@vzn/vx 0.0.354 → 0.0.356

package/src/exec/sandbox-runtime.ts

@@ -48,6 +48,7 @@ import {
   shellQuote,
   withForwardArgs,
   signalExitCode,
+  stopSignal,
   spawnFailureText,
   streamToString,
   resourceUsageToCpuRss,
@@ -63,7 +64,13 @@ import {
   UserError,
   xxh3hex,
 } from '../util/index.js'
-import { bindableReads, bindableWrites, buildCustomConfig, scratchWrites } from './sandbox-binds.js'
+import {
+  bindableReads,
+  bindableWrites,
+  buildCustomConfig,
+  scratchWrites,
+  widenedEntries,
+} from './sandbox-binds.js'
 import {
   atOrUnder,
   isMountableLiteral,
@@ -550,6 +557,9 @@ export async function initSandbox(opts?: {
   /** Whether any task of the run grants `gitConfig`: SRT reads it run-wide, so it is set per wrap (B-41). */
   gitConfig?: boolean
 }): Promise<void> {
+  // This run owns the session now; a reset an earlier run deferred to its
+  // last server would tear it down under this run's tasks (M-25).
+  resetDeferred = false
   // A reset a server's exit started unawaited: a watch cycle stops its
   // server and starts its run at once, and an init under that reset
   // found SRT up, hot-reloaded it, and had it torn down after (item 884).
@@ -947,6 +957,8 @@ export async function wrapSandboxedCommand(
       server?: boolean
       /** Trace the command's `openat` calls to descriptor TRACE_FD (Linux; `wantsStraceDetection`). */
       trace?: 'plain' | 'seccomp'
+      /** Trace with `-y`, each descriptor's path printed: a read under a widened grant is judged. */
+      tracePaths?: boolean
     },
 ): Promise<{
   wrapped: string
@@ -1004,7 +1016,7 @@ export async function wrapSandboxedCommand(
   const ports = process.platform === 'linux' ? bridgedPorts(args.config) : []
   const grouped =
     process.platform === 'linux'
-      ? ownGroupCommand(tag, inTmp, args.trace)
+      ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
       : { command: taggedCommand, forwards: false, traced: false }
   const inner = [
     ports.length > 0 ? portBridgeInner(ports, tag) : '',
@@ -1082,6 +1094,7 @@ function ownGroupCommand(
   tag: string,
   userCommand: string,
   trace?: 'plain' | 'seccomp',
+  tracePaths = false,
 ): { command: string; forwards: boolean; traced: boolean } {
   // `sh`, as an unsandboxed task runs (`runner.ts`): the command ran under
   // bash here, so `[[ … ]]`, brace expansion and `echo 'a\tb'` read one
@@ -1131,6 +1144,10 @@ function ownGroupCommand(
     '-DD',
     '-f',
     ...(trace === 'seccomp' ? ['--seccomp-bpf'] : []),
+    // A read through a directory's descriptor (`find`, `grep -r`) names
+    // only the entry; `-y` prints the path it opened. 40% slower on 2,000
+    // opens, so only where a widened grant's reads are judged.
+    ...(tracePaths ? ['-y'] : []),
     '-qq',
     '-e',
     // A process's cwd moves on `chdir` and starts as its parent's at the
@@ -1477,9 +1494,31 @@ async function runSandboxedOnce(
   // kernel filter stops only on `openat`. strace ≥ 5.3 (2019); an older
   // one gets the slow form rather than no detection.
   const useStrace = await wantsStraceDetection()
+  // Before the spawn: what the task creates under a widened grant is its own.
+  const widened = useStrace ? widenedEntries(args.config.allowWrite) : undefined
   const { wrapped, tag, srtCommand, baselines, scratch, forwardsSignals, traced } =
-    await wrapSandboxedCommand({ ...args, ...(useStrace ? { trace: useStrace } : {}) })
+    await wrapSandboxedCommand({
+      ...args,
+      ...(useStrace ? { trace: useStrace } : {}),
+      ...(widened !== undefined && widened.size > 0 ? { tracePaths: true } : {}),
+    })
   const takeRecords = collectRecords(SandboxManager.getSandboxViolationStore(), srtCommand)
+  // A stop that landed during the awaits above leaves nothing to kill yet:
+  // spawned now, the task ran after the teardown swept the run's children.
+  if (args.signal?.aborted === true) {
+    releaseBridges(tag)
+    takeRecords()
+    const signal = stopSignal(args.signal.reason)
+    return {
+      exitCode: signalExitCode(signal),
+      durationMs: Date.now() - start,
+      stdout: '',
+      stderr: '',
+      signal,
+      violations: [],
+      tracerFailed: false,
+    }
+  }
   // Beside the task directories, which every sandbox replaces with its own:
   // in the shared temp dir a concurrent task read this log, every path
   // this task opened (L-25).
@@ -1628,7 +1667,7 @@ async function runSandboxedOnce(
     process.platform === 'linux'
       ? [
           ...(straceLog
-            ? await parseStraceViolations(straceLog, args, baselines).catch(() => [])
+            ? await parseStraceViolations(straceLog, args, baselines, widened).catch(() => [])
             : []),
           ...refusedWrites(
             // Keyed by what SRT wrapped, the in-sandbox group wrapper

