@vzn/vx 0.0.520 → 0.0.522

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.520",
+  "version": "0.0.522",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.520",
-    "@vzn/vx-linux-arm64": "0.0.520",
-    "@vzn/vx-darwin-x64": "0.0.520",
-    "@vzn/vx-darwin-arm64": "0.0.520"
+    "@vzn/vx-linux-x64": "0.0.522",
+    "@vzn/vx-linux-arm64": "0.0.522",
+    "@vzn/vx-darwin-x64": "0.0.522",
+    "@vzn/vx-darwin-arm64": "0.0.522"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -214,6 +214,22 @@ export class GitFilesCache extends Map<string, readonly string[]> {
     this.dirty = dirty
   }
 
+  /** The populate's `git var -l`, for `configValue`. */
+  private vars: Map<string, string> | null = null
+
+  setGitVars(listing: string | null): void {
+    this.vars = listing === null ? null : gitVarList(listing)
+  }
+
+  /**
+   * A config key's value as `git config --get` answers it (the last one),
+   * from the populate's `git var -l`: null when the config has none,
+   * undefined when no listing was read.
+   */
+  configValue(key: string): string | null | undefined {
+    return this.vars === null ? undefined : (this.vars.get(key) ?? null)
+  }
+
   markOutputsChanged(projectDir: string, relPaths: readonly string[]): void {
     this.recordChanged(projectDir, relPaths)
     // The workspace-wide partition sees the same files under
@@ -774,6 +790,12 @@ async function dropFilteredOids(
     pathspecs: readonly string[]
     gitVars: string
     spawnGit: (a: string[], stdin?: string) => Promise<GitRun | null>
+    /**
+     * The same `check-attr`, already started over every listed index entry
+     * (a superset of `trusted`) because `attributesInIndex` fired before
+     * `status` was back.
+     */
+    early?: Promise<GitRun | null> | undefined
   },
 ): Promise<void> {
   if (trusted.size === 0) return
@@ -823,14 +845,48 @@ async function dropFilteredOids(
   // blob's OID keyed an edit git calls clean, and the run replayed the old
   // output (item 978). Git LFS is a `filter` as well: its files are hashed
   // from disk now, the one honest identity of what a task reads.
-  const res = await args.spawnGit(
-    ['check-attr', '--stdin', '-z', 'text', 'eol', 'ident', 'filter', 'working-tree-encoding'],
-    [...trusted.keys()].join('\0'),
-  )
+  const res = await (args.early ?? args.spawnGit(CHECK_ATTR, [...trusted.keys()].join('\0')))
   if (res === null || res.exitCode !== 0) return
   for (const rel of parseCheckAttrOutput(res.stdout)) trusted.delete(rel)
 }
 
