@vzn/vx 0.0.527 → 0.0.529

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.527",
+  "version": "0.0.529",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.527",
-    "@vzn/vx-linux-arm64": "0.0.527",
-    "@vzn/vx-darwin-x64": "0.0.527",
-    "@vzn/vx-darwin-arm64": "0.0.527"
+    "@vzn/vx-linux-x64": "0.0.529",
+    "@vzn/vx-linux-arm64": "0.0.529",
+    "@vzn/vx-darwin-x64": "0.0.529",
+    "@vzn/vx-darwin-arm64": "0.0.529"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -7,7 +7,13 @@
 
 import path from 'node:path'
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
-import { UserError, executablePath, gitSpawnRefusal, xxh3hex } from '../util/index.js'
+import {
+  UserError,
+  executablePath,
+  gitSpawnRefusal,
+  isInstalledPath,
+  xxh3hex,
+} from '../util/index.js'
 import { FILE_HASH_RACY_MS, racyWindowMs } from './layer.js'
 
 /** Three facts of the repository a directory is in: read off the disk, or one `git rev-parse`. */
@@ -517,7 +523,8 @@ function walkFiles(dir: string, rel = ''): string[] {
   }
   const out: string[] = []
   for (const e of entries) {
-    if (e.name === '.git') continue
+    // Nothing tracks a vendored tree's files; an install there is not one.
+    if (e.name === '.git' || e.name === 'node_modules') continue
     const r = rel === '' ? e.name : `${rel}/${e.name}`
     if (e.isDirectory()) out.push(...walkFiles(dir, r))
     else out.push(r)
@@ -562,6 +569,7 @@ function parseLsFilesOutput(
     if (record.length === 0) continue
     const m = LS_FILES_STAGE_RE.exec(record)
     const filePath = m === null ? record : record.slice(m[0].length) // --others: bare path
+    if (m === null && isInstalledPath(filePath)) continue
     files.push(filePath)
     if (undecodableRecords.size > 0 && undecodableRecords.has(record)) undecodable.push(filePath)
     if (m === null) continue
@@ -1376,7 +1384,11 @@ export async function startGitEnumeration(
   // is). They come from the status walk, repo-root-relative like the dirty
   // set. Without a status answer the enumeration is the index alone.
   const untracked =
-    parsedStatus === null ? [] : [...stripPrefixFromSet(new Set(parsedStatus.untracked), gitPrefix)]
+    parsedStatus === null
+      ? []
+      : [...stripPrefixFromSet(new Set(parsedStatus.untracked), gitPrefix)].filter(
+          (rel) => !isInstalledPath(rel),
+        )
   const listed = untracked.length === 0 ? tracked : tracked.concat(untracked)
   const nested = expandNestedRepos(workspaceRoot, listed, gitlinks)
   const all = nested.files

package/src/cache/inputs.ts

@@ -58,8 +58,10 @@ export {
 // re-lock can't bust every cache key the way a tracked source file
 // would. (Literal pattern, not the workspace `LOCKFILE_NAME` constant:
 // cache is a leaf module and must not import from workspace.)
+//
+// `node_modules` is not here: the enumeration drops an untracked file
+// under one (`isInstalledPath`), and a tracked one is a source.
 const ALWAYS_IGNORE = [
-  '**/node_modules/**',
   // Defense in depth, and measured as exactly that (item 497): git never
   // reports a path under `.git`, so dropping this line changes NOTHING on
   // any route into the input set. Probed three ways with the pattern in

package/src/graph/index.ts

@@ -11,6 +11,7 @@ export {
 export {
   type ContinueMode,
   deadServerBehind,
+  type InputChanges,
   RestoreDemoted,
   runGraph,
   type TaskOutcome,

package/src/graph/scheduler.ts

@@ -36,6 +36,14 @@ export type TaskStatus =
   // are partial.
   | 'aborted'
 
