@vzn/vx 0.0.50 → 0.0.51

package/src/orchestrator/summary.ts

@@ -326,23 +326,34 @@ export function formatRunSummary(
 }
 
 /**
- * Post-summary section naming the tasks a shutdown signal killed. An aborted
- * task did no work, so it is in no tally bucket and no history row — but the
- * run still exits non-zero, and without this the user reads a red exit over a
- * fully green summary that names nothing. The interactive Ctrl-C path never
- * gets here (the signal handler exits before any outcome lands), so this only
- * ever prints for a run that reached its summary WITH a task killed by some
- * other signal — an external `kill`, a supervisor, a self-terminating child.
- * Empty when nothing aborted.
+ * Post-summary section naming the tasks a shutdown signal killed, and those
+ * the stop reached before they ran. An aborted task did no work, so it is in
+ * no tally bucket and no history row — but the run still exits non-zero, and
+ * without this the user reads a red exit over a fully green summary that
+ * names nothing. Empty when nothing aborted.
  */
 export function formatAbortedSection(outcomes: readonly TaskOutcome[]): string[] {
-  const aborted = outcomes.filter((o) => o.status === 'aborted')
-  if (aborted.length === 0) return []
-  const lines = [
-    '',
-    `  Aborted:  ${aborted.length} task${aborted.length === 1 ? '' : 's'} killed by a shutdown signal — not counted above`,
-  ]
-  for (const o of aborted) lines.push(`    ✗ ${o.node.id} — exit ${o.exitCode}, nothing cached`)
+  // The scheduler marks what the stop reached before dispatch `aborted` too,
+  // with an invented exit 1: listed as killed, a task that never ran read as
+  // one the signal cut short (item 1062). Only a started one carries a
+  // wall-clock start. A group is no task here, as in the skipped section.
+  const aborted = outcomes.filter((o) => o.status === 'aborted' && !isGroupTask(o.node))
+  const killed = aborted.filter((o) => o.wallclockStartNs !== undefined)
+  const unstarted = aborted.filter((o) => o.wallclockStartNs === undefined)
+  const tasks = (n: number): string => `${n} task${n === 1 ? '' : 's'}`
+  const lines: string[] = []
+  if (killed.length > 0) {
+    lines.push(
+      '',
+      `  Aborted:  ${tasks(killed.length)} killed by a shutdown signal — not counted above`,
+    )
+    for (const o of killed) lines.push(`    ✗ ${o.node.id} — exit ${o.exitCode}, nothing cached`)
+  }
+  if (unstarted.length > 0) {
+    const they = unstarted.length === 1 ? 'it' : 'they'
+    lines.push('', `  Not started:  ${tasks(unstarted.length)} the run stopped before ${they} ran`)
+    for (const o of unstarted) lines.push(`    · ${o.node.id}`)
+  }
   return lines
 }
 

package/src/orchestrator/task-hash.ts

@@ -6,6 +6,7 @@ import {
   type CacheKeyInput,
   type CacheLayer,
   FILE_HASH_RACY_MS,
+  racyWindowMs,
   resolveInputs,
   type GitFilesCache,
   WORKSPACE_OUTPUT_PREFIX,
@@ -222,8 +223,12 @@ export async function movedInput(
     } catch {
       return f.path
     }
-    if (commandFrom !== undefined && ctimeMs >= commandFrom) return f.path
-    if (ctimeMs >= f.since - FILE_HASH_RACY_MS) suspects.push(f)
+    // A whole-second stamp may stand for any write in its second, one
+    // during the command included (`racyWindowMs`).
+    if (commandFrom !== undefined && ctimeMs >= commandFrom - racyWindowMs(ctimeMs, 0)) {
+      return f.path
+    }
+    if (ctimeMs >= f.since - racyWindowMs(ctimeMs, FILE_HASH_RACY_MS)) suspects.push(f)
   }
   for (const f of suspects) {
     const now = await cache.hashFile(f.path).catch(() => undefined)

