@vzn/vx 0.0.357 → 0.0.359

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.357",
+  "version": "0.0.359",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.357",
-    "@vzn/vx-linux-arm64": "0.0.357",
-    "@vzn/vx-darwin-x64": "0.0.357",
-    "@vzn/vx-darwin-arm64": "0.0.357"
+    "@vzn/vx-linux-x64": "0.0.359",
+    "@vzn/vx-linux-arm64": "0.0.359",
+    "@vzn/vx-darwin-x64": "0.0.359",
+    "@vzn/vx-darwin-arm64": "0.0.359"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/foreign-flags.ts

@@ -572,7 +572,8 @@ export const FOREIGN_VERBS: Readonly<Record<string, string>> = {
   ls: '`turbo ls` is `vx show` here: every project, its directory and its task count',
   query:
     '`turbo query` has no vx form: `vx run <task> --dry=json` prints the planned graph as JSON',
-  reset: '`nx reset` is `vx cache prune` here (or remove the cache directory `vx info` names)',
+  reset:
+    '`nx reset` is `vx cache prune --older-than <age>` here, or remove the cache directory `vx info` names to drop it all',
   daemon: 'vx has no daemon: there is nothing to start or stop',
   login: TURBO_LOGIN,
   logout: TURBO_LOGIN,

package/src/cli/init.ts

@@ -14,9 +14,9 @@ import { PLUGIN_TEMPLATES } from './plugin-templates.js'
 import { isUserError, UserError } from '../util/index.js'
 import {
   applyMigration,
+  discoverProjects,
   findWorkspaceRoot,
   type LoadReads,
-  listProjects,
   loadWorkspace,
   migrateScripts,
   WORKSPACE_CONFIG_FILENAMES,
@@ -74,7 +74,8 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     }
     throw err
   })
-  const metas = await listProjects(await loadWorkspace(root, reads))
+  const nameless: string[] = []
+  const metas = await discoverProjects(await loadWorkspace(root, reads), nameless)
   // `init` reads scripts only; a runner's own config beside them is the
   // richer source (dependsOn, inputs, outputs) and was ignored without a
   // word — the walkthrough on a Turbo repo (2026-09-09) got the scripts'
@@ -106,6 +107,7 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     ),
     source: 'package.json scripts',
     verb: 'vx init',
+    notes: namelessNotes(root, nameless),
     dry: parsed.dry,
     force: parsed.force,
     init: true,
@@ -348,6 +350,35 @@ function firstTask(file: string, runner: 'turbo' | 'nx'): string {
   return first ?? 'build'
 }
 
+/**
+ * A member whose package.json has no `name` is no project, so its scripts
+ * map to nothing, and init said nothing of them (D-106).
+ */
+function namelessNotes(root: string, dirs: readonly string[]): string[] {
+  const withScripts = dirs
+    .filter((dir) => {
+      const scripts = (
+        JSON.parse(readText(path.join(dir, 'package.json')) || '{}') as {
+          scripts?: unknown
+        }
+      ).scripts
+      return (
+        typeof scripts === 'object' &&
+        scripts !== null &&
+        Object.values(scripts).some((v) => typeof v === 'string' && v !== '')
+      )
+    })
+    .map((dir) => path.relative(root, dir).split(path.sep).join('/'))
+    .sort()
+  if (withScripts.length === 0) return []
+  const shown =
+    withScripts.slice(0, 3).join(', ') +
+    (withScripts.length > 3 ? `, and ${withScripts.length - 3} more` : '')
+  return [
+    `not mapped: ${shown} — ${withScripts.length === 1 ? 'its package.json has' : 'their package.json files have'} no "name", and vx names a project by it; give ${withScripts.length === 1 ? 'it one' : 'each one'} and run \`vx init\` again`,
+  ]
+}
+
 /** The root package.json as an object, `{}` when unreadable or not one. */
 async function readRootManifest(root: string): Promise<Record<string, unknown>> {
   const pj: unknown = await Bun.file(path.join(root, 'package.json'))

