (`--older-than`, `--max-size`)',
+}
+
+function cacheSubHint(sub: string): string {
+  const elsewhere = CACHE_ELSEWHERE[sub]
+  if (elsewhere !== undefined) return ` — ${elsewhere}`
+  const best = nearest(sub, ['prune'])
+  return best === undefined ? '' : `. Did you mean ${best}?`
+}
 
 export async function cacheCmd(args: readonly string[]): Promise<number> {
   const [sub, ...rest] = args
@@ -18,7 +47,9 @@ export async function cacheCmd(args: readonly string[]): Promise<number> {
       process.stderr.write('vx cache: missing subcommand. Try `vx cache prune`.\n')
       return 1
     default:
-      process.stderr.write(`vx cache: unknown subcommand: ${sub}${seeHelp('cache')}\n`)
+      process.stderr.write(
+        `vx cache: unknown subcommand: ${sub}${cacheSubHint(sub)}${seeHelp('cache')}\n`,
+      )
       return 1
   }
 }
@@ -110,8 +141,23 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
   // `config` plugin's edit of it — `vx run` and `vx cache prune` must
   // operate on the same directory or prune silently no-ops against the
   // wrong path.
-  const cache = new Cache(await cliCacheDir(root, parsed.cacheDir))
+  // A dry run only reads: it never resets the index (item 896).
+  const dir = await cliCacheDir(root, parsed.cacheDir)
+  const cache = parsed.dryRun === true ? Cache.inspect(dir) : new Cache(dir)
+  // A prune deletes rows and artifacts; a cache this user cannot write is
+  // refused up front with the directory named, as a run refuses it, rather
+  // than dying in the first DELETE with SQLite's "readonly database" and a
+  // stack (an unprivileged user on a root-owned `.vx`, 2026-09-16). A dry
+  // run only reads, and reads a read-only cache fine.
+  if (!parsed.dryRun) cache.assertWritable()
   noteSchemaReset(cache, warnToStderr)
+  // A prune beside a run on this workspace evicts what the run has just
+  // probed as hits, whose `accessed_at` bumps it has not flushed yet; the
+  // run then re-runs those tasks (upstream survey, nx#36688). So a prune
+  // takes the run's lock and waits its turn. A dry run deletes nothing.
+  const releaseRunLock = parsed.dryRun
+    ? async (): Promise<void> => {}
+    : await acquireRunLock(root, { log: warnToStderr })
   try {
     const opts: { olderThanMs?: number; maxBytes?: number; dryRun?: boolean } = {}
     if (parsed.olderThanMs !== undefined) opts.olderThanMs = parsed.olderThanMs
@@ -128,23 +174,7 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
     )
   } finally {
     cache.close()
+    await releaseRunLock()
   }
   return 0
 }
-
-/**
- * Parse `<n><unit>` where unit is s/m/h/d, case-insensitively (`parseSize`
- * has always been case-insensitive; this matched only lowercase, so `30D`
- * was rejected while `1GB` and `1gb` both worked).
- */
-export function parseDuration(input: string): number | null {
-  const m = input.match(/^(\d+)([smhd])$/i)
-  if (!m) return null
-  const n = parseDecimalInt(m[1]!)
-  if (n === null) return null
-  // Lowercase before the switch: with the /i flag an uppercase `M` would
-  // otherwise fall through to the days branch.
-  const unit = m[2]!.toLowerCase()
-  const mult = unit === 's' ? 1000 : unit === 'm' ? 60_000 : unit === 'h' ? 3_600_000 : 86_400_000
-  return n * mult
-}

