@vzn/vx 0.0.349 → 0.0.350

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.349",
+  "version": "0.0.350",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.349",
-    "@vzn/vx-linux-arm64": "0.0.349",
-    "@vzn/vx-darwin-x64": "0.0.349",
-    "@vzn/vx-darwin-arm64": "0.0.349"
+    "@vzn/vx-linux-x64": "0.0.350",
+    "@vzn/vx-linux-arm64": "0.0.350",
+    "@vzn/vx-darwin-x64": "0.0.350",
+    "@vzn/vx-darwin-arm64": "0.0.350"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -605,6 +605,14 @@ export class Cache implements CacheLayer {
       // every open there failed `attempt to write a readonly database`
       // before the not-writable refusal could name the directory (O-10).
       if (!absent) this.db.fileControl(SQLITE_FCNTL_PERSIST_WAL, 1)
+      // Any non-negative limit makes the last clean close truncate a
+      // persistent `-wal` to zero bytes once it is checkpointed (SQLite's
+      // walClose). At the default (-1) it kept every frame, so each later
+      // connection recovered them at open and copied them into the
+      // database again at its close: 738 frames, 4.5 MB, on a 1,000-project
+      // cache. The file stays (O-10 above); 64 MiB is far above what a run
+      // writes, so the limit never trims a WAL mid-run.
+      this.db.exec('PRAGMA journal_size_limit = 67108864')
       this.db.exec('PRAGMA synchronous = NORMAL')
       this.db.exec('PRAGMA foreign_keys = ON')
       this.db.exec(`

package/src/cache/git-inputs.ts

@@ -853,6 +853,9 @@ export interface GitEnumeration {
   startedAtMs: number
 }
 
+/** Above this many project dirs the enumeration walks the whole tree. */
+export const MAX_SCOPED_PATHSPECS = 64
+
 /**
  * Pathspec scoping: when the run only needs a handful of projects
  * (scoped config loading), let git scan just those dirs — 75 ms →
@@ -868,7 +871,7 @@ export function gitPathspecs(
   const scoped =
     !workspaceWide &&
     rels.length > 0 &&
-    rels.length <= 64 &&
+    rels.length <= MAX_SCOPED_PATHSPECS &&
     rels.every((r) => r !== '' && r !== '.')
   return scoped ? rels : ['.']
 }

package/src/cache/index.ts

@@ -49,6 +49,7 @@ export {
   GitFilesCache,
   applyGitEnumeration,
   gitPathspecs,
+  MAX_SCOPED_PATHSPECS,
   repoRootOf,
   startGitEnumeration,
   lazyGitEnumeration,

package/src/cache/inputs.ts

@@ -1032,27 +1032,67 @@ function refuseOneAlternativeBrace(
   }
 }
 
-async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
+/** What a `files` declaration and its task's outputs compile to, whatever the project. */
+interface FilesPlan {
+  positive: string[]
+  negative: string[]
+  excludeGlobs: Bun.Glob[]
+  ownOutput: (rel: string) => boolean
+  positiveGlobs: Bun.Glob[]
+  /** The literal entries, each naming one path (see `unmatchedLiterals`). */
+  literals: string[]
+}
+
+/**
+ * Compiled once per declaration for the life of the process: a workspace
+ * declares a handful of `files` lists over thousands of tasks, and
+ * splitting, normalizing and compiling them per task was ~6 ms of a
+ * 1,000-task warm run (I-29). A refused declaration is never stored, so it
+ * throws for every task that carries it.
+ */
+const filesPlans = new Map<string, FilesPlan | null>()
+
+function filesPlan(
+  files: readonly string[] | undefined,
+  ownOutputs: readonly string[],
+): FilesPlan | null {
+  const key = JSON.stringify([files ?? null, ownOutputs])
+  const memo = filesPlans.get(key)
+  if (memo !== undefined) return memo
   const positive: string[] = []
   const negative: string[] = []
-
-  if (args.files === undefined) {
+  if (files === undefined) {
     positive.push(...DEFAULT_FILE_GLOBS)
   } else {
-    refuseOneAlternativeBrace(args.files, 'files')
-    for (const entry of args.files) {
+    refuseOneAlternativeBrace(files, 'files')
+    for (const entry of files) {
       if (entry.startsWith('!')) negative.push(entry.slice(1))
       else positive.push(entry)
     }
   }
+  const plan =
+    positive.length === 0
+      ? null
+      : {
+          positive,
+          negative,
+          excludeGlobs: [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor),
+          // A path the task's own outputs take back with `!` is no output, so it
+          // stays an input: a tracked file under `dist` the build reads (A-44).
+          ownOutput: outputMatcher(ownOutputs, globFor),
+          positiveGlobs: asTrees(positive).map(globFor),
+          literals: positive.map(normalizeGlob).filter(isLiteralPattern).map(stripTrailingSlash),
+        }
+  filesPlans.set(key, plan)
+  return plan
+}
 