package/src/exec/sandbox-violations.ts

@@ -50,6 +50,25 @@ const STRACE_RESUMED_RE = new RegExp(
 )
 /** A resumed call that SUCCEEDED — clears the pending entry, emits nothing. */
 const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>`)
+/**
+ * An `openat` that succeeded, and not for writing alone: a read. Placed by
+ * the path `-y` prints for the descriptor it returned; without one, only
+ * from the cwd (`AT_FDCWD`) or by an absolute path.
+ */
+const READ_FLAGS = '(?![A-Z_|]*O_WRONLY)[A-Z_|]+'
+const OPEN_READ_RE = new RegExp(
+  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<[^"]*>)?, ${QUOTED}, ${READ_FLAGS}[^)]*\\)\\s*=\\s*\\d+(?:<(.*)>)?$`,
+)
+const OPEN_READ_UNFINISHED_RE = new RegExp(
+  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<[^"]*>)?, ${QUOTED}, ${READ_FLAGS}.*<unfinished`,
+)
+const RESUMED_FD_RE = /resumed>.*\)\s*=\s*\d+(?:<(.*)>)?$/
+
+/** Where a successful read opened: `-y`'s path, else the call's own when placeable. */
+function readPath(dirfd: string, rawPath: string, opened: string | undefined): string | undefined {
+  if (opened !== undefined) return cStringPath(opened)
+  return dirfd === 'AT_FDCWD' || rawPath.startsWith('/') ? rawPath : undefined
+}
 
 const C_ESCAPES: Record<string, number> = { n: 10, t: 9, r: 13, v: 11, f: 12, a: 7, b: 8 }
 
