@vzn/vx 0.0.255 → 0.0.258

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.255",
+  "version": "0.0.258",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.255",
-    "@vzn/vx-linux-arm64": "0.0.255",
-    "@vzn/vx-darwin-x64": "0.0.255",
-    "@vzn/vx-darwin-arm64": "0.0.255"
+    "@vzn/vx-linux-x64": "0.0.258",
+    "@vzn/vx-linux-arm64": "0.0.258",
+    "@vzn/vx-darwin-x64": "0.0.258",
+    "@vzn/vx-darwin-arm64": "0.0.258"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -100,8 +100,9 @@ import { CACHE_VERSION, foldKey } from './key-fold.js'
 /**
  * An artifact or temp file without an `entries` row is reaped by
  * `prune()` only once it is this old. A save renames the artifact into
- * place and commits its row in the same tick; a crashed save's temp is
- * stale long before this. Generous on purpose — a false orphan costs a
+ * place inside its `BEGIN IMMEDIATE` row transaction (A-3), so a live
+ * artifact without a row is one whose commit failed and was taken back
+ * out; a crashed save's temp is stale long before this. Generous on purpose — a false orphan costs a
  * re-run, a leaked temp costs disk.
  */
 const ORPHAN_GRACE_MS = 60 * 60 * 1000

package/src/cache/key-fold.ts

@@ -87,6 +87,15 @@ import type { CacheKeyInput } from './layer.js'
 // never folded and saved what it built. The fix withholds that link unless
 // the key answers for the package, but an entry saved before it still hits
 // after the sibling changes (probed: the old output replayed).
+// v32: an artifact saved before non-UTF-8 names were refused lacks that
+// output under an unchanged key (item 739).
+// v33: an entry saved after an input changed under a running task sits
+// under the key the fixed code derives once the tree is back (item 743).
+// v34: the same for an in-run lockfile rewrite (item 750).
+// v35: the sidecar records the key and ingest refuses a mismatch; a v34
+// artifact records none (item 943).
+// v36: each artifact ends in a `.vx-sum` CRC-32 of its entries, checked on
+// scan and restore; a v35 artifact has none (L-19).
 export const CACHE_VERSION = 'vx-cache-v36'
 
 /**

package/src/cache/layer.ts

@@ -498,8 +498,8 @@ export class ArtifactVanishedError extends Error {
 }
 
 /**
- * The shape every cache implementation honors. `Cache` (the local v10
- * implementation) and `LayeredCache` both `implements` this so the
+ * The shape every cache implementation honors. `Cache` (the local store)
+ * and `LayeredCache` both `implements` this so the
  * orchestrator's `executeTask` can take either without a discriminated
  * union and we get a compile-time guarantee the surfaces stay congruent.
  */
@@ -561,7 +561,8 @@ export interface CacheLayer {
    * Lightweight existence probe. `'local'` / `'remote'` names the layer
    * that holds the artifact; `null` is a miss. NEVER moves bytes: no
    * artifact read, no remote download, no local ingest, no accessed_at
-   * bump (the LayeredCache's remote side is an HTTP HEAD). Planning
+   * bump (on the remote side the layer decides the call: an HTTP HEAD, or
+   * REAPI's `getActionResult` + `findMissingBlobs`). Planning
    * (`--dry` / `--graph`) predicts hits with this instead of `get` so a
    * dry run can't pull N artifacts over the network. Remote errors
    * degrade to `null` — an existence probe never fails anything.

package/src/cache/layered-cache.ts

@@ -396,8 +396,8 @@ export class LayeredCache implements CacheLayer {
     const remoteBody = remoteResult as { body: Blob | Response; durationMs?: number }
 
     // Ingest the remote body into local using the caller-supplied
-    // taskId/command plus the remote-reported durationMs. The remote
-    // layer carries durationMs as an HTTP header (x-artifact-duration);
+    // taskId/command plus the remote-reported durationMs, which `get`
+    // returns beside the body (the layer decides where it reads it from);
     // taskId + command come from the orchestrator's TaskNode in scope.
     // Without `ctx`, we can't populate a meaningful entries row, so
     // ingest with placeholders — caller-side typing nudges everyone