-  if (positive.length === 0) return []
+async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
+  const plan = filesPlan(args.files, args.ownOutputs)
+  if (plan === null) return []
+  const { positive, negative, excludeGlobs, ownOutput, positiveGlobs } = plan
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
-  const excludeGlobs = [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor)
-  // A path the task's own outputs take back with `!` is no output, so it
-  // stays an input: a tracked file under `dist` the build reads (A-44).
-  const ownOutput = outputMatcher(args.ownOutputs, globFor)
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
   // files, .git/info/exclude, and global excludes all participate
@@ -1062,7 +1102,6 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // per task (build + test + lint + …). Spawning git N times for the
   // same project per run is wasteful; we cache the result for the
   // duration of one orchestrator run.
-  const positiveGlobs = asTrees(positive).map(globFor)
   // Everything below the snapshot that decides the result: the project, what
   // it declares, what it excludes as its own outputs, and the boundaries.
   const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
@@ -1102,9 +1141,7 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // an artifact built from an older version of a file the config explicitly
   // claims as an input. See the refusal below for why this is not simply
   // honoured instead.
-  const unmatchedLiterals = new Set(
-    positive.map(normalizeGlob).filter(isLiteralPattern).map(stripTrailingSlash),
-  )
+  const unmatchedLiterals = new Set(plan.literals)
   // First pass: glob-filter to candidate absolute paths (no I/O).
   const candidates: string[] = []
   for (const rel of gitFiles) {

package/src/exec/sandbox-runtime.ts

@@ -742,20 +742,19 @@ function canonicalBaselines(
  * only if it exists in the new root, and otherwise `$HOME`, with no word:
  * a project granted no read ran in the home directory, where `cat x.txt`
  * read `~/x.txt`. A grant at or above the cwd holds it, and so does an
- * existing one below (bwrap builds the path to a bind), and so does a
- * deny that IS the cwd (a single-package workspace's anchor). When none does,
+ * existing one below (bwrap builds the path to a bind). When none does,
  * the cwd is denied instead: an empty directory the task enters, whose
- * reads are refused and reported as the anchor's are.
+ * reads are refused and reported as the anchor's are. A single-package
+ * workspace's cwd is its anchor, denied already; the runtime takes the
+ * second entry as the same mount.
  */
 function cwdMounted(
   cwd: string,
   fs: {
     allowRead?: readonly string[] | undefined
     allowWrite?: readonly string[] | undefined
-    denyRead?: readonly string[] | undefined
   },
 ): boolean {
-  if (fs.denyRead?.includes(cwd) === true) return true
   return [...(fs.allowRead ?? []), ...(fs.allowWrite ?? [])].some(
     (p) => atOrUnder(cwd, p) || (atOrUnder(p, cwd) && existsSync(p)),
   )
@@ -2076,12 +2075,20 @@ async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why:
     } else {
       const m = /version (\d+)\.(\d+)/.exec(out)
       const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
-      const form = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
-      const refused = await traceRefusal(form)
+      let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+      let refused = await traceRefusal(form)
+      // A strace that cannot check the seccomp filter says so and traces on
+      // without it, exit 0. Inside the sandbox that line read as the trace
+      // cut short, and every sandboxed task ran twice: the plain form, if
+      // it is quiet, is the one that works here.
+      if (refused?.warned === true && form === 'seccomp') {
+        refused = await traceRefusal('plain')
+        if (refused === null) form = 'plain'
+      }
       straceAvailableCache =
         refused === null
           ? { form, why: '' }
-          : { form: false, why: `strace cannot trace here (${refused})` }
+          : { form: false, why: `strace cannot trace here (${refused.line})` }
     }
   } catch {
     // Not on PATH. Said as the refused attach is: without it an undeclared
@@ -2111,14 +2118,17 @@ export async function untracedReason(): Promise<string | null> {
 
