@vzn/vx 0.0.345 → 0.0.347

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.345",
+  "version": "0.0.347",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.345",
-    "@vzn/vx-linux-arm64": "0.0.345",
-    "@vzn/vx-darwin-x64": "0.0.345",
-    "@vzn/vx-darwin-arm64": "0.0.345"
+    "@vzn/vx-linux-x64": "0.0.347",
+    "@vzn/vx-linux-arm64": "0.0.347",
+    "@vzn/vx-darwin-x64": "0.0.347",
+    "@vzn/vx-darwin-arm64": "0.0.347"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -841,6 +841,12 @@ export interface GitEnumeration {
    * paths (both sides of a rename) and untracked files. Null when it failed.
    */
   changed: readonly string[] | null
+  /**
+   * What `git status` listed as untracked, workspace-relative and before
+   * nested repositories are expanded — `git ls-files --others
+   * --exclude-standard`'s set. Null when it failed.
+   */
+  untracked: readonly string[] | null
   /** Workspace-relative paths whose names are not UTF-8 (`decodeGitZ`). */
   undecodable: readonly string[]
   /** `Date.now()` before the spawns: what `trusted` says is true as of no earlier. */
@@ -1048,6 +1054,7 @@ export async function startGitEnumeration(
     trusted,
     dirty: worktreeDirty,
     changed: dirty === null ? null : [...dirty, ...untracked],
+    untracked: dirty === null ? null : untracked,
     undecodable,
     startedAtMs,
   }

package/src/cli/select.ts

@@ -26,7 +26,7 @@ import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
 import { nearest, UserError } from '../util/index.js'
-import { claimedAffected, fingerprintClaims } from '../orchestrator/index.js'
+import { claimedAffected, fingerprintClaims, gitOfDiscovery } from '../orchestrator/index.js'
 import {
   type CliLoadOptions,
   discoverCliProjects,
@@ -230,6 +230,11 @@ export async function resolveFilters(
     return { error: err instanceof Error ? err.message : String(err) }
   }
   const walksGraph = parsed.some((f) => f.withDeps || f.withDependents || f.onlyDeps)
+  // A filter that diffs against git starts the run's whole-tree walk now:
+  // the diff reads its untracked files from it (one walk where it spawned
+  // its own), and the run reuses it with the discovery (I-26).
+  const git = parsed.some((f) => f.gitSince !== undefined) ? gitOfDiscovery(projects) : undefined
+  void git?.start()
   // Every reader of the staged configs in this pass — the `pkg#task`
   // edge walk, the `workspaceFiles` owners of a changed path — shares
   // ONE load, and the run reuses it (`RunOptions.staged`): the `project`
@@ -262,6 +267,7 @@ export async function resolveFilters(
           workspaceGlobOwners(root, projects, changed, load, stagedOnce),
         fingerprintClaims: () => workspaceFingerprintClaims(root, projects, load),
         taskEdges: async () => edges ?? taskEdgesFrom(await stagedOnce()),
+        ...(git !== undefined ? { untracked: async () => (await git.start()).untracked } : {}),
       })
       affectedByFilter.set(f, names)
     } catch (err) {

package/src/cli/workspace-config.ts

@@ -12,7 +12,6 @@ import { Cache, noteSchemaReset } from '../cache/index.js'
 import { discoverProjects, loadProjects, loadWorkspacePlugins } from '../orchestrator/index.js'
 import type { VxPlugin } from '../orchestrator/index.js'
 import {
-  buildPackageGraph,
   computeWorkspaceFingerprint,
   FROZEN_WITHOUT_LOCK,
   type Workspace,
@@ -140,7 +139,6 @@ export async function loadCliProjects(
       cacheDir,
       plugins,
       projectMetas: metas,
-      packageGraph: buildPackageGraph([...metas]),
       seeds: scope,
       closure: false,
       lock,

package/src/exec/runner.ts

@@ -206,6 +206,10 @@ const SHELL_BUILTINS = new Set([
   'let',
   'declare',
   'typeset',
+  // bash's reserved words that may open a one-line command; macOS's `sh`
+  // is bash, and `exec [[ … ]]` there is "exec: [[: not found".
+  '[[',
+  'time',
 ])
 