+/** What moved in a missed task's key since the last entry saved for it. */
+export interface InputChanges {
+  /** How many components changed, appeared or went. 0: the same key, its entry gone. */
+  count: number
+  /** The first of them, by kind then name. */
+  first: readonly { kind: string; name: string; change: 'changed' | 'added' | 'removed' }[]
+}
+
 export interface TaskOutcome {
   node: TaskNode
   status: TaskStatus
@@ -69,6 +77,20 @@ export interface TaskOutcome {
    * stream and the summary footer show it.
    */
   admissionHeldMs?: number
+  /**
+   * How long this task waited ready (its deps done, or none to wait on)
+   * before it was dispatched: a full worker pool's wait, plus any
+   * `admissionHeldMs`. Absent when it started within the millisecond and
+   * on a task that never ran.
+   */
+  queuedMs?: number
+  /** On a cacheable task that ran: how many files its key read. */
+  inputFiles?: number
+  /**
+   * On a cacheable task that ran: what its key changed since the last entry
+   * saved for it. Only when a telemetry sink asked, and the cache holds one.
+   */
+  inputChanges?: InputChanges
   /** v11 analytics: CPU time + peak RSS for this task's child process. */
   cpuMs?: number
   peakRssBytes?: number
@@ -439,9 +461,14 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // decrements still happen (in finishOne) but never re-enqueue it.
   // Everything else enqueues on the exec-tier the moment its deps
   // complete.
+  // When each queued id became ready; dispatch takes it out.
+  const readyAt = new Map<string, number>()
+  const startedAt = Date.now()
   for (const node of nodes.values()) {
     if (restoreTier?.has(node.id)) restoreReady.push(node.id)
     else if (node.deps.length === 0) execReady.push(node.id)
+    else continue
+    readyAt.set(node.id, startedAt)
   }
 
   let active = 0
@@ -603,7 +630,10 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
         // don't wait on deps); one that finished early releases its own
         // dependents now. Only an exec-tier dependent is enqueued.
         if (heldRelease.delete(d)) release(d)
-        else if (!inRestoreTier(d)) execReady.push(d)
+        else if (!inRestoreTier(d)) {
+          execReady.push(d)
+          readyAt.set(d, Date.now())
+        }
       }
     }
 
@@ -741,6 +771,8 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           continue
         }
 
+        const queuedMs = Date.now() - (readyAt.get(id) ?? Date.now())
+        readyAt.delete(id)
         const leave = admit(id)
         // Listed as running on dispatch, so the policy's next ask in this
         // tick sees it; the completion callbacks unlist it.
@@ -749,7 +781,13 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
         const heldMs = since === undefined ? 0 : Math.max(1, Date.now() - since)
         if (since !== undefined) heldSince.delete(id)
         const withHold = (o: TaskOutcome): TaskOutcome =>
-          heldMs > 0 ? { ...o, admissionHeldMs: heldMs } : o
+          heldMs === 0 && queuedMs === 0
+            ? o
+            : {
+                ...o,
+                ...(heldMs > 0 ? { admissionHeldMs: heldMs } : {}),
+                ...(queuedMs > 0 ? { queuedMs } : {}),
+              }
         // Crash-isolated observer hook — a throwing onStart must not abort
         // the dispatch loop (it would strand the tick with the slot held).
         // A demoted task's second dispatch is the same task, already started.
@@ -799,7 +837,10 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
               leave()
               untrack()
               demoted.add(id)
-              if (pending.get(id) === 0) execReady.push(id)
+              if (pending.get(id) === 0) {
+                execReady.push(id)
+                readyAt.set(id, Date.now())
+              }
               tick()
               return
             }

package/src/orchestrator/events.ts

@@ -7,7 +7,7 @@
 // stall task exec. See docs/design/event-stream-2026-06.md.
 