@@ -89,6 +108,8 @@ export interface DeniedCall {
   syscall: string
   rawPath: string
   errno: string
+  /** A read that SUCCEEDED (`errno` empty): asked for by `deniedCalls`' `reads`. */
+  read?: true
   /**
    * The directory a relative `rawPath` was opened from, when the trace
    * shows the process (or one it was forked from) changed into one; absent
@@ -132,8 +153,11 @@ type Op = { chdir: string } | { lost: true } | { call: number }
  * detector, and a synthetic trace pins the split-line shapes deterministically
  * where an end-to-end run only produces them when strace happens to interleave.
  */
-export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
-  const pending = new Map<string, { syscall: string; rawPath: string }>()
+export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCall[] {
+  const pending = new Map<
+    string,
+    { syscall: string; rawPath: string; read?: true; dirfd?: string }
+  >()
   const out: DeniedCall[] = []
   const ops = new Map<string, Op[]>()
   // A clone with CLONE_FS (every thread) shares its creator's cwd, so a
@@ -162,6 +186,15 @@ export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
     const opener =
       line.includes('= -1') || line.includes('<unfinished') || line.includes('resumed>')
     if (!opener) {
+      if (reads && line.includes('openat(')) {
+        const m = OPEN_READ_RE.exec(line)
+        if (m !== null) {
+          const at = readPath(m[2]!, cStringPath(m[3]!), m[4])
+          if (at !== undefined)
+            denied(m[1]!, { syscall: 'openat', rawPath: at, errno: '', read: true })
+          continue
+        }
+      }
       if (
         cwd !== undefined &&
         (line.includes('chdir(') || line.includes('fork(') || line.includes('clone'))
@@ -180,7 +213,12 @@ export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
       unfinished[2] !== undefined &&
       unfinished[3] !== undefined
     ) {
-      pending.set(unfinished[1], { syscall: unfinished[2], rawPath: cStringPath(unfinished[3]) })
+      pending.set(unfinished[1], {
+        syscall: unfinished[2],
+        rawPath: cStringPath(unfinished[3]),
+        ...(reads && OPEN_READ_UNFINISHED_RE.test(line) ? { read: true as const } : {}),
+        ...(reads ? { dirfd: OPEN_READ_UNFINISHED_RE.exec(line)?.[2] ?? 'AT_FDCWD' } : {}),
+      })
       continue
     }
     const resumedOk = STRACE_RESUMED_OK_RE.exec(line)
@@ -190,8 +228,14 @@ export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
       const resumed = STRACE_RESUMED_RE.exec(line)
       // Only a resume that carries a DENIAL is a violation; a successful
       // resume just retires the pending entry.
+      const fd = held?.read === true ? RESUMED_FD_RE.exec(line) : null
       if (held !== undefined && resumed?.[3] !== undefined) {
-        denied(resumedOk[1], { ...held, errno: resumed[3] })
+        denied(resumedOk[1], { syscall: held.syscall, rawPath: held.rawPath, errno: resumed[3] })
+      } else if (held !== undefined && fd !== null) {
+        const at = readPath(held.dirfd ?? 'AT_FDCWD', held.rawPath, fd[1])
+        if (at !== undefined) {
+          denied(resumedOk[1], { syscall: held.syscall, rawPath: at, errno: '', read: true })
+        }
       }
       continue
     }
@@ -264,6 +308,8 @@ export async function parseStraceViolations(
   logPath: string,
   args: SandboxedRunArgs,
   baselines: { allowRead: readonly string[]; denyRead: readonly string[]; cwd: string },
+  /** `widenedEntries` taken as the task started: no entry, no read parse. */
+  widened: ReadonlyMap<string, ReadonlySet<string>> = new Map(),
 ): Promise<SandboxViolation[]> {
   const text = await Bun.file(logPath).text()
   if (text.length === 0) return []
@@ -281,29 +327,60 @@ export async function parseStraceViolations(
     ),
   )
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
+  // A read under a widened write grant's directory is never refused, so it
+  // is reported when it succeeds: an entry that was there at the start and
+  // no grant covers is an input the key never saw, and so is the
+  // directory's listing while it holds one. The granted files and what the
+  // task made itself stay readable.
+  const written = new Set(args.config.allowWrite.map((p) => toRealPath(absolutize(p))))
+  const undeclared = (abs: string): boolean => {
+    for (const [dir, entries] of widened) {
+      if (abs === dir)
+        return [...entries].some((e) => !isUnderAny(e, written) && !isUnderAny(e, allowAbs))
+      if (!atOrUnder(abs, dir)) continue
+      const top = path.join(dir, path.relative(dir, abs).split(path.sep)[0]!)
+      return entries.has(top) && !isUnderAny(abs, written)
+    }
+    return false
+  }
 