 /**

package/src/exec/sandbox-runtime.ts

@@ -1125,7 +1125,9 @@ function ownGroupCommand(
     ...(trace === 'seccomp' ? ['--seccomp-bpf'] : []),
     '-qq',
     '-e',
-    'trace=openat',
+    // A process's cwd moves on `chdir` and starts as its parent's at the
+    // fork (`deniedCalls`); `?` lets an arch without `fork` skip it.
+    TRACED_CALLS,
     '-o',
     `/dev/fd/${TRACE_FD}`,
     '--',
@@ -1141,6 +1143,9 @@ function ownGroupCommand(
   return { command: `${tag0} ${run} ${watch} wait "$c"`, forwards: true, traced: true }
 }
 
+/** What strace stops on: the reads, and what moves or makes a process's cwd. */
+const TRACED_CALLS = 'trace=openat,chdir,fchdir,clone,?clone3,?fork,?vfork'
+
 /** The descriptor an in-sandbox strace writes its trace to (`ownGroupCommand`). */
 const TRACE_FD = 5
 
@@ -2122,7 +2127,7 @@ async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
       ...(form === 'seccomp' ? ['--seccomp-bpf'] : []),
       '-qq',
       '-e',
-      'trace=openat',
+      TRACED_CALLS,
       '-o',
       '/dev/null',
       '--',

package/src/exec/sandbox-violations.ts

@@ -88,22 +88,71 @@ export interface DeniedCall {
   syscall: string
   rawPath: string
   errno: string
+  /**
+   * The directory a relative `rawPath` was opened from, when the trace
+   * shows the process (or one it was forked from) changed into one; absent
+   * where it never did, or where it lost track (`fchdir`).
+   */
+  dir?: string
 }
 
