@vzn/vx 0.0.50 → 0.0.52

package/src/orchestrator/sandbox-request.ts

@@ -96,7 +96,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
  * The domain union is computed here from every sandboxed node, because
  * SRT runs ONE filtering proxy per run and checks every request against
  * the allowlist given to `initialize()` — never the per-call one
- * (`sandbox-manager.js` 0.0.75). A task that declares no domains still
+ * (`sandbox-manager.js`, 0.0.75 and 0.0.76). A task that declares no domains still
  * reaches nothing: its profile is not given the proxy's port at all.
  * The unix-socket allowance is per run the same way: SRT's Linux seccomp
  * filter on `socket(AF_UNIX)` is all-or-nothing and read at
@@ -183,11 +183,14 @@ export async function sandboxRequestFor(
   // Pre-create what the task said it will write — after the grants are
   // resolved, which refuses one that leaves the project through a link
   // before anything is created along it (item 1003).
-  const config = wallOff(resolveSandboxConfig(sandbox, node.projectDir), workspaceRoot, [
-    ...nested,
-    path.join(workspaceRoot, '.git'),
-    path.join(workspaceRoot, '.vx'),
-  ])
+  const walls = [...nested, path.join(workspaceRoot, '.git'), path.join(workspaceRoot, '.vx')].map(
+    toRealPath,
+  )
+  const config = wallOff(
+    resolveSandboxConfig(sandbox, node.projectDir, walls),
+    workspaceRoot,
+    walls,
+  )
   const placeholders = await prepareOutputsForBind(node.projectDir, sandbox.allow?.write ?? [])
   const request: NonNullable<ExecuteRequest['sandbox']> = {
     // Only what the task declared, plus node_modules. Write paths are
@@ -197,7 +200,13 @@ export async function sandboxRequestFor(
     // Enforcement anchors at the WORKSPACE ROOT: a task may not leave
     // its project, so every sibling and every root file is denied.
     // Reporting is a different question — see `reportWithin` below.
-    baseDenyRead: [workspaceRoot],
+    // On macOS the walls are denied too: seatbelt does not mount, so the
+    // punch cannot apply, and SRT emits a deny strictly inside a literal
+    // read grant AFTER the grant, where it wins (`lateReadDenyFilters`,
+    // 0.0.76). A grant naming a wall is not strictly outside it and wins.
+    // Without it a root task's `read: ['.']` read its nested projects under
+    // seatbelt (B-4).
+    baseDenyRead: process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
     // walk `bun build --compile` makes from `/` down to its cwd lists
@@ -422,14 +431,14 @@ async function prepareOutputsForBind(
  * punched (`punchWalls`); a write grant whose bind would hold one — a file
  * grant binds its directory on Linux, so `write: ['out.txt']` in a root
  * project bound the whole workspace writable, `.git` included — is
- * refused, as there is no writable bind that leaves a wall out.
+ * refused, as there is no writable bind that leaves a wall out. A glob's
+ * hits already stop at the walls (`resolveSandboxConfig` takes them).
  */
 function wallOff(
   config: ResolvedSandboxConfig,
   workspaceRoot: string,
-  raw: readonly string[],
+  walls: readonly string[],
 ): ResolvedSandboxConfig {
-  const walls = raw.map(toRealPath)
   const home = toRealPath(workspaceRoot)
   for (const bind of bindableWrites(config.allowWrite)) {
     // A bind outside the workspace is the user's own path (`/tmp/x`,