package/src/orchestrator/prepare.ts

@@ -438,33 +438,6 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // cycle under `vx watch` (item 1029). run() owns both only once this
   // returns.
   try {
-    const gitFilesCache = new GitFilesCache()
-    // Bulk-populate via a single `git ls-files` at the workspace root —
-    // partitions the output by project. Avoids one fork+exec per project
-    // (~5-10ms each on Linux; the dominant cold-start cost on big
-    // monorepos). When any loaded task declares inputs.workspaceFiles,
-    // the enumeration must see every file from the root (no pathspec
-    // scoping) and additionally stores a workspace-wide partition.
-    const usesWorkspaceInputs = [...projects.values()].some((p) =>
-      Object.values(p.config.tasks ?? {}).some(
-        (t) => (t.cache?.inputs.workspaceFiles?.length ?? 0) > 0,
-      ),
-    )
-    const projectDirs = [...projects.values()].map((p) => p.dir)
-    const enumeration = await (git.started ??
-      startGitEnumeration(
-        workspaceRoot,
-        gitPathspecs(workspaceRoot, projectDirs, usesWorkspaceInputs),
-      ))
-    await applyGitEnumeration(
-      enumeration,
-      workspaceRoot,
-      projectDirs,
-      gitFilesCache,
-      usesWorkspaceInputs,
-      localCache,
-    )
-    mark('git enumeration')
     const hashCache = createHashCache()
     const fingerprintWatch = new FingerprintWatch(workspaceRoot, fingerprints, fingerprintsAt)
 
@@ -490,7 +463,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
         workspaceFingerprint,
         fingerprintWatch,
         nestedDirsByProject,
-        gitFilesCache,
+        gitFilesCache: new GitFilesCache(),
         hashCache,
         workspaceProjectCount: projectMetas.length,
         empty:
@@ -545,11 +518,45 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
         )
       }
     }
-    // The graph is built; what follows is the plugins' (graph, key,
-    // schedule). Two rows, so a plugin's key stage reads as its own cost
-    // and not as graph building — a lockfile plugin's 1000 stats per run
-    // hid inside one `prepare (graph)` row until 2026-09-10.
+    // The graph is built; what follows is git's enumeration over its
+    // projects, then the plugins' stages (graph, key, schedule). Separate
+    // rows, so a plugin's key stage reads as its own cost and not as graph
+    // building — a lockfile plugin's 1000 stats per run hid inside one
+    // `prepare (graph)` row until 2026-09-10.
     mark('build graph')
+    const gitFilesCache = new GitFilesCache()
+    // Bulk-populate via a single `git ls-files` at the workspace root —
+    // partitions the output by project. Avoids one fork+exec per project
+    // (~5-10ms each on Linux; the dominant cold-start cost on big
+    // monorepos). When any task in the graph declares inputs.workspaceFiles,
+    // the enumeration must see every file from the root (no pathspec
+    // scoping) and additionally stores a workspace-wide partition.
+    // Over the projects that own a task, not every project loaded: a scoped
+    // run loads its dependency closure for the `^` walk, and a `lint` of one
+    // package walked the whole tree for it (~60 ms of git where one
+    // project's pathspec takes ~7, 1,000 projects). A node a `graph` hook
+    // adds in another project keys through `resolveFiles`' own spawn.
+    const graphDirs = new Set<string>()
+    let usesWorkspaceInputs = false
+    for (const n of nodes.values()) {
+      graphDirs.add(n.projectDir)
+      if ((n.config.cache?.inputs.workspaceFiles?.length ?? 0) > 0) usesWorkspaceInputs = true
+    }
+    const projectDirs = [...graphDirs]
+    const enumeration = await (git.started ??
+      startGitEnumeration(
+        workspaceRoot,
+        gitPathspecs(workspaceRoot, projectDirs, usesWorkspaceInputs),
+      ))
+    await applyGitEnumeration(
+      enumeration,
+      workspaceRoot,
+      projectDirs,
+      gitFilesCache,
+      usesWorkspaceInputs,
+      localCache,
+    )
+    mark('git enumeration')
     if (hasHook(plugins, 'graph')) {
       await applyGraphHooks(plugins, nodes, {
         workspaceRoot,

package/src/orchestrator/run.ts

@@ -41,6 +41,7 @@ import {
   UserError,
   machineParallelism,
   teardownTimeoutMs,
+  secretMask,
 } from '../util/index.js'
 import { keyedProjects } from './keyed-projects.js'
 import { prepareSandbox } from './sandbox-request.js'
@@ -191,6 +192,10 @@ export function shouldShortCircuit(
  * GitHub job summary and a check-run posted over the API verbatim (item
  * 1057). Local history (`vx last`) keeps the whole line, on this machine.
  */
+function maskInvocation(command: string): string {
+  return secretMask([process.env])?.mask(command) ?? command
+}
+
 export function invocationCommand(argv: readonly string[]): string {
   const sep = argv.indexOf('--')
   if (sep === -1) return argv.join(' ')
@@ -1046,7 +1051,10 @@ async function runOnBus(
       endedAtMs,
       totalMs,
       ok,
-      command: options.command ?? process.argv.slice(1).join(' '),
+      // The invocation is stored and `vx last` prints it: a secret passed
+      // after `--` (`-- --token=$NPM_TOKEN`) is masked here as the task's
+      // own output masks it, so cache.db holds no plaintext value.
+      command: maskInvocation(options.command ?? process.argv.slice(1).join(' ')),
       requestedTasks: options.tasks,
       cachePolicy: compactCachePolicy(policy),
       concurrency,

package/src/util/secret-mask.ts

@@ -16,6 +16,22 @@ const SECRET_NAME = /TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL/i
  */
 const NOT_SECRET = /_(FILE|PATH|DIR)$|^GIT_CONFIG_KEY_\d+$/i
 