package/src/orchestrator/telemetry.ts

@@ -107,7 +107,7 @@ export interface RunContextRecord {
   /** ULID, shared by every record in one `vx run`. */
   runId: string
   vxVersion: string
-  /** The invocation command line (process.argv-derived). */
+  /** The invocation command line (process.argv-derived), what follows `--` counted, not quoted. */
   command: string
   requestedTasks: readonly string[]
   /** Compact cache-policy flags, e.g. `'lR,lW,rR,rW'`. */
@@ -318,8 +318,14 @@ export interface TelemetrySink {
    * Losing a slow sink's telemetry is strictly better than the alternative:
    * `run()` never returns, so the cache never closes and `vx` exits 0 on a
    * failed run.
+   *
+   * `signal` aborts at that deadline. Abandoning a flush does not end its
+   * I/O: a request still in flight keeps the event loop, and so the
+   * process, alive after the run has returned — a hanging GitHub API held
+   * `vx run` open until the CI job's own timeout (item 1055). A sink passes
+   * the signal to its `fetch` (or closes its socket on it).
    */
-  flush?(): Promise<void>
+  flush?(signal: AbortSignal): Promise<void>
 }
 
 /** Read-only context a sink is created with. No mutable run handle — the
@@ -496,12 +502,13 @@ export function createTelemetrySource(args: {
       // pending — Bun exits 0 and a FAILED run reports green, with the cache's
       // accessed_at bumps and every later plugin's teardown lost with it.
       // Sinks race concurrently, so each still gets the whole budget.
+      const deadline = new AbortController()
       const settled = await settleWithin(
         Promise.all(
           sinks.map(async (sink) => {
             if (disabled.has(sink) || sink.flush === undefined) return
             try {
-              await sink.flush()
+              await sink.flush(deadline.signal)
             } catch (err) {
               // A flush failure can never break the run — but it still costs
               // this sink its export, so say so rather than dropping it.
@@ -513,7 +520,10 @@ export function createTelemetrySource(args: {
         ),
         ms,
       )
-      if (!settled) warn?.(`[vx] telemetry flush timed out after ${ms}ms; buffered records lost`)
+      if (!settled) {
+        deadline.abort(new Error(`telemetry flush deadline (${ms}ms)`))
+        warn?.(`[vx] telemetry flush timed out after ${ms}ms; buffered records lost`)
+      }
     },
   }
 }

package/src/util/paths.ts

@@ -69,21 +69,28 @@ function prefixOf(glob: string, wildcards: RegExp): string {
 
 /**
  * The directories a task's declared outputs cover WHOLE — every glob is
- * `<dir>/**` with a plain, non-root, non-escaping `<dir>` — or `null` when
- * any glob is shaped otherwise. The directory-mtime short-circuit on a warm
- * hit (`Cache.outputDirsCurrent`) is sound only for whole subtrees: with
- * every directory under `<dir>` recorded, a file added or removed anywhere
- * the glob could see bumps a recorded directory's mtime (its parent, or a
- * new directory whose creation bumped a recorded ancestor). A root-anchored
- * `**\/*.js` has no such closed set, so it keeps the walk.
+ * `<dir>/**` or a bare literal (which `asTrees` reads as the path or the
+ * tree under it), with a plain, non-root, non-escaping `<dir>` — or `null`
+ * when any glob is shaped otherwise. The directory-mtime short-circuit on a
+ * warm hit (`Cache.outputDirsCurrent`) is sound only for whole subtrees:
+ * with every directory under `<dir>` recorded, a file added or removed
+ * anywhere the glob could see bumps a recorded directory's mtime (its
+ * parent, or a new directory whose creation bumped a recorded ancestor). A
+ * root-anchored `**\/*.js` has no such closed set, so it keeps the walk.
+ * A literal that names a FILE is no directory: the snapshot refuses it
+ * whole (`recordOutputDirs`) and that task keeps the walk too, so the
+ * literal costs nothing it did not cost before; one that names a directory
+ * gets the same stats a `<dir>/**` does (Next 27: an nx() output file
+ * had to be `<dir>/**` to keep the short-circuit, and saved nothing).
  */
 export function wholeSubtreePrefixes(globs: readonly string[]): string[] | null {
   if (globs.length === 0) return null
   const out: string[] = []
   for (const g of globs.map(normalizeGlob)) {
     const m = /^([^*?{}!]+?)\/\*\*$/.exec(g)
-    if (m === null) return null
-    const dir = m[1]!.replace(/\/+$/, '')
+    const whole = m?.[1] ?? (isLiteralPattern(g) && !g.startsWith('!') ? g : null)
+    if (whole === null) return null
+    const dir = whole.replace(/\/+$/, '')
     if (dir === '' || dir === '.' || dir.startsWith('/') || dir.split('/').includes('..'))
       return null
     out.push(dir)

package/src/workspace/affected.ts

@@ -21,6 +21,7 @@ import { configImportOwners } from './config-imports.js'
 import { configImports } from './config-cache.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
+import { buildPackageGraph } from './package-graph.js'
 import type { PackageJson, ProjectMeta } from './workspace.js'
 