package/src/cache/policy.ts

@@ -9,9 +9,11 @@ import { UserError } from '../util/index.js'
  * toggled on its own so `--force` (re-execute but still refresh the
  * cache) is distinct from `--no-cache` (disable everything).
  *
- * Only the task-artifact get/save path is gated. `recordRun`, `stats`,
- * `prune`, key derivation, and prefetch-ingest are never affected — they
- * are bookkeeping/analytics that a run policy has no business disabling.
+ * The task-artifact get/save path is gated, and the local axes also gate
+ * the local store's config-evaluation reads and writes and its file-hash
+ * writes (`cache.ts`). `recordRun`, `stats`, `prune`, key derivation, and
+ * prefetch-ingest are never affected — they are bookkeeping/analytics
+ * that a run policy has no business disabling.
  */
 export interface CachePolicy {
   localRead: boolean

package/src/cli/init.ts

@@ -216,11 +216,17 @@ function remoteCacheSignal(root: string, runner: 'turbo' | 'nx'): string | undef
       } catch {
         continue
       }
-      if (typeof rc === 'object' && rc !== null && (rc as { enabled?: unknown }).enabled !== false)
+      if (typeof rc === 'object' && rc !== null) {
+        // Turned off in turbo.json is off, whatever CI sets.
+        if ((rc as { enabled?: unknown }).enabled === false) return undefined
         return `${f} names a remoteCache`
+      }
     }
   }
   const variable = REMOTE_CACHE_ENV[runner]
+  // A line that sets it (`TURBO_TOKEN: …`, `TURBO_TOKEN=…`), not one that
+  // names it: a comment or a doc line counted as "sets" (J's lead).
+  const sets = new RegExp(`^(?!\\s*#).*\\b${variable}\\s*[:=]`, 'm')
   const workflows = new Bun.Glob('.github/workflows/*.{yml,yaml}')
   const files = [...workflows.scanSync({ cwd: root, dot: true })].sort().concat(CI_FILES)
   for (const f of files) {
@@ -230,7 +236,7 @@ function remoteCacheSignal(root: string, runner: 'turbo' | 'nx'): string | undef
     } catch {
       continue
     }
-    if (text.includes(variable)) return `${f} sets ${variable}`
+    if (sets.test(text)) return `${f} sets ${variable}`
   }
   return undefined
 }