+const CHECK_ATTR = [
+  'check-attr',
+  '--stdin',
+  '-z',
+  'text',
+  'eol',
+  'ident',
+  'filter',
+  'working-tree-encoding',
+]
+
+/**
+ * The filter gate's half that needs only the index listing: an attributes
+ * file tracked in it, in `$GIT_DIR/info/attributes`, or above the scanned
+ * dirs. When it fires, `dropFilteredOids` is sure to ask `check-attr`, so the
+ * enumeration starts it beside `status` (~8 ms on this repo, U-3)
+ * instead of after it. When it does not, the whole gate decides later.
+ */
+function attributesInIndex(args: {
+  tracked: readonly string[]
+  workspaceRoot: string
+  gitDir: string
+  gitPrefix: string
+  pathspecs: readonly string[]
+}): boolean {
+  if (
+    args.gitDir !== '' &&
+    existsSync(path.resolve(args.workspaceRoot, args.gitDir, 'info', 'attributes'))
+  ) {
+    return true
+  }
+  for (const rel of args.tracked) {
+    if (rel === '.gitattributes' || rel.endsWith('/.gitattributes')) return true
+  }
+  return attributesAbove(args)
+}
+
 /**
  * The repository root, derived from the workspace root and git's own
  * `--show-prefix` (the repo→workspace path). Exact and free: the prefix
@@ -1095,6 +1151,8 @@ export interface GitEnumeration {
   trusted: Map<string, string>
   /** Whether the worktree had uncommitted changes; null when `git status` failed. */
   dirty: boolean | null
+  /** `git var -l`'s listing (merged config, then git's variables); null when it failed. */
+  vars: string | null
   /**
    * What `git status` listed, workspace-relative: modified, staged or deleted
    * paths (both sides of a rename) and untracked files. Null when it failed.
@@ -1259,7 +1317,20 @@ export async function startGitEnumeration(
     }
   }
   const indexKeyRead = readIndexKey()
-  const [ls, status, vars] = await running
+  const gitPrefix = facts?.prefix ?? ''
+  const gitDir = facts?.commonDir ?? ''
+  const ls = await listing
+  const parsedLs =
+    ls !== null && ls.exitCode === 0
+      ? parseLsFilesOutput(ls.stdout.length === 0 ? [] : ls.stdout.split('\0'), ls.undecodable)
+      : undefined
+  const early =
+    parsedLs !== undefined &&
+    parsedLs.oids.size > 0 &&
+    attributesInIndex({ tracked: parsedLs.files, workspaceRoot, gitDir, gitPrefix, pathspecs })
+      ? spawnGit(CHECK_ATTR, [...parsedLs.oids.keys()].join('\0'))
+      : undefined
+  const [, status, vars] = await running
   // The key stands for the index `ls-files` listed only when that index
   // was written before the enumeration began (git writes it by rename, so
   // the stamp moves with any write) and is still in place after it: a
@@ -1281,20 +1352,14 @@ export async function startGitEnumeration(
   if (ls === null) {
     throw gitSpawnRefusal(workspaceRoot)
   }
-  if (ls.exitCode !== 0) {
+  if (parsedLs === undefined) {
     const stderr = ls.stderr.trim()
     throw new UserError(
       `vx requires git: ${workspaceRoot} is not inside a git work tree. ` +
         `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
     )
   }
-  const {
-    files: tracked,
-    oids,
-    flagged,
-    gitlinks,
-    undecodable,
-  } = parseLsFilesOutput(ls.stdout.length === 0 ? [] : ls.stdout.split('\0'), ls.undecodable)
+  const { files: tracked, oids, flagged, gitlinks, undecodable } = parsedLs
   // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
   // the `--show-prefix`) so the dirty set is keyed identically to the trusted
   // OID map. Without this, when the workspace root is a git subdir, a modified
@@ -1302,8 +1367,6 @@ export async function startGitEnumeration(
   // a STALE cache hit serving old outputs. Empty prefix (workspace == git root,
   // the common case) is a zero-cost no-op. Paths above the workspace can't be
   // inputs, so they drop out of the set.
-  const gitPrefix = facts?.prefix ?? ''
-  const gitDir = facts?.commonDir ?? ''
   const parsedStatus =
     status !== null && status.exitCode === 0
       ? parseStatusOutput(status.stdout, status.undecodable)
@@ -1357,6 +1420,7 @@ export async function startGitEnumeration(
     pathspecs,
     gitVars: vars !== null && vars.exitCode === 0 ? vars.stdout : '',
     spawnGit,
+    early,
   })
   if (vars !== null && vars.exitCode === 0 && fileModeIgnored(vars.stdout)) {
     restampModes(trusted, workspaceRoot)
@@ -1368,6 +1432,7 @@ export async function startGitEnumeration(
     all,
     trusted,
     dirty: worktreeDirty,
+    vars: vars !== null && vars.exitCode === 0 ? vars.stdout : null,
     changed: dirty === null ? null : [...dirty, ...untracked],
     untracked: dirty === null ? null : untracked,
     undecodable,
@@ -1436,6 +1501,7 @@ export async function applyGitEnumeration(
   await dropResizedOids(enumeration, memo)
   const { all, trusted } = enumeration
   cache.setWorktreeDirty(enumeration.dirty)
+  cache.setGitVars(enumeration.vars)
   cache.enumeratedAtMs = enumeration.startedAtMs
   cache.markUndecodable(enumeration.undecodable.map((rel) => path.join(workspaceRoot, rel)))
   // Sort once, then each project's files are a contiguous range found

