@vzn/vx 0.0.455 → 0.0.457

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.455",
+  "version": "0.0.457",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.455",
-    "@vzn/vx-linux-arm64": "0.0.455",
-    "@vzn/vx-darwin-x64": "0.0.455",
-    "@vzn/vx-darwin-arm64": "0.0.455"
+    "@vzn/vx-linux-x64": "0.0.457",
+    "@vzn/vx-linux-arm64": "0.0.457",
+    "@vzn/vx-darwin-x64": "0.0.457",
+    "@vzn/vx-darwin-arm64": "0.0.457"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/archive.ts

@@ -41,6 +41,7 @@ import { chmodSync, renameSync, statSync, utimesSync } from 'node:fs'
 import { lstat, mkdir, readlink, realpath, rmdir, stat, unlink, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import { UserError } from '../util/index.js'
+import { WORKSPACE_OUTPUT_PREFIX } from './layer.js'
 import { TarFormatError, type TarInput, tarEntries, tarPack, tarSize } from './tar-stream.js'
 
 /** Archive entry name carrying the per-output mode/mtime sidecar. */
@@ -236,11 +237,17 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
       // file's bytes and comes back as a regular file. A link to a
       // directory, or a dangling one, has no bytes to pack: refuse loudly
       // rather than store an entry that restores to nothing.
-      const shown = name.startsWith('outputs/') ? name.slice('outputs/'.length) : name
+      // The path as the config spells it: a root-anchored output's entry
+      // name is vx's own `workspace-outputs/…` (M-66).
+      const shown = name.startsWith('outputs/')
+        ? `output ${name.slice('outputs/'.length)}`
+        : name.startsWith(WORKSPACE_OUTPUT_PREFIX)
+          ? `workspaceFiles output ${name.slice(WORKSPACE_OUTPUT_PREFIX.length)}`
+          : `output ${name}`
       const dangling = (err: NodeJS.ErrnoException): never => {
         if (err.code === 'ENOENT') {
           throw new UserError(
-            `output ${shown} is a dangling symlink: vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
+            `${shown} is a dangling symlink: vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
           )
         }
         throw err
@@ -256,7 +263,7 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
           const root = await withinReal
           if (!src.startsWith(root + path.sep) && !(await ownOutputs()).has(src)) {
             throw new UserError(
-              `output ${shown} is a symlink to ${src}, outside the project: vx packs a symlinked output as its target's bytes, and a project's outputs come from its own directory — emit a file there, or take it back with a '!' entry`,
+              `${shown} is a symlink to ${src}, outside the project: vx packs a symlinked output as its target's bytes, and a project's outputs come from its own directory — emit a file there, or take it back with a '!' entry`,
             )
           }
         }
@@ -264,7 +271,7 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
       }
       if (!st.isFile()) {
         throw new UserError(
-          `output ${shown} is not a regular file (a symlink to a directory?): vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
+          `${shown} is not a regular file (a symlink to a directory?): vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
         )
       }
       const mode = st.mode & 0o777

package/src/cli/completions.ts

@@ -5,7 +5,8 @@
 // project names are not (a completion that evaluates configs on every
 // Tab is the wrong price).
 
-import { acceptedFlags, CORE_VERBS, seeHelp } from './help.js'
+import { acceptedFlags, CORE_VERBS, flagHint, seeHelp } from './help.js'
+import { nearest } from '../util/index.js'
 
 export type CompletionShell = 'bash' | 'zsh' | 'fish'
 const SHELLS: readonly CompletionShell[] = ['bash', 'zsh', 'fish']
@@ -95,8 +96,17 @@ export async function completionsCmd(
 ): Promise<number> {
   const shell = args[0]
   if (args.length !== 1 || !(SHELLS as readonly string[]).includes(shell ?? '')) {
+    const flag = args.find((a) => a.startsWith('-'))
+    if (flag !== undefined) {
+      process.stderr.write(
+        `vx completions: unknown flag: ${flag}${flagHint('completions', flag)}${seeHelp('completions')}\n`,
+      )
+      return 1
+    }
+    const one = shell !== undefined && args.length === 1
+    const best = one ? nearest(shell, SHELLS) : undefined
     process.stderr.write(
-      `vx completions: expected one shell — bash, zsh or fish${shell !== undefined && args.length === 1 ? ` (got ${shell})` : ''}${seeHelp('completions')}\n`,
+      `vx completions: expected one shell — bash, zsh or fish${one ? ` (got ${shell})` : ''}${best === undefined ? '' : `. Did you mean ${best}?`}${seeHelp('completions')}\n`,
     )
     return 1
   }

package/src/cli/help.ts

@@ -216,7 +216,8 @@ export function refusedWord(arg: string): string {
 export function flagHint(verb: string, arg: string): string {
   if (!arg.startsWith('-')) return ''
   const name = arg.replace(/=.*$/, '')
-  const flags = acceptedFlags(verb)
+  // Every core verb answers `--help`, which no usage line spells.
+  const flags = ['--help', ...acceptedFlags(verb)]
   // `--json` is gh's and Nx's spelling; a verb with `--format` reads it
   // there, and no edit budget reaches `--format json` from `--json`.
   if (name === '--json' && flags.includes('--format')) return ' (did you mean --format json?)'

package/src/cli/index.ts

@@ -2,7 +2,7 @@
 // handler lives in a sibling `<name>.ts`; tests import its parsers there.
 
