@vzn/vx 0.0.410 → 0.0.412

package/README.md

@@ -34,11 +34,11 @@ Same graph, commands and concurrency: [how it is measured](https://vznjs.github.
 
 <!-- bench:end -->
 
-## Why it is faster
+## What vx is
 
-- **Nothing boots per task:** no daemon, no Node process; vx spawns your command.
-- **No source-file reads to hash:** on a clean tree, keys come from git's index; each project's `package.json` and the lockfile are still read.
-- **One pass:** one git walk per run; each stat and lookup happens once.
+A task runner and build cache for JavaScript monorepos.
+Each task is one shell command with declared inputs and outputs; vx runs
+them in dependency order and replays results from a content-addressed cache.
 
 ## Install
 
@@ -103,6 +103,12 @@ start, not a way to run the repo. The numbers above are native vx
 config. `@vzn/vx-migrate`'s first npm publish is pending.
 [Migration guide](https://vznjs.github.io/vx/guides/migrate/).
 
+## Why it is faster
+
+- **Nothing boots per task:** no daemon, no Node process; vx spawns your command.
+- **No source-file reads to hash:** on a clean tree, keys come from git's index; each project's `package.json` and the lockfile are still read.
+- **One pass:** one git walk per run; each stat and lookup happens once.
+
 ## More than speed
 
 - **A cache you can trust:** TypeScript configs are evaluated before
@@ -111,22 +117,21 @@ config. `@vzn/vx-migrate`'s first npm publish is pending.
 - **Sandboxed tasks:** opt in per task; a workspace file the task did
   not declare is out of its reach, so it cannot poison the cache.
 - **Clean exits:** Ctrl-C reaps each task's process group.
-- **Plugins at every stage:** remote cache, remote execution, telemetry,
+- **Plugins at every stage** (14 hooks, `commands` included): remote cache, remote execution, telemetry,
   CLI verbs. Core ships none and needs none.
 - **Free:** MIT. No paywall, no cloud, no account.
 
 ## How it compares
 
-|                           | vx                                        | Turborepo                      | Nx               |
-| ------------------------- | ----------------------------------------- | ------------------------------ | ---------------- |
-| Config                    | TypeScript, evaluated into the cache key  | JSON (static)                  | JSON (static)    |
-| Output ownership          | **Strict**: wiped before exec and restore | Additive (stale files survive) | Additive         |
-| Clean-tree hashing        | **No source reads** (git index OIDs)      | git OIDs                       | re-hash / daemon |
-| Daemon required for speed | **No**                                    | No (`turbo run` has none)      | Yes              |
-| Per-task sandbox          | **Yes**: kernel-level, opt-in             | No                             | No               |
-| Plugin API                | **Yes**: every pipeline stage             | No                             | Yes (TS-tied)    |
-| OTel CI/CD spans          | **Yes**: `otel()` plugin, no OTel SDK     | No                             | Paid             |
-| Install                   | **Single binary**; no Bun, Node optional  | npm + Node                     | npm + Node       |
+|                    | vx                                        | Turborepo                      | Nx               |
+| ------------------ | ----------------------------------------- | ------------------------------ | ---------------- |
+| Config             | TypeScript, evaluated into the cache key  | JSON (static)                  | JSON (static)    |
+| Output ownership   | **Strict**: wiped before exec and restore | Additive (stale files survive) | Additive         |
+| Clean-tree hashing | **No source reads** (git index OIDs)      | git OIDs                       | re-hash / daemon |
+| Daemon             | **None**                                  | None for `turbo run`           | On by default    |
+| Per-task sandbox   | **Yes**: kernel-level, opt-in             | No                             | No               |
+| Plugin API         | **Yes**: every pipeline stage             | No                             | Yes (TS-tied)    |
+| Install            | **Single binary**; no Bun, Node optional  | npm + Node                     | npm + Node       |
 
 Every gap, and when another tool is the better pick:
 [comparison](packages/vx/docs/comparison.md) ·
@@ -157,13 +162,6 @@ Write your own: [plugin guide](https://vznjs.github.io/vx/guides/plugins/) ·
 vx. The schema may still change; 1.0's promise:
 [versioning-1.0.md](packages/vx/docs/design/versioning-1.0.md).
 