package/src/cache/output-index.ts

@@ -8,6 +8,12 @@
 
 /** `mtime_ms` of a recorded output prefix that did not exist when the snapshot was taken. */
 const ABSENT_DIR_MTIME = -1
+/**
+ * `mtime_ms` of a recorded output prefix that was a regular file: a literal
+ * output naming one (`public/app.js`). The set under it is the file alone
+ * while it stays a regular file; its bytes are the per-file check's.
+ */
+const FILE_PREFIX_MTIME = -2
 
 import type { Database } from 'bun:sqlite'
 import { inHashes, lazyStatement } from './schema.js'
@@ -244,7 +250,14 @@ export class OutputIndex {
         }
         return false
       }
-      if (!st.isDirectory()) return false
+      if (!st.isDirectory()) {
+        // A literal output naming a file walked its glob on every hit: two
+        // of this repo's site tasks, ~6 ms of each warm run (U-5).
+        if (!isPrefix || !st.isFile()) return false
+        rows.push([rel, FILE_PREFIX_MTIME])
+        files.push(rel)
+        return true
+      }
       rows.push([rel, st.mtimeMs])
       if (rows.length > OUTPUT_DIRS_CAP) return false
       let entries
@@ -379,6 +392,7 @@ export class OutputIndex {
         return r.mtimeMs === ABSENT_DIR_MTIME
       }
       if (r.mtimeMs === ABSENT_DIR_MTIME) return false
+      if (r.mtimeMs === FILE_PREFIX_MTIME) return st.isFile()
       return st.isDirectory() && Math.abs(st.mtimeMs - r.mtimeMs) < 1
     })
     return results.every(Boolean)

package/src/orchestrator/run-context.ts

@@ -4,9 +4,11 @@
 // unset env degrades each field to null and NEVER throws. Telemetry must
 // not be able to fail a build.
 //
-// Cost: ONE git spawn (`captureGitContext`) on every run, plus two more
-// (`captureWorkspaceIdentity`, `captureDefaultBranch`) only when a plugin
-// declares the `telemetry` capability — nobody else needs those fields.
+// Cost: HEAD read from `.git` on every run (`captureGitContext`), plus
+// `refs/remotes/origin/HEAD` and the enumeration's `remote.origin.url`
+// only when a plugin declares the `telemetry` capability — nobody else
+// needs those fields. Each falls back to a `git` spawn where the files or
+// the enumeration cannot answer.
 
 import fs from 'node:fs'
 import os from 'node:os'
@@ -115,28 +117,9 @@ function readHeadDirect(
   workspaceRoot: string,
 ): { commitSha: string; branch: string | null } | null {
   try {
-    let gitDir = path.join(workspaceRoot, '.git')
-    const st = fs.statSync(gitDir)
-    if (st.isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(gitDir, 'utf8'))
-      if (m === null) return null
-      gitDir = path.resolve(workspaceRoot, m[1]!.trim())
-    }
-    let commonDir = gitDir
-    const commonFile = path.join(gitDir, 'commondir')
-    if (fs.existsSync(commonFile)) {
-      commonDir = path.resolve(gitDir, fs.readFileSync(commonFile, 'utf8').trim())
-    }
-    // Reftable storage (`git init --ref-format=reftable`, git 2.45): HEAD
-    // names `refs/heads/.invalid` and the refs live in `reftable/`, so the
-    // files say nothing true about HEAD. A leftover `packed-refs` there was
-    // read as the answer; git is asked instead.
-    if (
-      fs.existsSync(path.join(gitDir, 'reftable')) ||
-      fs.existsSync(path.join(commonDir, 'reftable'))
-    ) {
-      return null
-    }
+    const dirs = refDirsOf(workspaceRoot)
+    if (dirs === null) return null
+    const { gitDir, commonDir } = dirs
     const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim()
     const SHA = /^[0-9a-f]{40,64}$/
     if (SHA.test(head)) return { commitSha: head, branch: null }
@@ -166,6 +149,57 @@ function readHeadDirect(
   }
 }
 