 /**
@@ -42,9 +43,19 @@ function spawnGitSync(
   }
 }
 
-function spawnGit(args: string[], cwd: string): Bun.Subprocess<'ignore', 'pipe', 'pipe'> {
+function spawnGit(
+  args: string[],
+  cwd: string,
+  stdin?: Uint8Array,
+): Bun.Subprocess<Uint8Array | 'ignore', 'pipe', 'pipe'> {
   try {
-    return Bun.spawn({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr: 'pipe' })
+    return Bun.spawn({
+      cmd: [executablePath('git'), ...args],
+      cwd,
+      stdin: stdin ?? 'ignore',
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
   } catch (err) {
     if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
     throw err
@@ -79,6 +90,13 @@ export interface AffectedArgs {
    * — the common one — never needs it.
    */
   fingerprintClaims?: () => Promise<FingerprintClaims>
+  /**
+   * The cross-project `dependsOn` edges, project → the projects its tasks
+   * name. Asked only when a package's name moved or it was removed: a
+   * config naming `dependsOn: ['lib#build']` breaks on it, which the
+   * package graph cannot see (item 1085).
+   */
+  taskEdges?: () => Promise<ReadonlyMap<string, readonly string[]>>
 }
 
 export interface FingerprintClaims {
@@ -225,13 +243,28 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
   for (const name of claimedOwned) owned.add(name)
 
-  // A package the change REMOVED is no project now, so containment maps its
-  // paths to nothing, and the dependents walk sees only today's graph: a
-  // `git rm -r pkgs/lib`, or `lib` dropped from `workspaces`, re-keyed and
-  // broke `app#build` while `--affected` said nothing affected (item 959).
-  const dependents = await dependentsOfRemoved(args.workspaceRoot, base, changed, args.projects)
-  if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
-  for (const name of dependents) owned.add(name)
+  // A manifest edit can drop an edge today's graph no longer shows: a
+  // package the change REMOVED is no project now (a `git rm -r pkgs/lib`,
+  // or `lib` dropped from `workspaces`, item 959), and one whose `version`
+  // or `name` moved no longer satisfies what a dependent declares. Either
+  // re-keys the dependent through its upstream, while containment maps the
+  // change to the package alone and the dependents walk sees only today's
+  // graph, so `--affected` left `app#build` out (D-3).
+  const manifests = changed.filter((rel) => path.posix.basename(rel) === 'package.json')
+  if (manifests.length > 0) {
+    const atBase = await gitBlobsAt(args.workspaceRoot, base, manifests)
+    const dependents = await dependentsAtBase(
+      args.workspaceRoot,
+      atBase,
+      args.projects,
+      args.taskEdges,
+    )
+    if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
+    for (const name of dependents) owned.add(name)
+    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, args.projects)) {
+      owned.add(name)
+    }
+  }
 
   // THIRD CHANNEL: a project whose `vx.config.*` IMPORTS a changed file.
   // Resolved-config hashing folds those values into the key, so the same
@@ -254,22 +287,27 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
 }
 