package/src/cli/plugin-templates.ts

@@ -20,8 +20,8 @@ export const PLUGIN_TEMPLATES: Readonly<Record<string, { plugin: string; test: s
   },
   executor: {
     plugin:
-      "// `executor`: where a task's command runs. This one runs it here, in a\n// shell of its own, and stops the shell's whole process group when core\n// aborts the request (a stop, or `exec.timeout`): core cannot reach a\n// process an executor spawned.\nimport { definePlugin, type TaskExecutor, type VxPlugin } from '@vzn/vx'\n\nexport function shellExecutor(): VxPlugin {\n  const executor: TaskExecutor = {\n    name: 'shell',\n    async execute(req) {\n      const started = Date.now()\n      const child = Bun.spawn(['sh', '-c', [req.command, ...req.forwardArgs].join(' ')], {\n        cwd: req.cwd,\n        env: req.env,\n        stdout: 'pipe',\n        stderr: 'pipe',\n        detached: true,\n      })\n      const stop = (): void => {\n        try {\n          process.kill(-child.pid, 'SIGTERM')\n        } catch {\n          // already gone\n        }\n      }\n      req.signal?.addEventListener('abort', stop, { once: true })\n      const drain = async (stream: ReadableStream<Uint8Array>, on: (s: string) => void) => {\n        const decoder = new TextDecoder()\n        let all = ''\n        for await (const chunk of stream) {\n          const text = decoder.decode(chunk, { stream: true })\n          all += text\n          on(text)\n        }\n        return all\n      }\n      const [stdout, stderr, exitCode] = await Promise.all([\n        drain(child.stdout, req.onStdout),\n        drain(child.stderr, req.onStderr),\n        child.exited,\n      ])\n      req.signal?.removeEventListener('abort', stop)\n      return {\n        exitCode,\n        durationMs: Date.now() - started,\n        stdout,\n        stderr,\n        violations: [],\n        where: 'shell',\n      }\n    },\n  }\n  return definePlugin(import.meta, { executor: () => executor })\n}\n",
-    test: "// A test for the example `executor` plugin beside it: a throwaway workspace\n// declares the plugin and vx's own run() drives it. `bun test` runs it.\nimport { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { afterEach, beforeEach, expect, it } from 'bun:test'\nimport { run, type Logger } from '@vzn/vx'\n\nlet root: string\nbeforeEach(async () => {\n  root = await mkdtemp(path.join(os.tmpdir(), 'vx-plugin-executor-'))\n  await writeFile(path.join(root, 'package.json'), JSON.stringify({ name: 'ws', private: true }))\n  await writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages:\\n  - \"packages/*\"\\n')\n  Bun.spawnSync({ cmd: ['git', 'init', '-q'], cwd: root })\n})\nafterEach(async () => {\n  await rm(root, { recursive: true, force: true })\n})\n\n/** A package `name` whose `vx.config.mjs` is `config`. */\nasync function pkg(\n  name: string,\n  config: string,\n  scripts?: Record<string, string>,\n): Promise<string> {\n  const dir = path.join(root, 'packages', name)\n  await mkdir(dir, { recursive: true })\n  await writeFile(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name, version: '1.0.0', ...(scripts ? { scripts } : {}) }),\n  )\n  await writeFile(path.join(dir, 'vx.config.mjs'), config)\n  return dir\n}\n\n/** A `vx.workspace.mjs` declaring `call`, e.g. `shellExecutor()`, from the plugin file beside this test. */\nasync function workspace(call: string): Promise<void> {\n  const from = JSON.stringify(path.join(import.meta.dir, 'executor.ts'))\n  await writeFile(\n    path.join(root, 'vx.workspace.mjs'),\n    `import { shellExecutor } from ${from}\\nexport default { plugins: [${call}] }\\n`,\n  )\n}\n\nfunction log(order: string[] = []): Logger {\n  return {\n    status() {},\n    taskStart(node) {\n      order.push(`start ${node.id}`)\n    },\n    taskStdout() {},\n    taskStderr() {},\n    taskComplete(node) {\n      order.push(`end ${node.id}`)\n    },\n  }\n}\n\nit('runs the command and says where; stops it on exec.timeout', async () => {\n  const dir = await pkg(\n    'a',\n    `export default { tasks: {\n      hello: { exec: { command: 'echo hi > out.txt' } },\n      slow: { exec: { command: 'exec sleep 30', timeout: 300 } },\n    } }`,\n  )\n  await workspace('shellExecutor()')\n  const ok = await run({ cwd: root, tasks: ['hello'], log: log(), handleSignals: false })\n  expect(ok.outcomes.map((o) => [o.node.id, o.status, o.where])).toEqual([\n    ['a#hello', 'success', 'shell'],\n  ])\n  expect(await Bun.file(path.join(dir, 'out.txt')).text()).toBe('hi\\n')\n  const started = Date.now()\n  const slow = await run({ cwd: root, tasks: ['slow'], log: log(), handleSignals: false })\n  expect(slow.outcomes.map((o) => [o.node.id, o.status, o.timedOut === true])).toEqual([\n    ['a#slow', 'failed', true],\n  ])\n  expect(Date.now() - started).toBeLessThan(10_000)\n}, 20_000)\n",
