@vzn/vx 0.0.421 → 0.0.423

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.421",
+  "version": "0.0.423",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.421",
-    "@vzn/vx-linux-arm64": "0.0.421",
-    "@vzn/vx-darwin-x64": "0.0.421",
-    "@vzn/vx-darwin-arm64": "0.0.421"
+    "@vzn/vx-linux-x64": "0.0.423",
+    "@vzn/vx-linux-arm64": "0.0.423",
+    "@vzn/vx-darwin-x64": "0.0.423",
+    "@vzn/vx-darwin-arm64": "0.0.423"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/init.ts

@@ -75,7 +75,8 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     throw err
   })
   const nameless: string[] = []
-  const metas = await discoverProjects(await loadWorkspace(root, reads), nameless)
+  const workspace = await loadWorkspace(root, reads)
+  const metas = await discoverProjects(workspace, nameless)
   // `init` reads scripts only; a runner's own config beside them is the
   // richer source (dependsOn, inputs, outputs) and was ignored without a
   // word — the walkthrough on a Turbo repo (2026-09-09) got the scripts'
@@ -107,7 +108,10 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     ),
     source: 'package.json scripts',
     verb: 'vx init',
-    notes: namelessNotes(root, nameless),
+    notes: [
+      ...(await unreadWorkspaces(root, workspace.packageGlobs)),
+      ...namelessNotes(root, nameless),
+    ],
     dry: parsed.dry,
     force: parsed.force,
     init: true,
@@ -379,6 +383,29 @@ function namelessNotes(root: string, dirs: readonly string[]): string[] {
   ]
 }
 
+/**
+ * `pnpm-workspace.yaml`'s `packages` decides the members, as pnpm reads it,
+ * and a root `workspaces` that lists other globs was dropped without a word:
+ * a bun or npm repo with a stale yaml lost those members (M-51).
+ */
+async function unreadWorkspaces(root: string, globs: readonly string[]): Promise<string[]> {
+  if (!existsSync(path.join(root, 'pnpm-workspace.yaml'))) return []
+  const ws = (await readRootManifest(root))['workspaces']
+  const list = Array.isArray(ws)
+    ? ws
+    : typeof ws === 'object' &&
+        ws !== null &&
+        Array.isArray((ws as { packages?: unknown }).packages)
+      ? (ws as { packages: unknown[] }).packages
+      : undefined
+  if (list === undefined) return []
+  const pkg = list.filter((g): g is string => typeof g === 'string')
+  if ([...pkg].sort().join('\0') === [...globs].sort().join('\0')) return []
+  return [
+    `pnpm-workspace.yaml's \`packages\` lists the members, as pnpm reads them; package.json's \`workspaces\` (${pkg.map((g) => `"${g}"`).join(', ')}) is not read: if bun, npm or yarn installs this repo, copy those globs into pnpm-workspace.yaml's \`packages\`, or delete that key so package.json decides`,
+  ]
+}
+
 /** The root package.json as an object, `{}` when unreadable or not one. */
 async function readRootManifest(root: string): Promise<Record<string, unknown>> {
   const pj: unknown = await Bun.file(path.join(root, 'package.json'))