+// The calls that move a process's cwd, and the ones that make a process:
+// a child starts in its parent's cwd as it was at the fork.
+const CHDIR_DONE_RE = new RegExp(`^(\\d+)\\s+chdir\\(${QUOTED}\\)\\s*=\\s*0`)
+const CHDIR_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+chdir\\(${QUOTED} <unfinished`)
+const CHDIR_RESUMED_RE = /^(\d+)\s+<\.\.\. chdir resumed>.*?=\s*(-?\d+)/
+const FCHDIR_RE = /^(\d+)\s+(?:fchdir\(\d+\)|<\.\.\. fchdir resumed>.*?)\s*=\s*0/
+const FORK = '(?:clone3?|v?fork)'
+const FORK_DONE_RE = new RegExp(`^(\\d+)\\s+${FORK}\\(.*\\)\\s*=\\s*(\\d+)$`)
+const FORK_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+${FORK}\\(.*<unfinished`)
+const FORK_RESUMED_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. ${FORK} resumed>.*?=\\s*(\\d+)$`)
+
+/** What a process did, in order, as far as its cwd and its denials go. */
+type Op = { chdir: string } | { lost: true } | { call: number }
+
 /**
  * Walk the trace, pairing `<unfinished ...>` with its `<... resumed>` line.
+ * Given the task's starting `cwd`, also follow each process's `chdir` and
+ * forks, so a denial of `secret.txt` after `cd src` is `src/secret.txt`:
+ * resolved against the starting cwd, it named a file that does not exist
+ * and no `ignore` pattern for the real one matched. Resolved after the
+ * whole pass: a `vfork` child's lines come before its parent's
+ * `resumed` line names it. (`-y` names the directory on every line, but
+ * cost 40% on 2,000 opens; this costs a stop per process.)
  *
  * Exported for testing: this is the security-relevant half of the Linux
  * detector, and a synthetic trace pins the split-line shapes deterministically
  * where an end-to-end run only produces them when strace happens to interleave.
  */
-export function deniedCalls(text: string): DeniedCall[] {
+export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
   const pending = new Map<string, { syscall: string; rawPath: string }>()
   const out: DeniedCall[] = []
+  const ops = new Map<string, Op[]>()
+  // A clone with CLONE_FS (every thread) shares its creator's cwd, so a
+  // `chdir` by either moves both: such a pid keeps the creator's list.
+  const sharing = new Map<string, string>()
+  const owner = (pid: string): string => sharing.get(pid) ?? pid
+  const opsOf = (pid: string): Op[] => {
+    let list = ops.get(owner(pid))
+    if (list === undefined) ops.set(owner(pid), (list = []))
+    return list
+  }
+  const parent = new Map<string, { pid: string; at: number }>()
+  const forking = new Map<string, { at: number; shared: boolean }>()
+  const forked = (from: string, child: string, at: number, shared: boolean): void => {
+    // Shared only while the child has done nothing of its own yet.
+    if (shared && !ops.has(child)) sharing.set(child, owner(from))
+    else parent.set(child, { pid: owner(from), at })
+  }
+  const chdirring = new Map<string, string>()
+  const denied = (pid: string, call: DeniedCall): void => {
+    opsOf(pid).push({ call: out.length })
+    out.push(call)
+  }
   for (const line of text.split('\n')) {
     const done = STRACE_DONE_RE.exec(line)
     if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
-      out.push({ syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
+      denied(done[1]!, { syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
       continue
     }
     const unfinished = STRACE_UNFINISHED_RE.exec(line)
@@ -116,15 +165,61 @@ export function deniedCalls(text: string): DeniedCall[] {
       continue
     }
     const resumedOk = STRACE_RESUMED_OK_RE.exec(line)
-    if (resumedOk?.[1] === undefined) continue
-    const held = pending.get(resumedOk[1])
-    pending.delete(resumedOk[1])
-    const resumed = STRACE_RESUMED_RE.exec(line)
-    // Only a resume that carries a DENIAL is a violation; a successful
-    // resume just retires the pending entry.
-    if (held !== undefined && resumed?.[3] !== undefined) {
-      out.push({ syscall: held.syscall, rawPath: held.rawPath, errno: resumed[3] })
+    if (resumedOk?.[1] !== undefined) {
+      const held = pending.get(resumedOk[1])
+      pending.delete(resumedOk[1])
+      const resumed = STRACE_RESUMED_RE.exec(line)
+      // Only a resume that carries a DENIAL is a violation; a successful
+      // resume just retires the pending entry.
+      if (held !== undefined && resumed?.[3] !== undefined) {
+        denied(resumedOk[1], { ...held, errno: resumed[3] })
+      }
+      continue
     }
+    if (cwd === undefined) continue
+    let m: RegExpExecArray | null
+    if ((m = CHDIR_DONE_RE.exec(line)) !== null) opsOf(m[1]!).push({ chdir: cStringPath(m[2]!) })
+    else if ((m = CHDIR_UNFINISHED_RE.exec(line)) !== null) chdirring.set(m[1]!, cStringPath(m[2]!))
+    else if ((m = CHDIR_RESUMED_RE.exec(line)) !== null) {
+      const to = chdirring.get(m[1]!)
+      chdirring.delete(m[1]!)
+      if (to !== undefined && m[2] === '0') opsOf(m[1]!).push({ chdir: to })
+    } else if ((m = FCHDIR_RE.exec(line)) !== null) opsOf(m[1]!).push({ lost: true })
+    else if ((m = FORK_DONE_RE.exec(line)) !== null) {
+      forked(m[1]!, m[2]!, opsOf(m[1]!).length, line.includes('CLONE_FS'))
+    } else if ((m = FORK_UNFINISHED_RE.exec(line)) !== null) {
+      forking.set(m[1]!, { at: opsOf(m[1]!).length, shared: line.includes('CLONE_FS') })
+    } else if ((m = FORK_RESUMED_RE.exec(line)) !== null) {
+      const start = forking.get(m[1]!)
+      forking.delete(m[1]!)
+      forked(m[1]!, m[2]!, start?.at ?? opsOf(m[1]!).length, start?.shared === true)
+    }
+  }
+  if (cwd === undefined) return out
+  // dirsOf(pid)[i]: the process's cwd before its op i (undefined: lost).
+  const dirs = new Map<string, (string | undefined)[]>()
+  const dirsOf = (pid: string): (string | undefined)[] => {
+    const known = dirs.get(pid)
+    if (known !== undefined) return known
+    dirs.set(pid, []) // a cycle reads as lost
+    const from = parent.get(pid)
+    let dir: string | undefined = from === undefined ? cwd : dirsOf(from.pid)[from.at]
+    const list: (string | undefined)[] = [dir]
+    for (const op of ops.get(pid) ?? []) {
+      if ('chdir' in op) {
+        dir = path.isAbsolute(op.chdir) ? op.chdir : dir && path.resolve(dir, op.chdir)
+      } else if ('lost' in op) dir = undefined
+      list.push(dir)
+    }
+    dirs.set(pid, list)
+    return list
+  }
+  for (const [pid, list] of ops) {
+    list.forEach((op, i) => {
+      if (!('call' in op)) return
+      const dir = dirsOf(pid)[i]
+      if (dir !== undefined && dir !== cwd) out[op.call]!.dir = dir
+    })
   }
   return out
 }
@@ -150,8 +245,8 @@ export async function parseStraceViolations(
 