package/src/orchestrator/summary.ts

@@ -326,23 +326,34 @@ export function formatRunSummary(
 }
 
 /**
- * Post-summary section naming the tasks a shutdown signal killed. An aborted
- * task did no work, so it is in no tally bucket and no history row — but the
- * run still exits non-zero, and without this the user reads a red exit over a
- * fully green summary that names nothing. The interactive Ctrl-C path never
- * gets here (the signal handler exits before any outcome lands), so this only
- * ever prints for a run that reached its summary WITH a task killed by some
- * other signal — an external `kill`, a supervisor, a self-terminating child.
- * Empty when nothing aborted.
+ * Post-summary section naming the tasks a shutdown signal killed, and those
+ * the stop reached before they ran. An aborted task did no work, so it is in
+ * no tally bucket and no history row — but the run still exits non-zero, and
+ * without this the user reads a red exit over a fully green summary that
+ * names nothing. Empty when nothing aborted.
  */
 export function formatAbortedSection(outcomes: readonly TaskOutcome[]): string[] {
-  const aborted = outcomes.filter((o) => o.status === 'aborted')
-  if (aborted.length === 0) return []
-  const lines = [
-    '',
-    `  Aborted:  ${aborted.length} task${aborted.length === 1 ? '' : 's'} killed by a shutdown signal — not counted above`,
-  ]
-  for (const o of aborted) lines.push(`    ✗ ${o.node.id} — exit ${o.exitCode}, nothing cached`)
+  // The scheduler marks what the stop reached before dispatch `aborted` too,
+  // with an invented exit 1: listed as killed, a task that never ran read as
+  // one the signal cut short (item 1062). Only a started one carries a
+  // wall-clock start. A group is no task here, as in the skipped section.
+  const aborted = outcomes.filter((o) => o.status === 'aborted' && !isGroupTask(o.node))
+  const killed = aborted.filter((o) => o.wallclockStartNs !== undefined)
+  const unstarted = aborted.filter((o) => o.wallclockStartNs === undefined)
+  const tasks = (n: number): string => `${n} task${n === 1 ? '' : 's'}`
+  const lines: string[] = []
+  if (killed.length > 0) {
+    lines.push(
+      '',
+      `  Aborted:  ${tasks(killed.length)} killed by a shutdown signal — not counted above`,
+    )
+    for (const o of killed) lines.push(`    ✗ ${o.node.id} — exit ${o.exitCode}, nothing cached`)
+  }
+  if (unstarted.length > 0) {
+    const they = unstarted.length === 1 ? 'it' : 'they'
+    lines.push('', `  Not started:  ${tasks(unstarted.length)} the run stopped before ${they} ran`)
+    for (const o of unstarted) lines.push(`    · ${o.node.id}`)
+  }
   return lines
 }
 

package/src/orchestrator/task-hash.ts

@@ -6,6 +6,7 @@ import {
   type CacheKeyInput,
   type CacheLayer,
   FILE_HASH_RACY_MS,
+  racyWindowMs,
   resolveInputs,
   type GitFilesCache,
   WORKSPACE_OUTPUT_PREFIX,
@@ -222,8 +223,12 @@ export async function movedInput(
     } catch {
       return f.path
     }
-    if (commandFrom !== undefined && ctimeMs >= commandFrom) return f.path
-    if (ctimeMs >= f.since - FILE_HASH_RACY_MS) suspects.push(f)
+    // A whole-second stamp may stand for any write in its second, one
+    // during the command included (`racyWindowMs`).
+    if (commandFrom !== undefined && ctimeMs >= commandFrom - racyWindowMs(ctimeMs, 0)) {
+      return f.path
+    }
+    if (ctimeMs >= f.since - racyWindowMs(ctimeMs, FILE_HASH_RACY_MS)) suspects.push(f)
   }
   for (const f of suspects) {
     const now = await cache.hashFile(f.path).catch(() => undefined)

package/src/orchestrator/telemetry.ts

@@ -107,7 +107,7 @@ export interface RunContextRecord {
   /** ULID, shared by every record in one `vx run`. */
   runId: string
   vxVersion: string
-  /** The invocation command line (process.argv-derived). */
+  /** The invocation command line (process.argv-derived), what follows `--` counted, not quoted. */
   command: string
   requestedTasks: readonly string[]
   /** Compact cache-policy flags, e.g. `'lR,lW,rR,rW'`. */
@@ -318,8 +318,14 @@ export interface TelemetrySink {
    * Losing a slow sink's telemetry is strictly better than the alternative:
    * `run()` never returns, so the cache never closes and `vx` exits 0 on a
    * failed run.
+   *
+   * `signal` aborts at that deadline. Abandoning a flush does not end its
+   * I/O: a request still in flight keeps the event loop, and so the
+   * process, alive after the run has returned — a hanging GitHub API held
+   * `vx run` open until the CI job's own timeout (item 1055). A sink passes
+   * the signal to its `fetch` (or closes its socket on it).
    */
-  flush?(): Promise<void>
+  flush?(signal: AbortSignal): Promise<void>
 }
 