+/**
+ * The git dir and common dir behind `workspaceRoot` when its refs are files
+ * this code reads: a `.git` directory or a `.git` FILE (`gitdir: …`, a linked
+ * worktree, whose shared refs live under `commondir`). Null for a reftable
+ * repository (`git init --ref-format=reftable`, git 2.45): HEAD names
+ * `refs/heads/.invalid` and the refs live in `reftable/`, so the files say
+ * nothing true. A leftover `packed-refs` there was read as the answer.
+ * Throws when there is no `.git` at the root (a workspace in a subdirectory).
+ */
+function refDirsOf(workspaceRoot: string): { gitDir: string; commonDir: string } | null {
+  let gitDir = path.join(workspaceRoot, '.git')
+  const st = fs.statSync(gitDir)
+  if (st.isFile()) {
+    const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(gitDir, 'utf8'))
+    if (m === null) return null
+    gitDir = path.resolve(workspaceRoot, m[1]!.trim())
+  }
+  let commonDir = gitDir
+  const commonFile = path.join(gitDir, 'commondir')
+  if (fs.existsSync(commonFile)) {
+    commonDir = path.resolve(gitDir, fs.readFileSync(commonFile, 'utf8').trim())
+  }
+  if (
+    fs.existsSync(path.join(gitDir, 'reftable')) ||
+    fs.existsSync(path.join(commonDir, 'reftable'))
+  ) {
+    return null
+  }
+  return { gitDir, commonDir }
+}
+
+/**
+ * `refs/remotes/origin/HEAD`'s target from the files, as `git symbolic-ref
+ * --short` names it (`origin/main`): `undefined` when the files cannot say
+ * (no `.git` at the root, reftable), null when there is no such symbolic
+ * ref. A symbolic ref is never packed, so a missing file is git's answer
+ * too.
+ */
+function readOriginHeadDirect(workspaceRoot: string): string | null | undefined {
+  try {
+    const dirs = refDirsOf(workspaceRoot)
+    if (dirs === null) return undefined
+    const file = path.join(dirs.commonDir, 'refs', 'remotes', 'origin', 'HEAD')
+    if (!fs.existsSync(file)) return null
+    const ref = /^ref:\s*refs\/remotes\/(.+)$/.exec(fs.readFileSync(file, 'utf8').trim())
+    return ref === null ? undefined : ref[1]!
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * The branch a CI provider says this checkout came from, or null.
  *
@@ -221,30 +255,34 @@ export function captureDefaultBranch(
     }
   }
 
-  try {
-    const proc = Bun.spawnSync({
-      cmd: [
-        executablePath('git'),
-        '-C',
-        workspaceRoot,
-        'symbolic-ref',
-        '--short',
-        'refs/remotes/origin/HEAD',
-      ],
-      stdout: 'pipe',
-      stderr: 'ignore',
-    })
-    if (proc.exitCode === 0) {
-      const ref = new TextDecoder().decode(proc.stdout).trim()
-      // `refs/remotes/origin/HEAD` → `origin/main`; strip the remote prefix.
-      const slash = ref.indexOf('/')
-      const name = slash >= 0 ? ref.slice(slash + 1) : ref
-      if (name.length > 0) return name
+  // The file first, as `captureGitContext` reads HEAD: a spawn here was
+  // ~8 ms of every run a telemetry plugin is declared in.
+  let ref = readOriginHeadDirect(workspaceRoot)
+  if (ref === undefined) {
+    ref = null
+    try {
+      const proc = Bun.spawnSync({
+        cmd: [
+          executablePath('git'),
+          '-C',
+          workspaceRoot,
+          'symbolic-ref',
+          '--short',
+          'refs/remotes/origin/HEAD',
+        ],
+        stdout: 'pipe',
+        stderr: 'ignore',
+      })
+      if (proc.exitCode === 0) ref = new TextDecoder().decode(proc.stdout).trim()
+    } catch {
+      // git unavailable / no remote HEAD ref: null.
     }
-  } catch {
-    // git unavailable / no remote HEAD ref: null.
   }
-  return null
+  if (ref === null) return null
+  // `refs/remotes/origin/HEAD` → `origin/main`; strip the remote prefix.
+  const slash = ref.indexOf('/')
+  const name = slash >= 0 ? ref.slice(slash + 1) : ref
+  return name.length > 0 ? name : null
 }
 