 import { exitSignal } from '../exec/index.js'
-import type { TaskNode, TaskOutcome } from '../graph/index.js'
+import type { InputChanges, TaskNode, TaskOutcome } from '../graph/index.js'
 import { isGroupTask } from '../graph/index.js'
 import { maskedCommand, secretMask } from '../util/index.js'
 import type { Logger } from './logger.js'
@@ -250,6 +250,12 @@ export interface OutcomeView {
   blockedBy?: string
   /** How long an `admit` policy held the task with a worker free (see `TaskOutcome`). */
   admissionHeldMs?: number
+  /** How long the task waited ready for a worker (see `TaskOutcome`). */
+  queuedMs?: number
+  /** How many files a cacheable task's key read when it ran (see `TaskOutcome`). */
+  inputFiles?: number
+  /** What a missed task's key changed since its last saved entry (see `TaskOutcome`). */
+  inputChanges?: InputChanges
   restored?: boolean
   sandboxViolations?: number
   sandboxViolationLines?: string[]
@@ -369,6 +375,9 @@ export function projectOutcome(outcome: TaskOutcome): OutcomeView {
   if (outcome.cpuMs !== undefined) view.cpuMs = outcome.cpuMs
   if (outcome.peakRssBytes !== undefined) view.peakRssBytes = outcome.peakRssBytes
   if (outcome.admissionHeldMs !== undefined) view.admissionHeldMs = outcome.admissionHeldMs
+  if (outcome.queuedMs !== undefined) view.queuedMs = outcome.queuedMs
+  if (outcome.inputFiles !== undefined) view.inputFiles = outcome.inputFiles
+  if (outcome.inputChanges !== undefined) view.inputChanges = outcome.inputChanges
   if (outcome.timedOut === true) view.timedOut = true
   if (outcome.notReady !== undefined) view.notReady = outcome.notReady
   if (outcome.blockedBy !== undefined) view.blockedBy = outcome.blockedBy

package/src/orchestrator/execute-task.ts

@@ -68,6 +68,7 @@ import {
 import { markUnsaved, saveMiss, type OutputDirSnapshot } from './miss-save.js'
 import type { FingerprintWatch } from './fingerprint-watch.js'
 import { restoreHit } from './hit-restore.js'
+import type { MissExplainer } from './miss-reason.js'
 import { shellVerdict } from './shell-verdict.js'
 // The hit path's entry stays importable from here (tests).
 export { restoreHit, type RestoreHitArgs } from './hit-restore.js'
@@ -147,6 +148,8 @@ export interface ExecuteArgs {
   liveChildren?: Set<ReturnType<typeof Bun.spawn>>
   /** Sample a spawned task's process tree (`TelemetrySource.track`); absent when nobody samples. */
   track?: (taskId: string, pid: number) => () => void
+  /** Name what a missed key changed (`createMissExplainer`); absent when nobody listens. */
+  explainMiss?: MissExplainer
   /**
    * Run-level retry default (`--retry <n>` / `RunOptions.retries`).
    * Explicit `exec.retries` wins, including an explicit 0. Threaded as
@@ -819,6 +822,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       if (c.kind === 'env' && named.includes(c.name) && !secretNamed(c.name))
         c.hash = MASKED + c.hash
   const inputs: TaskInputs | undefined = described?.inputs
+  const inputChanges = described !== undefined ? args.explainMiss?.(node.id, captured) : undefined
   // A plugin may keep the request past the run (the cache closed): it gets
   // the upstream outputs read now. Only the local floor leaves them unread.
   if (inputs !== undefined && !isLocalExecutor(args.executor)) void inputs.upstream
@@ -1361,6 +1365,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     hash,
     ...(attempt > 1 ? { attempts: attempt } : {}),
     ...(failedAttempts.length > 0 ? { failedAttempts } : {}),
+    ...(described !== undefined
+      ? { inputFiles: captured.reduce((n, c) => (c.kind === 'file' ? n + 1 : n), 0) }
+      : {}),
+    ...(inputChanges !== undefined ? { inputChanges } : {}),
     ...(unkeyed ? { unkeyed: true as const } : {}),
     ...(result.timedOut === true && effectiveExitCode !== 0 ? { timedOut: true as const } : {}),
     ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),