 /** Read-only context a sink is created with. No mutable run handle — the
@@ -496,12 +502,13 @@ export function createTelemetrySource(args: {
       // pending — Bun exits 0 and a FAILED run reports green, with the cache's
       // accessed_at bumps and every later plugin's teardown lost with it.
       // Sinks race concurrently, so each still gets the whole budget.
+      const deadline = new AbortController()
       const settled = await settleWithin(
         Promise.all(
           sinks.map(async (sink) => {
             if (disabled.has(sink) || sink.flush === undefined) return
             try {
-              await sink.flush()
+              await sink.flush(deadline.signal)
             } catch (err) {
               // A flush failure can never break the run — but it still costs
               // this sink its export, so say so rather than dropping it.
@@ -513,7 +520,10 @@ export function createTelemetrySource(args: {
         ),
         ms,
       )
-      if (!settled) warn?.(`[vx] telemetry flush timed out after ${ms}ms; buffered records lost`)
+      if (!settled) {
+        deadline.abort(new Error(`telemetry flush deadline (${ms}ms)`))
+        warn?.(`[vx] telemetry flush timed out after ${ms}ms; buffered records lost`)
+      }
     },
   }
 }

package/src/util/paths.ts

@@ -69,21 +69,28 @@ function prefixOf(glob: string, wildcards: RegExp): string {
 
 /**
  * The directories a task's declared outputs cover WHOLE — every glob is
- * `<dir>/**` with a plain, non-root, non-escaping `<dir>` — or `null` when
- * any glob is shaped otherwise. The directory-mtime short-circuit on a warm
- * hit (`Cache.outputDirsCurrent`) is sound only for whole subtrees: with
- * every directory under `<dir>` recorded, a file added or removed anywhere
- * the glob could see bumps a recorded directory's mtime (its parent, or a
- * new directory whose creation bumped a recorded ancestor). A root-anchored
- * `**\/*.js` has no such closed set, so it keeps the walk.
+ * `<dir>/**` or a bare literal (which `asTrees` reads as the path or the
+ * tree under it), with a plain, non-root, non-escaping `<dir>` — or `null`
+ * when any glob is shaped otherwise. The directory-mtime short-circuit on a
+ * warm hit (`Cache.outputDirsCurrent`) is sound only for whole subtrees:
+ * with every directory under `<dir>` recorded, a file added or removed
+ * anywhere the glob could see bumps a recorded directory's mtime (its
+ * parent, or a new directory whose creation bumped a recorded ancestor). A
+ * root-anchored `**\/*.js` has no such closed set, so it keeps the walk.
+ * A literal that names a FILE is no directory: the snapshot refuses it
+ * whole (`recordOutputDirs`) and that task keeps the walk too, so the
+ * literal costs nothing it did not cost before; one that names a directory
+ * gets the same stats a `<dir>/**` does (Next 27: an nx() output file
+ * had to be `<dir>/**` to keep the short-circuit, and saved nothing).
  */
 export function wholeSubtreePrefixes(globs: readonly string[]): string[] | null {
   if (globs.length === 0) return null
   const out: string[] = []
   for (const g of globs.map(normalizeGlob)) {
     const m = /^([^*?{}!]+?)\/\*\*$/.exec(g)
-    if (m === null) return null
-    const dir = m[1]!.replace(/\/+$/, '')
+    const whole = m?.[1] ?? (isLiteralPattern(g) && !g.startsWith('!') ? g : null)
+    if (whole === null) return null
+    const dir = whole.replace(/\/+$/, '')
     if (dir === '' || dir === '.' || dir.startsWith('/') || dir.split('/').includes('..'))
       return null
     out.push(dir)

package/src/workspace/affected.ts

@@ -21,6 +21,7 @@ import { configImportOwners } from './config-imports.js'
 import { configImports } from './config-cache.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
+import { buildPackageGraph } from './package-graph.js'
 import type { PackageJson, ProjectMeta } from './workspace.js'
 
