@vzn/vx 0.0.356 → 0.0.358

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.356",
+  "version": "0.0.358",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.356",
-    "@vzn/vx-linux-arm64": "0.0.356",
-    "@vzn/vx-darwin-x64": "0.0.356",
-    "@vzn/vx-darwin-arm64": "0.0.356"
+    "@vzn/vx-linux-x64": "0.0.358",
+    "@vzn/vx-linux-arm64": "0.0.358",
+    "@vzn/vx-darwin-x64": "0.0.358",
+    "@vzn/vx-darwin-arm64": "0.0.358"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/foreign-flags.ts

@@ -572,7 +572,8 @@ export const FOREIGN_VERBS: Readonly<Record<string, string>> = {
   ls: '`turbo ls` is `vx show` here: every project, its directory and its task count',
   query:
     '`turbo query` has no vx form: `vx run <task> --dry=json` prints the planned graph as JSON',
-  reset: '`nx reset` is `vx cache prune` here (or remove the cache directory `vx info` names)',
+  reset:
+    '`nx reset` is `vx cache prune --older-than <age>` here, or remove the cache directory `vx info` names to drop it all',
   daemon: 'vx has no daemon: there is nothing to start or stop',
   login: TURBO_LOGIN,
   logout: TURBO_LOGIN,

package/src/cli/init.ts

@@ -14,9 +14,9 @@ import { PLUGIN_TEMPLATES } from './plugin-templates.js'
 import { isUserError, UserError } from '../util/index.js'
 import {
   applyMigration,
+  discoverProjects,
   findWorkspaceRoot,
   type LoadReads,
-  listProjects,
   loadWorkspace,
   migrateScripts,
   WORKSPACE_CONFIG_FILENAMES,
@@ -74,7 +74,8 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     }
     throw err
   })
-  const metas = await listProjects(await loadWorkspace(root, reads))
+  const nameless: string[] = []
+  const metas = await discoverProjects(await loadWorkspace(root, reads), nameless)
   // `init` reads scripts only; a runner's own config beside them is the
   // richer source (dependsOn, inputs, outputs) and was ignored without a
   // word — the walkthrough on a Turbo repo (2026-09-09) got the scripts'
@@ -106,6 +107,7 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     ),
     source: 'package.json scripts',
     verb: 'vx init',
+    notes: namelessNotes(root, nameless),
     dry: parsed.dry,
     force: parsed.force,
     init: true,
@@ -348,6 +350,35 @@ function firstTask(file: string, runner: 'turbo' | 'nx'): string {
   return first ?? 'build'
 }
 
+/**
+ * A member whose package.json has no `name` is no project, so its scripts
+ * map to nothing, and init said nothing of them (D-106).
+ */
+function namelessNotes(root: string, dirs: readonly string[]): string[] {
+  const withScripts = dirs
+    .filter((dir) => {
+      const scripts = (
+        JSON.parse(readText(path.join(dir, 'package.json')) || '{}') as {
+          scripts?: unknown
+        }
+      ).scripts
+      return (
+        typeof scripts === 'object' &&
+        scripts !== null &&
+        Object.values(scripts).some((v) => typeof v === 'string' && v !== '')
+      )
+    })
+    .map((dir) => path.relative(root, dir).split(path.sep).join('/'))
+    .sort()
+  if (withScripts.length === 0) return []
+  const shown =
+    withScripts.slice(0, 3).join(', ') +
+    (withScripts.length > 3 ? `, and ${withScripts.length - 3} more` : '')
+  return [
+    `not mapped: ${shown} — ${withScripts.length === 1 ? 'its package.json has' : 'their package.json files have'} no "name", and vx names a project by it; give ${withScripts.length === 1 ? 'it one' : 'each one'} and run \`vx init\` again`,
+  ]
+}
+
 /** The root package.json as an object, `{}` when unreadable or not one. */
 async function readRootManifest(root: string): Promise<Record<string, unknown>> {
   const pj: unknown = await Bun.file(path.join(root, 'package.json'))

package/src/exec/runner.ts

@@ -235,9 +235,23 @@ export function execWrap(command: string): string {
  */
 export function execWord(command: string): string | undefined {
   if (SHELL_CONTROL.test(command)) return undefined
-  const first = command.trimStart().split(/\s+/)[0] ?? ''
-  if (first === '' || first.includes('=') || SHELL_BUILTINS.has(first)) return undefined
-  return first
+  // The word as the shell reads it: quotes group and are removed, so
+  // `"./my tool.sh"` names one file (the verdict looked for `"./my`).
+  const raw = command.trimStart()
+  let first = ''
+  let quote = ''
+  let i = 0
+  for (; i < raw.length; i++) {
+    const c = raw[i]!
+    if (quote !== '') {
+      if (c === quote) quote = ''
+      else first += c
+    } else if (c === "'" || c === '"') quote = c
+    else if (/\s/.test(c)) break
+    else first += c
+  }
+  if (quote !== '' || first === '' || raw.slice(0, i).includes('=')) return undefined
+  return SHELL_BUILTINS.has(first) ? undefined : first
 }
 
 /**

package/src/orchestrator/execute-task.ts

@@ -37,7 +37,7 @@ import {
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { killGraceMs, maskedEmitter, printable, relPosix, secretMask, span } from '../util/index.js'
-import { SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
+import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
   mayWriteFingerprint,
@@ -354,6 +354,22 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     persistentOpts.timeoutMs = effectiveTimeout
   }
 
