@vzn/vx 0.0.359 → 0.0.361

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.359",
+  "version": "0.0.361",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.359",
-    "@vzn/vx-linux-arm64": "0.0.359",
-    "@vzn/vx-darwin-x64": "0.0.359",
-    "@vzn/vx-darwin-arm64": "0.0.359"
+    "@vzn/vx-linux-x64": "0.0.361",
+    "@vzn/vx-linux-arm64": "0.0.361",
+    "@vzn/vx-darwin-x64": "0.0.361",
+    "@vzn/vx-darwin-arm64": "0.0.361"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -6,10 +6,10 @@
 // task declared. Nothing here reads a config or applies a boundary.
 
 import path from 'node:path'
-import { existsSync, lstatSync, readdirSync, realpathSync } from 'node:fs'
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { UserError, executablePath, gitSpawnRefusal } from '../util/index.js'
 
-/** Three facts of the repository a directory is in, from one `git rev-parse`. */
+/** Three facts of the repository a directory is in: read off the disk, or one `git rev-parse`. */
 export interface RepoFacts {
   /** `--show-prefix`: the directory's path below the worktree root, `''` at the root. */
   prefix: string
@@ -32,6 +32,11 @@ const repoFactsMemo = new Map<string, RepoFacts>()
 export function repoFacts(dir: string): RepoFacts | null {
   const hit = repoFactsMemo.get(dir)
   if (hit !== undefined) return hit
+  const read = repoFactsFromDisk(dir)
+  if (read !== undefined) {
+    repoFactsMemo.set(dir, read)
+    return read
+  }
   let proc
   try {
     proc = Bun.spawnSync({
@@ -66,6 +71,75 @@ export function repoFacts(dir: string): RepoFacts | null {
   return facts
 }
 
+/** Variables that move where git finds the repository: with any set, git is asked. */
+const GIT_LOCATION_ENV = [
+  'GIT_DIR',
+  'GIT_WORK_TREE',
+  'GIT_COMMON_DIR',
+  'GIT_CEILING_DIRECTORIES',
+  'GIT_DISCOVERY_ACROSS_FILESYSTEM',
+]
+
+/**
+ * `repoFacts` for the plain case, read off the disk: the nearest `.git`
+ * DIRECTORY above `dir` (resolved as git resolves its cwd), on the same
+ * file system, holding a `HEAD`, and its config's object format. The
+ * spawn it saves was ~3 ms of every run, synchronous. Undefined — ask
+ * git — for anything else: a `.git` file (a linked worktree, a
+ * submodule), a location variable, an include in the config, a format it
+ * cannot read, no repository at all.
+ */
+function repoFactsFromDisk(dir: string): RepoFacts | undefined {
+  if (GIT_LOCATION_ENV.some((name) => process.env[name] !== undefined)) return undefined
+  try {
+    const real = realpathSync(dir)
+    const dev = lstatSync(real).dev
+    for (let at = real; ;) {
+      const dotGit = path.join(at, '.git')
+      const st = lstatSync(dotGit, { throwIfNoEntry: false })
+      if (st !== undefined) {
+        if (!st.isDirectory() || !existsSync(path.join(dotGit, 'HEAD'))) return undefined
+        const objectFormat = configObjectFormat(readFileSync(path.join(dotGit, 'config'), 'utf8'))
+        if (objectFormat === undefined) return undefined
+        const below = path.relative(at, real).split(path.sep).join('/')
+        return {
+          prefix: below === '' ? '' : `${below}/`,
+          commonDir: path.relative(real, dotGit).split(path.sep).join('/'),
+          objectFormat,
+        }
+      }
+      const parent = path.dirname(at)
+      if (parent === at || lstatSync(parent).dev !== dev) return undefined
+      at = parent
+    }
+  } catch {
+    return undefined
+  }
+}
+
+/** `[extensions] objectFormat` of a repository config, sha1 when unset; undefined when unsure. */
+function configObjectFormat(config: string): 'sha1' | 'sha256' | undefined {
+  let section = ''
+  let format: 'sha1' | 'sha256' = 'sha1'
+  for (const raw of config.split('\n')) {
+    const line = raw.trim()
+    if (line === '' || line.startsWith('#') || line.startsWith(';')) continue
+    const head = /^\[\s*([A-Za-z0-9.-]+)/.exec(line)
+    if (head !== null) {
+      section = head[1]!.toLowerCase()
+      if (section === 'include' || section === 'includeif') return undefined
+      continue
+    }
+    if (section !== 'extensions') continue
+    const kv = /^([A-Za-z0-9-]+)\s*=\s*(.*)$/.exec(line)
+    if (kv === null || kv[1]!.toLowerCase() !== 'objectformat') continue
+    const value = kv[2]!.toLowerCase()
+    if (value === 'sha256' || value === 'sha1') format = value
+    else return undefined
+  }
+  return format
+}
+
 export class GitFilesCache extends Map<string, readonly string[]> {
   private changed = new Map<string, string[]>()
   /**

