@vzn/vx 0.0.454 → 0.0.456

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.454",
+  "version": "0.0.456",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.454",
-    "@vzn/vx-linux-arm64": "0.0.454",
-    "@vzn/vx-darwin-x64": "0.0.454",
-    "@vzn/vx-darwin-arm64": "0.0.454"
+    "@vzn/vx-linux-x64": "0.0.456",
+    "@vzn/vx-linux-arm64": "0.0.456",
+    "@vzn/vx-darwin-x64": "0.0.456",
+    "@vzn/vx-darwin-arm64": "0.0.456"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/completions.ts

@@ -5,7 +5,8 @@
 // project names are not (a completion that evaluates configs on every
 // Tab is the wrong price).
 
-import { acceptedFlags, CORE_VERBS, seeHelp } from './help.js'
+import { acceptedFlags, CORE_VERBS, flagHint, seeHelp } from './help.js'
+import { nearest } from '../util/index.js'
 
 export type CompletionShell = 'bash' | 'zsh' | 'fish'
 const SHELLS: readonly CompletionShell[] = ['bash', 'zsh', 'fish']
@@ -95,8 +96,17 @@ export async function completionsCmd(
 ): Promise<number> {
   const shell = args[0]
   if (args.length !== 1 || !(SHELLS as readonly string[]).includes(shell ?? '')) {
+    const flag = args.find((a) => a.startsWith('-'))
+    if (flag !== undefined) {
+      process.stderr.write(
+        `vx completions: unknown flag: ${flag}${flagHint('completions', flag)}${seeHelp('completions')}\n`,
+      )
+      return 1
+    }
+    const one = shell !== undefined && args.length === 1
+    const best = one ? nearest(shell, SHELLS) : undefined
     process.stderr.write(
-      `vx completions: expected one shell — bash, zsh or fish${shell !== undefined && args.length === 1 ? ` (got ${shell})` : ''}${seeHelp('completions')}\n`,
+      `vx completions: expected one shell — bash, zsh or fish${one ? ` (got ${shell})` : ''}${best === undefined ? '' : `. Did you mean ${best}?`}${seeHelp('completions')}\n`,
     )
     return 1
   }

package/src/cli/help.ts

@@ -216,7 +216,8 @@ export function refusedWord(arg: string): string {
 export function flagHint(verb: string, arg: string): string {
   if (!arg.startsWith('-')) return ''
   const name = arg.replace(/=.*$/, '')
-  const flags = acceptedFlags(verb)
+  // Every core verb answers `--help`, which no usage line spells.
+  const flags = ['--help', ...acceptedFlags(verb)]
   // `--json` is gh's and Nx's spelling; a verb with `--format` reads it
   // there, and no edit budget reaches `--format json` from `--json`.
   if (name === '--json' && flags.includes('--format')) return ' (did you mean --format json?)'

package/src/cli/index.ts

@@ -2,7 +2,7 @@
 // handler lives in a sibling `<name>.ts`; tests import its parsers there.
 
 import { VERSION } from '../version.js'
-import { CORE_VERBS, printHelp } from './help.js'
+import { CORE_VERBS, flagHint, printHelp, refusedWord, seeHelp } from './help.js'
 import { FOREIGN_VERBS } from './foreign-flags.js'
 import { isUserError, MOVED_VERBS, nearest, UserError } from '../util/index.js'
 
@@ -49,6 +49,12 @@ export async function run(argv: readonly string[]): Promise<number> {
           process.stderr.write(`${pointer}\n`)
           return 1
         }
+        if (unknown && verb.startsWith('-')) {
+          process.stderr.write(
+            `vx help: unknown flag: ${verb}${flagHint('help', verb)} (see \`vx help\`)\n`,
+          )
+          return 1
+        }
         if (unknown) {
           const declared = resolved === null ? [] : resolved.declaredVerbs
           process.stderr.write(
@@ -61,9 +67,19 @@ export async function run(argv: readonly string[]): Promise<number> {
       return 0
     }
     case '--version':
-    case 'version':
+    case 'version': {
+      // `vx version --hlp` printed the version and exited 0: a word it
+      // takes no more of is refused, as every other verb refuses one.
+      const extra = rest[0]
+      if (extra !== undefined) {
+        process.stderr.write(
+          `vx version: ${refusedWord(extra)}: ${extra}${flagHint('version', extra)}${seeHelp('version')}\n`,
+        )
+        return 1
+      }
       process.stdout.write(`vx ${VERSION}\n`)
       return 0
+    }
     case 'run':
       return await (await import('./run.js')).runCmd(rest)
     case 'watch':

package/src/cli/upgrade.ts

@@ -13,7 +13,7 @@
 // deno upgrade — "update" is what package managers do to indexes.
 
 import { chmod, chown, link, rename, rm, stat } from 'node:fs/promises'
-import { seeHelp } from './help.js'
+import { flagHint, seeHelp } from './help.js'
 import { UserError } from '../util/index.js'
 import { VERSION } from '../version.js'
 