+/**
+ * Each name's verdict, decided once: every task asks it of the whole
+ * process env (two regex tests a variable, ~10 µs a call at 150 names).
+ * The values are read fresh each time; only the name decides this.
+ */
+const secretNames = new Map<string, boolean>()
+
+function secretNamed(name: string): boolean {
+  let secret = secretNames.get(name)
+  if (secret === undefined) {
+    secret = SECRET_NAME.test(name) && !NOT_SECRET.test(name)
+    secretNames.set(name, secret)
+  }
+  return secret
+}
+
 /**
  * Values shorter than this are not masked: `KEY=1` would mask every `1`
  * in every line, and a value that short is no secret worth the noise.
@@ -51,9 +67,7 @@ export function secretMask(
   }
   for (const source of sources) {
     if (source === undefined) continue
-    for (const name in source) {
-      if (SECRET_NAME.test(name) && !NOT_SECRET.test(name)) add(source[name])
-    }
+    for (const name in source) if (secretNamed(name)) add(source[name])
     for (const name of named) add(source[name])
   }
   if (values.size === 0) return null

package/src/workspace/affected.ts

@@ -700,7 +700,16 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
         (stderr.length > 0 ? `: ${stderr}` : ''),
     )
   }
-  throw new UserError(`git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`)
+  // A shallow clone (CI's checkout fetches one commit by default) has no
+  // HEAD~1 and no base branch: the ref exists, the history does not.
+  const shallow = spawnGitSync(['rev-parse', '--is-shallow-repository'], workspaceRoot, 'pipe')
+  const isShallow = new TextDecoder().decode(shallow.stdout).trim() === 'true'
+  throw new UserError(
+    `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.` +
+      (isShallow
+        ? ' This clone is shallow: fetch the history the base needs (`git fetch --unshallow`, or `fetch-depth: 0` on actions/checkout).'
+        : ''),
+  )
 }
 
 function isDirectory(abs: string): boolean {

package/src/workspace/index.ts

@@ -45,6 +45,7 @@ export {
 } from './config-cache.js'
 export {
   findWorkspaceRoot,
+  discoverProjects,
   listProjects,
   namedProject,
   loadWorkspace,

package/src/workspace/migration.ts

@@ -365,6 +365,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
   } else if (empty) {
     report.push(
       `${verb}: no package.json scripts to turn into tasks.`,
+      ...(args.notes ?? []).map((n) => `note: ${n}`),
       hasWorkspaceFile
         ? `${workspaceName} already exists.`
         : dry
@@ -477,7 +478,9 @@ export function vxInvocation(userAgent: string | undefined, installed: boolean):
     case 'pnpm':
       return installed ? 'pnpm vx' : 'pnpm dlx @vzn/vx'
     case 'yarn':
-      return installed ? 'yarn vx' : 'yarn dlx @vzn/vx'
+      // `dlx` is Yarn 2+; Yarn 1 answers `Command "dlx" not found`.
+      if (installed) return 'yarn vx'
+      return userAgent!.startsWith('yarn/1.') ? 'npx @vzn/vx' : 'yarn dlx @vzn/vx'
     default:
       return 'vx'
   }

package/src/workspace/workspace.ts

@@ -522,6 +522,18 @@ function absent<T>(err: unknown, value: T): T {
 }
 
 export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]> {
+  return discoverProjects(workspace)
+}
+
+/**
+ * `listProjects`, and `nameless` collects each member directory whose
+ * manifest has no `name`: `vx init` names them, since their scripts map to
+ * nothing.
+ */
+export async function discoverProjects(
+  workspace: Workspace,
+  nameless?: string[],
+): Promise<ProjectMeta[]> {
   // Run all package globs concurrently. Disk-bound walks parallelize
   // well; serializing them just stretches the discovery phase by N×.
   const { positive, negative } = splitPackageGlobs(workspace.packageGlobs)
@@ -567,6 +579,7 @@ export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]>
     if (entry === null) continue
     const { dir, pkg, configPath } = entry
     if (!pkg.name) {
+      nameless?.push(dir)
       // A nameless manifest can't be addressed, filtered, or made affected —
       // and vx identifies projects by name, so it simply vanishes. Silent is
       // fine for a dir that declares no tasks; a dir with a vx config was