   const seen = new Set<string>()
   const out: SandboxViolation[] = []
-  for (const { syscall, rawPath, errno } of deniedCalls(text)) {
-    const abs = toRealPath(absolutize(rawPath, baselines.cwd))
+  for (const { syscall, rawPath, errno, dir } of deniedCalls(text, baselines.cwd)) {
+    const abs = toRealPath(absolutize(rawPath, dir ?? baselines.cwd))
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue

package/src/orchestrator/doctor.ts

@@ -20,7 +20,6 @@ import {
 import { VERSION } from '../version.js'
 import { probeSandbox, resetSandbox, untracedReason } from '../exec/index.js'
 import {
-  buildPackageGraph,
   computeWorkspaceFingerprint,
   findWorkspaceRoot,
   type LoadReads,
@@ -144,7 +143,6 @@ export async function collectInfo(cwd: string, opts: CollectInfoOptions = {}): P
         cacheDir,
         plugins,
         projectMetas: metas,
-        packageGraph: buildPackageGraph([...metas]),
         seeds: 'all',
         closure: false,
         lock: null,

package/src/orchestrator/index.ts

@@ -5,6 +5,7 @@ export { run, planRun, nxProjectTarget, projectNamed } from './run.js'
 export { prepareRun, type PreparedRun } from './prepare.js'
 export {
   discoverProjects,
+  gitOfDiscovery,
   loadProjects,
   loadResolvedProjects,
   loadWorkspacePlugins,

package/src/orchestrator/options.ts

@@ -47,6 +47,7 @@ export interface RunOptions {
    * as `staged` is.
    */
   discovered?: { root: string; projects: ProjectMeta[] }
+  /** Worker slots: a positive integer; run() refuses anything else (C-61). */
   concurrency?: number
   /**
    * Cache directory override (`--cache-dir <path>`). Absolute, or relative
@@ -115,6 +116,7 @@ export interface RunOptions {
    * `exec.retries` (explicit config wins, including `retries: 0`).
    * Threaded as an option only — never folded into any cache key, so
    * the same run with and without `--retry` derives identical keys.
+   * A non-negative integer; run() refuses anything else (C-61).
    */
   retries?: number
   /**
@@ -124,6 +126,8 @@ export interface RunOptions {
    * `exec.timeout` always wins. Threaded as an option only — never
    * folded into any cache key (a timed-out task fails and is never
    * cached), so a `--timeout` run cache-hits a plain run's entry.
+   * A positive integer of ms up to `2 ** 31 - 1`; run() refuses anything
+   * else (C-61).
    */
   timeout?: number
   /**