@@ -275,7 +275,9 @@ export async function replaceBinary(
 export async function upgradeCmd(args: readonly string[]): Promise<number> {
   const unknown = args.find((a) => a.startsWith('-'))
   if (unknown !== undefined) {
-    process.stderr.write(`vx upgrade: unknown flag: ${unknown}${seeHelp('upgrade')}\n`)
+    process.stderr.write(
+      `vx upgrade: unknown flag: ${unknown}${flagHint('upgrade', unknown)}${seeHelp('upgrade')}\n`,
+    )
     return 1
   }
   // One release is installed; a second tag was dropped without a word and

package/src/orchestrator/execute-task.ts

@@ -36,7 +36,16 @@ import {
   sandboxReads,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { killGraceMs, maskedEmitter, printable, relPosix, secretMask, span } from '../util/index.js'
+import {
+  killGraceMs,
+  MASKED,
+  maskedEmitter,
+  printable,
+  relPosix,
+  secretMask,
+  secretNamed,
+  span,
+} from '../util/index.js'
 import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
@@ -778,6 +787,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
       })
     : undefined
+  // A name only `exec.env.secret` makes secret is not one the name rule
+  // sees later: its row carries the mark, so `vx why` hides its hash (M-63).
+  const named = node.config.exec?.env?.secret
+  if (named !== undefined)
+    for (const c of captured)
+      if (c.kind === 'env' && named.includes(c.name) && !secretNamed(c.name))
+        c.hash = MASKED + c.hash
   const inputs: TaskInputs | undefined = described?.inputs
   // A declared input set that resolves to NOTHING is the quiet stale hit:
   // the key stops moving with this project's source and every later run

package/src/orchestrator/metrics.ts

@@ -557,11 +557,12 @@ export function diffKeyComponents(
   const old = new Map(before.map((c) => [id(c), c]))
   const entries: InputDiffEntry[] = []
   let unchangedCount = 0
-  // A secret-named env input's hash is its value, unsalted: a short one is
+  // A secret env input's hash is its value, unsalted: a short one is
   // recoverable from a log that printed `vx why` (M-62). The diff says it
-  // changed and never shows the hash.
+  // changed and never shows the hash. Secret by name, or by the mark a
+  // task's `exec.env.secret` put on its row (M-63).
   const shown = (c: TaskInputComponent): string =>
-    c.kind === 'env' && secretNamed(c.name) ? MASKED : c.hash
+    c.kind === 'env' && (secretNamed(c.name) || c.hash.startsWith(MASKED)) ? MASKED : c.hash
   const keys = new Set<string>([...cur.keys(), ...old.keys()])
   for (const key of keys) {
     const a = cur.get(key)

package/src/workspace/config-schema.ts

@@ -536,7 +536,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
         if (typeof g !== 'string' || g.length === 0) {
           throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
         }
-        if (g.startsWith('/') || g.startsWith('!/')) {
+        if (isAbsoluteGlob(g)) {
           throw new UserError(
             `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
               `outputs must be project-relative globs`,
@@ -574,7 +574,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
         if (typeof g !== 'string' || g.length === 0) {
           throw new UserError(`${where}.cache.inputs.files must be an array of non-empty strings`)
         }
-        if (g.startsWith('/')) {
+        if (!g.startsWith('!/') && isAbsoluteGlob(g)) {
           throw new UserError(
             `${where}.cache.inputs.files: absolute paths are not allowed (got "${g}") — ` +
               `inputs must be project-relative globs`,
@@ -1025,7 +1025,19 @@ function namesDirItself(glob: string): boolean {
  */
 function hasParentSegment(glob: string): boolean {
   const g = glob.startsWith('!') ? glob.slice(1) : glob
-  return g.split('/').some((seg) => seg === '..')
+  // A brace alternative is a segment too: `{../shared,src}/**` splits on `/`
+  // into `{..`, so it passed, and its `..` arm matched nothing — an input
+  // that silently left the key (M-64).
+  return g.split(/[/{},]/).some((seg) => seg === '..')
+}
+
+/**
+ * True when a glob is absolute, or a brace alternative in it is:
+ * `{/etc,dist}/*` matched nothing outside and said so nowhere (M-64).
+ */
+function isAbsoluteGlob(glob: string): boolean {
+  const g = glob.startsWith('!') ? glob.slice(1) : glob
+  return g.startsWith('/') || (g.includes('{') && /[{,]\//.test(g))
 }
 
 /**
@@ -1203,7 +1215,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
     if (typeof g !== 'string' || g.length === 0) {
       throw new UserError(`${where} must be an array of non-empty strings`)
     }
-    if (g.startsWith('/') || g.startsWith('!/')) {
+    if (isAbsoluteGlob(g)) {
       throw new UserError(
         `${where}: absolute paths are not allowed (got "${g}") — ` +
           `entries are workspace-root-relative globs`,