   const seen = new Set<string>()
   const out: SandboxViolation[] = []
-  for (const { syscall, rawPath, errno, dir } of deniedCalls(text, baselines.cwd)) {
+  for (const { syscall, rawPath, errno, dir, read } of deniedCalls(
+    text,
+    baselines.cwd,
+    widened.size > 0,
+  )) {
     const abs = toRealPath(absolutize(rawPath, dir ?? baselines.cwd))
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
     if (isUnderAny(abs, allowAbs)) continue
+    if (read === true && !undeclared(abs)) continue
     const key = `${syscall}|${abs}`
     if (seen.has(key)) continue
     seen.add(key)
-    out.push({
-      line: `${syscall}(${rawPath}) = -1 ${errno}  [${abs}]`,
-      timestamp: new Date(),
-      target: abs,
-      path: abs,
-      // The trace is `-e trace=openat`, and an openat is a read or a
-      // write depending on flags the trace does not carry — so either
-      // list can silence it.
-      ignorable: ['read', 'write'],
-    })
+    out.push(
+      read === true
+        ? {
+            line: `${syscall}(${rawPath}) read under a write grant's directory, granted no read  [${abs}]`,
+            timestamp: new Date(),
+            target: abs,
+            path: abs,
+            ignorable: ['read'],
+          }
+        : {
+            line: `${syscall}(${rawPath}) = -1 ${errno}  [${abs}]`,
+            timestamp: new Date(),
+            target: abs,
+            path: abs,
+            // The trace is `-e trace=openat`, and an openat is a read or a
+            // write depending on flags the trace does not carry — so either
+            // list can silence it.
+            ignorable: ['read', 'write'],
+          },
+    )
   }
   return out
 }

package/src/orchestrator/events.ts

@@ -52,7 +52,12 @@ export interface EventBus {
 }
 
 export function createEventBus(): EventBus {
-  const subscribers: RunEventSubscriber[] = []
+  // Replaced, never mutated: an emit walks the list it started with, so a
+  // subscriber that unsubscribes itself (an embedder's `off()` on
+  // `run:end`) no longer shifts the next one past the event — the terminal
+  // renderer after it missed `run:end` (C-77). A subscriber added during
+  // an emit hears the next event, not this one.
+  let subscribers: readonly RunEventSubscriber[] = []
   return {
     emit(event) {
       // Synchronous, in-subscription-order fan-out. Ordering is part of
@@ -79,10 +84,10 @@ export function createEventBus(): EventBus {
       }
     },
     subscribe(subscriber) {
-      subscribers.push(subscriber)
+      subscribers = [...subscribers, subscriber]
       return () => {
         const i = subscribers.indexOf(subscriber)
-        if (i >= 0) subscribers.splice(i, 1)
+        if (i >= 0) subscribers = subscribers.toSpliced(i, 1)
       }
     },
   }

package/src/orchestrator/execute-task.ts

@@ -493,11 +493,22 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // The local executor keeps its own timer (it signals the process group).
   let timeoutTimer: ReturnType<typeof setTimeout> | undefined
   let timeoutFired = false
+  // The attempt's listener on the run's stop signal, taken off once the
+  // attempt settles. Left on, every task of the run added one: the list
+  // grew to the task count, and each add scans it for a duplicate, ~100 ms
+  // of a 1,000-task cold run.
+  let unlistenStop: (() => void) | undefined
   function requestSignal(): AbortSignal {
     const stop = new AbortController()
     const abort = (): void => stop.abort(args.stopSignal?.reason)
+    unlistenStop?.()
+    unlistenStop = undefined
     if (args.stopSignal?.aborted === true) abort()
-    else args.stopSignal?.addEventListener('abort', abort, { once: true })
+    else if (args.stopSignal !== undefined) {
+      const run = args.stopSignal
+      run.addEventListener('abort', abort, { once: true })
+      unlistenStop = () => run.removeEventListener('abort', abort)
+    }
     if (effectiveTimeout !== undefined) {
       clearTimeout(timeoutTimer)
       timeoutFired = false
@@ -801,6 +812,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       })
       .finally(() => {
         clearTimeout(timeoutTimer)
+        unlistenStop?.()
+        unlistenStop = undefined
         flushMasked()
       })
     endExec()

package/src/orchestrator/run-lock.ts

@@ -240,7 +240,7 @@ async function place(lockDir: string): Promise<string | null> {
   await mkdir(staging)
   try {
     await writeFile(path.join(staging, entry), '')
-    await (WIN32 ? renameWin32(staging, lockDir) : rename(staging, lockDir))
+    await rename(staging, lockDir)
     return entry
   } catch (err) {
     await rm(staging, { recursive: true, force: true })
@@ -250,36 +250,6 @@ async function place(lockDir: string): Promise<string | null> {
   }
 }
 