 /**
  * Why strace may not attach here (null when it may), asked once with the flags a task's trace
- * uses (`ownGroupCommand`). `--version` answers on a host that refuses
+ * uses (`ownGroupCommand`). A strace that exits 0 having said something of
+ * its own is refused too (`warned`): in a task, its line is the retry key. `--version` answers on a host that refuses
  * ptrace (Yama's `ptrace_scope` 2 or 3, a container's seccomp profile),
  * and there every sandboxed task failed twice, the retry included, on
  * `attach: ptrace(PTRACE_SEIZE…): Operation not permitted`. Refused, the
  * run goes untraced, as without strace: bwrap still enforces, and only the
  * read-violation report is lost, which is said once.
  */
-async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
+async function traceRefusal(
+  form: 'plain' | 'seccomp',
+): Promise<{ line: string; warned: boolean } | null> {
   const p = Bun.spawn(
     [
       executablePath('strace'),
@@ -2136,8 +2146,9 @@ async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
     { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe' },
   )
   const err = await new Response(p.stderr).text()
-  if ((await p.exited) === 0) return null
-  return err.trim().split('\n')[0] || `exit ${p.exitCode}`
+  const line = err.split('\n').find((l) => STRACE_OWN_ERROR.test(l))
+  if ((await p.exited) === 0) return line === undefined ? null : { line, warned: true }
+  return { line: err.trim().split('\n')[0] || `exit ${p.exitCode}`, warned: false }
 }
 let warnedNoTrace = false
 

package/src/orchestrator/framed-output.ts

@@ -468,6 +468,19 @@ export function formatPersistentTailBlock(
   return lines.join('\n') + '\n'
 }
 
+/**
+ * What a kept server writes after the summary, one line at a time under its
+ * id (`app#dev │ Local: http://localhost:5173`), so several servers'
+ * logs read apart. `text` holds whole lines, its last newline cut off.
+ */
+export function formatKeptLines(node: TaskNode, text: string, colors: ColorSupport): string {
+  const prefix = `${paintTaskId(node, colors)} ${paint('', '│', colors, { dim: true })} `
+  return text
+    .split('\n')
+    .map((line) => `${prefix}${line}\n`)
+    .join('')
+}
+
 /**
  * Between the requested task's frame and the summary footer, list the
  * persistent tasks (dev servers / watchers) the run is keeping alive in

package/src/orchestrator/logger.ts

@@ -4,6 +4,7 @@ import {
   formatFailureRecap,
   formatFrameClose,
   formatFrameOpen,
+  formatKeptLines,
   formatPersistentTailBlock,
   formatTaskBlock,
   formatTaskExecutedLine,
@@ -318,6 +319,39 @@ export function defaultLogger(
     { node: TaskNode; outcome?: TaskOutcome; out: Tail; err: Tail }
   >()
   let flushedPersistent = false
+  // After that flush nothing prints a tail again, yet a kept server writes
+  // for as long as vx holds it: `vx run dev --all` showed none of its
+  // servers' logs while it ran (C-56). So a ready server's output streams
+  // from then on, a line at a time under its id; the partial line each
+  // holds waits for its newline, a second runEnd, or `settle`.
+  const KEPT_LINE_CAP = 64 * 1024
+  const keptLines = new Map<string, { node: TaskNode; rest: string }>()
+  const streamKept = (node: TaskNode, chunk: string): void => {
+    const held = keptLines.get(node.id) ?? { node, rest: '' }
+    keptLines.set(node.id, held)
+    const text = held.rest + chunk
+    const cut = text.lastIndexOf('\n')
+    if (cut < 0) {
+      // A line that never ends (a `\r` progress bar) is printed at the cap
+      // rather than held without bound.
+      if (text.length < KEPT_LINE_CAP) held.rest = text
+      else {
+        held.rest = ''
+        writer.write(fenced(formatKeptLines(node, text, colors)))
+      }
+      return
+    }
+    held.rest = text.slice(cut + 1)
+    writer.write(fenced(formatKeptLines(node, text.slice(0, cut), colors)))
+  }
+  const flushKept = (): void => {
+    for (const held of keptLines.values()) {
+      if (held.rest.length > 0) writer.write(fenced(formatKeptLines(held.node, held.rest, colors)))
+      held.rest = ''
+    }
+  }
+  const printsKept = (tail: { outcome?: TaskOutcome }): boolean =>
+    flushedPersistent && tail.outcome !== undefined && view.mode !== 'errors-only'
   // The recap's material, decided at each failure so nothing is held for a
   // task that passed. A buffered task's tail is read off the buffers the
   // frame drains; a live-streamed one keeps no buffer, so a bounded ring
@@ -411,6 +445,8 @@ export function defaultLogger(
 