package/src/orchestrator/projects.ts

@@ -22,7 +22,6 @@ import type { WorkspaceConfig } from '../config.js'
 import { Cache, lazyGitEnumeration, type LazyGitEnumeration } from '../cache/index.js'
 import { UserError } from '../util/index.js'
 import {
-  buildPackageGraph,
   computeWorkspaceFingerprint,
   listProjects,
   loadWorkspace,
@@ -81,8 +80,10 @@ export async function discoverProjects(
   git: LazyGitEnumeration = lazyGitEnumeration(workspace.root),
 ): Promise<ProjectMeta[]> {
   const projects = await listProjects(workspace)
-  if (!hasHook(plugins, 'discover')) return projects
+  // Registered whatever the hooks: an `--affected` selection reads its
+  // untracked files from this walk, and the run reuses it (I-26).
   discoveredGit.set(projects, git)
+  if (!hasHook(plugins, 'discover')) return projects
   const worktreeChanges = (): Promise<readonly string[] | null> =>
     git.start().then(
       (e) => e.changed,
@@ -97,12 +98,16 @@ export async function discoverProjects(
   return projects.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
 }
 
-export interface LoadProjectsArgs {
+export type LoadProjectsArgs = LoadProjectsBase &
+  // The graph is read only for the closure: a load without one built it
+  // for nothing (1,000 projects: ~10 ms, once per CLI selection pass).
+  ({ closure: true; packageGraph: PackageGraph } | { closure: false; packageGraph?: PackageGraph })
+
+interface LoadProjectsBase {
   workspaceRoot: string
   cacheDir: string
   plugins: readonly VxPlugin[]
   projectMetas: readonly ProjectMeta[]
-  packageGraph: PackageGraph
   /**
    * Projects whose configs must load — `'all'`, or names (unknown and
    * config-less ones are ignored). With `closure`, each seed's transitive
@@ -111,7 +116,6 @@ export interface LoadProjectsArgs {
    * way, since the package graph cannot see the cross form.
    */
   seeds: 'all' | Iterable<string>
-  closure: boolean
   /** Read configs from the lock instead of evaluating them (`--frozen`). */
   lock: Lockfile | null
   evalCache: LoadProjectConfigOptions['evalCache']
@@ -148,7 +152,8 @@ export interface LoadedProjects {
  * enters scope.
  */
 export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjects> {
-  const { plugins, packageGraph, lock, workspaceRoot } = args
+  const { plugins, lock, workspaceRoot } = args
+  const graph = args.closure ? args.packageGraph : null
   // A package with no config file declares no tasks — unless a plugin
   // fills the `project` stage, in which case it is a project the stage may
   // give tasks to (the zero-migration shape: `turbo.json` or `package.json`
@@ -178,7 +183,7 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
     }
   }
   const walked = new Set<string>()
-  const considerWithDeps = (name: string): void => {
+  const considerWithDeps = (packageGraph: PackageGraph, name: string): void => {
     consider(name)
     // Every config-bearing project already considered: the closure can
     // add nothing, and asking for it would build the package graph's
@@ -190,8 +195,10 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
   }
   const seeds = args.seeds === 'all' ? metaByName.keys() : [...args.seeds]
   for (const seed of seeds) consider(seed)
-  if (args.closure && pending.length < metaByName.size) {
-    for (const seed of args.seeds === 'all' ? metaByName.keys() : seeds) considerWithDeps(seed)
+  if (graph !== null && pending.length < metaByName.size) {
+    for (const seed of args.seeds === 'all' ? metaByName.keys() : seeds) {
+      considerWithDeps(graph, seed)
+    }
   }
 