+      "// `executor`: where a task's command runs. This one runs it here, in a\n// shell of its own, and stops the shell's whole process group when core\n// aborts the request (a stop, or `exec.timeout`): core cannot reach a\n// process an executor spawned.\nimport { definePlugin, type TaskExecutor, type VxPlugin } from '@vzn/vx'\n\nexport function shellExecutor(): VxPlugin {\n  const executor: TaskExecutor = {\n    name: 'shell',\n    async execute(req) {\n      const started = Date.now()\n      // vx's own `sh`: a bare name is looked up on `req.env`'s PATH, which\n      // leads with the project's node_modules/.bin, where a dependency's\n      // `sh` would run every command.\n      const sh = Bun.which('sh') ?? '/bin/sh'\n      const child = Bun.spawn([sh, '-c', [req.command, ...req.forwardArgs].join(' ')], {\n        cwd: req.cwd,\n        env: req.env,\n        stdout: 'pipe',\n        stderr: 'pipe',\n        detached: true,\n      })\n      const stop = (): void => {\n        try {\n          process.kill(-child.pid, 'SIGTERM')\n        } catch {\n          // already gone\n        }\n      }\n      req.signal?.addEventListener('abort', stop, { once: true })\n      const drain = async (stream: ReadableStream<Uint8Array>, on: (s: string) => void) => {\n        const decoder = new TextDecoder()\n        let all = ''\n        for await (const chunk of stream) {\n          const text = decoder.decode(chunk, { stream: true })\n          all += text\n          on(text)\n        }\n        return all\n      }\n      const [stdout, stderr, exitCode] = await Promise.all([\n        drain(child.stdout, req.onStdout),\n        drain(child.stderr, req.onStderr),\n        child.exited,\n      ])\n      req.signal?.removeEventListener('abort', stop)\n      return {\n        exitCode,\n        durationMs: Date.now() - started,\n        stdout,\n        stderr,\n        violations: [],\n        where: 'shell',\n      }\n    },\n  }\n  return definePlugin(import.meta, { executor: () => executor })\n}\n",
+    test: "// A test for the example `executor` plugin beside it: a throwaway workspace\n// declares the plugin and vx's own run() drives it. `bun test` runs it.\nimport { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { afterEach, beforeEach, expect, it } from 'bun:test'\nimport { run, type Logger } from '@vzn/vx'\n\nlet root: string\nbeforeEach(async () => {\n  root = await mkdtemp(path.join(os.tmpdir(), 'vx-plugin-executor-'))\n  await writeFile(path.join(root, 'package.json'), JSON.stringify({ name: 'ws', private: true }))\n  await writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages:\\n  - \"packages/*\"\\n')\n  Bun.spawnSync({ cmd: ['git', 'init', '-q'], cwd: root })\n})\nafterEach(async () => {\n  await rm(root, { recursive: true, force: true })\n})\n\n/** A package `name` whose `vx.config.mjs` is `config`. */\nasync function pkg(\n  name: string,\n  config: string,\n  scripts?: Record<string, string>,\n): Promise<string> {\n  const dir = path.join(root, 'packages', name)\n  await mkdir(dir, { recursive: true })\n  await writeFile(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name, version: '1.0.0', ...(scripts ? { scripts } : {}) }),\n  )\n  await writeFile(path.join(dir, 'vx.config.mjs'), config)\n  return dir\n}\n\n/** A `vx.workspace.mjs` declaring `call`, e.g. `shellExecutor()`, from the plugin file beside this test. */\nasync function workspace(call: string): Promise<void> {\n  const from = JSON.stringify(path.join(import.meta.dir, 'executor.ts'))\n  await writeFile(\n    path.join(root, 'vx.workspace.mjs'),\n    `import { shellExecutor } from ${from}\\nexport default { plugins: [${call}] }\\n`,\n  )\n}\n\nfunction log(order: string[] = []): Logger {\n  return {\n    status() {},\n    taskStart(node) {\n      order.push(`start ${node.id}`)\n    },\n    taskStdout() {},\n    taskStderr() {},\n    taskComplete(node) {\n      order.push(`end ${node.id}`)\n    },\n  }\n}\n\nit('runs the command and says where; stops it on exec.timeout', async () => {\n  const dir = await pkg(\n    'a',\n    `export default { tasks: {\n      hello: { exec: { command: 'echo hi > out.txt' } },\n      slow: { exec: { command: 'exec sleep 30', timeout: 300 } },\n    } }`,\n  )\n  await workspace('shellExecutor()')\n  const ok = await run({ cwd: root, tasks: ['hello'], log: log(), handleSignals: false })\n  expect(ok.outcomes.map((o) => [o.node.id, o.status, o.where])).toEqual([\n    ['a#hello', 'success', 'shell'],\n  ])\n  expect(await Bun.file(path.join(dir, 'out.txt')).text()).toBe('hi\\n')\n  const started = Date.now()\n  const slow = await run({ cwd: root, tasks: ['slow'], log: log(), handleSignals: false })\n  expect(slow.outcomes.map((o) => [o.node.id, o.status, o.timedOut === true])).toEqual([\n    ['a#slow', 'failed', true],\n  ])\n  expect(Date.now() - started).toBeLessThan(10_000)\n}, 20_000)\n\nit(\"runs the command through this machine's sh, not a project's node_modules/.bin sh\", async () => {\n  const dir = await pkg(\n    'a',\n    `export default { tasks: { hello: { exec: { command: 'echo real' } } } }`,\n  )\n  await mkdir(path.join(dir, 'node_modules', '.bin'), { recursive: true })\n  await writeFile(path.join(dir, 'node_modules', '.bin', 'sh'), '#!/bin/sh\\necho planted\\n', {\n    mode: 0o755,\n  })\n  await workspace('shellExecutor()')\n  const out: string[] = []\n  const r = await run({\n    cwd: root,\n    tasks: ['hello'],\n    log: { ...log(), taskStdout: (_n, chunk) => void out.push(chunk) },\n    handleSignals: false,\n  })\n  expect([r.outcomes.map((o) => o.status), out.join('')]).toEqual([['success'], 'real\\n'])\n}, 20_000)\n",
   },
   graph: {
     plugin:

package/src/config.ts

@@ -261,8 +261,10 @@ export interface SandboxGrants {
    */
   write?: string[]
   /**
-   * Reachable domains. `true` allows all, `['*.example.com']` a pattern.
-   * Omitted means no network at all.
+   * Reachable domains, `['*.example.com']` a pattern. The proxy is the
+   * run's: it filters every sandboxed task against the union of the lists
+   * the run's tasks declare, so `true` adds no domain and reaches only
+   * those (none in a run with no list). Omitted adds none either.
    */
   network?: true | string[]
   /**

package/src/exec/sandbox-runtime.ts

@@ -9,8 +9,9 @@
 //   This module adds nothing implicit on top — no /tmp, no project dir —
 //   so what a task may touch is its vx.config.ts plus those baselines.
 //
-// Network is opt-in per task. By default the sandbox blocks all outbound
-// traffic; tasks that need it set `sandbox.network: true`.
+// Network is a domain list, and the run's: SRT's one proxy filters every
+// sandboxed task against the union of the lists the run's tasks declare.
+// With no list, no domain is reachable; `sandbox.network: true` adds none.
 //
 // Platform reality:
 //   macOS — `SandboxViolationStore` is populated from the system log
@@ -520,9 +521,8 @@ function hostHasIpv6(): boolean {
  * servers + (on macOS) the violation log monitor. Safe to call repeatedly
  * — SRT itself returns early on the second call.
  *
- * The base config sets network to "block everything" (empty allowedDomains).
- * Per-task wrapping passes a customConfig that re-enables network for
- * tasks with `sandbox.network: true`.
+ * The base config sets network to "block everything" (empty allowedDomains)
+ * unless `allowedDomains` names some; `sandbox.network: true` adds none.
  *
  * @param opts.allowedDomains every domain any sandboxed task in this run
  * declared. SRT's filtering proxy is per-RUN and reads its allowlist from

package/src/orchestrator/options.ts

@@ -176,8 +176,9 @@ export interface RunOptions {
    */
   signal?: AbortSignal
   /**
-   * Hand the requested persistent tasks still running back on
-   * `RunSummary.persistent` instead of stopping them when the graph ends.
+   * Hand the requested persistent tasks still running, and the persistent
+   * tasks they depend on (C-46), back on `RunSummary.persistent` instead
+   * of stopping them when the graph ends.
    * The caller owns them from then on and stops them with its `stop()`.
    * The watch loop sets this: a dev server stays up while watch idles and
    * is replaced only when the next cycle starts.

package/src/orchestrator/plan.ts

@@ -4,7 +4,7 @@
 //
 // No TASK execution happens: no task spawn, no cleanOutputs, no
 // restoreOutputs. Cache probing uses the byte-free `cache.has()`
-// existence probe (a remote layer answers with an HTTP HEAD — no
+// existence probe (a remote layer answers it its own way — no
 // artifact download, no local ingest), so the plan is read-only — with
 // one deliberate exception: `cache.inputs.runtime` / `workspaceRuntime`
 // probe commands DO run, because predicting a task's key requires