   return {
     settle() {
+      // The bus delivers one `run:end`, so the CLI's last word reaches here.
+      flushKept()
       writer.settle()
     },
     failureRecap() {
@@ -483,6 +519,7 @@ export function defaultLogger(
       // like the failures below: run() calls runEnd twice on the success
       // path (once before the summary, once in its finally), and a
       // kept-alive child keeps writing between the two.
+      if (flushedPersistent) flushKept()
       if (!flushedPersistent) {
         flushedPersistent = true
         if (view.mode !== 'none' && view.mode !== 'errors-only') {
@@ -533,7 +570,8 @@ export function defaultLogger(
       }
       const tail = persistentTails.get(node.id)
       if (tail !== undefined) {
-        appendTail(tail.out, chunk)
+        if (printsKept(tail)) streamKept(node, chunk)
+        else appendTail(tail.out, chunk)
         return
       }
       pushChunk(stdoutBuffers, node.id, chunk)
@@ -550,7 +588,8 @@ export function defaultLogger(
       }
       const tail = persistentTails.get(node.id)
       if (tail !== undefined) {
-        appendTail(tail.err, chunk)
+        if (printsKept(tail)) streamKept(node, chunk)
+        else appendTail(tail.err, chunk)
         return
       }
       pushChunk(stderrBuffers, node.id, chunk)

package/src/orchestrator/options.ts

@@ -180,9 +180,10 @@ export interface RunOptions {
    */
   signal?: AbortSignal
   /**
-   * Hand the requested persistent tasks still running, and the persistent
-   * tasks they depend on (C-46), back on `RunSummary.persistent` instead
-   * of stopping them when the graph ends.
+   * Hand the requested persistent tasks still running, those a requested
+   * group stands for (C-52), and the persistent tasks they depend on
+   * (C-46), back on `RunSummary.persistent` instead of stopping them when
+   * the graph ends.
    * The caller owns them from then on and stops them with its `stop()`.
    * The watch loop sets this: a dev server stays up while watch idles and
    * is replaced only when the next cycle starts.

package/src/orchestrator/plugin-host.ts

@@ -386,12 +386,13 @@ export function buildAdmission(
 }
 
 /**
- * Collect every plugin's `cache` layer in declaration order. One layer is
- * used as is; two or more are chained (lookup walks them, save reaches all;
- * see ChainedCache). A bare local layer that another declared layer already
- * wraps (`layer.local === ctx.localCache`) is dropped, so a remote plugin
- * that layers over the local handle does not also write the local store
- * directly. A plugin declaring nothing leaves that store, unwrapped.
+ * Collect every plugin's `cache` layer in declaration order, with the local
+ * store at the tail, and chain them (lookup walks them, save reaches all;
+ * see ChainedCache). The local store is dropped when a declared layer wraps
+ * it (`layer.local === ctx.localCache`), so a remote plugin that layers over
+ * the local handle does not also write it directly. Only a single layer
+ * left is used as is: the local store when no plugin declares one, or the
+ * one layer that wraps it.
  */
 export async function resolveCache(
   plugins: readonly VxPlugin[],

