@vzn/vx 0.0.568 → 0.0.569

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.568",
+  "version": "0.0.569",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.568",
-    "@vzn/vx-linux-arm64": "0.0.568",
-    "@vzn/vx-darwin-x64": "0.0.568",
-    "@vzn/vx-darwin-arm64": "0.0.568"
+    "@vzn/vx-linux-x64": "0.0.569",
+    "@vzn/vx-linux-arm64": "0.0.569",
+    "@vzn/vx-darwin-x64": "0.0.569",
+    "@vzn/vx-darwin-arm64": "0.0.569"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/run.ts

@@ -10,6 +10,7 @@ import {
   outcomeLabel,
   projectOutcome,
   run as runOrchestrator,
+  shellQuote,
   type OutcomeView,
   type RunOptions,
   type RunResult,
@@ -649,8 +650,9 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   }
   const opts = resolved
   // The raw invocation, recorded on the `invocations` row so dashboards
-  // show what was actually run. `args` is everything after `run`.
-  opts.command = ['vx', 'run', ...args].join(' ')
+  // show what was actually run. `args` is everything after `run`, quoted
+  // so `vx last` replays one paste-able line.
+  opts.command = ['vx', 'run', ...args.map(shellQuote)].join(' ')
 
   // Planning paths short-circuit execution. Both build the full task
   // graph + probe the cache; the difference is just the formatter.

package/src/exec/index.ts

@@ -13,6 +13,7 @@ export {
   runPersistent,
   PersistentReadyError,
   withForwardArgs,
+  shellQuote,
   signalExitCode,
   exitSignal,
   type CaptureConfig,

package/src/exec/runner.ts

@@ -106,7 +106,8 @@ function taskStdio(terminal: boolean | undefined, stdin: 'ignore' | 'pipe') {
 
 export function shellQuote(arg: string): string {
   if (arg === '') return `''`
-  if (/^[A-Za-z0-9_\-.,/=:@%+]+$/.test(arg)) return arg
+  // A `#` opens a comment only at a word's start, so `app#build` stays bare.
+  if (/^[A-Za-z0-9_\-.,/=:@%+][A-Za-z0-9_\-.,/=:@%+#]*$/.test(arg)) return arg
   return `'${arg.replace(/'/g, `'\\''`)}'`
 }
 

package/src/orchestrator/index.ts

@@ -21,7 +21,8 @@ export type { HeldPersistent, RunOptions, RunSummary } from './options.js'
 // reach it without importing the cache module directly.
 export { type CachePolicy, FULL_CACHE_POLICY, parseCachePolicy } from '../cache/index.js'
 // The CLI reads a recorded exit code; the runner's convention decodes it.
-export { exitSignal } from '../exec/index.js'
+// It records its own argv quoted as the runner quotes forwarded args.
+export { exitSignal, shellQuote } from '../exec/index.js'
 export { forwardedSignal } from './signals.js'
 // `vx cache prune` waits for a run on the workspace before it evicts.
 export { acquireRunLock } from './run-lock.js'

package/src/util/secret-mask.ts

@@ -65,6 +65,9 @@ export function secretMask(
   const add = (value: string | undefined): void => {
     if (value === undefined || value.length < MIN_SECRET_CHARS) return
     values.add(value)
+    // A value with a `'` reaches a printed command spelled as shellQuote
+    // spells it (`'\''`), which the plain value does not match (X-45).
+    if (value.includes("'")) values.add(value.replaceAll("'", `'\\''`))
     // A multi-line value (a PEM key) is also masked line by line, as GitHub
     // Actions does: a tool that indents or reflows it prints no copy of the
     // whole value, and every line leaked (L-36).