@vzn/vx 0.0.450 → 0.0.452

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.450",
+  "version": "0.0.452",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.450",
-    "@vzn/vx-linux-arm64": "0.0.450",
-    "@vzn/vx-darwin-x64": "0.0.450",
-    "@vzn/vx-darwin-arm64": "0.0.450"
+    "@vzn/vx-linux-x64": "0.0.452",
+    "@vzn/vx-linux-arm64": "0.0.452",
+    "@vzn/vx-darwin-x64": "0.0.452",
+    "@vzn/vx-darwin-arm64": "0.0.452"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/watch.ts

@@ -530,7 +530,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
         if (!packageDirs.has(dir)) want.add(dir)
       }
     for (const [dir, handle] of pending) {
-      if (want.has(dir)) continue
+      if (want.has(dir) && !stale(dir)) continue
       handle.close()
       pending.delete(dir)
     }
@@ -548,6 +548,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
             if (filename === 'package.json') arrived()
           }),
         )
+        armedAs.set(dir, inodeOf(dir) ?? '')
       } catch (err) {
         sayCannot(`cannot watch ${dir}`, err)
         continue
@@ -578,12 +579,14 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
     }
     importNames = want
     for (const [dir, handle] of importArms) {
-      if (want.has(dir)) continue
+      if (want.has(dir) && !stale(dir)) continue
       handle.close()
       importArms.delete(dir)
     }
     for (const dir of want.keys()) {
       if (importArms.has(dir)) continue
+      // Gone for now: its ancestor's arm (`armAncestors`) hears it return.
+      if (inodeOf(dir) === undefined) continue
       try {
         importArms.set(
           dir,
@@ -605,10 +608,12 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
             )
           }),
         )
+        armedAs.set(dir, inodeOf(dir) ?? '')
       } catch (err) {
         sayCannot(`cannot watch ${dir}`, err)
       }
     }
+    armAncestors()
   }
 
   const watchingLine = (count: number): string =>
@@ -676,34 +681,35 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
   // A base removed and made again is no event to its own watch (it holds
   // the deleted directory) nor to the root arm, which drops every name but
   // its own files: `watching 0 project(s)` and silence until a restart. So
-  // each base is watched from its nearest directory that exists, for the
-  // next name on the way down: its parent while it is there, an ancestor
-  // when the parent went too (`apps/` removed under `apps/web/*`).
-  const baseParents = new Map<string, WatchHandle>()
-  let baseNames = new Map<string, Set<string>>()
-  const armBaseParents = (): void => {
-    baseNames = new Map()
-    for (const base of memberBases) {
+  // each base, and each directory a config imports from, is watched from
+  // its nearest directory that exists, for the next name on the way down:
+  // its parent while it is there, an ancestor when the parent went too
+  // (`apps/` removed under `apps/web/*`).
+  const ancestorArms = new Map<string, WatchHandle>()
+  let ancestorNames = new Map<string, Set<string>>()
+  const armAncestors = (): void => {
+    ancestorNames = new Map()
+    for (const base of [...memberBases, ...importNames.keys()]) {
       let dir = path.dirname(base)
       let name = path.basename(base)
       while (inodeOf(dir) === undefined && dir !== workspaceRoot && dir !== path.dirname(dir)) {
         name = path.basename(dir)
         dir = path.dirname(dir)
       }
-      baseNames.set(dir, (baseNames.get(dir) ?? new Set()).add(name))
+      ancestorNames.set(dir, (ancestorNames.get(dir) ?? new Set()).add(name))
     }
-    for (const [dir, handle] of baseParents) {
-      if (baseNames.has(dir) && !stale(dir)) continue
+    for (const [dir, handle] of ancestorArms) {
+      if (ancestorNames.has(dir) && !stale(dir)) continue
       handle.close()
-      baseParents.delete(dir)
+      ancestorArms.delete(dir)
     }
-    for (const dir of baseNames.keys()) {
-      if (baseParents.has(dir)) continue
+    for (const dir of ancestorNames.keys()) {
+      if (ancestorArms.has(dir)) continue
       try {
-        baseParents.set(
+        ancestorArms.set(
           dir,
           arm(dir, false, (filename) => {
-            if (!baseNames.get(dir)?.has(filename)) return
+            if (!ancestorNames.get(dir)?.has(filename)) return
             reread = true
             const abs = path.join(dir, filename)
             trigger(path.relative(workspaceRoot, abs), abs)
@@ -716,7 +722,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
     }
   }
   const armBases = (): void => {
-    armBaseParents()
+    armAncestors()
     const want = new Set(memberBases)
     for (const [base, handle] of baseArms) {
       if (want.has(base) && !stale(base)) continue
@@ -740,7 +746,12 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
             // and cost an uncached task one execution per cycle (CI,
             // 2026-09-10).
             const now = memberEntries(base)
-            if (sameMembers(members, now)) return
+            // The same names, but a directory still without a package made
+            // again (or replaced by a rename): its pending watch holds the
+            // deleted one, and the `package.json` that lands next is heard
+            // only by a new arm.
+            const entry = path.join(base, filename)
+            if (sameMembers(members, now) && !(pending.has(entry) && stale(entry))) return
             members = now
             reread = true
             trigger(`${path.relative(workspaceRoot, base)}/${filename}`, path.join(base, filename))