package/src/cache/inputs.ts

@@ -1179,7 +1179,18 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // claims as an input. See the refusal below for why this is not simply
   // honoured instead.
   const unmatchedLiterals = new Set(plan.literals)
-  // First pass: glob-filter to candidate absolute paths (no I/O).
+  // First pass: glob-filter to candidate absolute paths (no I/O). Git
+  // prints normalized relative paths, so under an absolute, normalized
+  // project dir a join is a concatenation: `path.resolve` per file was
+  // ~27 ms of a 900-task, 12,000-file warm run (I-30).
+  const base =
+    path.sep === '/' &&
+    path.isAbsolute(args.projectDir) &&
+    path.normalize(args.projectDir) === args.projectDir
+      ? args.projectDir.endsWith('/')
+        ? args.projectDir
+        : `${args.projectDir}/`
+      : undefined
   const candidates: string[] = []
   const verdicts = plan.verdicts
   for (const rel of gitFiles) {
@@ -1193,7 +1204,7 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
       verdicts.set(rel, input)
     }
     if (!input || nested(rel)) continue
-    candidates.push(path.resolve(args.projectDir, rel))
+    candidates.push(base === undefined ? path.resolve(args.projectDir, rel) : base + rel)
   }
   if (unmatchedLiterals.size > 0) {
     await assertNoInvisibleLiteralInputs(unmatchedLiterals, args.projectDir, 'files')
@@ -1206,7 +1217,15 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // `git ls-files -s` can surface staged entries whose working-tree
   // file is gone; the hasher would otherwise throw ENOENT.
   const oids = args.gitFilesCache?.oidsFor(args.projectDir)
-  const resolved = candidates.filter((abs) => oids?.has(abs) === true || isInputOnDisk(abs)).sort()
+  const resolved = candidates.filter((abs) => oids?.has(abs) === true || isInputOnDisk(abs))
+  // Git's slice comes sorted and a common prefix keeps it so: one pass
+  // proves it instead of a sort per task.
+  for (let i = 1; i < resolved.length; i++) {
+    if (resolved[i - 1]! > resolved[i]!) {
+      resolved.sort()
+      break
+    }
+  }
   // Stored only on the way out: a declaration whose literal named an
   // invisible file threw above, and every task sharing it must throw too.
   args.projectFilesCache?.set(memoKey, { snapshot: gitFiles, result: resolved })

package/src/exec/runner.ts

@@ -4,7 +4,7 @@
 // process exits. cpuMs / peakRssBytes are then surfaced on RunResult and
 // folded into the v11 `runs` table by the orchestrator.
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
 import {
   shellArgv,
@@ -769,15 +769,23 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
  * `true` read 44 MB through vx while its shell's `VmHWM` was 1.9 MB, and
  * 300 MB allocated in the parent made `true` read 328 MB (2026-09-12).
  * Read after the child exits so it covers the whole task's span (the mark
- * is monotonic). Linux reads its own peak (`getrusage`); elsewhere the
- * current RSS is the bound in hand.
+ * is monotonic). Linux reads `VmHWM`; elsewhere the current RSS is the
+ * bound in hand.
  */
 export function ownRssHighWater(): number {
-  // getrusage's own peak, not `/proc/self/status`'s `VmHWM`: one syscall
-  // where generating and parsing the status file was ~20 µs a task alone
-  // and ~70 ms of a 1,000-task cold run. It is the same mark, raised only
-  // by the image this one exec'd from (a shell), within the floor's slack.
-  if (process.platform === 'linux') return peakRssBytes(process.resourceUsage().maxRSS)
+  // `VmHWM`, not getrusage's own peak: that one also holds the peak of the
+  // image this process exec'd from, which under vfork is the PARENT's
+  // memory — vx spawned from a 300 MB test runner (or node) read a floor
+  // of 300 MB, and a task holding 150 MB reported no peak (I-40's
+  // regression, tests/own-rss-high-water.test.ts).
+  if (process.platform === 'linux') {
+    try {
+      const m = /VmHWM:\s+(\d+) kB/.exec(readFileSync('/proc/self/status', 'utf8'))
+      if (m !== null) return Number(m[1]) * 1024
+    } catch {
+      // /proc unreadable: fall through to the current RSS.
+    }
+  }
   return process.memoryUsage.rss()
 }
 

package/src/exec/sandbox-runtime.ts

@@ -33,6 +33,7 @@ import {
   existsSync,
   mkdirSync,
   openSync,
+  readFileSync,
   readlinkSync,
   realpathSync,
   rmSync,
@@ -60,6 +61,7 @@ import {
   executablePath,
   grantPrefix,
   isTmpdirRefusal,
+  procfsIsOwn,
   TMPDIR_HINT,
   UserError,
   xxh3hex,
@@ -492,6 +494,22 @@ function bundledJavaAgent(): { javaAgentJarPath?: string } {
 /** Whether this run's SRT scans at depth 1 and vx supplies the task-scoped denies (B-40). */
 let scopedDenyScan = false
 