-| Surface                                            | Maturity             |
-| -------------------------------------------------- | -------------------- |
-| Core task runner + caching                         | **production-ready** |
-| Plugin pipeline (14 hooks, `commands` included)    | **shippable**        |
-| `vx init` / `@vzn/vx-migrate` (scripts; Turbo, Nx) | **shippable**        |
-| First-party plugins (table above)                  | **shippable**        |
-
 ## Contributing
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.410",
+  "version": "0.0.412",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.410",
-    "@vzn/vx-linux-arm64": "0.0.410",
-    "@vzn/vx-darwin-x64": "0.0.410",
-    "@vzn/vx-darwin-arm64": "0.0.410"
+    "@vzn/vx-linux-x64": "0.0.412",
+    "@vzn/vx-linux-arm64": "0.0.412",
+    "@vzn/vx-darwin-x64": "0.0.412",
+    "@vzn/vx-darwin-arm64": "0.0.412"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/workspace/project-loader.ts

@@ -456,6 +456,7 @@ export async function loadProjectConfigs(
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
+  let tainted = false
   const loadOne = async (entry: (typeof prepared)[number]): Promise<Loaded> => {
     const { configPath, cacheKey } = entry
     // A fast key that missed: the closure is stale or the file changed.
@@ -500,7 +501,7 @@ export async function loadProjectConfigs(
     const changed = repeat
       ? []
       : [
-          ...restoreBuiltins(builtins),
+          ...restoreBuiltins(builtins, overlapping),
           ...restoreEnv(env),
           ...restoreCwd(cwd),
           ...restoreUmask(umask),
@@ -585,20 +586,30 @@ export async function loadProjectConfigs(
             ...restoreUmask(umask),
           ]
         : []
-    if (first?.failed instanceof ChangedInRound) {
+    // Overlapping loads check most built-ins only here, so a change one
+    // config made may have broken another's load: it is refused first, and
+    // nothing the round evaluated is stored.
+    const changedInRound =
+      first?.failed instanceof ChangedInRound
+        ? first.failed.changed
+        : overlapping && changed.length > 0
+          ? changed
+          : undefined
+    if (changedInRound !== undefined) {
+      tainted = true
       for (const i of misses) {
         const configPath = prepared[i]!.configPath
         const own = await builtinsChangedBy(configPath)
         if (own.length > 0) throw builtinsChanged(own, configPath)
       }
-      throw builtinsChanged(first.failed.changed)
+      throw builtinsChanged(changedInRound)
     }
     if (first !== undefined) throw first.failed
     if (changed.length > 0) throw builtinsChanged(changed)
     return results.map((r) => (r as Loaded).config)
   } finally {
     endRound()
-    if (store !== undefined) {
+    if (store !== undefined && !tainted) {
       if (evals.length > 0) {
         if (store.putConfigEvals !== undefined) store.putConfigEvals(evals)
         else for (const [k, json] of evals) store.putConfigEval(k, json)
@@ -655,10 +666,11 @@ interface OwnProperties {
 
 interface BuiltinSnapshot {
   readonly prims: Primitives
-  readonly props: readonly OwnProperties[]
+  /** Undefined for a watched name the snapshot leaves out. */
+  readonly props: readonly (OwnProperties | undefined)[]
 }
 
