@vzn/vx 0.0.50 → 0.0.52

package/src/workspace/config-schema.ts

@@ -282,9 +282,16 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       const sandbox = (exec as { sandbox?: unknown }).sandbox
       if (sandbox !== undefined) validateSandbox(sandbox, `${where}.exec`)
       const command = (exec as { command?: unknown }).command
-      if (typeof command !== 'string' || command.length === 0) {
+      // Whitespace alone ran as a shell no-op, green and cached (item 1099).
+      if (typeof command !== 'string' || command.trim().length === 0) {
         throw new UserError(`${where}.exec.command must be a non-empty string`)
       }
+      // No argv can carry a NUL: the spawn refused it and the task failed
+      // as exit 127, "not on this task's PATH", with the NUL printed as a
+      // space (D-4), as an env name with one did before item 999.
+      if (command.includes('\0')) {
+        throw new UserError(`${where}.exec.command holds a NUL, which no command line can carry`)
+      }
       const timeout = (exec as { timeout?: unknown }).timeout
       if (timeout !== undefined) {
         if (typeof timeout !== 'number' || !Number.isInteger(timeout) || timeout <= 0) {
@@ -329,6 +336,16 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `${where}.exec.env.passThrough must be an array of env var names (non-empty, no '=' or NUL)`,
             )
           }
+          // `VITE_*` passed nothing through and loaded clean (Turbo's
+          // passThroughEnv expands it), where `cache.inputs.env` refused the
+          // same text below: one refusal for the class (item 1090).
+          const wild = (passThrough as string[]).find((n) => BUN_GLOB_WILDCARDS.test(n))
+          if (wild !== undefined) {
+            throw new UserError(
+              `${where}.exec.env.passThrough: wildcards in env names are not supported ` +
+                `(got "${wild}") — list explicit env var names instead`,
+            )
+          }
         }
         const define = (env as { define?: unknown }).define
         if (define !== undefined) {
@@ -582,9 +599,12 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       for (const field of ['runtime', 'workspaceRuntime'] as const) {
         const list = (inputs as Record<string, unknown>)[field]
         if (list !== undefined) {
-          if (!Array.isArray(list) || list.some((s) => typeof s !== 'string' || s.length === 0)) {
+          if (
+            !Array.isArray(list) ||
+            list.some((s) => typeof s !== 'string' || s.length === 0 || s.includes('\0'))
+          ) {
             throw new UserError(
-              `${where}.cache.inputs.${field} must be an array of non-empty shell command strings`,
+              `${where}.cache.inputs.${field} must be an array of non-empty shell command strings with no NUL`,
             )
           }
         }
@@ -633,6 +653,40 @@ const CACHE_INPUT_FIELDS = new Set([
 ])
 const CACHE_OUTPUT_FIELDS = new Set(['files', 'workspaceFiles'])
 