+/**
+ * SRT's own deny scan, when `wrapSandboxedCommand` walks each task's write
+ * grants (B-40): none. SRT spawns its ripgrep on every wrap, and at depth
+ * 1 the scan finds only the root's entries, which SRT keeps only inside a
+ * write grant, where the scoped walk already reaches (the parity rows in
+ * `sandbox-deny-scan.unsafe.test.ts`). A no-op in rg's place ends the
+ * spawn's 3.8 ms at 1.0; SRT has no way to skip it.
+ */
+function scopedScanConfig(): { mandatoryDenySearchDepth: number; ripgrep?: { command: string } } {
+  try {
+    return { mandatoryDenySearchDepth: 1, ripgrep: { command: executablePath('true') } }
+  } catch {
+    return { mandatoryDenySearchDepth: 1 }
+  }
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -577,9 +595,7 @@ export async function initSandbox(opts?: {
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
     ignoreViolations: DEFAULT_IGNORE_VIOLATIONS,
     ...linuxToolPaths(),
-    // SRT's own scan walks only the root's entries; `wrapSandboxedCommand`
-    // walks each task's write grants for the rest (B-40).
-    ...(scopedDenyScan ? { mandatoryDenySearchDepth: 1 } : {}),
+    ...(scopedDenyScan ? scopedScanConfig() : {}),
     ...bundledJavaAgent(),
   }
   if (!srtUp) await unlinkStaleMuxSockets()
@@ -1053,7 +1069,10 @@ export async function wrapSandboxedCommand(
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   if (args.server === true) liveServers.add(tag)
-  if (ports.length > 0) spawnHostBridges(ports, tag)
+  if (ports.length > 0) {
+    spawnHostBridges(ports, tag)
+    await hostBridgesListen(ports, tag)
+  }
   return {
     wrapped,
     tag,
@@ -1306,12 +1325,47 @@ const hostBridges = new Map<
   { ports: readonly number[]; procs: Array<ReturnType<typeof Bun.spawn>> }
 >()
 
+/**
+ * Wait until each host-side bridge listens on its port, so a server that
+ * says it is ready inside the sandbox is reachable on the host: the socat
+ * starts asynchronously, and a held server's port refused a connection
+ * right after its ready line under I/O load (M-22). Read off
+ * /proc/net/tcp (127.0.0.1, state 0A); skipped where /proc is not this
+ * process's (its net table could be another namespace's), ended early by
+ * a bridge that exited (a port already taken), and bounded at 5 s.
+ */
+async function hostBridgesListen(ports: readonly number[], tag: string): Promise<void> {
+  if (!procfsIsOwn()) return
+  const want = ports.map((p) => `0100007F:${p.toString(16).toUpperCase().padStart(4, '0')}`)
+  const procs = hostBridges.get(tag)?.procs ?? []
+  const until = Date.now() + 5_000
+  while (Date.now() < until && procs.every((p) => p.exitCode === null)) {
+    let table: string
+    try {
+      table = readFileSync('/proc/net/tcp', 'utf8')
+    } catch {
+      return
+    }
+    const listening = new Set<string>()
+    for (const line of table.split('\n')) {
+      const f = line.trim().split(/\s+/)
+      if (f[3] === '0A' && f[1] !== undefined) listening.add(f[1])
+    }
+    if (want.every((w) => listening.has(w))) return
+    await Bun.sleep(5)
+  }
+}
+
 function spawnHostBridges(ports: readonly number[], tag: string): void {
   const procs: Array<ReturnType<typeof Bun.spawn>> = []
   for (const p of ports) {
     // A spawn failure (no socat on the host) is the task's to report:
     // its own side dies the same way, in its frame.
     try {
+      // socat resolved on vx's PATH, as every tool vx spawns: by bare name
+      // Bun.spawn walked the startup PATH (M-22).
+      const [tool, ...rest] = portBridgeHostArgv(tag, p)
+      const argv = [executablePath(tool!), ...rest]
       // Guarded, in a group of its own (kill-tree.ts): a plain child of vx
       // was in no group the guard lists, and a `kill -9` of vx left it
       // listening on the port under init, where the next run's bridge
@@ -1319,7 +1373,7 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
       procs.push(
         spawnGuarded((guard) =>
           guard === undefined
-            ? Bun.spawn(portBridgeHostArgv(tag, p), {
+            ? Bun.spawn(argv, {
                 stdio: ['ignore', 'ignore', 'ignore'],
                 detached: true,
               })
@@ -1327,7 +1381,7 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
                 [
                   executablePath('sh'),
                   '-c',
-                  `${guardLine(3)}exec ${portBridgeHostArgv(tag, p).map(shellQuote).join(' ')}`,
+                  `${guardLine(3)}exec ${argv.map(shellQuote).join(' ')}`,
                 ],
                 { stdio: ['ignore', 'ignore', 'ignore', guard], detached: true },
               ),

package/src/exec/sandbox-violations.ts

@@ -41,10 +41,16 @@ import type {
  */
 const SYSCALLS = 'openat|access|statx|newfstatat'
 const QUOTED = '"((?:[^"\\\\]|\\\\.)+)"'
+// The directory descriptor a call names, `-y`'s path included: taken up to
+// the `, "` that opens the path argument, since a directory's name may hold
+// a quote (`4</ws/q"d>`).
+const DIRFD = '(?:AT_FDCWD|\\d+)(?:<.*?>)?, '
 const STRACE_DONE_RE = new RegExp(
-  `^(\\d+)\\s+(${SYSCALLS})\\([^"]*${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+)
+const STRACE_UNFINISHED_RE = new RegExp(
+  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*<unfinished`,
 )
-const STRACE_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+(${SYSCALLS})\\([^"]*${QUOTED}[^)]*<unfinished`)
 const STRACE_RESUMED_RE = new RegExp(
   `^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
@@ -57,10 +63,10 @@ const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) res
  */
 const READ_FLAGS = '(?![A-Z_|]*O_WRONLY)[A-Z_|]+'
 const OPEN_READ_RE = new RegExp(
-  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<[^"]*>)?, ${QUOTED}, ${READ_FLAGS}[^)]*\\)\\s*=\\s*\\d+(?:<(.*)>)?$`,
+  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<.*?>)?, ${QUOTED}, ${READ_FLAGS}[^)]*\\)\\s*=\\s*\\d+(?:<(.*)>)?$`,
 )
 const OPEN_READ_UNFINISHED_RE = new RegExp(
-  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<[^"]*>)?, ${QUOTED}, ${READ_FLAGS}.*<unfinished`,
+  `^(\\d+)\\s+openat\\((AT_FDCWD|\\d+)(?:<.*?>)?, ${QUOTED}, ${READ_FLAGS}.*<unfinished`,
 )
 const RESUMED_FD_RE = /resumed>.*\)\s*=\s*\d+(?:<(.*)>)?$/
 