package/src/cli/format.ts

@@ -1,15 +1,4 @@
-/**
- * Human-readable byte size with KB/MB/GB/TB/PB suffixes and one
- * decimal of precision below 10 of any unit. Used by `vx stats` and
- * `vx cache prune` output.
- */
-export function formatBytes(n: number): string {
-  if (n < 1024) return `${n} B`
-  const units = ['KB', 'MB', 'GB', 'TB']
-  let v = n / 1024
-  for (const u of units) {
-    if (v < 1024) return `${v.toFixed(v < 10 ? 1 : 0)} ${u}`
-    v /= 1024
-  }
-  return `${v.toFixed(0)} PB`
-}
+// `formatBytes` moved to util/size.ts beside the parsers (item 658): a run
+// names what the workspace's `cacheRetention` evicted, and the orchestrator
+// may not import the CLI.
+export { formatBytes } from '../util/index.js'

package/src/cli/help.ts

@@ -11,8 +11,12 @@ export function printHelp(pluginCommands: readonly string[] = [], verb?: string)
 export function verbHelpText(verb: string): string {
   const blocks = helpText().split('\n\n')
   const title = blocks[0]!
+  // The verb goes into a RegExp, so it is escaped: `vx 'r.n' --help` is an
+  // unknown verb, not a pattern that matches `vx run` and answers with a
+  // help cut for a verb that does not exist.
+  const quoted = verb.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
   const names = (line: string): boolean =>
-    new RegExp(`^\\s*vx ${verb}( |$)`).test(line) ||
+    new RegExp(`^\\s*vx ${quoted}( |$)`).test(line) ||
     line.includes(`(for ${verb})`) ||
     line.includes(`(for ${verb} `)
   const kept: string[] = []
@@ -54,7 +58,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '      --filter <pat>       pnpm-style filter (repeatable). Examples:',
     '                             foo, @scope/*, ./packages/foo, foo..., ...foo,',
     '                             foo^..., !foo, [<since>]',
-    '      --affected[=<base>]  Sugar for --filter "[<base>]". Default base =',
+    '      --affected[=<base>]  Sugar for --filter "...[<base>]". Default base =',
     '                             origin/HEAD (falls back to HEAD~1).',
     "  pkg#task                 Run a specific project's task directly.",
     '',
@@ -76,10 +80,12 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '      --timeout <ms>              Default per-task timeout for tasks without their own exec.timeout',
     '                                  (above VX_TASK_TIMEOUT env + workspace timeout). Kills + fails',
     '                                  a runaway task. Per-task exec.timeout always wins.',
+    '      --continue[=<mode>]         What a failed task takes down: never | deps-ok (default, skips',
+    '                                  its dependents) | always (bare form; dependents run, never save).',
     '      --frozen                    Load configs from vx-lock.json (CI; pair with vx lock --check).',
     '      --output-logs <mode>        full | errors-only | hash-only | none — overrides the flow default',
-    '      --download <mode>           all (default) | toplevel | none — where remote outputs land',
     '                                  (focused without --all/--filter/--affected, broad with, full in CI).',
+    '      --download <mode>           all (default) | toplevel | none — where remote outputs land.',
     '      --verbosity <n>             0 (default) or 1+: print a per-task summary table after the run.',
     '',
     'Planning (for run — skips execution):',
@@ -89,6 +95,9 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     'Artifacts (for run):',
     '      --summarize[=<path>] Write per-run JSON to <cacheDir>/runs/<run_id>.json.',
     '      --profile[=<path>]   Write Chrome-trace JSON (default profile.json).',
+    '      --report[=markdown]  Print a markdown run report to stdout after the run.',
+    '      --report-file <path> Append that report to <path> (for $GITHUB_STEP_SUMMARY).',
+    '      --tag <k=v>          Label this invocation (repeatable); recorded on its history row.',
     '',
     'Extensions (plugins):',
     '  vx core runs tasks in-process and nothing else. A dashboard, remote',
@@ -115,6 +124,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '      --cache-dir <path>              The cache a run with the same flag uses (why, last, info too).',
     '',
     '  Duration units: s, m, h, d. Size units: K, M, G, T (powers of 1024).',
+    '  Cache statistics — directory, entry count, size — are part of `vx info`.',
     '',
     'Introspection:',
     '  vx show              List every project: name, dir, declared task count.',