 /**
- * The projects that depend on a package the change removed: a
- * `<dir>/package.json` the base had and the tree does not, read at the base
- * for its name. `undefined` (every project) when the root manifest's
- * `workspaces` moved: which packages left is a discovery at the base, and
- * selection cannot tell cheaply. Only DELETED manifests are read at the
- * base, one `git show` each; an edited one stays a project and is owned.
+ * The projects whose workspace dependencies at the base differ from
+ * today's: the package graph is built again over the changed manifests as
+ * the base had them, and every project whose `directDeps` (the edges its
+ * key folds) moved is selected. `undefined` (every project) when the root
+ * manifest's `workspaces` moved: which packages left is a discovery at the
+ * base, and selection cannot tell cheaply. `atBase` holds each changed
+ * manifest as the base had it, read in one `git cat-file --batch`.
  */
-async function dependentsOfRemoved(
+async function dependentsAtBase(
   workspaceRoot: string,
-  base: string,
-  changed: readonly string[],
+  atBase: ReadonlyMap<string, Uint8Array | null>,
   projects: readonly ProjectMeta[],
+  taskEdges: AffectedArgs['taskEdges'],
 ): Promise<Set<string> | undefined> {
-  const out = new Set<string>()
-  const removed = new Set<string>()
-  for (const rel of changed) {
+  const byDir = new Map<string, ProjectMeta>()
+  for (const p of projects) byDir.set(p.dir, p)
+  const nameNow = new Map(projects.map((p) => [p.dir, p.name]))
+  // Base names no project holds today: a removed or renamed package.
+  const gone = new Set<string>()
+  const changedDirs = new Set<string>()
+  for (const rel of atBase.keys()) {
     if (rel === 'package.json') {
       const workspacesOf = (bytes: Uint8Array | null): string => {
         if (bytes === null) return ''
@@ -281,37 +319,141 @@ async function dependentsOfRemoved(
           return 'unreadable'
         }
       }
-      const before = workspacesOf(await gitBytesAt(workspaceRoot, base, rel))
+      const before = workspacesOf(atBase.get(rel) ?? null)
       const after = workspacesOf(await bytesOrNull(path.join(workspaceRoot, rel)))
       if (before !== after) return undefined
-      continue
     }
-    if (path.posix.basename(rel) !== 'package.json') continue
-    if ((await bytesOrNull(path.join(workspaceRoot, rel))) !== null) continue
-    const bytes = await gitBytesAt(workspaceRoot, base, rel)
-    if (bytes === null) continue
+    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
+    changedDirs.add(dir)
+    byDir.delete(dir)
+    const bytes = atBase.get(rel)
+    if (bytes === undefined || bytes === null) continue
+    let pkg: PackageJson
     try {
-      const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
-      if (typeof name === 'string' && name !== '') removed.add(name)
+      pkg = JSON.parse(new TextDecoder().decode(bytes)) as PackageJson
     } catch {
       // A manifest that did not parse at the base named no package.
+      continue
     }
+    if (
+      pkg === null ||
+      typeof pkg !== 'object' ||
+      typeof pkg.name !== 'string' ||
+      pkg.name === ''
+    ) {
+      continue
+    }
+    byDir.set(dir, { name: pkg.name, dir, packageJson: pkg, configPath: null })
+    if (nameNow.get(dir) !== pkg.name) gone.add(pkg.name)
   }
-  if (removed.size === 0) return out
+  const now = buildPackageGraph([...projects])
+  const then = buildPackageGraph([...byDir.values()])
+  const out = new Set<string>()
   for (const p of projects) {
-    const pkg = p.packageJson
-    for (const deps of [
-      pkg.dependencies,
-      pkg.devDependencies,
-      pkg.peerDependencies,
-      pkg.optionalDependencies,
-    ]) {
-      if (deps !== undefined && Object.keys(deps).some((d) => removed.has(d))) out.add(p.name)
+    // A project whose own manifest changed is owned by containment.
+    if (changedDirs.has(p.dir)) continue
+    const a = now.directDeps(p.name)
+    const b = then.directDeps(p.name)
+    if (a.length !== b.length || a.some((d, i) => d !== b[i])) out.add(p.name)
+  }
+  if (gone.size > 0 && taskEdges !== undefined) {
+    for (const [project, targets] of await taskEdges()) {
+      if (targets.some((t) => gone.has(t))) out.add(project)
     }
   }
   return out
 }
 