 import { VERSION } from '../version.js'
-import { CORE_VERBS, printHelp } from './help.js'
+import { CORE_VERBS, flagHint, printHelp, refusedWord, seeHelp } from './help.js'
 import { FOREIGN_VERBS } from './foreign-flags.js'
 import { isUserError, MOVED_VERBS, nearest, UserError } from '../util/index.js'
 
@@ -28,7 +28,20 @@ export async function run(argv: readonly string[]): Promise<number> {
   }
 
   switch (command) {
-    case undefined:
+    case undefined: {
+      // A bare `vx` where no workspace is printed 151 lines of help, none
+      // of which says the one thing wrong: there is nothing here to run.
+      const { findWorkspaceRoot } = await import('../workspace/index.js')
+      try {
+        await findWorkspaceRoot(process.cwd())
+      } catch (err) {
+        if (!isUserError(err)) throw err
+        process.stderr.write(`vx: ${err.message}; \`vx help\` lists the verbs\n`)
+        return 1
+      }
+      printHelp(await (await plugins()).pluginCommandHelp())
+      return 0
+    }
     case '--help':
     case '-h':
       printHelp(await (await plugins()).pluginCommandHelp())
@@ -49,6 +62,12 @@ export async function run(argv: readonly string[]): Promise<number> {
           process.stderr.write(`${pointer}\n`)
           return 1
         }
+        if (unknown && verb.startsWith('-')) {
+          process.stderr.write(
+            `vx help: unknown flag: ${verb}${flagHint('help', verb)} (see \`vx help\`)\n`,
+          )
+          return 1
+        }
         if (unknown) {
           const declared = resolved === null ? [] : resolved.declaredVerbs
           process.stderr.write(
@@ -61,9 +80,19 @@ export async function run(argv: readonly string[]): Promise<number> {
       return 0
     }
     case '--version':
-    case 'version':
+    case 'version': {
+      // `vx version --hlp` printed the version and exited 0: a word it
+      // takes no more of is refused, as every other verb refuses one.
+      const extra = rest[0]
+      if (extra !== undefined) {
+        process.stderr.write(
+          `vx version: ${refusedWord(extra)}: ${extra}${flagHint('version', extra)}${seeHelp('version')}\n`,
+        )
+        return 1
+      }
       process.stdout.write(`vx ${VERSION}\n`)
       return 0
+    }
     case 'run':
       return await (await import('./run.js')).runCmd(rest)
     case 'watch':

package/src/cli/upgrade.ts

@@ -13,7 +13,7 @@
 // deno upgrade — "update" is what package managers do to indexes.
 
 import { chmod, chown, link, rename, rm, stat } from 'node:fs/promises'
-import { seeHelp } from './help.js'
+import { flagHint, seeHelp } from './help.js'
 import { UserError } from '../util/index.js'
 import { VERSION } from '../version.js'
 
@@ -275,7 +275,9 @@ export async function replaceBinary(
 export async function upgradeCmd(args: readonly string[]): Promise<number> {
   const unknown = args.find((a) => a.startsWith('-'))
   if (unknown !== undefined) {
-    process.stderr.write(`vx upgrade: unknown flag: ${unknown}${seeHelp('upgrade')}\n`)
+    process.stderr.write(
+      `vx upgrade: unknown flag: ${unknown}${flagHint('upgrade', unknown)}${seeHelp('upgrade')}\n`,
+    )
     return 1
   }
   // One release is installed; a second tag was dropped without a word and

package/src/orchestrator/execute-task.ts

@@ -36,7 +36,16 @@ import {
   sandboxReads,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { killGraceMs, maskedEmitter, printable, relPosix, secretMask, span } from '../util/index.js'
+import {
+  killGraceMs,
+  MASKED,
+  maskedEmitter,
+  printable,
+  relPosix,
+  secretMask,
+  secretNamed,
+  span,
+} from '../util/index.js'
 import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
@@ -778,6 +787,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
       })
     : undefined
+  // A name only `exec.env.secret` makes secret is not one the name rule
+  // sees later: its row carries the mark, so `vx why` hides its hash (M-63).
+  const named = node.config.exec?.env?.secret
+  if (named !== undefined)
+    for (const c of captured)
+      if (c.kind === 'env' && named.includes(c.name) && !secretNamed(c.name))
+        c.hash = MASKED + c.hash
   const inputs: TaskInputs | undefined = described?.inputs
   // A declared input set that resolves to NOTHING is the quiet stale hit:
   // the key stops moving with this project's source and every later run

package/src/orchestrator/metrics.ts

@@ -557,11 +557,12 @@ export function diffKeyComponents(
   const old = new Map(before.map((c) => [id(c), c]))
   const entries: InputDiffEntry[] = []
   let unchangedCount = 0
-  // A secret-named env input's hash is its value, unsalted: a short one is
+  // A secret env input's hash is its value, unsalted: a short one is
   // recoverable from a log that printed `vx why` (M-62). The diff says it
-  // changed and never shows the hash.
+  // changed and never shows the hash. Secret by name, or by the mark a
+  // task's `exec.env.secret` put on its row (M-63).
   const shown = (c: TaskInputComponent): string =>
-    c.kind === 'env' && secretNamed(c.name) ? MASKED : c.hash
+    c.kind === 'env' && (secretNamed(c.name) || c.hash.startsWith(MASKED)) ? MASKED : c.hash
   const keys = new Set<string>([...cur.keys(), ...old.keys()])
   for (const key of keys) {
     const a = cur.get(key)