 /**
@@ -42,9 +43,19 @@ function spawnGitSync(
   }
 }
 
-function spawnGit(args: string[], cwd: string): Bun.Subprocess<'ignore', 'pipe', 'pipe'> {
+function spawnGit(
+  args: string[],
+  cwd: string,
+  stdin?: Uint8Array,
+): Bun.Subprocess<Uint8Array | 'ignore', 'pipe', 'pipe'> {
   try {
-    return Bun.spawn({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr: 'pipe' })
+    return Bun.spawn({
+      cmd: [executablePath('git'), ...args],
+      cwd,
+      stdin: stdin ?? 'ignore',
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
   } catch (err) {
     if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
     throw err
@@ -79,6 +90,13 @@ export interface AffectedArgs {
    * — the common one — never needs it.
    */
   fingerprintClaims?: () => Promise<FingerprintClaims>
+  /**
+   * The cross-project `dependsOn` edges, project → the projects its tasks
+   * name. Asked only when a package's name moved or it was removed: a
+   * config naming `dependsOn: ['lib#build']` breaks on it, which the
+   * package graph cannot see (item 1085).
+   */
+  taskEdges?: () => Promise<ReadonlyMap<string, readonly string[]>>
 }
 
 export interface FingerprintClaims {
@@ -225,13 +243,28 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   const owned = projectsContaining(args.workspaceRoot, changed, args.projects)
   for (const name of claimedOwned) owned.add(name)
 
-  // A package the change REMOVED is no project now, so containment maps its
-  // paths to nothing, and the dependents walk sees only today's graph: a
-  // `git rm -r pkgs/lib`, or `lib` dropped from `workspaces`, re-keyed and
-  // broke `app#build` while `--affected` said nothing affected (item 959).
-  const dependents = await dependentsOfRemoved(args.workspaceRoot, base, changed, args.projects)
-  if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
-  for (const name of dependents) owned.add(name)
+  // A manifest edit can drop an edge today's graph no longer shows: a
+  // package the change REMOVED is no project now (a `git rm -r pkgs/lib`,
+  // or `lib` dropped from `workspaces`, item 959), and one whose `version`
+  // or `name` moved no longer satisfies what a dependent declares. Either
+  // re-keys the dependent through its upstream, while containment maps the
+  // change to the package alone and the dependents walk sees only today's
+  // graph, so `--affected` left `app#build` out (D-3).
+  const manifests = changed.filter((rel) => path.posix.basename(rel) === 'package.json')
+  if (manifests.length > 0) {
+    const atBase = await gitBlobsAt(args.workspaceRoot, base, manifests)
+    const dependents = await dependentsAtBase(
+      args.workspaceRoot,
+      atBase,
+      args.projects,
+      args.taskEdges,
+    )
+    if (dependents === undefined) return new Set(args.projects.map((p) => p.name))
+    for (const name of dependents) owned.add(name)
+    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, args.projects)) {
+      owned.add(name)
+    }
+  }
 
   // THIRD CHANNEL: a project whose `vx.config.*` IMPORTS a changed file.
   // Resolved-config hashing folds those values into the key, so the same
@@ -254,22 +287,27 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
 }
 