+/**
+ * The projects a NEW nested project took files from. A project's inputs
+ * stop at every project below it, so a `package.json` that makes an
+ * existing directory a project re-keys the project above it — its
+ * `**` lost the directory's files — while containment maps the change to
+ * the new project alone, and `--affected` left the re-keyed parent out.
+ * "New" is judged at the base: no manifest there, or one with no name,
+ * which discovery skips. `atBase` holds each changed manifest there.
+ */
+function parentsOfNewNested(
+  workspaceRoot: string,
+  atBase: ReadonlyMap<string, Uint8Array | null>,
+  projects: readonly ProjectMeta[],
+): Set<string> {
+  const out = new Set<string>()
+  const dirToName = new Map<string, string>()
+  for (const p of projects) dirToName.set(p.dir, p.name)
+  for (const [rel, bytes] of atBase) {
+    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
+    if (!dirToName.has(dir)) continue
+    let parent: string | undefined
+    for (let d = path.dirname(dir); parent === undefined; d = path.dirname(d)) {
+      parent = dirToName.get(d)
+      if (path.dirname(d) === d) break
+    }
+    if (parent === undefined || out.has(parent)) continue
+    let named = false
+    if (bytes !== null) {
+      try {
+        const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
+        named = typeof name === 'string' && name !== ''
+      } catch {
+        // A manifest that did not parse at the base named no project.
+      }
+    }
+    if (!named) out.add(parent)
+  }
+  return out
+}
+
+/**
+ * Each of `files` (workspace-root-relative) as `ref` has it, in one `git
+ * cat-file --batch`: null for a file the ref does not have. `./` anchors
+ * each path to the cwd, the workspace root, as `gitBytesAt` does.
+ */
+async function gitBlobsAt(
+  workspaceRoot: string,
+  ref: string,
+  files: readonly string[],
+): Promise<Map<string, Uint8Array | null>> {
+  const blobs = new Map<string, Uint8Array | null>()
+  // The batch reads one path per line; a name holding a newline asks alone.
+  const batched: string[] = []
+  for (const file of files) {
+    if (file.includes('\n')) blobs.set(file, await gitBytesAt(workspaceRoot, ref, file))
+    else batched.push(file)
+  }
+  if (batched.length === 0) return blobs
+  const proc = spawnGit(
+    ['cat-file', '--batch'],
+    workspaceRoot,
+    new TextEncoder().encode(batched.map((f) => `${ref}:./${f}\n`).join('')),
+  )
+  const [out, stderr, exit] = await Promise.all([
+    new Response(proc.stdout).bytes(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  if (exit !== 0) {
+    throw new UserError(`git cat-file --batch failed (exit ${exit}): ${stderr.trim()}`)
+  }
+  let at = 0
+  for (const file of batched) {
+    const eol = out.indexOf(0x0a, at)
+    if (eol === -1) throw new UserError(`git cat-file --batch ended before ${ref}:./${file}`)
+    const header = new TextDecoder().decode(out.subarray(at, eol))
+    at = eol + 1
+    // `<oid> <type> <size>`, or `<spec> missing` / `<spec> ambiguous`.
+    const m = /^[0-9a-f]{40,64} (\w+) (\d+)$/.exec(header)
+    if (m === null) {
+      blobs.set(file, null)
+      continue
+    }
+    const size = Number(m[2])
+    blobs.set(file, m[1] === 'blob' ? out.slice(at, at + size) : null)
+    at += size + 1
+  }
+  return blobs
+}
+
 /**
  * Whether `changed` holds the workspace config or a file it imports by
  * relative specifier. Its plugins' `config` and `project` stages shape
@@ -505,6 +647,14 @@ function isDirectory(abs: string): boolean {
   }
 }
 
+function realpathOr(p: string): string {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
@@ -519,6 +669,19 @@ function projectsContaining(
   // pays for.
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir, p.name)
+  // A member linked in from elsewhere in the tree (`pkgs/b -> ../ext/b`) is
+  // indexed by its link, and git reports its files at their real place
+  // (`ext/b/src/a.txt`), which resolved to no project: an edit there
+  // selected nothing (item 1079). Its real place under the root is indexed
+  // too. One realpath per member, and only on an --affected run.
+  const realRoot = realpathOr(workspaceRoot)
+  for (const p of projects) {
+    const real = realpathOr(p.dir)
+    const rel = path.relative(realRoot, real)
+    if (rel.startsWith('..') || path.isAbsolute(rel)) continue
+    const spelled = path.resolve(workspaceRoot, rel)
+    if (spelled !== p.dir && !dirToName.has(spelled)) dirToName.set(spelled, p.name)
+  }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
     let dir = path.resolve(workspaceRoot, rel)