package/src/cli/watch-filter.ts

@@ -160,26 +160,51 @@ function outputContainer(raw: string): string {
  */
 export function gitIgnored(workspaceRoot: string, paths: readonly string[]): Set<string> {
   const ignored = new Set<string>()
-  if (paths.length === 0) return ignored
-  let proc: ReturnType<typeof Bun.spawnSync>
-  try {
-    proc = Bun.spawnSync({
-      cmd: [executablePath('git'), 'check-ignore', '-z', '--stdin'],
-      cwd: workspaceRoot,
-      stdin: Buffer.from(paths.map((p) => `${p}\0`).join('')),
-      stdout: 'pipe',
-      stderr: 'ignore',
-    })
-  } catch {
-    // No git on PATH: nothing is ignored, and the loop keeps judging —
-    // the initial run already said what vx requires.
-    return ignored
+  // `-v -n` answers every path with a record, so on a refusal the count of
+  // records says which path git refused: a path inside a submodule ends
+  // the batch (exit 128, "is in submodule"), and reading that as nothing
+  // ignored let a pid file in the same window start cycles again. The
+  // refused path is skipped and the rest asked again; a refusal before
+  // any record outside a work tree is git refusing them all.
+  let rest = paths
+  let inWorkTree: boolean | undefined
+  while (rest.length > 0) {
+    let proc: ReturnType<typeof Bun.spawnSync>
+    try {
+      proc = Bun.spawnSync({
+        cmd: [executablePath('git'), 'check-ignore', '-v', '-n', '-z', '--stdin'],
+        cwd: workspaceRoot,
+        stdin: Buffer.from(rest.map((p) => `${p}\0`).join('')),
+        stdout: 'pipe',
+        stderr: 'ignore',
+      })
+    } catch {
+      // No git on PATH: nothing is ignored, and the loop keeps judging —
+      // the initial run already said what vx requires.
+      return ignored
+    }
+    // Each record: source, line, pattern, path. No source: no pattern
+    // matched; a `!` pattern: re-included. Either way not ignored.
+    const fields = new TextDecoder().decode(proc.stdout).split('\0')
+    const records = Math.floor(fields.length / 4)
+    for (let i = 0; i < records; i++) {
+      const [source, , pattern, p] = fields.slice(i * 4, i * 4 + 4)
+      if (source !== '' && !pattern!.startsWith('!')) ignored.add(p!)
+    }
+    // 0: some ignored; 1: none. Anything else is git refusing.
+    if (proc.exitCode === 0 || proc.exitCode === 1) return ignored
+    if (records === 0) {
+      inWorkTree ??=
+        Bun.spawnSync({
+          cmd: [executablePath('git'), 'rev-parse', '--is-inside-work-tree'],
+          cwd: workspaceRoot,
+          stdout: 'ignore',
+          stderr: 'ignore',
+        }).exitCode === 0
+      if (!inWorkTree) return ignored
+    }
+    rest = rest.slice(records + 1)
   }
-  // 0: some ignored; 1: none. Anything else is git refusing (not a
-  // repository, a path inside a nested one): no path is ignored.
-  if (proc.exitCode !== 0) return ignored
-  for (const p of new TextDecoder().decode(proc.stdout).split('\0'))
-    if (p.length > 0) ignored.add(p)
   return ignored
 }
 

package/src/workspace/config-eval.ts

@@ -217,7 +217,7 @@ interface Pending {
 
 /**
  * How long a single config evaluation may take, in the worker or in process
- * (D-66). Real evaluations are ~10 ms; this exists only so a hung config or a
+ * (D-66); in process a synchronous loop holds the thread the deadline needs. Real evaluations are ~10 ms; this exists only so a hung config or a
  * killed worker cannot stall a run or a long-lived process indefinitely. Read
  * per call so a test can drive the deadline instead of waiting it out.
  */

package/src/workspace/load-reads.ts

@@ -5,6 +5,8 @@
 // it. The map lives exactly as long as the load: a `vx watch` cycle is a
 // new load and reads fresh bytes.
 
+import { isPermissionError, UserError } from '../util/index.js'
+
 /** The files one load has read, by absolute path: the bytes, or null when no file is there. */
 export type LoadReads = Map<string, Promise<Uint8Array | null>>
 
@@ -28,5 +30,17 @@ export function readOnce(reads: LoadReads | undefined, file: string): Promise<Ui
 
 async function readIfFile(file: string): Promise<Uint8Array | null> {
   const f = Bun.file(file)
-  return (await f.exists()) ? await f.bytes() : null
+  return (await f.exists()) ? await f.bytes().catch((err: unknown) => unreadable(err, file)) : null
+}
+
+/**
+ * A read the file system refused is the user's to fix, named as a read: a
+ * config at mode 000 reached the user as "a path vx must write is not
+ * writable" (D-132). Anything else is rethrown as it came.
+ */
+export function unreadable(err: unknown, file: string): never {
+  if (isPermissionError(err)) {
+    throw new UserError(`${file}: not readable by this user (${err.code})`)
+  }
+  throw err
 }

package/src/workspace/project-loader.ts

@@ -20,7 +20,7 @@ import {
   configImports,
   type ConfigEvalStore,
 } from './config-cache.js'
-import { readOnce } from './load-reads.js'
+import { readOnce, unreadable } from './load-reads.js'
 