-const WIN32 = process.platform === 'win32'
-
-/**
- * Windows renames no directory onto another, even an empty one: EPERM
- * where POSIX gives ENOTEMPTY, which read as a refusal and ran every
- * contender unlocked. A name that exists is taken; an empty one (a
- * holder's leave that lost its rmdir) is removed and the rename tried
- * once more, as POSIX's rename onto it would replace it.
- */
-async function renameWin32(staging: string, lockDir: string): Promise<void> {
-  try {
-    await rename(staging, lockDir)
-    return
-  } catch (err) {
-    const code = (err as NodeJS.ErrnoException).code
-    if (code !== 'EPERM' && code !== 'EACCES') throw err
-    const empty = await rmdir(lockDir).then(
-      () => true,
-      () => false,
-    )
-    if (!empty) throw Object.assign(new Error('run lock taken'), { code: 'EEXIST' })
-  }
-  await rename(staging, lockDir).catch((err: NodeJS.ErrnoException) => {
-    if (err.code === 'EPERM' || err.code === 'EACCES') {
-      throw Object.assign(new Error('run lock taken'), { code: 'EEXIST' })
-    }
-    throw err
-  })
-}
-
 /**
  * Unlink one taking's entry, then the directory if that left it empty.
  * Gone already is not an error (another waiter reclaimed it first); a

package/src/orchestrator/sandbox-request.ts

@@ -193,7 +193,7 @@ export async function sandboxRequestFor(
   // character class, so vx's own workspace wall matched nothing (B-65).
   // A `*` or `?` is one too, and its grants matched the project's siblings.
   const home = toRealPath(node.projectDir)
-  if (process.platform !== 'win32' && /[[\]*?]/.test(home)) {
+  if (/[[\]*?]/.test(home)) {
     throw new UserError(
       `exec.sandbox: ${home} holds [, ], * or ?, which the sandbox runtime reads as a ` +
         `pattern, not a name — rename the directory, or run the task without exec.sandbox`,

package/src/util/real-path.ts

@@ -1,11 +1,8 @@
 import { realpathSync } from 'node:fs'
 
 /**
- * A path's canonical spelling. On Windows `realpathSync` keeps an 8.3
- * short name (`C:\Users\RUNNER~1\…`) where git, `fs.promises.realpath`
- * and every other reader say `runneradmin`, so one file had two
- * spellings and a key or a comparison that folds the path split on
- * them (O-16). The native call asks the OS for the final path.
+ * A path's canonical spelling: the OS's own answer for the final path,
+ * so a key or a comparison that folds the path sees one spelling (O-16).
  */
 export function realPath(p: string): string {
   return realpathSync.native(p)

package/src/util/which.ts

@@ -48,13 +48,8 @@ export function executablePath(name: string): string {
 }
 
 /**
- * The argv that runs `script` in the task shell: `sh -c` on Linux and
- * macOS, and Bun's own shell (`bun exec`) on Windows, which ships no `sh`
- * (docs/design/windows-2026-09.md § Decisions 1). Bun's shell reads the
- * same `&&`, `|`, `$(…)` and `VAR=x cmd` syntax that `bun run` uses there.
+ * The argv that runs `script` in the task shell: `sh -c`.
  */
 export function shellArgv(script: string): string[] {
-  return process.platform === 'win32'
-    ? [process.execPath, 'exec', script]
-    : [executablePath('sh'), '-c', script]
+  return [executablePath('sh'), '-c', script]
 }

package/src/workspace/config-cache.ts

@@ -545,6 +545,21 @@ export async function configEvalKeyFromClosure(a: {
   return h.toString(16).padStart(16, '0')
 }
 
+/** `configEvalKeyFromClosure` over identities already in hand; null when one is missing. */
+export function configEvalKeyFromIdentities(a: {
+  closure: readonly string[]
+  identities: ReadonlyMap<string, string>
+  workspaceFingerprint: string
+}): string | null {
+  let h = keySeed(a.workspaceFingerprint)
+  for (const file of a.closure) {
+    const id = a.identities.get(file)
+    if (id === undefined) return null
+    h = xxh3(`${file}\0${id}`, h)
+  }
+  return h.toString(16).padStart(16, '0')
+}
+
 /**
  * Every file a config imports by relative specifier, transitively, outside
  * `node_modules`, the config itself excluded. `vx watch` watches these: a

