@vzn/vx 0.0.528 → 0.0.529

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.528",
+  "version": "0.0.529",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.528",
-    "@vzn/vx-linux-arm64": "0.0.528",
-    "@vzn/vx-darwin-x64": "0.0.528",
-    "@vzn/vx-darwin-arm64": "0.0.528"
+    "@vzn/vx-linux-x64": "0.0.529",
+    "@vzn/vx-linux-arm64": "0.0.529",
+    "@vzn/vx-darwin-x64": "0.0.529",
+    "@vzn/vx-darwin-arm64": "0.0.529"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -7,7 +7,13 @@
 
 import path from 'node:path'
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
-import { UserError, executablePath, gitSpawnRefusal, xxh3hex } from '../util/index.js'
+import {
+  UserError,
+  executablePath,
+  gitSpawnRefusal,
+  isInstalledPath,
+  xxh3hex,
+} from '../util/index.js'
 import { FILE_HASH_RACY_MS, racyWindowMs } from './layer.js'
 
 /** Three facts of the repository a directory is in: read off the disk, or one `git rev-parse`. */
@@ -517,7 +523,8 @@ function walkFiles(dir: string, rel = ''): string[] {
   }
   const out: string[] = []
   for (const e of entries) {
-    if (e.name === '.git') continue
+    // Nothing tracks a vendored tree's files; an install there is not one.
+    if (e.name === '.git' || e.name === 'node_modules') continue
     const r = rel === '' ? e.name : `${rel}/${e.name}`
     if (e.isDirectory()) out.push(...walkFiles(dir, r))
     else out.push(r)
@@ -562,6 +569,7 @@ function parseLsFilesOutput(
     if (record.length === 0) continue
     const m = LS_FILES_STAGE_RE.exec(record)
     const filePath = m === null ? record : record.slice(m[0].length) // --others: bare path
+    if (m === null && isInstalledPath(filePath)) continue
     files.push(filePath)
     if (undecodableRecords.size > 0 && undecodableRecords.has(record)) undecodable.push(filePath)
     if (m === null) continue
@@ -1376,7 +1384,11 @@ export async function startGitEnumeration(
   // is). They come from the status walk, repo-root-relative like the dirty
   // set. Without a status answer the enumeration is the index alone.
   const untracked =
-    parsedStatus === null ? [] : [...stripPrefixFromSet(new Set(parsedStatus.untracked), gitPrefix)]
+    parsedStatus === null
+      ? []
+      : [...stripPrefixFromSet(new Set(parsedStatus.untracked), gitPrefix)].filter(
+          (rel) => !isInstalledPath(rel),
+        )
   const listed = untracked.length === 0 ? tracked : tracked.concat(untracked)
   const nested = expandNestedRepos(workspaceRoot, listed, gitlinks)
   const all = nested.files

package/src/cache/inputs.ts

@@ -58,8 +58,10 @@ export {
 // re-lock can't bust every cache key the way a tracked source file
 // would. (Literal pattern, not the workspace `LOCKFILE_NAME` constant:
 // cache is a leaf module and must not import from workspace.)
+//
+// `node_modules` is not here: the enumeration drops an untracked file
+// under one (`isInstalledPath`), and a tracked one is a source.
 const ALWAYS_IGNORE = [
-  '**/node_modules/**',
   // Defense in depth, and measured as exactly that (item 497): git never
   // reports a path under `.git`, so dropping this line changes NOTHING on
   // any route into the input set. Probed three ways with the pattern in

package/src/util/index.ts

@@ -43,6 +43,7 @@ export {
   splitNegations,
   staticPrefix,
   anyTaskGlob,
+  isInstalledPath,
   taskGlob,
   wholeSubtreePrefixes,
   slashBraceExpansions,

package/src/util/paths.ts

@@ -366,6 +366,16 @@ export function slashBraceExpansions(pattern: string): string[] {
   return [pattern]
 }
 
+/**
+ * Whether a path git lists as UNTRACKED is an installed dependency: it sits
+ * under a `node_modules` directory. Such a file is never an input, and the
+ * enumeration drops it. A TRACKED file there (a committed test fixture) is
+ * a source like any other: dropped by path, an edit to it was a stale hit.
+ */
+export function isInstalledPath(rel: string): boolean {
+  return rel.startsWith('node_modules/') || rel.includes('/node_modules/')
+}
+
 // oxlint-disable-next-line no-control-regex
 const CONTROL = /[\x00-\x1f\x7f-\x9f]/g
 

package/src/workspace/affected.ts

@@ -15,6 +15,7 @@ import {
   UserError,
   gitSpawnRefusal,
   isExecutableMissing,
+  isInstalledPath,
   relPosix,
   taskGlob,
 } from '../util/index.js'
@@ -234,7 +235,11 @@ export async function affectedChanges(
 
   // vx-lock.json (workspace-root metadata) is excluded like a gitignored
   // file: re-running `vx lock` must not mark every project affected.
-  const changed = [...diffed, ...untracked].filter((s) => s !== LOCKFILE_NAME)
+  // An untracked file under `node_modules` is an install, which the input
+  // enumeration drops too (`isInstalledPath`); a tracked one is a source.
+  const changed = [...diffed, ...untracked.filter((s) => !isInstalledPath(s))].filter(
+    (s) => s !== LOCKFILE_NAME,
+  )
 
   // A lockfile or workspace-definition change re-keys EVERY task, because the
   // workspace fingerprint folds those files into every cache key. Mapping