package/src/cli/why.ts

@@ -16,7 +16,7 @@ import {
   whyDidThisRerunQuery as whyDidThisRerun,
   resolveRunId,
 } from '../orchestrator/index.js'
-import { nearMatches, printable, UserError } from '../util/index.js'
+import { MASKED, nearMatches, printable, UserError } from '../util/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { cliCacheDir, parseCacheDirFlag, warnToStderr } from './workspace-config.js'
 
@@ -245,14 +245,17 @@ export async function whyCmd(args: readonly string[]): Promise<number> {
       )
       const kindW = Math.max(...diff.entries.map((e) => e.kind.length), 4)
       for (const e of diff.entries) {
+        // A secret-named env input shows its name and its change, no hash.
         const beforeAfter =
-          e.change === 'added'
-            ? `+ ${e.after}`
-            : e.change === 'removed'
-              ? `- ${e.before}`
-              : `${e.before} → ${e.after}`
+          e.before === MASKED || e.after === MASKED
+            ? ''
+            : e.change === 'added'
+              ? `+ ${e.after}`
+              : e.change === 'removed'
+                ? `- ${e.before}`
+                : `${e.before} → ${e.after}`
         lines.push(
-          `    ${e.change.padEnd(7)} ${e.kind.padEnd(kindW)}  ${printable(e.name)}  ${beforeAfter}`,
+          `    ${e.change.padEnd(7)} ${e.kind.padEnd(kindW)}  ${printable(e.name)}  ${beforeAfter}`.trimEnd(),
         )
       }
       const kinds = [...new Set(diff.entries.map((e) => e.kind))].filter((k) => k in WHAT_TO_DO)

package/src/orchestrator/metrics.ts

@@ -14,7 +14,7 @@ import type { Database } from 'bun:sqlite'
 // rule written once cannot drift.
 import { KEYED_RUNS_SQL } from '../cache/index.js'
 import { splitTaskId } from '../graph/index.js'
-import { clampInt } from '../util/index.js'
+import { clampInt, MASKED, secretNamed } from '../util/index.js'
 import type { TaskInputComponent } from './task-hash.js'
 import { isPassStatus } from './telemetry.js'
 
@@ -557,6 +557,11 @@ export function diffKeyComponents(
   const old = new Map(before.map((c) => [id(c), c]))
   const entries: InputDiffEntry[] = []
   let unchangedCount = 0
+  // A secret-named env input's hash is its value, unsalted: a short one is
+  // recoverable from a log that printed `vx why` (M-62). The diff says it
+  // changed and never shows the hash.
+  const shown = (c: TaskInputComponent): string =>
+    c.kind === 'env' && secretNamed(c.name) ? MASKED : c.hash
   const keys = new Set<string>([...cur.keys(), ...old.keys()])
   for (const key of keys) {
     const a = cur.get(key)
@@ -568,13 +573,13 @@ export function diffKeyComponents(
           kind: a.kind,
           name: a.name,
           change: 'changed',
-          before: b.hash,
-          after: a.hash,
+          before: shown(b),
+          after: shown(a),
         })
     } else if (a) {
-      entries.push({ kind: a.kind, name: a.name, change: 'added', before: null, after: a.hash })
+      entries.push({ kind: a.kind, name: a.name, change: 'added', before: null, after: shown(a) })
     } else if (b) {
-      entries.push({ kind: b.kind, name: b.name, change: 'removed', before: b.hash, after: null })
+      entries.push({ kind: b.kind, name: b.name, change: 'removed', before: shown(b), after: null })
     }
   }
   // Code-unit order, not `localeCompare`: collation follows the machine's

package/src/util/index.ts

@@ -61,5 +61,6 @@ export {
   maskedLine,
   MASKED,
   secretMask,
+  secretNamed,
   type SecretMask,
 } from './secret-mask.js'

package/src/util/secret-mask.ts

@@ -23,7 +23,7 @@ const NOT_SECRET = /_(FILE|PATH|DIR)$|^GIT_CONFIG_KEY_\d+$/i
  */
 const secretNames = new Map<string, boolean>()
 
-function secretNamed(name: string): boolean {
+export function secretNamed(name: string): boolean {
   let secret = secretNames.get(name)
   if (secret === undefined) {
     secret = SECRET_NAME.test(name) && !NOT_SECRET.test(name)