 // The validator lives in config-schema.ts; re-exported so a reader that
 // reaches the loader for it (the tests do) keeps working.
@@ -401,7 +401,9 @@ export async function loadProjectConfigs(
       })
       if (fastKey !== null) return { configPath, bytes: null, cacheKey: fastKey, indexed: true }
     }
-    const bytes = await Bun.file(configPath).bytes()
+    const bytes = await Bun.file(configPath)
+      .bytes()
+      .catch((err: unknown) => unreadable(err, configPath))
     const keyed =
       evalCache === undefined
         ? null
@@ -465,7 +467,9 @@ export async function loadProjectConfigs(
     let closure = entry.closure
     let key = cacheKey
     if (entry.indexed) {
-      bytes = await Bun.file(configPath).bytes()
+      bytes = await Bun.file(configPath)
+        .bytes()
+        .catch((err: unknown) => unreadable(err, configPath))
       const keyed = await configEvalKey({
         configPath,
         bytes,
@@ -670,7 +674,52 @@ interface BuiltinSnapshot {
   readonly props: readonly (OwnProperties | undefined)[]
 }
 
-function builtinSnapshot(leaveOut?: string): BuiltinSnapshot {
+/**
+ * The members of `Bun` vx reads, which the workspace config's guard checks;
+ * of the rest it keeps the keys and their order, not their descriptors.
+ * Some members are built on their first read (`postgres` loaded `bun:sql`,
+ * 3.4 ms), and the guard runs on every warm run, where its full read of
+ * `Bun` was 4.4–5 ms of a 45 ms no-op (compiled, 2026-10-03). A project
+ * config's guard reads them all. Held to every `Bun.<name>` in `src/` by
+ * tests/workspace-guard-bun.test.ts.
+ */
+const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
+  'Archive',
+  'BunFile',
+  'CryptoHasher',
+  'Glob',
+  'JSONC',
+  'Subprocess',
+  'Transpiler',
+  'YAML',
+  'color',
+  'deepEquals',
+  'env',
+  'file',
+  'hash',
+  'main',
+  'nanoseconds',
+  'plugin',
+  'randomUUIDv7',
+  'resolveSync',
+  'semver',
+  'serve',
+  'sleep',
+  'spawn',
+  'spawnSync',
+  'stdout',
+  'stringWidth',
+  'version',
+  'which',
+  'write',
+  'zstdCompress',
+  'zstdDecompress',
+]
+
+/** A descriptor the snapshot did not read. */
+const UNREAD: PropertyDescriptor = Object.freeze({})
+
+function builtinSnapshot(leaveOut?: string, onlyBunMembersVxReads = false): BuiltinSnapshot {
   const prims: Primitives = {
     ownKeys: Reflect.ownKeys,
     descriptorOf: Object.getOwnPropertyDescriptor,
@@ -689,7 +738,12 @@ function builtinSnapshot(leaveOut?: string): BuiltinSnapshot {
     const proto = WATCHED_BUILTINS[i]![1]
     const keys = prims.ownKeys(proto)
     const descriptors: PropertyDescriptor[] = []
-    for (let j = 0; j < keys.length; j++) descriptors[j] = prims.descriptorOf(proto, keys[j]!)!
+    const narrow = onlyBunMembersVxReads && proto === Bun
+    for (let j = 0; j < keys.length; j++) {
+      const key = keys[j]!
+      descriptors[j] =
+        narrow && !BUN_MEMBERS_VX_READS.includes(key) ? UNREAD : prims.descriptorOf(proto, key)!
+    }
     props[i] = { keys, descriptors }
   }
   return { prims, props }
@@ -712,7 +766,9 @@ function unchanged(
   for (let j = 0; j < keys.length; j++) {
     const key = keys[j]!
     if (key !== was.keys[j]) return false
-    if (!sameDescriptor(p, was.descriptors[j]!, p.descriptorOf(proto, key)!)) return false
+    const prior = was.descriptors[j]!
+    if (prior === UNREAD) continue
+    if (!sameDescriptor(p, prior, p.descriptorOf(proto, key)!)) return false
   }
   return true
 }
@@ -785,6 +841,7 @@ function restoreBuiltins(before: BuiltinSnapshot | undefined, everyLoadOnly = fa
           break
         }
       }
+      if (prior === UNREAD) continue
       if (prior !== undefined && sameDescriptor(p, prior, p.descriptorOf(proto, key)!)) continue
       changed[changed.length] = name + '.' + p.keyName(key)
       if (prior === undefined) p.deleteOwn(proto, key)
@@ -794,7 +851,8 @@ function restoreBuiltins(before: BuiltinSnapshot | undefined, everyLoadOnly = fa
       const key = was.keys[k]!
       if (p.hasOwn(proto, key)) continue
       changed[changed.length] = name + '.' + p.keyName(key)
-      p.defineOwn(proto, key, was.descriptors[k]!)
+      // An unread member cannot be put back as it was; it is refused all the same.
+      if (was.descriptors[k] !== UNREAD) p.defineOwn(proto, key, was.descriptors[k]!)
     }
   }
   return changed
@@ -933,7 +991,7 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
     // left out: it loads first in every run, filtered or not, so none
     // depends on what else loaded (D-122's case), and plugins' tests and
     // tools hand state through them.
-    const builtins = builtinSnapshot('globalThis')
+    const builtins = builtinSnapshot('globalThis', true)
     const env = { ...process.env }
     const cwd = process.cwd()
     const umask = currentUmask()