package/src/orchestrator/plugin.ts

@@ -28,12 +28,10 @@ import type { TelemetryContext, TelemetrySink } from './telemetry.js'
  * executed. Registered explicitly in vx.workspace.ts via
  * defineWorkspace({ plugins: [...] }). No auto-discovery.
  *
- * The old observe-only `Plugin` (`{ name, setup(ctx) }`) is a subset of
- * this shape: a plugin with only `setup` installs and runs exactly as
- * before via `installPlugins`. The capabilities are consulted by
- * `plugin-host.ts`; core's own executor and cache are plugins too
- * (src/plugins/), declared by the workspace — there is no fallback
- * outside the list.
+ * Made by `definePlugin(import.meta, hooks)` only: the loader refuses a
+ * plain object. The capabilities are consulted by `plugin-host.ts`. Core
+ * names no plugin; the local executor and the local cache are the floor
+ * under the list, taking what every plugin declines.
  */
 export interface VxPlugin {
   /**
@@ -47,7 +45,7 @@ export interface VxPlugin {
   // --- PIPELINE stages (shape the run before it executes — opt-in) ----------
   //
   // Each receives the object core is about to use and edits it IN PLACE;
-  // core re-validates after the last plugin, so a plugin cannot produce what
+  // core re-validates after each plugin, so a plugin cannot produce what
   // the loader would refuse from a user. Declaration order is the order.
   // Whatever a stage changes reaches the cache key by construction: the key
   // hashes the task config AFTER `project` ran. See

package/src/orchestrator/sandbox-request.ts

@@ -81,9 +81,10 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
   for (const n of sandboxed) {
     const allow = n.config.exec?.sandbox?.allow
     const net = allow?.network
-    // `network: true` is deliberately absent from the union: it SKIPS the
-    // proxy rather than going through it, so folding it in as `*` would
+    // `network: true` adds nothing to the union: folded in as `*` it would
     // widen the allowlist every OTHER task in the run is filtered against.
+    // It does not skip the proxy either, so it reaches only the domains
+    // some task of the run lists (schema.md § network is per-RUN).
     if (Array.isArray(net)) for (const d of net) domains.add(d)
     for (const d of n.config.exec?.sandbox?.deny?.network ?? []) denied.add(d)
     const sockets = allow?.unixSockets

package/src/util/task-id.ts

@@ -10,9 +10,10 @@
  * about the identity of the same task: a lookup either found nothing or, worse,
  * answered with a different task's history.
  *
- * A `#`-containing task name is legal and pinned elsewhere in the suite, so
- * this is reachable rather than theoretical. The cache's run history read
- * the same rule from a private copy until item 646; one rule, one place.
+ * A config's task name may not hold `#` (`taskNameProblem`), but an id also
+ * arrives from run history and plugins, so the first-`#` rule is the one
+ * the graph uses. The cache's run history read the same rule from a
+ * private copy until item 646; one rule, one place.
  */
 export function splitTaskId(id: string): [project: string, task: string] {
   const i = id.indexOf('#')

package/src/workspace/affected.ts

@@ -594,10 +594,15 @@ export async function defaultAffectedBase(workspaceRoot: string): Promise<string
     'ignore',
   )
   const out = new TextDecoder().decode(probe.stdout).trim()
-  if (probe.exitCode === 0 && out.length > 0) return out
+  // An origin/HEAD naming a branch the remote deleted (a pruned fetch keeps
+  // the symref) is no base either: it failed as `git ref "origin/master" did
+  // not resolve`, a ref nobody typed, where an unset one falls back.
+  if (probe.exitCode === 0 && out.length > 0 && revParse(workspaceRoot, out) !== undefined) {
+    return out
+  }
   if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
     throw new UserError(
-      '--affected has no base here: origin/HEAD is not set and HEAD has no parent to compare ' +
+      '--affected has no base here: origin/HEAD is not set (or names a branch that is gone) and HEAD has no parent to compare ' +
         'with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0) or name the ' +
         'base: --affected=origin/main',
     )

package/src/workspace/config-schema.ts

@@ -993,8 +993,10 @@ function assertFilterNamesDeclaredDeps(
     if (raw.startsWith('!')) continue
     const f = specForm(raw)
     if (f.task.length === 0 || f.task.includes('*') || named(f)) continue
+    // `where` opens with the config's path; the message names it once.
+    const task = where.slice(where.lastIndexOf(': tasks.') + 2)
     throw new UserError(
-      `${where}.cache.inputs.tasks: "${raw}" names no task in ${where}.dependsOn ` +
+      `${where}.cache.inputs.tasks: "${raw}" names no task in ${task}.dependsOn ` +
         `(${declared.length === 0 ? 'none declared' : dependsOn!.map((d) => `'${d}'`).join(', ')}) — ` +
         `it would match nothing and fold no upstream hash, decoupling the task from its ` +
         `dependencies. \`name\` is this project's task, \`^name\` its dependencies', ` +