package/src/orchestrator/logger.ts

@@ -517,8 +517,9 @@ export function defaultLogger(
       // output / only failed tasks print), so they stay silent — the tail
       // is still captured and still bounded, just never printed. Guarded
       // like the failures below: run() calls runEnd twice on the success
-      // path (once before the summary, once in its finally), and a
-      // kept-alive child keeps writing between the two.
+      // path (once before the summary, once in its finally), and though the
+      // bus delivers `run:end` once (`busLogger`), a renderer an embedder
+      // drives directly may hear both.
       if (flushedPersistent) flushKept()
       if (!flushedPersistent) {
         flushedPersistent = true

package/src/orchestrator/options.ts

@@ -211,9 +211,9 @@ export interface RunOptions {
    */
   inflight?: Map<string, Promise<void>>
   /**
-   * `--tag k=v` pairs (Tier-3). Persisted verbatim on the run's
-   * `invocations` row (JSON object) so dashboards can filter runs by
-   * label. CLI parsing is the CLI's job; the orchestrator just records.
+   * `--tag k=v` pairs (Tier-3). Persisted on the run's `invocations`
+   * row (JSON object) so dashboards can filter runs by label, a secret
+   * value masked (L-38). CLI parsing is the CLI's job.
    */
   tags?: Record<string, string>
   /**

package/src/orchestrator/plugin-host.ts

@@ -443,22 +443,20 @@ const executorPlugin = new WeakMap<TaskExecutor, string>()
 /**
  * A plugin executor's throw from `execute`, named as every other hook's
  * is: `plugin 'p' (executor 'e') failed in execute: …`. It read `internal
- * error in <task>: pool down`, naming neither (C-63). The error itself is
- * kept, its class, cause and code with it, so the scheduler still tells a
- * refusal from a bug; the floor's own throw is vx's and stays as it is.
+ * error in <task>: pool down`, naming neither (C-63). A refusal, as
+ * `safe()` makes every stage's throw: the plugin is named, so it is not
+ * vx's bug, and an `internal error` line said it was (C-85). A fresh error
+ * with the plugin's as its cause, never the plugin's own renamed: one
+ * error an executor rejects every task with was named once per task
+ * (C-74). The floor's own throw is vx's and stays as it is.
  */
 export function nameExecutorFailure(executor: TaskExecutor, err: unknown): unknown {
-  if (!(err instanceof Error) || !executorPlugin.has(executor)) return err
-  // Once: one error an executor rejects several tasks with (a failed
-  // connection it memoized) reaches here once per task (C-74).
-  const prefix = `${executorLabel(executor)} failed in execute: `
-  if (err.message.startsWith(prefix)) return err
-  try {
-    err.message = `${prefix}${err.message}`
-  } catch {
-    // A frozen error keeps its own words.
-  }
-  return err
+  if (!executorPlugin.has(executor)) return err
+  const named = new UserError(
+    `${executorLabel(executor)} failed in execute: ${err instanceof Error ? err.message : String(err)}`,
+  )
+  named.cause = err
+  return named
 }
 
 /** How a message names `executor`: its plugin and its own name, or its name alone (the floor). */
@@ -539,7 +537,7 @@ export async function teardownPlugins(
       }
     } catch (err) {
       warn(
-        `[vx] plugin '${plugin.name}' teardown failed: ${err instanceof Error ? err.message : String(err)}`,
+        `[vx] plugin '${plugin.name}' failed in teardown: ${err instanceof Error ? err.message : String(err)}`,
       )
     }
   }

package/src/orchestrator/run-context.ts

@@ -109,7 +109,7 @@ export function captureGitContext(
  * about the layout is unfamiliar (the caller then spawns git). Handles a
  * `.git` directory, a `.git` FILE (`gitdir: …` — a linked worktree, whose
  * refs live under `commondir`), a symbolic HEAD, a detached HEAD, loose refs
- * and `packed-refs`.
+ * and `packed-refs`. A reftable repository is always null.
  */
 function readHeadDirect(
   workspaceRoot: string,
@@ -127,6 +127,16 @@ function readHeadDirect(
     if (fs.existsSync(commonFile)) {
       commonDir = path.resolve(gitDir, fs.readFileSync(commonFile, 'utf8').trim())
     }
+    // Reftable storage (`git init --ref-format=reftable`, git 2.45): HEAD
+    // names `refs/heads/.invalid` and the refs live in `reftable/`, so the
+    // files say nothing true about HEAD. A leftover `packed-refs` there was
+    // read as the answer; git is asked instead.
+    if (
+      fs.existsSync(path.join(gitDir, 'reftable')) ||
+      fs.existsSync(path.join(commonDir, 'reftable'))
+    ) {
+      return null
+    }
     const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim()
     const SHA = /^[0-9a-f]{40,64}$/
     if (SHA.test(head)) return { commitSha: head, branch: null }

package/src/orchestrator/run.ts

@@ -185,6 +185,21 @@ export function shouldShortCircuit(
   return nodes.size > 0
 }
 