package/src/orchestrator/miss-reason.ts

@@ -0,0 +1,55 @@
+// Why a task missed the cache, for telemetry: its key's components against
+// the last entry this cache saved for the same task. The `vx why` join
+// (`diffKeyComponents`), asked at run time instead of after it.
+//
+// Paid only when a telemetry sink exists, and only on a miss: one scan of
+// `entries` for the newest entry per task, the first time a miss asks, then
+// one primary-key read of that entry's `entry_inputs` per miss.
+
+import type { Database } from 'bun:sqlite'
+import type { InputChanges } from '../graph/index.js'
+import { diffKeyComponents } from './metrics.js'
+import type { TaskInputComponent } from './task-hash.js'
+
+/** How many changed components a miss names; `count` says how many there were. */
+const NAMED = 10
+
+export type MissExplainer = (
+  taskId: string,
+  components: readonly TaskInputComponent[],
+) => InputChanges | undefined
+
+export function createMissExplainer(db: Database): MissExplainer {
+  let newest: Map<string, string> | undefined
+  return (taskId, components) => {
+    try {
+      // Each task asks before its own command runs, so its own new entry is
+      // never the one it is compared with.
+      newest ??= new Map(
+        (
+          db
+            // A bare column beside MAX() comes from the row that has it.
+            .query(
+              'SELECT project, task, hash, MAX(created_at) FROM entries GROUP BY project, task',
+            )
+            .all() as { project: string; task: string; hash: string }[]
+        ).map((r) => [`${r.project}#${r.task}`, r.hash]),
+      )
+      const prev = newest.get(taskId)
+      if (prev === undefined) return undefined
+      const before = db
+        .query('SELECT kind, name, hash FROM entry_inputs WHERE entry_hash = ?')
+        .all(prev) as TaskInputComponent[]
+      // Pruned, or saved before fingerprints were kept: nothing to compare.
+      if (before.length === 0) return undefined
+      const { entries } = diffKeyComponents(before, components)
+      return {
+        count: entries.length,
+        first: entries.slice(0, NAMED).map(({ kind, name, change }) => ({ kind, name, change })),
+      }
+    } catch {
+      // History is observability: an unreadable one explains nothing.
+      return undefined
+    }
+  }
+}

package/src/orchestrator/run-context.ts

@@ -29,6 +29,16 @@ export interface CiContext {
   /** Which CI matched: 'github' | 'gitlab' | 'buildkite' | 'circleci'
    *  | 'generic' (bare `CI`), or null when no CI env is present. */
   provider: string | null
+  /** The provider's page for this run (a GitHub Actions run, a GitLab pipeline). */
+  runUrl?: string
+  /** The pull or merge request number this run builds. */
+  change?: string
+  /** The workflow or pipeline name. */
+  pipeline?: string
+  /** The job (or step) within it. */
+  job?: string
+  /** 1 on a first run, 2 on its first re-run. */
+  attempt?: number
 }
 
 export interface HostContext {
@@ -307,11 +317,71 @@ function isTruthy(v: string | undefined): boolean {
  */
 export function detectCi(env: NodeJS.ProcessEnv | Record<string, string | undefined>): CiContext {
   for (const [varName, provider] of CI_PROVIDERS) {
-    if (isTruthy(env[varName])) return { ci: true, provider }
+    if (isTruthy(env[varName])) return { ci: true, provider, ...ciLinks(provider, env) }
   }
   return { ci: false, provider: null }
 }
 
+type CiLinks = Pick<CiContext, 'runUrl' | 'change' | 'pipeline' | 'job' | 'attempt'>
+
+/** Where a dashboard links back to: each provider's own documented variables. */
+function ciLinks(provider: string, env: Record<string, string | undefined>): CiLinks {
+  const v = (k: string): string | undefined => (env[k] === '' ? undefined : env[k])
+  const n = (raw: string | undefined, plus = 0): number | undefined => {
+    const x = raw === undefined ? NaN : Number(raw)
+    return Number.isInteger(x) && x >= 0 ? x + plus : undefined
+  }
+  let links: Record<string, string | number | undefined>
+  switch (provider) {
+    case 'github': {
+      const server = v('GITHUB_SERVER_URL') ?? 'https://github.com'
+      const repo = v('GITHUB_REPOSITORY')
+      const id = v('GITHUB_RUN_ID')
+      links = {
+        runUrl: repo && id ? `${server}/${repo}/actions/runs/${id}` : undefined,
+        // `refs/pull/<n>/merge` on a pull_request event.
+        change: /^refs\/pull\/(\d+)\//.exec(v('GITHUB_REF') ?? '')?.[1],
+        pipeline: v('GITHUB_WORKFLOW'),
+        job: v('GITHUB_JOB'),
+        attempt: n(v('GITHUB_RUN_ATTEMPT')),
+      }
+      break
+    }
+    case 'gitlab':
+      links = {
+        runUrl: v('CI_PIPELINE_URL'),
+        change: v('CI_MERGE_REQUEST_IID'),
+        pipeline: v('CI_PIPELINE_NAME'),
+        job: v('CI_JOB_NAME'),
+      }
+      break
+    case 'buildkite': {
+      const pr = v('BUILDKITE_PULL_REQUEST')
+      links = {
+        runUrl: v('BUILDKITE_BUILD_URL'),
+        // `false` when the build is not for one.
+        change: pr !== undefined && /^\d+$/.test(pr) ? pr : undefined,
+        pipeline: v('BUILDKITE_PIPELINE_SLUG'),
+        job: v('BUILDKITE_LABEL'),
+        // Counts re-runs from 0.
+        attempt: n(v('BUILDKITE_RETRY_COUNT'), 1),
+      }
+      break
+    }
+    case 'circleci':
+      links = {
+        runUrl: v('CIRCLE_BUILD_URL'),
+        // The PR's URL, ending in its number.
+        change: /\/(\d+)$/.exec(v('CIRCLE_PULL_REQUEST') ?? '')?.[1] ?? v('CIRCLE_PR_NUMBER'),
+        job: v('CIRCLE_JOB'),
+      }
+      break
+    default:
+      return {}
+  }
+  return Object.fromEntries(Object.entries(links).filter(([, x]) => x !== undefined)) as CiLinks
+}
+
 /** Host name (null on failure) + platform + arch. */
 export function captureHostContext(): HostContext {
   let host: string | null = null