package/src/orchestrator/prepare.ts

@@ -20,6 +20,7 @@ import {
   LayeredCache,
   applyGitEnumeration,
   gitPathspecs,
+  MAX_SCOPED_PATHSPECS,
   startGitEnumeration,
   lazyGitEnumeration,
 } from '../cache/index.js'
@@ -181,9 +182,13 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // config, discovery, the cache open and the config evaluation. Its
   // ~60 ms is the warm run's wall floor on a 1000-project tree; it used to
   // start after discovery and the cache open, ~25 ms later. A scoped run
-  // waits: its pathspecs depend on which projects the configs pull in.
-  const unscoped =
-    options.projects === undefined && options.tasks.some((spec) => spec.indexOf('#') <= 0)
+  // waits: its pathspecs depend on which projects the configs pull in —
+  // unless it already names more projects than pathspecs scope, where the
+  // walk is the whole tree either way (an `--affected` run on 1,000
+  // projects waited ~60 ms for it after the configs loaded).
+  const wholeTree =
+    (options.projects === undefined || options.projects.length > MAX_SCOPED_PATHSPECS) &&
+    options.tasks.some((spec) => spec.indexOf('#') <= 0)
   // A `discover` hook that reads the worktree (nx()'s graph key) starts the
   // whole-tree enumeration a scoped run would otherwise scope later, here or
   // in the CLI's selection pass; the run reuses it instead of walking the
@@ -192,7 +197,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   const git =
     (reused !== undefined ? gitOfDiscovery(reused.projects) : undefined) ??
     lazyGitEnumeration(workspaceRoot)
-  if (unscoped) void git.start()
+  if (wholeTree) void git.start()
   const workspace = await loadWorkspace(workspaceRoot, reads)
   const { workspaceConfig, plugins } = await loadWorkspacePlugins(workspaceRoot, (m) =>
     log.status(m),

package/src/workspace/affected.ts

@@ -592,7 +592,8 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
- * etc.), then falls back to `HEAD~1`. A clone with no `origin/HEAD` and
+ * etc.), then `origin/main`, `origin/master`, `main`, `master`, then
+ * falls back to `HEAD~1`. A clone with no `origin/HEAD` and
  * no parent commit — a CI checkout at `fetch-depth: 1` — has no base at
  * all, and says so here rather than failing on a ref nobody typed.
  */
@@ -609,6 +610,12 @@ export async function defaultAffectedBase(workspaceRoot: string): Promise<string
   if (probe.exitCode === 0 && out.length > 0 && revParse(workspaceRoot, out) !== undefined) {
     return out
   }
+  // No origin/HEAD: `git remote add` + fetch, as actions/checkout does, sets
+  // none, and `HEAD~1` saw only a feature branch's last commit where Turbo
+  // and Nx compare with `main` (D-93). The usual trunk names, remote first;
+  // one that IS HEAD (a push to main) falls through to `HEAD~1` as before.
+  const trunk = trunkBase(workspaceRoot)
+  if (trunk !== undefined) return trunk
   if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
     throw new UserError(
       '--affected has no base here: origin/HEAD is not set (or names a branch that is gone) and HEAD has no parent to compare ' +
@@ -619,6 +626,32 @@ export async function defaultAffectedBase(workspaceRoot: string): Promise<string
   return 'HEAD~1'
 }
 
+const TRUNKS = ['origin/main', 'origin/master', 'main', 'master']
+
+/** The first of `TRUNKS` that exists and is not HEAD's commit, in one spawn. */
+function trunkBase(workspaceRoot: string): string | undefined {
+  const proc = spawnGitSync(
+    [
+      'for-each-ref',
+      '--format=%(refname:short) %(objectname)',
+      '--end-of-options',
+      ...TRUNKS.map((t) => (t.startsWith('origin/') ? `refs/remotes/${t}` : `refs/heads/${t}`)),
+    ],
+    workspaceRoot,
+    'ignore',
+  )
+  if (proc.exitCode !== 0) return undefined
+  const at = new Map(
+    new TextDecoder()
+      .decode(proc.stdout)
+      .split('\n')
+      .filter((l) => l !== '')
+      .map((l) => l.split(' ') as [string, string]),
+  )
+  const head = revParse(workspaceRoot, 'HEAD')
+  return TRUNKS.find((t) => at.has(t) && at.get(t) !== head)
+}
+
 /**
  * Does `ref` name the commit HEAD is on? A base that IS HEAD can never
  * mark anything affected — the shape of a single-branch clone whose