package/src/workspace/config-eval.ts

@@ -45,7 +45,10 @@ self.onmessage = async (e) => {
   const { id, path } = e.data
   try {
     const ns = await import(path)
-    const mod = ns?.default
+    // Awaited as the in-process load's async return flattens it: a Promise
+    // default loaded on a run and was refused as "an instance of Promise"
+    // on every later evaluation in the process (D-5).
+    const mod = await ns?.default
     const isObject = mod !== null && typeof mod === 'object'
     const nonJson = isObject ? nonJsonPaths(mod) : []
     postMessage({

package/src/workspace/config-schema.ts

@@ -282,9 +282,16 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       const sandbox = (exec as { sandbox?: unknown }).sandbox
       if (sandbox !== undefined) validateSandbox(sandbox, `${where}.exec`)
       const command = (exec as { command?: unknown }).command
-      if (typeof command !== 'string' || command.length === 0) {
+      // Whitespace alone ran as a shell no-op, green and cached (item 1099).
+      if (typeof command !== 'string' || command.trim().length === 0) {
         throw new UserError(`${where}.exec.command must be a non-empty string`)
       }
+      // No argv can carry a NUL: the spawn refused it and the task failed
+      // as exit 127, "not on this task's PATH", with the NUL printed as a
+      // space (D-4), as an env name with one did before item 999.
+      if (command.includes('\0')) {
+        throw new UserError(`${where}.exec.command holds a NUL, which no command line can carry`)
+      }
       const timeout = (exec as { timeout?: unknown }).timeout
       if (timeout !== undefined) {
         if (typeof timeout !== 'number' || !Number.isInteger(timeout) || timeout <= 0) {
@@ -329,6 +336,16 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `${where}.exec.env.passThrough must be an array of env var names (non-empty, no '=' or NUL)`,
             )
           }
+          // `VITE_*` passed nothing through and loaded clean (Turbo's
+          // passThroughEnv expands it), where `cache.inputs.env` refused the
+          // same text below: one refusal for the class (item 1090).
+          const wild = (passThrough as string[]).find((n) => BUN_GLOB_WILDCARDS.test(n))
+          if (wild !== undefined) {
+            throw new UserError(
+              `${where}.exec.env.passThrough: wildcards in env names are not supported ` +
+                `(got "${wild}") — list explicit env var names instead`,
+            )
+          }
         }
         const define = (env as { define?: unknown }).define
         if (define !== undefined) {
@@ -582,9 +599,12 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       for (const field of ['runtime', 'workspaceRuntime'] as const) {
         const list = (inputs as Record<string, unknown>)[field]
         if (list !== undefined) {
-          if (!Array.isArray(list) || list.some((s) => typeof s !== 'string' || s.length === 0)) {
+          if (
+            !Array.isArray(list) ||
+            list.some((s) => typeof s !== 'string' || s.length === 0 || s.includes('\0'))
+          ) {
             throw new UserError(
-              `${where}.cache.inputs.${field} must be an array of non-empty shell command strings`,
+              `${where}.cache.inputs.${field} must be an array of non-empty shell command strings with no NUL`,
             )
           }
         }
@@ -633,6 +653,40 @@ const CACHE_INPUT_FIELDS = new Set([
 ])
 const CACHE_OUTPUT_FIELDS = new Set(['files', 'workspaceFiles'])
 