package/src/orchestrator/run.ts

@@ -92,6 +92,7 @@ import { writeRunProfile, writeRunSummary } from './run-artifacts.js'
 import { createSaveLane } from './save-lane.js'
 import { formatRunSummary } from './summary.js'
 import { detectFlaky, type FlakyCandidate, type FlakyFinding } from './failure-mode.js'
+import { createMissExplainer } from './miss-reason.js'
 import type { RunOptions, RunSummary } from './options.js'
 
 // Per run, never shared: a `vx watch` process runs many, and a shared map
@@ -747,6 +748,11 @@ async function runOnBus(
         dirty: gitContext.dirty,
         ci: ciContext.ci,
         ciProvider: ciContext.provider,
+        ...(ciContext.runUrl !== undefined ? { ciRunUrl: ciContext.runUrl } : {}),
+        ...(ciContext.change !== undefined ? { ciChange: ciContext.change } : {}),
+        ...(ciContext.pipeline !== undefined ? { ciPipeline: ciContext.pipeline } : {}),
+        ...(ciContext.job !== undefined ? { ciJob: ciContext.job } : {}),
+        ...(ciContext.attempt !== undefined ? { ciAttempt: ciContext.attempt } : {}),
         host: hostContext.host,
         os: hostContext.os,
         arch: hostContext.arch,
@@ -916,6 +922,10 @@ async function runOnBus(
     const dependedOn = new Set<string>()
     for (const n of nodes.values()) for (const d of n.deps) dependedOn.add(d)
 
+    // Why a task missed, for a sink: a read of the history per miss, so only
+    // when a sink exists.
+    const explainMiss =
+      telemetry === undefined ? undefined : createMissExplainer(prepared.localCache.dbHandle())
     const buildExecuteArgs = (node: TaskNode, upstream: TaskOutcome[], reuseProbe = true) => {
       const probe = reuseProbe ? shortCircuit.preProbed.get(node.id) : undefined
       const upfrontKey = shortCircuit.uncachedKeys.get(node.id)
@@ -947,6 +957,7 @@ async function runOnBus(
         persistentRegistry,
         liveChildren,
         ...(telemetry?.track !== undefined ? { track: telemetry.track } : {}),
+        ...(explainMiss !== undefined ? { explainMiss } : {}),
         gitFilesCache,
         hashCache,
         ...(probe !== undefined ? { preProbed: probe } : {}),

package/src/orchestrator/telemetry.ts

@@ -17,7 +17,13 @@
 // core calls INTO; those are the behavior capabilities, kept separate.
 
 import { sampleTrees } from '../exec/index.js'
-import { isGroupTask, type TaskNode, type TaskOutcome, type TaskStatus } from '../graph/index.js'
+import {
+  isGroupTask,
+  type InputChanges,
+  type TaskNode,
+  type TaskOutcome,
+  type TaskStatus,
+} from '../graph/index.js'
 import { maskedCommand, settleWithin, teardownTimeoutMs } from '../util/index.js'
 import type { RunEvent, RunEventSubscriber } from './events.js'
 