package/src/workspace/workspace.ts

@@ -1,16 +1,17 @@
-import type { Dirent } from 'node:fs'
-import { readdir, stat } from 'node:fs/promises'
+import { constants, type Dirent } from 'node:fs'
+import { access, readdir, stat } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig, WorkspaceConfig } from '../config.js'
 import {
   BUN_GLOB_WILDCARDS,
   isOutOfFds,
+  isPermissionError,
   relPosix,
   slashBraceExpansions,
   UserError,
   normalizeBunGlob,
 } from '../util/index.js'
-import { type LoadReads, readOnce } from './load-reads.js'
+import { type LoadReads, readOnce, unreadable } from './load-reads.js'
 
 export interface PackageJson {
   name: string
@@ -548,6 +549,30 @@ function absent<T>(err: unknown, value: T): T {
   return value
 }
 
+/**
+ * A member's manifest text, or null when there is none. A manifest this
+ * user may not read is refused, not skipped: its project dropped out of
+ * `--all` and the run went green without it (D-132). A directory it may
+ * not search hides whether a manifest is there at all, so that one is
+ * named and skipped (a service's data directory under `packages/*`).
+ */
+async function readManifest(root: string, dir: string, file: string): Promise<string | null> {
+  try {
+    return await Bun.file(file).text()
+  } catch (err) {
+    if (!isPermissionError(err)) return absent(err, null)
+    const searchable = await access(dir, constants.X_OK).then(
+      () => true,
+      () => false,
+    )
+    if (searchable) unreadable(err, file)
+    process.stderr.write(
+      `vx: ${relPosix(root, dir)} is not readable by this user — skipped, with any project in it\n`,
+    )
+    return null
+  }
+}
+
 export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]> {
   return discoverProjects(workspace)
 }
@@ -591,9 +616,7 @@ export async function discoverProjects(
       const pkgJsonPath = dir + path.sep + 'package.json'
       const [configPath, text] = await Promise.all([
         findConfigFile(dir),
-        Bun.file(pkgJsonPath)
-          .text()
-          .catch((err: unknown) => absent(err, null)),
+        readManifest(workspace.root, dir, pkgJsonPath),
       ])
       if (text === null) {
         // A member dir with a vx config and no manifest was skipped without
@@ -712,9 +735,7 @@ export async function namedProject(
   const pkgJsonPath = dir + path.sep + 'package.json'
   const [configPath, text] = await Promise.all([
     findConfigFile(dir),
-    Bun.file(pkgJsonPath)
-      .text()
-      .catch((err: unknown) => absent(err, null)),
+    readManifest(workspace.root, dir, pkgJsonPath),
   ])
   if (
     text === null &&