 // Recognized CI env vars in match-priority order. The first whose value
@@ -324,28 +362,38 @@ export function normalizeRemoteUrl(raw: string): string {
  *      checkout keeps a stable identity across runs; `.vx/` is already
  *      gitignored infrastructure);
  *   3. unwritable `.vx/` → the root path itself (stable per machine).
- * One `git` spawn behind try/catch; call sites gate on telemetry being
- * active so a plain run never pays it. Never throws.
+ * The URL comes from the run's own `git var -l` when it has one, else one
+ * `git` spawn behind try/catch; call sites gate on telemetry being active
+ * so a plain run never pays it. Never throws.
  */
-export function captureWorkspaceIdentity(workspaceRoot: string): WorkspaceIdentity {
+export function captureWorkspaceIdentity(
+  workspaceRoot: string,
+  /**
+   * `remote.origin.url` as the run's enumeration read it (`git var -l`, the
+   * same merged config): null when it has none. Undefined asks git.
+   */
+  originUrl?: string | null,
+): WorkspaceIdentity {
   const base = workspaceRoot.replace(/\/+$/, '').split('/').pop() || 'workspace'
   try {
-    const proc = Bun.spawnSync({
-      // `config --get`, NOT `remote get-url`: get-url applies insteadOf
-      // rewrites, so two developers mirroring the same repo through
-      // different proxies would derive different workspace ids. The raw
-      // configured URL is the identity.
-      cmd: [executablePath('git'), '-C', workspaceRoot, 'config', '--get', 'remote.origin.url'],
-      stdout: 'pipe',
-      stderr: 'ignore',
-    })
-    if (proc.exitCode === 0) {
-      const url = new TextDecoder().decode(proc.stdout).trim()
-      if (url.length > 0) {
-        const normalized = normalizeRemoteUrl(url)
-        const name = normalized.split('/').pop() || base
-        return { id: xxh3hex(normalized), name }
-      }
+    let url = originUrl ?? ''
+    if (originUrl === undefined) {
+      const proc = Bun.spawnSync({
+        // `config --get`, NOT `remote get-url`: get-url applies insteadOf
+        // rewrites, so two developers mirroring the same repo through
+        // different proxies would derive different workspace ids. The raw
+        // configured URL is the identity.
+        cmd: [executablePath('git'), '-C', workspaceRoot, 'config', '--get', 'remote.origin.url'],
+        stdout: 'pipe',
+        stderr: 'ignore',
+      })
+      if (proc.exitCode === 0) url = new TextDecoder().decode(proc.stdout)
+    }
+    url = url.trim()
+    if (url.length > 0) {
+      const normalized = normalizeRemoteUrl(url)
+      const name = normalized.split('/').pop() || base
+      return { id: xxh3hex(normalized), name }
     }
   } catch {
     // git unavailable — fall through to the salt.

package/src/orchestrator/run.ts

@@ -720,9 +720,13 @@ async function runOnBus(
     // but declines still pays — its answer is only knowable by asking.
     const hasTelemetryPlugin = prepared.plugins.some((p) => p.telemetry !== undefined)
     if (hasTelemetryPlugin || options.telemetrySinks !== undefined) {
-      // Workspace identity (telemetry v2): one git spawn, paid only when a
-      // telemetry consumer can exist — a plain run never reaches here.
-      const wsIdentity = captureWorkspaceIdentity(workspaceRoot)
+      // Workspace identity (telemetry v2), paid only when a telemetry
+      // consumer can exist — a plain run never reaches here. The remote URL
+      // is the enumeration's `git var -l`: a spawn here cost ~4 ms.
+      const wsIdentity = captureWorkspaceIdentity(
+        workspaceRoot,
+        gitFilesCache.configValue('remote.origin.url'),
+      )
       runContextRecord = {
         runId,
         vxVersion: VERSION,