@@ -143,6 +149,16 @@ export interface RunContextRecord {
   dirty: boolean | null
   ci: boolean
   ciProvider: string | null
+  /** The CI provider's page for this run. */
+  ciRunUrl?: string
+  /** The pull or merge request number the run builds. */
+  ciChange?: string
+  /** The CI workflow or pipeline name. */
+  ciPipeline?: string
+  /** The CI job (or step) within it. */
+  ciJob?: string
+  /** 1 on a first run, 2 on its first re-run. */
+  ciAttempt?: number
   host: string | null
   os: string
   arch: string
@@ -207,6 +223,15 @@ export interface TaskTelemetry {
   storedPeakRssBytes?: number
   /** How long an `admit` policy held the task once it was ready. Additive. */
   admissionHeldMs?: number
+  /** How long the task waited ready for a worker, any admission hold included. Additive. */
+  queuedMs?: number
+  /** On a cacheable task that ran: how many files its key read. Additive. */
+  inputFiles?: number
+  /**
+   * On a cacheable task that ran, when the cache holds an earlier entry for
+   * it: what its key changed since, the first ten named. Additive.
+   */
+  inputChanges?: InputChanges
   /**
    * On a cache hit: whether outputs were written this run (`true`) or the
    * disk already matched the entry and nothing was restored (`false`, an
@@ -741,6 +766,9 @@ export function taskTelemetryOf(o: TaskOutcome): TaskTelemetry {
   if (o.storedCpuMs !== undefined) t.storedCpuMs = o.storedCpuMs
   if (o.storedPeakRssBytes !== undefined) t.storedPeakRssBytes = o.storedPeakRssBytes
   if (o.admissionHeldMs !== undefined) t.admissionHeldMs = o.admissionHeldMs
+  if (o.queuedMs !== undefined) t.queuedMs = o.queuedMs
+  if (o.inputFiles !== undefined) t.inputFiles = o.inputFiles
+  if (o.inputChanges !== undefined) t.inputChanges = o.inputChanges
   if (isCacheHit(o.status)) t.restored = o.restored === true
   if (o.wallclockStartNs !== undefined) t.wallclockStartNs = o.wallclockStartNs.toString()
   if (o.wallclockEndNs !== undefined) t.wallclockEndNs = o.wallclockEndNs.toString()

package/src/util/index.ts

@@ -43,6 +43,7 @@ export {
   splitNegations,
   staticPrefix,
   anyTaskGlob,
+  isInstalledPath,
   taskGlob,
   wholeSubtreePrefixes,
   slashBraceExpansions,

package/src/util/paths.ts

@@ -366,6 +366,16 @@ export function slashBraceExpansions(pattern: string): string[] {
   return [pattern]
 }
 
+/**
+ * Whether a path git lists as UNTRACKED is an installed dependency: it sits
+ * under a `node_modules` directory. Such a file is never an input, and the
+ * enumeration drops it. A TRACKED file there (a committed test fixture) is
+ * a source like any other: dropped by path, an edit to it was a stale hit.
+ */
+export function isInstalledPath(rel: string): boolean {
+  return rel.startsWith('node_modules/') || rel.includes('/node_modules/')
+}
+
 // oxlint-disable-next-line no-control-regex
 const CONTROL = /[\x00-\x1f\x7f-\x9f]/g
 

package/src/workspace/affected.ts

@@ -15,6 +15,7 @@ import {
   UserError,
   gitSpawnRefusal,
   isExecutableMissing,
+  isInstalledPath,
   relPosix,
   taskGlob,
 } from '../util/index.js'
@@ -234,7 +235,11 @@ export async function affectedChanges(
 
   // vx-lock.json (workspace-root metadata) is excluded like a gitignored
   // file: re-running `vx lock` must not mark every project affected.
-  const changed = [...diffed, ...untracked].filter((s) => s !== LOCKFILE_NAME)
+  // An untracked file under `node_modules` is an install, which the input
+  // enumeration drops too (`isInstalledPath`); a tracked one is a source.
+  const changed = [...diffed, ...untracked.filter((s) => !isInstalledPath(s))].filter(
+    (s) => s !== LOCKFILE_NAME,
+  )
 
   // A lockfile or workspace-definition change re-keys EVERY task, because the
   // workspace fingerprint folds those files into every cache key. Mapping