+/** A field a release took out of the schema, and what took its place. */
+interface Removal {
+  /** The vx version whose schema first refused it. */
+  removedIn: string
+  /** What to write instead, as a sentence fragment after "use". */
+  use: string
+}
+
+/**
+ * Fields the schema once accepted, by the level that held them (keyed by
+ * that level's field set). A removed field is refused naming its
+ * replacement and the version that removed it, never as an unknown field a
+ * reader must research (docs/design/versioning-1.0.md § Deprecation). An
+ * entry stays for good: a config written against an old release meets it
+ * whenever it upgrades.
+ */
+export const REMOVED_FIELDS: ReadonlyMap<
+  ReadonlySet<string>,
+  Readonly<Record<string, Removal>>
+> = new Map([
+  [
+    EXEC_FIELDS,
+    {
+      // Reservations left core with the `admit` seam (item 157).
+      resources: {
+        removedIn: '0.0.19',
+        use:
+          "`@vzn/vx-schedule-history`, which learns each task's reservation from its run " +
+          "history (declare one by hand with its `reservations: { 'pkg#task': { cpus, memory } }`)",
+      },
+    },
+  ],
+])
+
 function assertKnownFields(value: object, allowed: ReadonlySet<string>, where: string): void {
   // `typeof [] === 'object'`, so an array reaches here and its indices read
   // as fields: `outputs: ['dist/**']` (Turbo's spelling) was refused as
@@ -645,6 +699,12 @@ function assertKnownFields(value: object, allowed: ReadonlySet<string>, where: s
   }
   for (const key of Object.keys(value)) {
     if (!allowed.has(key)) {
+      const removal = REMOVED_FIELDS.get(allowed)?.[key]
+      if (removal !== undefined) {
+        throw new UserError(
+          `${where} has field "${key}", which vx ${removal.removedIn} removed — use ${removal.use}`,
+        )
+      }
       // The nearest accepted spelling first: the list says what the level
       // takes, the hint says which one was meant.
       const near = nearest(key, allowed)
@@ -934,6 +994,7 @@ const GRANT_FIELDS = new Set<string>([
   'unixSockets',
 ])
 const DENY_FIELDS = new Set(['network'])
+const IGNORE_FIELDS = new Set(['read', 'write', 'systemInfo', 'network'])
 
 function assertStringArray(v: unknown, where: string): void {
   if (!Array.isArray(v) || v.some((s) => typeof s !== 'string' || s.length === 0)) {
@@ -1021,17 +1082,16 @@ function validateSandbox(sandbox: unknown, where: string): void {
     if (typeof ignore !== 'object' || ignore === null || Array.isArray(ignore)) {
       throw new UserError(`${where}.sandbox.ignore must be an object`)
     }
-    assertKnownFields(ignore, GRANT_FIELDS, `${where}.sandbox.ignore`)
+    // Only these reach the report's filter (`matchesIgnore`): a denial is
+    // classed read, write, systemInfo or network, and nothing else. Every
+    // grant name loaded here once, so `ignore.machLookup` silenced nothing
+    // and said so nowhere (D-4).
+    assertKnownFields(ignore, IGNORE_FIELDS, `${where}.sandbox.ignore`)
     const g = ignore as Record<string, unknown>
     // Patterns, not prefixes — `ignore` is vx's own filter over lines it
     // already holds, so a glob costs nothing and works on every platform.
-    for (const f of [...GRANT_PATH_FIELDS, ...GRANT_NAME_FIELDS, 'network', 'unixSockets']) {
+    for (const f of IGNORE_FIELDS) {
       if (g[f] !== undefined) assertStringArray(g[f], `${where}.sandbox.ignore.${f}`)
     }
-    for (const f of GRANT_BOOL_FIELDS) {
-      if (g[f] !== undefined) {
-        throw new UserError(`${where}.sandbox.ignore.${f} is a flag, not something to ignore`)
-      }
-    }
   }
 }

package/src/workspace/fingerprint.ts

@@ -30,6 +30,12 @@ export const WORKSPACE_FINGERPRINT_FILES = [
   // (turborepo#12635). pnpm's catalogs live in pnpm-workspace.yaml, and
   // its lockfile records each importer's resolved version besides.
   '.yarnrc.yml',
+  // Install settings no lockfile records: bun's `linker = "isolated"` and
+  // pnpm's `node-linker` / hoisting lay `node_modules` out anew under a
+  // byte-identical lockfile, and a build that imported an undeclared
+  // hoisted package kept its green hit where it now fails (D-7).
+  '.npmrc',
+  'bunfig.toml',
 ]
 
 // DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs}`. Everything it can

package/src/workspace/migration.ts

@@ -101,7 +101,7 @@ export interface MigrationPlan {
   projects: GeneratedProject[]
   /** extra root-relative files (e.g. the preset) */
   extraFiles: { relPath: string; contents: string }[]
-  /** trailing report lines (e.g. implicit Nx deps) */
+  /** trailing report lines (e.g. what a turbo.json holds that vx has no place for) */
   notes: string[]
 }
 

package/src/workspace/project-loader.ts

@@ -1,10 +1,16 @@
+import { realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import type { ProjectConfig, WorkspaceConfig } from '../config.js'
 import { UserError, xxh3hex } from '../util/index.js'
 import { validateProjectConfig, validateWorkspace } from './config-schema.js'
 import { beginEvalRound, evaluateConfigFresh } from './config-eval.js'
 import { hasEsmExport, unprovidedBareImports } from './config-imports.js'
-import { configEvalKey, configEvalKeyFromClosure, type ConfigEvalStore } from './config-cache.js'
+import {
+  configEvalKey,
+  configEvalKeyFromClosure,
+  configImports,
+  type ConfigEvalStore,
+} from './config-cache.js'
 import { readOnce } from './load-reads.js'
 
 // The validator lives in config-schema.ts; re-exported so a reader that
@@ -420,6 +426,41 @@ export async function loadProjectConfig(
   return config!
 }
 
+/** When this process first began loading each workspace config, in ms. */
+const workspaceLoadedAt = new Map<string, number>()
+
+/**
+ * A repeat load in one process (`vx mcp`'s every call, `vx watch`'s every
+ * cycle) busts the workspace config's own URL, but Bun answers what it
+ * imports from the module registry: an edited local plugin kept its first
+ * version and `listTasks` served its old tasks with no word (item 1046).
+ * Bun cannot evaluate an imported module again, so the load is refused,
+ * naming the file, as `vx watch` already says when it sees the edit. Only
+ * a repeat load pays for the walk; a CLI verb loads once.
+ */
+async function refuseStaleWorkspaceImports(configPath: string, since: number): Promise<void> {
+  for (const file of await configImports(configPath)) {
+    let mtime: number
+    try {
+      mtime = statSync(file).mtimeMs
+    } catch {
+      continue
+    }
+    // `since` is whole milliseconds and an mtime is not: a file written in
+    // the millisecond the first load began (1000.4 against 1000) read as
+    // changed, and the control reload was refused one run in ten. An edit
+    // inside that millisecond is one the load may have read anyway.
+    if (Math.floor(mtime) > since) {
+      // The walk names real paths: a root reached through a symlink (macOS's
+      // temp dir) named `../target/helper.mjs` from the link.
+      const from = path.dirname(realpathSync(configPath))
+      throw new UserError(
+        `${path.basename(configPath)} imports ${path.relative(from, file)}, which changed after this process loaded it; a running process cannot evaluate an imported module again — restart it to apply the edit`,
+      )
+    }
+  }
+}
+
 /**
  * Find and load `vx.workspace.{ts,mts,js,mjs}` from the workspace
  * root. Returns `null` if no such file exists (the common case;
@@ -430,8 +471,19 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
   for (const configPath of WORKSPACE_CONFIG_FILENAMES.map((f) => path.join(root, f))) {
     const bytes = await readOnce(undefined, configPath)
     if (bytes === null) continue
+    const since = workspaceLoadedAt.get(configPath)
+    if (since !== undefined) await refuseStaleWorkspaceImports(configPath, since)
+    const startedAt = Date.now()
     const mod = (await loadDefaultExport(configPath, 'Workspace', bytes)) as WorkspaceConfig
+    // Checked again once awaited, as a project config is: a Promise default
+    // passed the first check, and `Promise.resolve(null)` crashed the
+    // validator with a stack while `Promise.resolve(42)` loaded as no
+    // config at all (D-6).
+    assertDefaultObject(mod, 'Workspace', configPath)
     validateWorkspace(mod, configPath)
+    // Set by a load that succeeded: a failed one may have left nothing in
+    // the registry, and its fix must not be refused.
+    if (since === undefined) workspaceLoadedAt.set(configPath, startedAt)
     return mod
   }
   return null

