@vzn/vx 0.0.568 → 0.0.570

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.568",
+  "version": "0.0.570",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.568",
-    "@vzn/vx-linux-arm64": "0.0.568",
-    "@vzn/vx-darwin-x64": "0.0.568",
-    "@vzn/vx-darwin-arm64": "0.0.568"
+    "@vzn/vx-linux-x64": "0.0.570",
+    "@vzn/vx-linux-arm64": "0.0.570",
+    "@vzn/vx-darwin-x64": "0.0.570",
+    "@vzn/vx-darwin-arm64": "0.0.570"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/run.ts

@@ -10,6 +10,7 @@ import {
   outcomeLabel,
   projectOutcome,
   run as runOrchestrator,
+  shellQuote,
   type OutcomeView,
   type RunOptions,
   type RunResult,
@@ -649,8 +650,9 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   }
   const opts = resolved
   // The raw invocation, recorded on the `invocations` row so dashboards
-  // show what was actually run. `args` is everything after `run`.
-  opts.command = ['vx', 'run', ...args].join(' ')
+  // show what was actually run. `args` is everything after `run`, quoted
+  // so `vx last` replays one paste-able line.
+  opts.command = ['vx', 'run', ...args.map(shellQuote)].join(' ')
 
   // Planning paths short-circuit execution. Both build the full task
   // graph + probe the cache; the difference is just the formatter.

package/src/exec/index.ts

@@ -13,6 +13,7 @@ export {
   runPersistent,
   PersistentReadyError,
   withForwardArgs,
+  shellQuote,
   signalExitCode,
   exitSignal,
   type CaptureConfig,

package/src/exec/runner.ts

@@ -106,7 +106,8 @@ function taskStdio(terminal: boolean | undefined, stdin: 'ignore' | 'pipe') {
 
 export function shellQuote(arg: string): string {
   if (arg === '') return `''`
-  if (/^[A-Za-z0-9_\-.,/=:@%+]+$/.test(arg)) return arg
+  // A `#` opens a comment only at a word's start, so `app#build` stays bare.
+  if (/^[A-Za-z0-9_\-.,/=:@%+][A-Za-z0-9_\-.,/=:@%+#]*$/.test(arg)) return arg
   return `'${arg.replace(/'/g, `'\\''`)}'`
 }
 

package/src/orchestrator/index.ts

@@ -21,7 +21,8 @@ export type { HeldPersistent, RunOptions, RunSummary } from './options.js'
 // reach it without importing the cache module directly.
 export { type CachePolicy, FULL_CACHE_POLICY, parseCachePolicy } from '../cache/index.js'
 // The CLI reads a recorded exit code; the runner's convention decodes it.
-export { exitSignal } from '../exec/index.js'
+// It records its own argv quoted as the runner quotes forwarded args.
+export { exitSignal, shellQuote } from '../exec/index.js'
 export { forwardedSignal } from './signals.js'
 // `vx cache prune` waits for a run on the workspace before it evicts.
 export { acquireRunLock } from './run-lock.js'

package/src/orchestrator/metrics.ts

@@ -428,7 +428,31 @@ function unchangedKeyNote(
   if (createdAt !== undefined && createdAt >= this_.startedAt) {
     return 'cache key unchanged — no entry for this key was in the cache when it ran (pruned or evicted), so it executed and saved one'
   }
-  return 'cache key unchanged — re-executed on the same key (--no-cache / --force, or unrelated)'
+  // The flags that skip a read were ruled out above whenever the policy was
+  // recorded; blaming them here named a flag the policy shows was not passed
+  // when the previous run's save had failed (X-46). No row records a failed
+  // save, only its trace: the previous run executed, succeeded, and no entry
+  // holds the key.
+  if (policy === undefined) {
+    return 'cache key unchanged — re-executed on the same key (--no-cache / --force, or unrelated)'
+  }
+  if (createdAt === undefined && prev.status === 'success' && prev.cacheHit === 0) {
+    const prevPolicy =
+      prev.runId === null
+        ? undefined
+        : (
+            db
+              .query('SELECT cache_policy AS p FROM invocations WHERE run_id = ?')
+              .get(prev.runId) as {
+              p: string
+            } | null
+          )?.p
+    if (prevPolicy !== undefined && !prevPolicy.split(',').some((a) => a === 'lW' || a === 'rW')) {
+      return 'cache key unchanged — the previous run on this key did not write the cache (--no-cache, or a --cache without write), so there was nothing to hit'
+    }
+    return 'cache key unchanged — the previous run on this key executed but no entry for it is in the cache (its save failed, or it was pruned since), so there was nothing to hit'
+  }
+  return 'cache key unchanged — re-executed on the same key though this run read the cache; vx cannot name the cause'
 }
 
 /**

package/src/util/secret-mask.ts

@@ -65,6 +65,9 @@ export function secretMask(
   const add = (value: string | undefined): void => {
     if (value === undefined || value.length < MIN_SECRET_CHARS) return
     values.add(value)
+    // A value with a `'` reaches a printed command spelled as shellQuote
+    // spells it (`'\''`), which the plain value does not match (X-45).
+    if (value.includes("'")) values.add(value.replaceAll("'", `'\\''`))
     // A multi-line value (a PEM key) is also masked line by line, as GitHub
     // Actions does: a tool that indents or reflows it prints no copy of the
     // whole value, and every line leaked (L-36).