package/src/cli/index.ts

@@ -67,7 +67,7 @@ export async function run(argv: readonly string[]): Promise<number> {
       // may own it (`VxPlugin.commands`). Core verbs were matched above, so
       // nothing here can shadow them.
       const resolved = await resolvePluginCommand(command)
-      if (resolved !== null && !('loadError' in resolved)) {
+      if (resolved !== null && !('loadError' in resolved) && !('declaredVerbs' in resolved)) {
         const code = await resolved.command.run(rest, resolved.ctx)
         // A plugin is a boundary: a JS-authored verb that resolves nothing
         // would reach `process.exit(undefined)` and read as SUCCESS. A verb
@@ -110,8 +110,21 @@ export async function run(argv: readonly string[]): Promise<number> {
         )
         return 1
       }
-      process.stderr.write(`vx: unknown command: ${command}${didYouMeanVerb(command)}${loadNote}\n`)
-      printHelp()
+      // One line, as a verb's own unknown flag or subcommand gets; the full
+      // help after a typo was a hundred lines past the hint that mattered.
+      // The verbs this workspace's plugins declare are verbs HERE, so they
+      // join the "did you mean" set, and when nothing is close the second
+      // line says where a verb can come from: `vx mpc` in a workspace
+      // declaring `mcp` read as a plain unknown command, and `vx mcp`
+      // before the plugin was declared said nothing about the file that
+      // would declare it (2026-09-20).
+      const declaredVerbs =
+        resolved !== null && 'declaredVerbs' in resolved ? resolved.declaredVerbs : []
+      const guess = didYouMeanVerb(command, declaredVerbs)
+      process.stderr.write(
+        `vx: unknown command: ${command}${guess}${loadNote} (see \`vx help\`)\n` +
+          (guess === '' && loadNote === '' ? verbSourceNote(resolved, declaredVerbs) : ''),
+      )
       return 1
     }
   }
@@ -145,11 +158,24 @@ function wantsHelp(command: string, rest: readonly string[]): boolean {
   return own.includes('--help') || own.includes('-h')
 }
 
-/** ` Did you mean run?` for a verb within two edits of a core one — the same
- *  hint a task or flag typo gets. Plugin verbs are not listed: resolving
- *  them loads the workspace, and this path is reached only when that
- *  lookup found nothing. */
-function didYouMeanVerb(verb: string): string {
-  const best = nearest(verb, CORE_VERBS)
+/** ` Did you mean run?` for a verb within two edits of a core one, or of a
+ *  verb this workspace's plugins declare — the same hint a task or flag typo
+ *  gets. The plugin verbs come from the lookup that just failed, so they
+ *  cost no second load. */
+function didYouMeanVerb(verb: string, pluginVerbsHere: readonly string[] = []): string {
+  const best = nearest(verb, [...CORE_VERBS, ...pluginVerbsHere])
   return best === undefined ? '' : `. Did you mean ${best}?`
 }
+
+/**
+ * Where a verb that is neither core nor declared COULD come from. Only when
+ * nothing is close enough to guess: after a plain typo the guess is the
+ * answer, and a second line would bury it.
+ */
+function verbSourceNote(resolved: unknown, declaredVerbs: readonly string[]): string {
+  if (declaredVerbs.length > 0) {
+    return `  This workspace's plugins declare: ${[...declaredVerbs].sort().join(', ')}.\n`
+  }
+  const here = resolved === null ? 'there is no workspace here' : 'this workspace declares none'
+  return `  A plugin declared in vx.workspace.ts can add verbs; ${here}.\n`
+}

package/src/cli/info.ts

@@ -6,8 +6,9 @@
 
 import { collectInfo, type FlakyTask, type InfoFacts } from '../orchestrator/index.js'
 import { seeHelp } from './help.js'
-import { parseCacheDirFlag, warnToStderr } from './workspace-config.js'
+import { namedCacheDir, parseCacheDirFlag, warnToStderr } from './workspace-config.js'
 import { formatBytes } from './format.js'
+import { MIN_BUN } from '../util/index.js'
 
 export interface InfoArgs {
   format: 'pretty' | 'json'
@@ -16,7 +17,7 @@ export interface InfoArgs {
   error?: string
 }
 