+function maskInvocation(command: string): string {
+  return secretMask([process.env])?.mask(command) ?? command
+}
+
+/**
+ * A run's `--tag`s, stored on its history row and handed to telemetry
+ * (`vx.tag.<key>`): a tag that carries a secret is masked as the
+ * invocation line that spells it is (L-38).
+ */
+function maskTags(tags: Readonly<Record<string, string>>): Record<string, string> {
+  const mask = secretMask([process.env])
+  if (mask === null) return { ...tags }
+  return Object.fromEntries(Object.entries(tags).map(([k, v]) => [mask.mask(k), mask.mask(v)]))
+}
+
 /**
  * The command line a run hands to its telemetry sinks, with what follows
  * `--` counted, not quoted. Those are the task's arguments,
@@ -192,10 +207,6 @@ export function shouldShortCircuit(
  * GitHub job summary and a check-run posted over the API verbatim (item
  * 1057). Local history (`vx last`) keeps the whole line, on this machine.
  */
-function maskInvocation(command: string): string {
-  return secretMask([process.env])?.mask(command) ?? command
-}
-
 export function invocationCommand(argv: readonly string[]): string {
   const sep = argv.indexOf('--')
   if (sep === -1) return argv.join(' ')
@@ -208,15 +219,50 @@ export function invocationCommand(argv: readonly string[]): string {
  * (C-61): a `concurrency` of 0, a negative or NaN left no worker slot and
  * the run waited for good; a `retries` of NaN retried a failing task
  * without end; a `timeout` of 0, a negative, NaN or past the timer's range
- * killed every task at once.
+ * killed every task at once. And the words and shapes the CLI parses
+ * (C-86): a `continueMode` of `'sometimes'` ran as `deps-ok`, so a typo
+ * lost fail-fast without a word; a string `excludeDependencies` dropped
+ * nothing; a `projects` string or a `signal` that is no AbortSignal died
+ * a TypeError inside the run.
  */
-function refuseRunNumbers(options: RunOptions): void {
-  const refuse = (name: string, value: number, rule: string): never => {
-    throw new UserError(`RunOptions.${name} is ${String(value)}: it must be ${rule}`)
+function refuseRunOptions(options: RunOptions): void {
+  const refuse = (name: string, value: unknown, rule: string): never => {
+    const shown =
+      typeof value === 'string'
+        ? JSON.stringify(value)
+        : typeof value === 'number'
+          ? String(value)
+          : value === null
+            ? 'null'
+            : Array.isArray(value)
+              ? 'an array'
+              : typeof value === 'object'
+                ? 'an object'
+                : `a ${typeof value}`
+    throw new UserError(`RunOptions.${name} is ${shown}: it must be ${rule}`)
   }
+  const names = (v: unknown): boolean => Array.isArray(v) && v.every((s) => typeof s === 'string')
+  if (!names(options.tasks)) refuse('tasks', options.tasks, 'an array of task names')
   // No task named read "No projects declare task(s): ." (C-61).
   if (options.tasks.length === 0 || options.tasks.includes(''))
     throw new UserError(`RunOptions.tasks names no task: give at least one task name`)
+  if (options.projects !== undefined && !names(options.projects))
+    refuse('projects', options.projects, 'an array of project names')
+  if (options.forwardArgs !== undefined && !names(options.forwardArgs))
+    refuse('forwardArgs', options.forwardArgs, 'an array of strings')
+  const oneOf = (name: string, value: unknown, words: readonly string[]): void => {
+    if (value !== undefined && !words.includes(value as string))
+      refuse(name, value, `one of ${words.map((w) => `'${w}'`).join(', ')}`)
+  }
+  oneOf('continueMode', options.continueMode, ['never', 'deps-ok', 'always'])
+  oneOf('outputLogs', options.outputLogs, ['full', 'errors-only', 'none', 'hash-only'])
+  oneOf('download', options.download, ['all', 'toplevel', 'none'])
+  oneOf('flow', options.flow, ['focused', 'broad'])
+  const exclude = options.excludeDependencies
+  if (exclude !== undefined && exclude !== 'all' && !names(exclude))
+    refuse('excludeDependencies', exclude, "'all' or an array of task names")
+  if (options.signal !== undefined && !(options.signal instanceof AbortSignal))
+    refuse('signal', options.signal, 'an AbortSignal')
   const { concurrency, retries, timeout } = options
   if (concurrency !== undefined && !(Number.isInteger(concurrency) && concurrency > 0))
     refuse('concurrency', concurrency, 'a positive integer')
@@ -230,7 +276,7 @@ function refuseRunNumbers(options: RunOptions): void {
 }
 