package/src/workspace/config-schema.ts

@@ -282,7 +282,14 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
     const where = `${configPath}: tasks.${name}`
     assertTaskName(name, configPath)
     if (!task || typeof task !== 'object') {
-      throw new UserError(`${where} must be an object`)
+      // package.json's shape, `name: 'command'`, was refused without the
+      // object that holds the command.
+      const raw: unknown = task
+      throw new UserError(
+        typeof raw === 'string' && raw.trim() !== ''
+          ? `${where} must be an object — a command is { exec: { command: ${JSON.stringify(raw)} } }`
+          : `${where} must be an object`,
+      )
     }
     assertKnownFields(task, TASK_FIELDS, where)
     const exec = (task as { exec?: unknown }).exec

package/src/workspace/migrate-scripts.ts

@@ -343,6 +343,16 @@ function cdsToMembers(script: string, rootDir: string, memberDirs: readonly stri
   return false
 }
 
+/**
+ * The hooks a package's build hides in when it has no `build` script:
+ * react-navigation's twelve packages build in `prepack: bob build`, their
+ * root's `build` (`lerna run prepack`) runs the members and is left out,
+ * and the repo mapped with no build at all.
+ */
+const LIFECYCLE_BUILD_HOOKS = ['prepack', 'prepublishOnly', 'prepublish', 'prepare']
+const BUILDER =
+  /(?:^|[\s;&|(])(?:bob build|tsc|tsup|tsdown|rollup|vite build|babel|unbuild|esbuild|webpack|microbundle|pkgroll|bunchee|preconstruct build)(?:\s|$)/
+
 /** The workspace flags that move a package manager off the package it runs in. */
 const ELSEWHERE_FLAG = /^(-r|--recursive|--filter|-F|--workspaces|-ws|--workspace)(=|$)/
 const DIR_FLAG = /^(-C|--dir|--cwd|--prefix)(?:=(.*))?$/
@@ -481,6 +491,7 @@ export function migrateScripts(
   // and maps.
   const root = metas.length > 1 ? workspaceRootOf(metas) : undefined
   const notes: string[] = []
+  const lifecycleBuilds: [string, string, string][] = []
   // The rest check the whole repo (`lint: oxlint .`, `test: vitest`):
   // `vx run lint` found no project in remix, wagmi or element-plus. Such a
   // script maps onto the root, when the root has a name (vx skips a
@@ -585,6 +596,12 @@ export function migrateScripts(
       return why === null ? [] : [[n, why] as const]
     })
     const names = runnable.filter((n) => taskNameProblem(n) === null)
+    if (meta !== rootMeta && !('build' in scripts)) {
+      const hook = LIFECYCLE_BUILD_HOOKS.find(
+        (h) => typeof scripts[h] === 'string' && BUILDER.test(scripts[h] as string),
+      )
+      if (hook !== undefined) lifecycleBuilds.push([meta.name, hook, scripts[hook] as string])
+    }
     if (runnable.length === 0) continue
     const hasBuild = names.includes('build')
     const has = (n: string): boolean => names.includes(n)
@@ -681,6 +698,13 @@ export function migrateScripts(
       projects.push({ name: meta.name, dir: meta.dir, importLines, tasks })
     }
   }
+  if (lifecycleBuilds.length > 0) {
+    const [name, hook, command] = lifecycleBuilds[0]!
+    const more = lifecycleBuilds.length - 1
+    notes.push(
+      `${lifecycleBuilds.length === 1 ? 'a package builds' : `${lifecycleBuilds.length} packages build`} only in a lifecycle script (\`${hook}: ${command}\` in ${name}${more > 0 ? ` and ${more} more` : ''}), which the package manager runs on pack or install and vx never runs: add a \`build\` script running it and run \`vx init\` again`,
+    )
+  }
   breakBuildCycles(projects, metas)
   pruneOrphanPersistentNotes(projects, PERSISTENT_TODO)
   return {

package/src/workspace/migration.ts

@@ -402,10 +402,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
       for (const f of replaced) report.push(`  ${relPosix(root, f)}`)
     }
   }
-  const firstTask =
-    plan.projects.flatMap((p) => p.tasks.map((t) => t.name)).find((n) => n === 'build') ??
-    plan.projects[0]?.tasks[0]?.name ??
-    'build'
+  const firstTask = nextTask(plan.projects.flatMap((p) => p.tasks))
   // A run of tasks none of which caches is never a hit, and a first try
   // that runs twice to see the cache work saw it run twice.
   if (!cached && [...todos.keys()].some(isCacheTodo)) {
@@ -442,6 +439,25 @@ function inGitWorkTree(root: string): boolean {
   }
 }
 