 /**
- * The projects that depend on a package the change removed: a
- * `<dir>/package.json` the base had and the tree does not, read at the base
- * for its name. `undefined` (every project) when the root manifest's
- * `workspaces` moved: which packages left is a discovery at the base, and
- * selection cannot tell cheaply. Only DELETED manifests are read at the
- * base, one `git show` each; an edited one stays a project and is owned.
+ * The projects whose workspace dependencies at the base differ from
+ * today's: the package graph is built again over the changed manifests as
+ * the base had them, and every project whose `directDeps` (the edges its
+ * key folds) moved is selected. `undefined` (every project) when the root
+ * manifest's `workspaces` moved: which packages left is a discovery at the
+ * base, and selection cannot tell cheaply. `atBase` holds each changed
+ * manifest as the base had it, read in one `git cat-file --batch`.
  */
-async function dependentsOfRemoved(
+async function dependentsAtBase(
   workspaceRoot: string,
-  base: string,
-  changed: readonly string[],
+  atBase: ReadonlyMap<string, Uint8Array | null>,
   projects: readonly ProjectMeta[],
+  taskEdges: AffectedArgs['taskEdges'],
 ): Promise<Set<string> | undefined> {
-  const out = new Set<string>()
-  const removed = new Set<string>()
-  for (const rel of changed) {
+  const byDir = new Map<string, ProjectMeta>()
+  for (const p of projects) byDir.set(p.dir, p)
+  const nameNow = new Map(projects.map((p) => [p.dir, p.name]))
+  // Base names no project holds today: a removed or renamed package.
+  const gone = new Set<string>()
+  const changedDirs = new Set<string>()
+  for (const rel of atBase.keys()) {
     if (rel === 'package.json') {
       const workspacesOf = (bytes: Uint8Array | null): string => {
         if (bytes === null) return ''
@@ -281,37 +319,141 @@ async function dependentsOfRemoved(
           return 'unreadable'
         }
       }
-      const before = workspacesOf(await gitBytesAt(workspaceRoot, base, rel))
+      const before = workspacesOf(atBase.get(rel) ?? null)
       const after = workspacesOf(await bytesOrNull(path.join(workspaceRoot, rel)))
       if (before !== after) return undefined
-      continue
     }
-    if (path.posix.basename(rel) !== 'package.json') continue
-    if ((await bytesOrNull(path.join(workspaceRoot, rel))) !== null) continue
-    const bytes = await gitBytesAt(workspaceRoot, base, rel)
-    if (bytes === null) continue
+    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
+    changedDirs.add(dir)
+    byDir.delete(dir)
+    const bytes = atBase.get(rel)
+    if (bytes === undefined || bytes === null) continue
+    let pkg: PackageJson
     try {
-      const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
-      if (typeof name === 'string' && name !== '') removed.add(name)
+      pkg = JSON.parse(new TextDecoder().decode(bytes)) as PackageJson
     } catch {
       // A manifest that did not parse at the base named no package.
+      continue
     }
+    if (
+      pkg === null ||
+      typeof pkg !== 'object' ||
+      typeof pkg.name !== 'string' ||
+      pkg.name === ''
+    ) {
+      continue
+    }
+    byDir.set(dir, { name: pkg.name, dir, packageJson: pkg, configPath: null })
+    if (nameNow.get(dir) !== pkg.name) gone.add(pkg.name)
   }
-  if (removed.size === 0) return out
+  const now = buildPackageGraph([...projects])
+  const then = buildPackageGraph([...byDir.values()])
+  const out = new Set<string>()
   for (const p of projects) {
-    const pkg = p.packageJson
-    for (const deps of [
-      pkg.dependencies,
-      pkg.devDependencies,
-      pkg.peerDependencies,
-      pkg.optionalDependencies,
-    ]) {
-      if (deps !== undefined && Object.keys(deps).some((d) => removed.has(d))) out.add(p.name)
+    // A project whose own manifest changed is owned by containment.
+    if (changedDirs.has(p.dir)) continue
+    const a = now.directDeps(p.name)
+    const b = then.directDeps(p.name)
+    if (a.length !== b.length || a.some((d, i) => d !== b[i])) out.add(p.name)
+  }
+  if (gone.size > 0 && taskEdges !== undefined) {
+    for (const [project, targets] of await taskEdges()) {
+      if (targets.some((t) => gone.has(t))) out.add(project)
     }
   }
   return out
 }
 