 export async function run(options: RunOptions): Promise<RunSummary> {
-  refuseRunNumbers(options)
+  refuseRunOptions(options)
   // Color decision: a custom logger (tests, embedders) handles its
   // own formatting and asserts on plain strings, so we suppress
   // ANSI escapes for them. Only the defaultLogger (real terminal
@@ -663,7 +709,7 @@ async function runOnBus(
         arch: hostContext.arch,
         workspaceId: wsIdentity.id,
         workspaceName: wsIdentity.name,
-        tags: options.tags ?? {},
+        tags: maskTags(options.tags ?? {}),
       }
       telemetry = await subscribeTelemetry(
         prepared.plugins,
@@ -1060,7 +1106,7 @@ async function runOnBus(
       concurrency,
       flow: options.flow ?? null,
       forwardArgs: options.forwardArgs,
-      tags: options.tags ?? {},
+      tags: maskTags(options.tags ?? {}),
       git: gitContext,
       ci: ciContext,
       host: hostContext,
@@ -1148,6 +1194,11 @@ async function runOnBus(
     // Not on a stopped run: one stopped while it waited on another run's
     // lock never held it, and its prune evicted under that run (item 858).
     if (!stopRun.signal.aborted) await applyCacheRetention(prepared, log)
+    // A plugin hears the run until its teardown and nothing after: released
+    // only in the finally, its handlers heard a kept server through the
+    // whole keep-alive wait below (C-66). Idempotent; the finally's stay.
+    disposePlugins?.()
+    telemetry?.dispose()
     await teardown()
     await closeCache()
     mark('close')
@@ -1302,6 +1353,7 @@ async function applyCacheRetention(prepared: PreparedRun, log: Logger): Promise<
  * existence check — no artifact download, no ingest, no accessed_at bump.
  */
 export async function planRun(options: RunOptions): Promise<RunPlan> {
+  refuseRunOptions(options)
   // The plan is the product and goes to stdout (`--dry=json` is parsed):
   // what a stage says on the way goes to stderr (C-6).
   const log = options.log ?? defaultLogger(undefined, undefined, process.stderr)

package/src/workspace/migrate-scripts.ts

@@ -237,6 +237,89 @@ function isWatcher(name: string, command: string): boolean {
   )
 }
 
+/** A server run alone (`serve website`, `http-server`), or a tool's own server verb. */
+const SERVERS = new Set(['serve', 'http-server', 'live-server', 'sirv', 'webpack-dev-server'])
+const SERVER_TOOLS = new Set([
+  'vite',
+  'next',
+  'astro',
+  'nuxt',
+  'nuxi',
+  'remix',
+  'react-router',
+  'docusaurus',
+  'storybook',
+  'netlify',
+  'wrangler',
+  'webpack',
+  'expo',
+  'react-native',
+])
+const SERVER_VERBS = new Set(['dev', 'serve', 'start', 'preview'])
+const LAUNCHERS = new Set(['cross-env', 'npx', 'bunx', 'exec', 'dlx'])
+
+/**
+ * A command that runs a server (D-91): docusaurus's `serve website` and
+ * `netlify dev` mapped as one-shot tasks, so a dependent waited forever and
+ * a server that exits on stdin EOF ended at once. Read per `&&` segment,
+ * past env assignments and launchers; a quoted string is another tool's
+ * argument (`start-server-and-test 'vite preview' …` exits).
+ */
+function servesCommand(command: string): boolean {
+  for (const segment of foreground(command.replace(/"[^"]*"|'[^']*'/g, ' '))) {
+    const words = segment
+      .trim()
+      .split(/\s+/)
+      .filter((w) => w !== '')
+    let i = 0
+    while (
+      i < words.length &&
+      (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]!) ||
+        LAUNCHERS.has(words[i]!) ||
+        words[i]!.startsWith('-') ||
+        (/^(pnpm|npm|yarn)$/.test(words[i]!) && LAUNCHERS.has(words[i + 1] ?? '')))
+    ) {
+      // A launcher's `--package <name>` / `-p <name>` names what to install,
+      // not the program: docusaurus's `pnpm dlx --package netlify-cli netlify
+      // dev` read `netlify-cli` as the program (D-112).
+      i += words[i] === '--package' || words[i] === '-p' ? 2 : 1
+    }
+    const [program, verb] = [words[i], words[i + 1]]
+    if (program === undefined) continue
+    if (SERVERS.has(program)) return true
+    if (SERVER_TOOLS.has(program) && verb !== undefined && SERVER_VERBS.has(verb)) return true
+    if (program === 'vite' && (verb === undefined || verb.startsWith('-'))) return true
+  }
+  return false
+}
+
+/**
+ * Whether script `name` never exits: by name, as a watcher, as a server, or
+ * running such a script of its own package by name (docusaurus's
+ * `start:baseUrl`: `cross-env BASE_URL=… pnpm start`).
+ */
+function isPersistent(
+  name: string,
+  scripts: Readonly<Record<string, unknown>>,
+  seen: Set<string> = new Set(),
+): boolean {
+  const own = scripts[name]
+  if (typeof own !== 'string' || seen.has(name)) return false
+  seen.add(name)
+  if (PERSISTENT_TASK_NAMES.has(name) || isWatcher(name, own) || servesCommand(own)) return true
+  return foreground(own).some((segment) =>
+    [...segment.matchAll(RUNS_SCRIPT)].some((m) => isPersistent(m[1]!, scripts, seen)),
+  )
+}
+
+/** The `&&` / `;` / `|` segments of a command, less those it backgrounds with a single `&`. */
+function foreground(command: string): string[] {
+  return command
+    .split(/&&|\|\||[;|()]/)
+    .flatMap((part) => part.split('&').slice(-1))
+    .filter((segment) => segment.trim() !== '')
+}
+
 function scriptsOf(meta: ProjectMeta): Record<string, unknown> {
   // package.json is a boundary: `scripts` is whatever the file holds. A
   // string or an array would enumerate its indices as script names.
@@ -343,6 +426,38 @@ function cdsToMembers(script: string, rootDir: string, memberDirs: readonly stri
   return false
 }
 