-export function parseInfoArgs(args: readonly string[]): InfoArgs {
+function parseInfoArgs(args: readonly string[]): InfoArgs {
   const out: InfoArgs = { format: 'pretty' }
   for (let i = 0; i < args.length; i++) {
     const a = args[i]
@@ -46,6 +47,10 @@ export async function infoCmd(args: readonly string[]): Promise<number> {
     process.stderr.write(`vx info: ${parsed.error}\n`)
     return 1
   }
+  // `collectInfo` takes a resolved directory from `vx mcp` too, where one
+  // not made yet is a workspace that never ran; the flag is the user's,
+  // and a directory it names that is not there is a typo (item 900).
+  if (parsed.cacheDir !== undefined) namedCacheDir(parsed.cacheDir)
   const facts = await collectInfo(process.cwd(), {
     ...(parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {}),
     warn: warnToStderr,
@@ -59,11 +64,26 @@ export async function infoCmd(args: readonly string[]): Promise<number> {
 export function renderInfo(f: InfoFacts): string {
   const rows: [string, string][] = [
     ['vx', f.vx],
-    ['bun', f.bun],
+    // The prose stays in the rendered row; `f.bun` itself is the bare
+    // version a script reads (doctor.ts says why).
+    [
+      'bun',
+      f.bunSupported
+        ? f.bun
+        : `${f.bun} — unsupported, vx needs >= ${MIN_BUN.join('.')}; answers may be wrong`,
+    ],
     ['git', f.git ?? '(not found)'],
     ['git status cache', renderGitStatusCache(f.gitStatusCache)],
     ['workspace root', f.workspaceRoot],
-    ['projects', `${f.projects} (${f.tasks} task${f.tasks === 1 ? '' : 's'})`],
+    ['projects', describeProjects(f)],
+    // Only when a config did not load: the count above says "zero" for
+    // it, and this row says which and why.
+    ...(f.configErrors.length > 0
+      ? ([['config errors', f.configErrors.map((e) => `${e.path}: ${e.message}`).join('; ')]] as [
+          string,
+          string,
+        ][])
+      : []),
     ['plugins', describePlugins(f.plugins)],
     ['workers', describeWorkers(f.workers)],
     ['memory', describeMemory(f.memory)],
@@ -79,14 +99,29 @@ export function renderInfo(f: InfoFacts): string {
           ],
         ] as [string, string][])
       : []),
-    ['runs (24h)', `${f.runs24h} (${f.hits24h} cache hits)`],
+    // Task runs, not invocations (which `vx last` calls runs): the count
+    // the hits are a share of.
+    ['task runs (24h)', `${f.runs24h} (${f.hits24h} cache hits)`],
     ['flaky tasks', describeFlakyTasks(f.flakyTasks)],
+    ['sandbox', describeSandbox(f.sandbox)],
     ['vx-lock.json', f.lockfile ? 'yes' : 'no'],
   ]
   const labelW = Math.max(...rows.map(([label]) => label.length))
   return rows.map(([label, value]) => `${`${label}:`.padEnd(labelW + 1)} ${value}`).join('\n')
 }
 