   // Load in rounds to a fixpoint. A `pkg#task` dependsOn entry names a
@@ -227,7 +234,7 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
       if (pre !== undefined) {
         projects.set(meta.name, pre)
         for (const name of crossDepProjects(pre.config)) {
-          if (args.closure) considerWithDeps(name)
+          if (graph !== null) considerWithDeps(graph, name)
           else consider(name)
         }
         continue
@@ -258,7 +265,7 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
       const named = rootName === undefined ? config : rootSpelled(config, rootName)
       projects.set(meta.name, { name: meta.name, dir: meta.dir, config: named })
       for (const name of crossDepProjects(named)) {
-        if (args.closure) considerWithDeps(name)
+        if (graph !== null) considerWithDeps(graph, name)
         else consider(name)
       }
     }
@@ -349,7 +356,6 @@ export async function loadResolvedProjects(
       cacheDir,
       plugins,
       projectMetas: metas,
-      packageGraph: buildPackageGraph([...metas]),
       seeds: opts.scope ?? 'all',
       closure: false,
       lock: null,

package/src/orchestrator/run.ts

@@ -193,7 +193,34 @@ export function invocationCommand(argv: readonly string[]): string {
   return [...argv.slice(0, sep), '--', `<${rest} argument${rest === 1 ? '' : 's'}>`].join(' ')
 }
 
+/**
+ * The bounds the CLI and the workspace config already hold, at the façade
+ * (C-61): a `concurrency` of 0, a negative or NaN left no worker slot and
+ * the run waited for good; a `retries` of NaN retried a failing task
+ * without end; a `timeout` of 0, a negative, NaN or past the timer's range
+ * killed every task at once.
+ */
+function refuseRunNumbers(options: RunOptions): void {
+  const refuse = (name: string, value: number, rule: string): never => {
+    throw new UserError(`RunOptions.${name} is ${String(value)}: it must be ${rule}`)
+  }
+  // No task named read "No projects declare task(s): ." (C-61).
+  if (options.tasks.length === 0 || options.tasks.includes(''))
+    throw new UserError(`RunOptions.tasks names no task: give at least one task name`)
+  const { concurrency, retries, timeout } = options
+  if (concurrency !== undefined && !(Number.isInteger(concurrency) && concurrency > 0))
+    refuse('concurrency', concurrency, 'a positive integer')
+  if (retries !== undefined && !(Number.isInteger(retries) && retries >= 0))
+    refuse('retries', retries, 'a non-negative integer')
+  if (
+    timeout !== undefined &&
+    !(Number.isInteger(timeout) && timeout > 0 && timeout <= MAX_TIMEOUT_MS)
+  )
+    refuse('timeout', timeout, `a positive integer of ms, at most ${MAX_TIMEOUT_MS}`)
+}
+
 export async function run(options: RunOptions): Promise<RunSummary> {
+  refuseRunNumbers(options)
   // Color decision: a custom logger (tests, embedders) handles its
   // own formatting and asserts on plain strings, so we suppress
   // ANSI escapes for them. Only the defaultLogger (real terminal
@@ -844,7 +871,21 @@ async function runOnBus(
     const foreground = options.log === undefined && (options.handleSignals ?? true)
     // An aborted run's children are already being torn down: nothing to hold.
     const hold = options.holdPersistent === true && !stopRun.signal.aborted
-    const keepAlive = selectKeepAlive(persistentRegistry, nodes, foreground || hold)
+    // A run that failed elsewhere holds nothing: `vx run dev --all` with one
+    // server that never became ready sat on the others for good, so a
+    // script hung, and the Ctrl-C that ended it read 130 over the failure
+    // (C-60). A kept server's own crash ends the wait below as before, and
+    // `--continue=always` asked to keep going, and does. The watch loop
+    // (`holdPersistent`) still holds: a failing test in a cycle stopped
+    // the dev server the next change would restart anyway.
+    let keepAlive = selectKeepAlive(persistentRegistry, nodes, foreground || hold)
+    const failedElsewhere =
+      ![...outcomes.values()].every((o) => isPassStatus(o.status)) ||
+      [...persistentRegistry.values()].some(
+        (c) => hasEnded(c) && c.exitCode !== 0 && !keepAlive.children.includes(c),
+      )
+    if (failedElsewhere && !hold && options.continueMode !== 'always')
+      keepAlive = { nodes: [], children: [] }
     const crashedPersistent = (
       await shutdownPersistent(persistentRegistry, keepAlive.children)
     ).filter((c) => endedBeforeStop?.has(persistentRegistry.get(c.id)!) ?? true)