+/**
+ * The projects a NEW nested project took files from. A project's inputs
+ * stop at every project below it, so a `package.json` that makes an
+ * existing directory a project re-keys the project above it — its
+ * `**` lost the directory's files — while containment maps the change to
+ * the new project alone, and `--affected` left the re-keyed parent out.
+ * "New" is judged at the base: no manifest there, or one with no name,
+ * which discovery skips. `atBase` holds each changed manifest there.
+ */
+function parentsOfNewNested(
+  workspaceRoot: string,
+  atBase: ReadonlyMap<string, Uint8Array | null>,
+  projects: readonly ProjectMeta[],
+): Set<string> {
+  const out = new Set<string>()
+  const dirToName = new Map<string, string>()
+  for (const p of projects) dirToName.set(p.dir, p.name)
+  for (const [rel, bytes] of atBase) {
+    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
+    if (!dirToName.has(dir)) continue
+    let parent: string | undefined
+    for (let d = path.dirname(dir); parent === undefined; d = path.dirname(d)) {
+      parent = dirToName.get(d)
+      if (path.dirname(d) === d) break
+    }
+    if (parent === undefined || out.has(parent)) continue
+    let named = false
+    if (bytes !== null) {
+      try {
+        const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
+        named = typeof name === 'string' && name !== ''
+      } catch {
+        // A manifest that did not parse at the base named no project.
+      }
+    }
+    if (!named) out.add(parent)
+  }
+  return out
+}
+
+/**
+ * Each of `files` (workspace-root-relative) as `ref` has it, in one `git
+ * cat-file --batch`: null for a file the ref does not have. `./` anchors
+ * each path to the cwd, the workspace root, as `gitBytesAt` does.
+ */
+async function gitBlobsAt(
+  workspaceRoot: string,
+  ref: string,
+  files: readonly string[],
+): Promise<Map<string, Uint8Array | null>> {
+  const blobs = new Map<string, Uint8Array | null>()
+  // The batch reads one path per line; a name holding a newline asks alone.
+  const batched: string[] = []
+  for (const file of files) {
+    if (file.includes('\n')) blobs.set(file, await gitBytesAt(workspaceRoot, ref, file))
+    else batched.push(file)
+  }
+  if (batched.length === 0) return blobs
+  const proc = spawnGit(
+    ['cat-file', '--batch'],
+    workspaceRoot,
+    new TextEncoder().encode(batched.map((f) => `${ref}:./${f}\n`).join('')),
+  )
+  const [out, stderr, exit] = await Promise.all([
+    new Response(proc.stdout).bytes(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  if (exit !== 0) {
+    throw new UserError(`git cat-file --batch failed (exit ${exit}): ${stderr.trim()}`)
+  }
+  let at = 0
+  for (const file of batched) {
+    const eol = out.indexOf(0x0a, at)
+    if (eol === -1) throw new UserError(`git cat-file --batch ended before ${ref}:./${file}`)
+    const header = new TextDecoder().decode(out.subarray(at, eol))
+    at = eol + 1
+    // `<oid> <type> <size>`, or `<spec> missing` / `<spec> ambiguous`.
+    const m = /^[0-9a-f]{40,64} (\w+) (\d+)$/.exec(header)
+    if (m === null) {
+      blobs.set(file, null)
+      continue
+    }
+    const size = Number(m[2])
+    blobs.set(file, m[1] === 'blob' ? out.slice(at, at + size) : null)
+    at += size + 1
+  }
+  return blobs
+}
+
 /**
  * Whether `changed` holds the workspace config or a file it imports by
  * relative specifier. Its plugins' `config` and `project` stages shape
@@ -505,6 +647,14 @@ function isDirectory(abs: string): boolean {
   }
 }
 
+function realpathOr(p: string): string {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
@@ -519,6 +669,19 @@ function projectsContaining(
   // pays for.
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir, p.name)
+  // A member linked in from elsewhere in the tree (`pkgs/b -> ../ext/b`) is
+  // indexed by its link, and git reports its files at their real place
+  // (`ext/b/src/a.txt`), which resolved to no project: an edit there
+  // selected nothing (item 1079). Its real place under the root is indexed
+  // too. One realpath per member, and only on an --affected run.
+  const realRoot = realpathOr(workspaceRoot)
+  for (const p of projects) {
+    const real = realpathOr(p.dir)
+    const rel = path.relative(realRoot, real)
+    if (rel.startsWith('..') || path.isAbsolute(rel)) continue
+    const spelled = path.resolve(workspaceRoot, rel)
+    if (spelled !== p.dir && !dirToName.has(spelled)) dirToName.set(spelled, p.name)
+  }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
     let dir = path.resolve(workspaceRoot, rel)

package/src/workspace/config-cache.ts

@@ -201,8 +201,6 @@ export const PURE_CORE_EXPORTS: ReadonlySet<string> = new Set([
   'normalizeGlob',
   'isLiteralPattern',
   'PLUGIN_HOOKS',
-  'TASK_STATUSES',
-  'PERSISTENT_TASK_NAMES',
 ])
 
 /** Whether an `import`/`export … from '@vzn/vx'` statement takes only pure values. */

package/src/workspace/config-eval.ts

@@ -45,7 +45,10 @@ self.onmessage = async (e) => {
   const { id, path } = e.data
   try {
     const ns = await import(path)
-    const mod = ns?.default
+    // Awaited as the in-process load's async return flattens it: a Promise
+    // default loaded on a run and was refused as "an instance of Promise"
+    // on every later evaluation in the process (D-5).
+    const mod = await ns?.default
     const isObject = mod !== null && typeof mod === 'object'
     const nonJson = isObject ? nonJsonPaths(mod) : []
     postMessage({