package/src/workspace/config-schema.ts

@@ -742,6 +742,16 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         '`exec.command`: vx runs one shell command (`nx()` from `@vzn/vx-migrate` runs an Nx executor as one)',
       options: '`exec.command` (a run-commands `options.command`) and `exec.env`',
       outputLogs: 'the `--output-logs` flag of `vx run`',
+      // Turbo's `interactive` / `with`, Nx's `cwd` / `parallelism` /
+      // `configurations`: refused with no word on where they went (D-89).
+      interactive:
+        'a command run outside vx: a task never reads the terminal (its stdin is EOF, or a pipe vx holds under `exec.persistent`)',
+      with: '`dependsOn` on each task it runs beside: a persistent one stays up, and this task starts once it is ready',
+      cwd: '`cd <dir> && …` in `exec.command`: a task runs in its project directory',
+      parallelism:
+        '`concurrency: 1` in vx.workspace or `--concurrency 1` on the run: no task runs alone beside others',
+      configurations:
+        'one task per configuration (`build:production`, with its own `exec.command`)',
     },
   ],
   [EXEC_FIELDS, { cmd: '`command`', script: '`command`' }],

package/src/workspace/migrate-scripts.ts

@@ -155,7 +155,10 @@ function ownerOf(dir: string, memo: Map<string, Owner>): Owner {
   try {
     const pm = (JSON.parse(read('package.json') ?? '') as { packageManager?: unknown })
       .packageManager
-    if (typeof pm === 'string')
+    // A manager vx knows nothing of (zod's `nub@0.8.3`) says nothing about
+    // hooks: the lockfile beside it does, and "nub ran `postbuild`" was a
+    // claim nothing had checked (D-96).
+    if (typeof pm === 'string' && /^(npm|pnpm|yarn|bun)@/.test(pm))
       manager = /^yarn@([2-9]|\d{2,})/.test(pm) ? 'berry' : pm.split('@')[0]
   } catch {}
   if (manager === undefined) {
@@ -342,6 +345,44 @@ function cdsToMembers(script: string, rootDir: string, memberDirs: readonly stri
 const RUNS_SCRIPT =
   /(?:^|[\s;&|(])(?:pnpm|npm|yarn|bun)\s+(?:run(?:-script)?\s+)?([^\s;&|()'"-][^\s;&|()'"]*)/g
 
+/**
+ * The scripts a command runs by name: a package manager's (`pnpm x`, `npm
+ * run x`), `run-s` / `run-p` / `npm-run-all` (`build:*` is one segment,
+ * `build:**` any), and `concurrently "npm:x"`. A root `ci: run-s build:all
+ * lint` over `build:all: pnpm -r build` mapped as a root task (D-95).
+ */
+function scriptRefs(command: string, scripts: readonly (readonly [string, string])[]): string[] {
+  const refs = [...command.matchAll(RUNS_SCRIPT)].map((m) => m[1]!)
+  for (const m of command.matchAll(/["']?\b(?:npm|pnpm|yarn|bun):([^\s"']+)/g)) refs.push(m[1]!)
+  for (const segment of command.split(/&&|\|\||[;|()]/)) {
+    const words = segment.trim().split(/\s+/)
+    const at = words.findIndex((w) => /^(run-s|run-p|npm-run-all)$/.test(w))
+    if (at < 0) continue
+    for (const w of words.slice(at + 1)) {
+      if (w.startsWith('-')) continue
+      const name = w.replace(/^(["'])(.*)\1$/, '$2')
+      if (!name.includes('*')) {
+        refs.push(name)
+        continue
+      }
+      const re = new RegExp(
+        `^${name
+          .split(/(\*\*|\*)/)
+          .map((part) =>
+            part === '**'
+              ? '.*'
+              : part === '*'
+                ? '[^:]*'
+                : part.replace(/[.+?^${}()|[\]\\]/g, '\\$&'),
+          )
+          .join('')}$`,
+      )
+      for (const [n] of scripts) if (re.test(n)) refs.push(n)
+    }
+  }
+  return refs
+}
+
 /**
  * The scripts that run the members, directly or through another of these
  * scripts: vite's `ci-docs` (`pnpm build && pnpm docs-build`) runs each
@@ -367,7 +408,7 @@ function runningMembers(
     grew = false
     for (const [n, v] of text) {
       if (out.has(n)) continue
-      if ([...v.matchAll(RUNS_SCRIPT)].some((m) => out.has(m[1]!))) {
+      if (scriptRefs(v, text).some((r) => out.has(r))) {
         out.add(n)
         grew = true
       }