-function builtinSnapshot(): BuiltinSnapshot {
+function builtinSnapshot(leaveOut?: string): BuiltinSnapshot {
   const prims: Primitives = {
     ownKeys: Reflect.ownKeys,
     descriptorOf: Object.getOwnPropertyDescriptor,
@@ -668,8 +680,12 @@ function builtinSnapshot(): BuiltinSnapshot {
     same: Object.is,
     keyName: String,
   }
-  const props: OwnProperties[] = []
+  const props: (OwnProperties | undefined)[] = []
   for (let i = 0; i < WATCHED_BUILTINS.length; i++) {
+    if (WATCHED_BUILTINS[i]![0] === leaveOut) {
+      props[i] = undefined
+      continue
+    }
     const proto = WATCHED_BUILTINS[i]![1]
     const keys = prims.ownKeys(proto)
     const descriptors: PropertyDescriptor[] = []
@@ -727,15 +743,36 @@ function builtinsChanged(changed: readonly string[], configPath?: string): UserE
   )
 }
 
+/**
+ * The built-ins checked after each of several overlapping loads: the ones
+ * the loader itself reads through between loads (its promises, maps, sets,
+ * JSON and keys). The rest are checked once, at the round's end: all of
+ * them after every load was ~73 µs a config, a quarter of a cold load of
+ * 1,000 (2026-10-03). A lone load checks them all. By index, decided at
+ * module load: a lookup through a `Set` is one a config can replace (D-124).
+ */
+const EVERY_LOAD: readonly boolean[] = WATCHED_BUILTINS.map(([name]) =>
+  [
+    'Object.prototype',
+    'JSON',
+    'Promise.prototype',
+    'Map.prototype',
+    'Set.prototype',
+    'Bun.hash',
+  ].includes(name),
+)
+
 /** Puts back what changed since `before`, naming each property it put back. */
-function restoreBuiltins(before: BuiltinSnapshot | undefined): string[] {
+function restoreBuiltins(before: BuiltinSnapshot | undefined, everyLoadOnly = false): string[] {
   const changed: string[] = []
   if (before === undefined) return changed
   const p = before.prims
   for (let i = 0; i < WATCHED_BUILTINS.length; i++) {
     const name = WATCHED_BUILTINS[i]![0]
+    if (everyLoadOnly && !EVERY_LOAD[i]) continue
     const proto = WATCHED_BUILTINS[i]![1]
-    const was = before.props[i]!
+    const was = before.props[i]
+    if (was === undefined) continue
     const keys = p.ownKeys(proto)
     if (unchanged(p, proto, keys, was)) continue
     // Slow path, a change only: a linear lookup keeps it off `Map`.
@@ -890,7 +927,29 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
     const since = workspaceLoadedAt.get(configPath)
     if (since !== undefined) await refuseStaleWorkspaceImports(configPath, since)
     const startedAt = Date.now()
-    const mod = (await loadDefaultExport(configPath, 'Workspace', bytes)) as WorkspaceConfig
+    // The same guard a project config's first load has: the workspace config
+    // runs in this process too, and its `Object.prototype.exec` ran in a
+    // project's task under a key that never saw it (D-126). Its globals are
+    // left out: it loads first in every run, filtered or not, so none
+    // depends on what else loaded (D-122's case), and plugins' tests and
+    // tools hand state through them.
+    const builtins = builtinSnapshot('globalThis')
+    const env = { ...process.env }
+    const cwd = process.cwd()
+    const umask = currentUmask()
+    let mod: WorkspaceConfig
+    try {
+      mod = (await loadDefaultExport(configPath, 'Workspace', bytes)) as WorkspaceConfig
+    } finally {
+      const changed = [
+        ...restoreBuiltins(builtins),
+        ...restoreEnv(env),
+        ...restoreCwd(cwd),
+        ...restoreUmask(umask),
+      ]
+      // eslint-disable-next-line no-unsafe-finally -- the refusal outranks the load's own error
+      if (changed.length > 0) throw builtinsChanged(changed, configPath)
+    }
     // Checked again once awaited, as a project config is: a Promise default
     // passed the first check, and `Promise.resolve(null)` crashed the
     // validator with a stack while `Promise.resolve(42)` loaded as no