+/** Names that change the repo or the world rather than check it. */
+const NOT_A_TRY = /^(clean|reset|nuke|release|publish|deploy|version|format|fix)(?:$|[:\-_.])/
+
+/**
+ * The task the `next:` line runs: `build`, else the first task that
+ * neither serves nor changes anything, else the first. react-navigation, whose
+ * packages build in `prepack`, was told `vx run clean --all` (D-105).
+ */
+function nextTask(tasks: readonly GeneratedTask[]): string {
+  const names = tasks.filter((t) => t.task !== null).map((t) => t.name)
+  const fit = tasks.find(
+    (t) =>
+      t.task !== null &&
+      !NOT_A_TRY.test(t.name) &&
+      (t.task['exec'] as { persistent?: unknown } | undefined)?.persistent === undefined,
+  )
+  return names.includes('build') ? 'build' : (fit?.name ?? names[0] ?? 'build')
+}
+
 /**
  * How the user runs vx, for the report's `next:` line. After `npx vx init`
  * or `bunx @vzn/vx init` a bare `vx` is on no PATH (the first-five-minutes

package/src/workspace/package-graph.ts

@@ -60,7 +60,6 @@ export function buildPackageGraph(
   // insurance against a future rule that does depend on it; it is not
   // what the stability rests on.
   const directDeps = new Map<string, string[]>()
-  const reachDeps = new Map<string, string[]>()
   const order = new Map<string, Set<string>>()
   const peers = new Map<string, Set<string>>()
   const sorted = [...projects].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
@@ -128,22 +127,30 @@ export function buildPackageGraph(
       if (!own.has(peer) && !reaches(peer, p.name)) own.add(peer)
     }
   }
-  for (const p of sorted) {
-    const own = order.get(p.name)!
-    directDeps.set(p.name, [...own].sort())
-    reachDeps.set(p.name, [...new Set([...own, ...peers.get(p.name)!])].sort())
-  }
+  for (const p of sorted) directDeps.set(p.name, [...order.get(p.name)!].sort())
 
-  // Reverse adjacency: who declares X as a workspace dep.
+  // REACH and its reverse (who declares X as a workspace dep) are read only
+  // by the transitive questions below, which an unscoped run never asks:
+  // built on the first one, as the closures are.
+  const reachDeps = new Map<string, string[]>()
   const directDependents = new Map<string, string[]>()
-  for (const [name, deps] of reachDeps) {
-    for (const d of deps) {
-      const arr = directDependents.get(d)
-      if (arr) arr.push(name)
-      else directDependents.set(d, [name])
+  let reachBuilt = false
+  const buildReach = (): void => {
+    if (reachBuilt) return
+    reachBuilt = true
+    for (const p of sorted) {
+      const own = order.get(p.name)!
+      reachDeps.set(p.name, [...new Set([...own, ...peers.get(p.name)!])].sort())
+    }
+    for (const [name, deps] of reachDeps) {
+      for (const d of deps) {
+        const arr = directDependents.get(d)
+        if (arr) arr.push(name)
+        else directDependents.set(d, [name])
+      }
     }
+    for (const arr of directDependents.values()) arr.sort()
   }
-  for (const arr of directDependents.values()) arr.sort()
 
   // Set-union DFS closures are O(P²) entries on dense layered graphs
   // (same disease the scheduler's reachOf had — 68 ms at 1090
@@ -224,6 +231,7 @@ export function buildPackageGraph(
     return (name) => {
       const cached = memo.get(name)
       if (cached) return cached
+      buildReach()
       if (closures === undefined) closures = bitsetClosures(edges)
       if (closures === null) {
         const result = reachableFrom(name, edges)