package/src/workspace/affected.ts

@@ -98,6 +98,13 @@ export interface AffectedArgs {
    * package graph cannot see (item 1085).
    */
   taskEdges?: () => Promise<ReadonlyMap<string, readonly string[]>>
+  /**
+   * The untracked files, workspace-relative, from a walk the caller shares
+   * with the run (`GitEnumeration.untracked`); null or absent spawns `git
+   * ls-files --others` here. The selection's own walk was a second one the
+   * run then paid again (I-26).
+   */
+  untracked?: () => Promise<readonly string[] | null>
 }
 
 export interface FingerprintClaims {
@@ -186,7 +193,9 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
     // `--affected` skips a package that genuinely has new work.
-    gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']),
+    (async () =>
+      (await args.untracked?.().catch(() => null)) ??
+      gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']))(),
   ])
 
   // vx-lock.json (workspace-root metadata) is excluded like a gitignored

package/src/workspace/lockfile.ts

@@ -153,7 +153,15 @@ export async function frozenProjectConfigs(
   const entries = metas.map((meta) => {
     const rel = relPosix(root, meta.configPath)
     const entry = lock.projects[meta.name]
-    if (!entry || entry.configPath !== rel) {
+    if (entry !== undefined && entry.configPath !== rel) {
+      // A renamed or moved config: "has no entry for a" named an entry the
+      // lock holds, under its old path (D-88).
+      throw new UserError(
+        `${LOCKFILE_NAME} locks "${meta.name}" at ${entry.configPath}, but its config is ${rel} now — ` +
+          `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
+      )
+    }
+    if (!entry) {
       throw new UserError(
         `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
           `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,

package/src/workspace/migrate-scripts.ts

@@ -407,6 +407,20 @@ export function migrateScripts(
     typeof outsideScripts === 'object' &&
     outsideScripts !== null &&
     Object.values(outsideScripts).some((v) => typeof v === 'string' && v !== '')
+  const unnamedMaps = (): string[] => {
+    const meta: ProjectMeta = {
+      name: 'package.json',
+      dir: outsideDir!,
+      packageJson: outside as never,
+      configPath: null,
+    }
+    const scripts = scriptsOf(meta)
+    return Object.keys(rootScripts(meta)).filter((n) => {
+      // A hook rides in its script's command and is no script to name.
+      const base = /^(?:pre|post)(.+)$/.exec(n)?.[1]
+      return !LIFECYCLE.test(n) && (base === undefined || !(base in scripts))
+    })
+  }
   const rootName =
     root?.name ??
     (outsideRuns
@@ -418,6 +432,14 @@ export function migrateScripts(
     notes.push(
       `${rootName} (the workspace root): its scripts that check the whole repo are its tasks; those that run the members (\`pnpm -r\`, \`--filter\`, a runner) or share a member's task name are left out`,
     )
+  } else if (rootName === 'package.json' && outsideDir !== undefined && unnamedMaps().length > 0) {
+    // react's nameless root: "its scripts run the workspace" was not why,
+    // and 30 of its scripts (`build`, `lint`, `test`) map once it has a
+    // name (D-87).
+    const would = unnamedMaps()
+    notes.push(
+      `package.json (the workspace root) not mapped: it has no "name", and vx names a project by it; give it one and run \`vx init\` again to map ${would.length} of its scripts (${would.slice(0, 8).join(', ')}${would.length > 8 ? ', …' : ''})`,
+    )
   } else if (rootName !== undefined) {
     // A nameless root's vx.config is skipped (vx names projects by their
     // manifest's name), so the hand-written one needs a name first (vuejs/core).