+/**
+ * The manager a root's files name, or undefined: `pnpm-workspace.yaml` is
+ * pnpm's whatever the lockfile, and the npm `ownerOf` falls back to at the
+ * file-system root with no lockfile anywhere is no claim.
+ */
+function rootManager(dir: string, memo: Map<string, Owner>): string | undefined {
+  if (existsSync(path.join(dir, 'pnpm-workspace.yaml'))) return 'pnpm'
+  const owner = ownerOf(dir, memo)
+  const guessed =
+    owner.at === path.parse(owner.at).root && !existsSync(path.join(owner.at, 'package-lock.json'))
+  return guessed ? undefined : owner.manager
+}
+
+/**
+ * How the repo's own manager runs the members, for the root note: an npm
+ * repo read "(`pnpm -r`, `--filter`, a runner)" (insomnia).
+ */
+function membersExample(manager: string | undefined): string {
+  switch (manager) {
+    case 'npm':
+      return '`--workspaces`, `-w`'
+    case 'yarn':
+      return '`yarn workspaces run`, `yarn workspace`'
+    case 'berry':
+      return '`yarn workspaces foreach`, `yarn workspace`'
+    case 'bun':
+      return '`bun --filter`'
+    default:
+      return '`pnpm -r`, `--filter`'
+  }
+}
+
 /**
  * The hooks a package's build hides in when it has no `build` script:
  * react-navigation's twelve packages build in `prepack: bob build`, their
@@ -395,6 +510,48 @@ function siblingRun(script: string, dir: string, others: readonly string[]): str
   return undefined
 }
 
+/**
+ * The package globs a `lerna.json` beside a lone root lists (Lerna's
+ * default when it names none), or undefined: Lerna-classic repos list
+ * their packages there, not in `workspaces`, and vx saw the root alone
+ * (D-111).
+ */
+function lernaPackages(dir: string): string[] | undefined {
+  let json: unknown
+  try {
+    json = JSON.parse(readFileSync(path.join(dir, 'lerna.json'), 'utf8'))
+  } catch {
+    return undefined
+  }
+  const listed = (json as { packages?: unknown } | null)?.packages
+  return Array.isArray(listed) && listed.every((g) => typeof g === 'string') && listed.length > 0
+    ? listed
+    : ['packages/*']
+}
+
+function lernaNote(globs: readonly string[]): string {
+  const list = globs.map((g) => JSON.stringify(g)).join(', ')
+  return `lerna.json lists the packages (${list}), but package.json declares no \`workspaces\`, so vx sees the root alone: add \`"workspaces": [${list}]\` to package.json and run \`vx init\` again`
+}
+
+/**
+ * Yarn 2+ installs with Plug'n'Play unless `.yarnrc.yml` names another
+ * linker: a package's bins live in `.pnp.cjs`, and a task's `json5` exited
+ * 127 under vx, which runs no `yarn` in front of a command (probed on Yarn
+ * 4.5).
+ */
+function usesPnp(dir: string): boolean {
+  let rc = ''
+  try {
+    rc = readFileSync(path.join(dir, '.yarnrc.yml'), 'utf8')
+  } catch {}
+  const linker = /^nodeLinker:\s*["']?([\w-]+)/m.exec(rc)?.[1]
+  return linker === undefined || linker === 'pnp'
+}
+
+const PNP_NOTE =
+  "Yarn Plug'n'Play installs this repo: a package's bins live in `.pnp.cjs`, not `node_modules/.bin`, so a task's `tsc` is not found under vx — set `nodeLinker: node-modules` in `.yarnrc.yml` and run `yarn install`, or write each command as `yarn exec '<command>'`"
+
 /** A package manager running a script by name: `pnpm build`, `npm run x`, `bun run x`. */
 const RUNS_SCRIPT =
   /(?:^|[\s;&|(])(?:pnpm|pn|npm|yarn|bun)\s+(?:run(?:-script)?\s+)?([^\s;&|()'"-][^\s;&|()'"]*)/g
@@ -559,7 +716,7 @@ export function migrateScripts(
       : undefined)
   if (rootName !== undefined && rootMapped > 0) {
     notes.push(
-      `${rootName} (the workspace root): its scripts that check the whole repo are its tasks; those that run the members (\`pnpm -r\`, \`--filter\`, a runner) or share a member's task name are left out`,
+      `${rootName} (the workspace root): its scripts that check the whole repo are its tasks; those that run the members (${membersExample(rootMeta && rootManager(rootMeta.dir, hookMemo))}, a runner) or share a member's task name are left out`,
     )
   } else if (rootName === 'package.json' && outsideDir !== undefined && unnamedMaps().length > 0) {
     // react's nameless root: "its scripts run the workspace" was not why,
@@ -671,7 +828,7 @@ export function migrateScripts(
         )
       }
       const task: Record<string, unknown> = { exec }
-      if (PERSISTENT_TASK_NAMES.has(name) || isWatcher(name, own)) {
+      if (isPersistent(name, scripts)) {
         exec['persistent'] = {}
         todos.push(PERSISTENT_TODO)
       }
@@ -698,6 +855,9 @@ export function migrateScripts(
       projects.push({ name: meta.name, dir: meta.dir, importLines, tasks })
     }
   }
+  const owner = metas[0] === undefined ? undefined : ownerOf(metas[0].dir, hookMemo)
+  if (owner?.manager === 'berry' && usesPnp(owner.at)) notes.push(PNP_NOTE)
+
   if (lifecycleBuilds.length > 0) {
     const [name, hook, command] = lifecycleBuilds[0]!
     const more = lifecycleBuilds.length - 1
@@ -705,6 +865,8 @@ export function migrateScripts(
       `${lifecycleBuilds.length === 1 ? 'a package builds' : `${lifecycleBuilds.length} packages build`} only in a lifecycle script (\`${hook}: ${command}\` in ${name}${more > 0 ? ` and ${more} more` : ''}), which the package manager runs on pack or install and vx never runs: add a \`build\` script running it and run \`vx init\` again`,
     )
   }
+  const lerna = metas.length === 1 ? lernaPackages(metas[0]!.dir) : undefined
+  if (lerna !== undefined) notes.push(lernaNote(lerna))
   breakBuildCycles(projects, metas)
   pruneOrphanPersistentNotes(projects, PERSISTENT_TODO)
   return {