+/** A field a release took out of the schema, and what took its place. */
+interface Removal {
+  /** The vx version whose schema first refused it. */
+  removedIn: string
+  /** What to write instead, as a sentence fragment after "use". */
+  use: string
+}
+
+/**
+ * Fields the schema once accepted, by the level that held them (keyed by
+ * that level's field set). A removed field is refused naming its
+ * replacement and the version that removed it, never as an unknown field a
+ * reader must research (docs/design/versioning-1.0.md § Deprecation). An
+ * entry stays for good: a config written against an old release meets it
+ * whenever it upgrades.
+ */
+export const REMOVED_FIELDS: ReadonlyMap<
+  ReadonlySet<string>,
+  Readonly<Record<string, Removal>>
+> = new Map([
+  [
+    EXEC_FIELDS,
+    {
+      // Reservations left core with the `admit` seam (item 157).
+      resources: {
+        removedIn: '0.0.19',
+        use:
+          "`@vzn/vx-schedule-history`, which learns each task's reservation from its run " +
+          "history (declare one by hand with its `reservations: { 'pkg#task': { cpus, memory } }`)",
+      },
+    },
+  ],
+])
+
 function assertKnownFields(value: object, allowed: ReadonlySet<string>, where: string): void {
   // `typeof [] === 'object'`, so an array reaches here and its indices read
   // as fields: `outputs: ['dist/**']` (Turbo's spelling) was refused as
@@ -645,6 +699,12 @@ function assertKnownFields(value: object, allowed: ReadonlySet<string>, where: s
   }
   for (const key of Object.keys(value)) {
     if (!allowed.has(key)) {
+      const removal = REMOVED_FIELDS.get(allowed)?.[key]
+      if (removal !== undefined) {
+        throw new UserError(
+          `${where} has field "${key}", which vx ${removal.removedIn} removed — use ${removal.use}`,
+        )
+      }
       // The nearest accepted spelling first: the list says what the level
       // takes, the hint says which one was meant.
       const near = nearest(key, allowed)
@@ -934,6 +994,7 @@ const GRANT_FIELDS = new Set<string>([
   'unixSockets',
 ])
 const DENY_FIELDS = new Set(['network'])
+const IGNORE_FIELDS = new Set(['read', 'write', 'systemInfo', 'network'])
 
 function assertStringArray(v: unknown, where: string): void {
   if (!Array.isArray(v) || v.some((s) => typeof s !== 'string' || s.length === 0)) {
@@ -1021,17 +1082,16 @@ function validateSandbox(sandbox: unknown, where: string): void {
     if (typeof ignore !== 'object' || ignore === null || Array.isArray(ignore)) {
       throw new UserError(`${where}.sandbox.ignore must be an object`)
     }
-    assertKnownFields(ignore, GRANT_FIELDS, `${where}.sandbox.ignore`)
+    // Only these reach the report's filter (`matchesIgnore`): a denial is
+    // classed read, write, systemInfo or network, and nothing else. Every
+    // grant name loaded here once, so `ignore.machLookup` silenced nothing
+    // and said so nowhere (D-4).
+    assertKnownFields(ignore, IGNORE_FIELDS, `${where}.sandbox.ignore`)
     const g = ignore as Record<string, unknown>
     // Patterns, not prefixes — `ignore` is vx's own filter over lines it
     // already holds, so a glob costs nothing and works on every platform.
-    for (const f of [...GRANT_PATH_FIELDS, ...GRANT_NAME_FIELDS, 'network', 'unixSockets']) {
+    for (const f of IGNORE_FIELDS) {
       if (g[f] !== undefined) assertStringArray(g[f], `${where}.sandbox.ignore.${f}`)
     }
-    for (const f of GRANT_BOOL_FIELDS) {
-      if (g[f] !== undefined) {
-        throw new UserError(`${where}.sandbox.ignore.${f} is a flag, not something to ignore`)
-      }
-    }
   }
 }

package/src/workspace/fingerprint.ts

@@ -30,6 +30,12 @@ export const WORKSPACE_FINGERPRINT_FILES = [
   // (turborepo#12635). pnpm's catalogs live in pnpm-workspace.yaml, and
   // its lockfile records each importer's resolved version besides.
   '.yarnrc.yml',
+  // Install settings no lockfile records: bun's `linker = "isolated"` and
+  // pnpm's `node-linker` / hoisting lay `node_modules` out anew under a
+  // byte-identical lockfile, and a build that imported an undeclared
+  // hoisted package kept its green hit where it now fails (D-7).
+  '.npmrc',
+  'bunfig.toml',
 ]
 
 // DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs}`. Everything it can

package/src/workspace/migration.ts

@@ -101,7 +101,7 @@ export interface MigrationPlan {
   projects: GeneratedProject[]
   /** extra root-relative files (e.g. the preset) */
   extraFiles: { relPath: string; contents: string }[]
-  /** trailing report lines (e.g. implicit Nx deps) */
+  /** trailing report lines (e.g. what a turbo.json holds that vx has no place for) */
   notes: string[]
 }