+/**
+ * `available (3 tasks declare exec.sandbox)`, or `unavailable — <why>; 3
+ * tasks declare exec.sandbox and will fail`: a declared sandbox whose
+ * runtime cannot start fails the task, so the doctor names it before a run
+ * does.
+ */
+function describeSandbox(s: InfoFacts['sandbox']): string {
+  const declared = `${s.declared} task${s.declared === 1 ? '' : 's'} declare${s.declared === 1 ? 's' : ''} exec.sandbox`
+  if (s.available) return `available (${declared})`
+  return `unavailable — ${s.reason}; ${declared}${s.declared > 0 ? ' and will fail' : ''}`
+}
+
 /** `4 — the CPU count`, `2 — cgroup CPU quota 2 of 8 cores`, `8 — vx.workspace.ts (4 cores)`. */
 export function describeWorkers(w: InfoFacts['workers']): string {
   const quota = w.cpuQuota === null ? '' : `, cgroup CPU quota ${trimCores(w.cpuQuota)}`
@@ -109,7 +144,14 @@ function trimCores(n: number): string {
 }
 
 /** `2 — app#test (3 of 7 runs failed on unchanged inputs); api#e2e (1 of 4)`, or `none`. */
-export function describeFlakyTasks(tasks: readonly FlakyTask[]): string {
+function describeProjects(f: InfoFacts): string {
+  const tasks = `${f.tasks} task${f.tasks === 1 ? '' : 's'}`
+  const n = f.configErrors.length
+  if (n === 0) return `${f.projects} (${tasks})`
+  return `${f.projects} (${tasks} · ${n} config${n === 1 ? '' : 's'} did not load)`
+}
+
+function describeFlakyTasks(tasks: readonly FlakyTask[]): string {
   if (tasks.length === 0) return 'none'
   const parts = tasks.map(
     (t, i) =>
@@ -118,7 +160,7 @@ export function describeFlakyTasks(tasks: readonly FlakyTask[]): string {
   return `${tasks.length} — ${parts.join('; ')}`
 }
 
-export function describePlugins(
+function describePlugins(
   plugins: ReadonlyArray<{ name: string; seams: readonly string[] }>,
 ): string {
   if (plugins.length === 0) return 'none'

package/src/cli/init.ts

@@ -8,6 +8,7 @@ import { seeHelp } from './help.js'
 import {
   applyMigration,
   findWorkspaceRoot,
+  type LoadReads,
   listProjects,
   loadWorkspace,
   migrateScripts,
@@ -39,16 +40,26 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     process.stderr.write(`vx init: ${parsed.error}\n`)
     return 1
   }
-  const root = await findWorkspaceRoot(process.cwd())
-  const metas = await listProjects(await loadWorkspace(root))
+  const reads: LoadReads = new Map()
+  const root = await findWorkspaceRoot(process.cwd(), reads)
+  const metas = await listProjects(await loadWorkspace(root, reads))
   // `init` reads scripts only; a runner's own config beside them is the
   // richer source (dependsOn, inputs, outputs) and was ignored without a
   // word — the walkthrough on a Turbo repo (2026-09-09) got the scripts'
   // TODOs and none of the edges turbo.json already declared.
   const notes: string[] = []
-  if (await Bun.file(path.join(root, 'turbo.json')).exists()) {
+  // Turbo 2.5+ reads `turbo.jsonc` as well (item 938).
+  let turbo: string | undefined
+  for (const name of ['turbo.json', 'turbo.jsonc']) {
+    if (await Bun.file(path.join(root, name)).exists()) {
+      turbo = name
+      break
+    }
+  }
+  if (turbo !== undefined) {
     notes.push(
-      'turbo.json found and not read — `bunx @vzn/vx-migrate` maps it (dependsOn, inputs, ' +
+      `${turbo} found and not read — ` +
+        '`bunx @vzn/vx-migrate` maps it (dependsOn, inputs, ' +
         'outputs), or `plugins: [turbo()]` from @vzn/vx-migrate runs it with nothing written',
     )
   } else if (
@@ -57,7 +68,8 @@ export async function initCmd(args: readonly string[]): Promise<number> {
   ) {
     notes.push(
       'an Nx workspace found and not read — `bunx @vzn/vx-migrate --from nx` maps its ' +
-        'exported project graph',
+        'exported project graph, or `plugins: [nx()]` from @vzn/vx-migrate runs it with ' +
+        'nothing written',
     )
   }
   return applyMigration({