package/src/workspace/workspace.ts

@@ -416,25 +416,65 @@ async function memberDirs(root: string, pattern: string): Promise<string[]> {
     }
     return dirs
   }
-  const globPattern = normalized === '' ? 'package.json' : `${normalized}/package.json`
-  const glob = new Bun.Glob(globPattern)
   const dirs: string[] = []
-  // A linked member is a member, as the readdir path above has it:
-  // `packages/*` found `packages/b -> ../ext/b` while `packages/{a,b}` and
-  // `pack*/*` did not (item 987). Followed only where the depth is bounded:
-  // under `**` the scan would walk every pnpm `node_modules` link.
-  const followSymlinks = !normalized.includes('**')
-  for await (const rel of glob.scan({ cwd: root, onlyFiles: true, dot: false, followSymlinks })) {
-    // Skip nested node_modules — workspace package globs shouldn't
-    // ever reach into them, but a pathological pattern like `**`
-    // would. Avoid splitting the path on the hot loop.
-    if (rel.includes(`${path.sep}node_modules${path.sep}`)) continue
-    if (rel.startsWith(`node_modules${path.sep}`)) continue
-    dirs.push(path.dirname(path.resolve(root, rel)))
+  // `Bun.Glob`'s scan finds nothing for a brace whose alternatives hold a
+  // slash, though its `match` reads one: `packages/{a,nested/b}` listed
+  // neither package, and both ran under no verb while the root still
+  // claimed them (D-2). Such a pattern is scanned as its expansions.
+  for (const expanded of slashBraceExpansions(normalized)) {
+    const globPattern = expanded === '' ? 'package.json' : `${expanded}/package.json`
+    const glob = new Bun.Glob(globPattern)
+    // A linked member is a member, as the readdir path above has it:
+    // `packages/*` found `packages/b -> ../ext/b` while `packages/{a,b}` and
+    // `pack*/*` did not (item 987). Followed only where the depth is bounded:
+    // under `**` the scan would walk every pnpm `node_modules` link.
+    const followSymlinks = !expanded.includes('**')
+    for await (const rel of glob.scan({ cwd: root, onlyFiles: true, dot: false, followSymlinks })) {
+      // Skip nested node_modules — workspace package globs shouldn't
+      // ever reach into them, but a pathological pattern like `**`
+      // would. Avoid splitting the path on the hot loop.
+      if (rel.includes(`${path.sep}node_modules${path.sep}`)) continue
+      if (rel.startsWith(`node_modules${path.sep}`)) continue
+      dirs.push(path.dirname(path.resolve(root, rel)))
+    }
   }
   return dirs
 }
 
+/**
+ * `pattern` with its first brace group expanded, recursively, while that
+ * group holds a `/`; any other pattern as itself, since `Bun.Glob`
+ * expands a slash-free brace on its own. An unbalanced or escaped brace
+ * is left to the glob.
+ */
+function slashBraceExpansions(pattern: string): string[] {
+  if (pattern.includes('\\')) return [pattern]
+  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+    let depth = 0
+    const cuts: number[] = []
+    let close = -1
+    for (let i = open; i < pattern.length && close === -1; i++) {
+      const c = pattern[i]
+      if (c === '{') depth++
+      else if (c === '}' && --depth === 0) close = i
+      else if (c === ',' && depth === 1) cuts.push(i)
+    }
+    if (close === -1) return [pattern]
+    const body = pattern.slice(open + 1, close)
+    if (cuts.length === 0 || !body.includes('/')) continue
+    const head = pattern.slice(0, open)
+    const tail = pattern.slice(close + 1)
+    const bounds = [open, ...cuts, close]
+    const out: string[] = []
+    for (let k = 0; k + 1 < bounds.length; k++) {
+      const alt = pattern.slice(bounds[k]! + 1, bounds[k + 1])
+      out.push(...slashBraceExpansions(head + alt + tail))
+    }
+    return [...new Set(out)]
+  }
+  return [pattern]
+}
+
 /**
  * The project's config file, by `PROJECT_CONFIG_FILENAMES` precedence, or null.
  *