package/src/workspace/package-graph.ts

@@ -134,6 +134,17 @@ export function buildPackageGraph(
   // built on the first one, as the closures are.
   const reachDeps = new Map<string, string[]>()
   const directDependents = new Map<string, string[]>()
+  /** One project's REACH list, made on first ask (`buildReach` makes them all). */
+  const reachOf = (name: string): string[] => {
+    let reach = reachDeps.get(name)
+    if (reach === undefined) {
+      const own = order.get(name)
+      if (own === undefined) return []
+      reach = [...new Set([...own, ...peers.get(name)!])].sort()
+      reachDeps.set(name, reach)
+    }
+    return reach
+  }
   let reachBuilt = false
   const buildReach = (): void => {
     if (reachBuilt) return
@@ -224,13 +235,40 @@ export function buildPackageGraph(
   // does a `^task` walk (it reads `directDeps`). Building both closures
   // eagerly was 12 ms of a 240 ms warm run at 1000 projects × 30 deps
   // (profiled 2026-09-09) for answers nobody read.
-  function makeAccessor(edges: Map<string, string[]>): (name: string) => string[] {
+  // A scoped run asks one or two seeds' closures: a search from each over
+  // the REACH lists it visits answers them without every project's list
+  // and the whole graph's bitsets (8–13 ms at 1,000 projects for one
+  // `--filter`). The same set, in the same name order; past a few asks
+  // the bitsets are cheaper per question.
+  const EARLY_SEARCHES = 8
+  const searchDeps = (name: string): string[] => {
+    const seen = new Set<string>()
+    const stack = [...reachOf(name)]
+    while (stack.length > 0) {
+      const cur = stack.pop()!
+      if (seen.has(cur)) continue
+      seen.add(cur)
+      for (const d of reachOf(cur)) stack.push(d)
+    }
+    return [...seen].sort()
+  }
+  function makeAccessor(
+    edges: Map<string, string[]>,
+    search?: (name: string) => string[],
+  ): (name: string) => string[] {
     const memo = new Map<string, string[]>()
     let closures: Uint32Array | null | undefined
     const words = (names.length + 31) >>> 5
+    let searched = 0
     return (name) => {
       const cached = memo.get(name)
       if (cached) return cached
+      if (search !== undefined && closures === undefined && searched < EARLY_SEARCHES) {
+        searched++
+        const result = search(name)
+        memo.set(name, result)
+        return result
+      }
       buildReach()
       if (closures === undefined) closures = bitsetClosures(edges)
       if (closures === null) {
@@ -257,7 +295,7 @@ export function buildPackageGraph(
 
   return {
     directDeps: (name) => directDeps.get(name) ?? [],
-    transitiveDeps: makeAccessor(reachDeps),
+    transitiveDeps: makeAccessor(reachDeps, searchDeps),
     transitiveDependents: makeAccessor(directDependents),
   }
 }

package/src/workspace/project-loader.ts

@@ -1,4 +1,4 @@
-import { realpathSync, statSync } from 'node:fs'
+import { existsSync, realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import type { ProjectConfig, WorkspaceConfig } from '../config.js'
 import { UserError, xxh3hex } from '../util/index.js'
@@ -200,6 +200,14 @@ const configExit = ((code?: number | string | null) => {
   throw new Error(`process.exit(${code ?? ''}) in a config: ${CONFIG_EXIT}`)
 }) as typeof process.exit
 
+/** A `.pnp.cjs` in `dir` or above: Yarn Plug'n'Play's install. */
+function pnpAbove(dir: string): boolean {
+  for (let d = dir; ; d = path.dirname(d)) {
+    if (existsSync(path.join(d, '.pnp.cjs'))) return true
+    if (path.dirname(d) === d) return false
+  }
+}
+
 /**
  * A bare import nothing above the config provides is refused BEFORE the
  * evaluation: left to Bun, a workspace with no `node_modules` would have
@@ -215,6 +223,14 @@ function refuseUnprovidedImports(bytes: Uint8Array, configPath: string, kind: st
     loader,
   )
   if (missing.length === 0) return
+  // Under Yarn Plug'n'Play the dependencies ARE installed, into a
+  // `.pnp.cjs` Bun does not read: "install them first" sent the user to a
+  // `yarn install` that changed nothing (D-109).
+  if (pnpAbove(path.dirname(configPath))) {
+    throw new UserError(
+      `${kind} config ${configPath}: cannot find '${missing[0]}' — Yarn Plug'n'Play installed the workspace's dependencies into .pnp.cjs, which Bun does not read; set \`nodeLinker: node-modules\` in .yarnrc.yml and run \`yarn install\``,
+    )
+  }
   throw new UserError(
     `${kind} config ${configPath}: cannot find '${missing[0]}' — no node_modules above the config provides it; install the workspace's dependencies first`,
   )