package/src/orchestrator/telemetry.ts

@@ -192,6 +192,17 @@ export interface TaskTelemetry {
   notReady?: 'timeout' | 'exited' | 'spawn'
   /** On a task that retried: each attempt that failed before the last, in order. Additive. */
   failedAttempts?: readonly FailedAttempt[]
+  /** On a task proved flaky this run: its key's passes and failures on record. Additive. */
+  flaky?: { passes: number; failures: number }
+  /** On a sandboxed task: the violation lines themselves, one per denial. Additive. */
+  sandboxViolationLines?: readonly string[]
+  /** On a cache hit: how long the run that stored the entry took — the time this hit saved. Additive. */
+  storedDurationMs?: number
+  /** On a cache hit: the CPU and peak memory of the run that stored it. Additive. */
+  storedCpuMs?: number
+  storedPeakRssBytes?: number
+  /** How long an `admit` policy held the task once it was ready. Additive. */
+  admissionHeldMs?: number
   /**
    * On a cache hit: whether outputs were written this run (`true`) or the
    * disk already matched the entry and nothing was restored (`false`, an
@@ -718,6 +729,14 @@ export function taskTelemetryOf(o: TaskOutcome): TaskTelemetry {
   if (o.sandboxViolations !== undefined) t.sandboxViolations = o.sandboxViolations
   if (o.notReady !== undefined) t.notReady = o.notReady
   if (o.failedAttempts !== undefined) t.failedAttempts = o.failedAttempts
+  if (o.flaky !== undefined) t.flaky = o.flaky
+  if (o.sandboxViolationLines !== undefined && o.sandboxViolationLines.length > 0) {
+    t.sandboxViolationLines = o.sandboxViolationLines
+  }
+  if (o.storedDurationMs !== undefined) t.storedDurationMs = o.storedDurationMs
+  if (o.storedCpuMs !== undefined) t.storedCpuMs = o.storedCpuMs
+  if (o.storedPeakRssBytes !== undefined) t.storedPeakRssBytes = o.storedPeakRssBytes
+  if (o.admissionHeldMs !== undefined) t.admissionHeldMs = o.admissionHeldMs
   if (isCacheHit(o.status)) t.restored = o.restored === true
   if (o.wallclockStartNs !== undefined) t.wallclockStartNs = o.wallclockStartNs.toString()
   if (o.wallclockEndNs !== undefined) t.wallclockEndNs = o.wallclockEndNs.toString()

package/src/workspace/config-cache.ts

@@ -165,6 +165,10 @@ const IMPURE_LITERAL_RE = /constructor|__proto__|prototype/
 const IMPORT_RE =
   /\b(?:import|export)\b(?:(?!\b(?:import|export)\b)[^;])*?\bfrom\s*\0(\d+)\0|\bimport\s*\0(\d+)\0/g
 
+// `import` as a keyword. Followed by `:` it is a property key (a task named
+// `import`): no import form, static or dynamic, puts a colon after the word.
+const IMPORT_WORD_RE = /\bimport\b(?!\s*:)/g
+
 /**
  * Every static import in `source` as its specifier and statement, or `null`
  * when the source cannot be lexed or holds an `import` no form above
@@ -181,9 +185,9 @@ function staticImports(
   let seen = 0
   for (const m of code.matchAll(IMPORT_RE)) {
     imports.push({ spec: strings[Number(m[1] ?? m[2])]!, statement: m[0] })
-    seen += m[0].match(/\bimport\b/g)?.length ?? 0
+    seen += m[0].match(IMPORT_WORD_RE)?.length ?? 0
   }
-  if (seen !== (code.match(/\bimport\b/g)?.length ?? 0)) return null
+  if (seen !== (code.match(IMPORT_WORD_RE)?.length ?? 0)) return null
   return { code, strings, imports }
 }