+  // A stop that landed during the awaits above (the key, the sandbox's
+  // arming, request and wrap) leaves nothing to kill yet: spawned now, the
+  // server came up after the teardown and held the run's exit 7 s.
+  if (args.stopSignal?.aborted === true) {
+    if (bridgeTag !== undefined) releaseBridges(bridgeTag)
+    await placeholderSweeper(placeholders)()
+    return {
+      node,
+      status: 'aborted',
+      // The signal a spawned server would have been sent (a hang-up forwards SIGTERM).
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal.reason)),
+      durationMs: 0,
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   const spawn = runPersistent(persistentOpts)
   // The host side of a port bridge lives exactly as long as the server:
   // released on the child's exit, whether the run tore it down or it died.

package/src/util/secret-mask.ts

@@ -16,6 +16,22 @@ const SECRET_NAME = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL/i
  */
 const NOT_SECRET = /_(FILE|PATH|DIR)$|^GIT_CONFIG_KEY_\d+$/i
 
+/**
+ * Each name's verdict, decided once: every task asks it of the whole
+ * process env (two regex tests a variable, ~10 µs a call at 150 names).
+ * The values are read fresh each time; only the name decides this.
+ */
+const secretNames = new Map<string, boolean>()
+
+function secretNamed(name: string): boolean {
+  let secret = secretNames.get(name)
+  if (secret === undefined) {
+    secret = SECRET_NAME.test(name) && !NOT_SECRET.test(name)
+    secretNames.set(name, secret)
+  }
+  return secret
+}
+
 /**
  * Values shorter than this are not masked: `KEY=1` would mask every `1`
  * in every line, and a value that short is no secret worth the noise.
@@ -51,9 +67,7 @@ export function secretMask(
   }
   for (const source of sources) {
     if (source === undefined) continue
-    for (const name in source) {
-      if (SECRET_NAME.test(name) && !NOT_SECRET.test(name)) add(source[name])
-    }
+    for (const name in source) if (secretNamed(name)) add(source[name])
     for (const name of named) add(source[name])
   }
   if (values.size === 0) return null

package/src/workspace/affected.ts

@@ -700,7 +700,16 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
         (stderr.length > 0 ? `: ${stderr}` : ''),
     )
   }
-  throw new UserError(`git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`)
+  // A shallow clone (CI's checkout fetches one commit by default) has no
+  // HEAD~1 and no base branch: the ref exists, the history does not.
+  const shallow = spawnGitSync(['rev-parse', '--is-shallow-repository'], workspaceRoot, 'pipe')
+  const isShallow = new TextDecoder().decode(shallow.stdout).trim() === 'true'
+  throw new UserError(
+    `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.` +
+      (isShallow
+        ? ' This clone is shallow: fetch the history the base needs (`git fetch --unshallow`, or `fetch-depth: 0` on actions/checkout).'
+        : ''),
+  )
 }
 
 function isDirectory(abs: string): boolean {

package/src/workspace/index.ts

@@ -45,6 +45,7 @@ export {
 } from './config-cache.js'
 export {
   findWorkspaceRoot,
+  discoverProjects,
   listProjects,
   namedProject,
   loadWorkspace,

package/src/workspace/migration.ts

@@ -365,6 +365,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
   } else if (empty) {
     report.push(
       `${verb}: no package.json scripts to turn into tasks.`,
+      ...(args.notes ?? []).map((n) => `note: ${n}`),
       hasWorkspaceFile
         ? `${workspaceName} already exists.`
         : dry
@@ -477,7 +478,9 @@ export function vxInvocation(userAgent: string | undefined, installed: boolean):
     case 'pnpm':
       return installed ? 'pnpm vx' : 'pnpm dlx @vzn/vx'
     case 'yarn':
-      return installed ? 'yarn vx' : 'yarn dlx @vzn/vx'
+      // `dlx` is Yarn 2+; Yarn 1 answers `Command "dlx" not found`.
+      if (installed) return 'yarn vx'
+      return userAgent!.startsWith('yarn/1.') ? 'npx @vzn/vx' : 'yarn dlx @vzn/vx'
     default:
       return 'vx'
   }

package/src/workspace/workspace.ts

@@ -522,6 +522,18 @@ function absent<T>(err: unknown, value: T): T {
 }
 
 export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]> {
+  return discoverProjects(workspace)
+}
+
+/**
+ * `listProjects`, and `nameless` collects each member directory whose
+ * manifest has no `name`: `vx init` names them, since their scripts map to
+ * nothing.
+ */
+export async function discoverProjects(
+  workspace: Workspace,
+  nameless?: string[],
+): Promise<ProjectMeta[]> {
   // Run all package globs concurrently. Disk-bound walks parallelize
   // well; serializing them just stretches the discovery phase by N×.
   const { positive, negative } = splitPackageGlobs(workspace.packageGlobs)
@@ -567,6 +579,7 @@ export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]>
     if (entry === null) continue
     const { dir, pkg, configPath } = entry
     if (!pkg.name) {
+      nameless?.push(dir)
       // A nameless manifest can't be addressed, filtered, or made affected —
       // and vx identifies projects by name, so it simply vanishes. Silent is
       // fine for a dir that declares no tasks; a dir with a vx config was