@vzn/vx 0.0.580 → 0.0.582

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.580",
+  "version": "0.0.582",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.580",
-    "@vzn/vx-linux-arm64": "0.0.580",
-    "@vzn/vx-darwin-x64": "0.0.580",
-    "@vzn/vx-darwin-arm64": "0.0.580"
+    "@vzn/vx-linux-x64": "0.0.582",
+    "@vzn/vx-linux-arm64": "0.0.582",
+    "@vzn/vx-darwin-x64": "0.0.582",
+    "@vzn/vx-darwin-arm64": "0.0.582"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/lock.ts

@@ -90,8 +90,8 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   if (leaks.length > 0) {
     process.stderr.write(
       `vx lock: ${LOCKFILE_NAME} is committed, and these configs evaluated to a secret value:\n` +
-        leaks.map((l) => `  ${l}\n`).join('') +
-        `let the shell expand it ($API_TOKEN in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
+        leaks.map((l) => `  ${l.at}\n`).join('') +
+        `let the shell expand it ($${leaks[0]!.name} in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
     )
     return 1
   }
@@ -111,7 +111,7 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
  * such a value would be published, and masking it would freeze a `***`
  * that `--frozen` runs (L-42).
  */
-function secretsIn(projects: Record<string, LockfileEntry>): string[] {
+function secretsIn(projects: Record<string, LockfileEntry>): Array<{ at: string; name: string }> {
   const named = new Set<string>()
   for (const entry of Object.values(projects)) {
     for (const task of Object.values(entry.config.tasks ?? {}))
@@ -123,11 +123,11 @@ function secretsIn(projects: Record<string, LockfileEntry>): string[] {
       secrets.push([value, name])
   }
   if (secrets.length === 0) return []
-  const found: string[] = []
+  const found: Array<{ at: string; name: string }> = []
   const walk = (project: string, at: string, v: unknown): void => {
     if (typeof v === 'string') {
       for (const [value, name] of secrets)
-        if (v.includes(value)) found.push(`${project}: ${at} holds $${name}`)
+        if (v.includes(value)) found.push({ at: `${project}: ${at} holds $${name}`, name })
     } else if (Array.isArray(v)) {
       v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
     } else if (v !== null && typeof v === 'object') {

package/src/graph/task-graph.ts

@@ -553,6 +553,7 @@ export function checkGraph(
     delete node.addsToOutputsOf
     delete node.outputsAddedToBy
   }
+  for (const node of nodes.values()) refuseSelfClean(node)
   detectCycle(nodes)
   detectOutputCollisions(nodes, workspaceRoot, rules?.exclusiveOutputs !== false)
   if (rules?.upfrontKeys !== false) detectInputOverlaps(nodes, workspaceRoot)
@@ -1123,6 +1124,44 @@ export function outputTakenBack(output: string, negatives: readonly string[]): b
   )
 }
 
+/**
+ * A task whose input entry its own outputs take back whole cleans its own
+ * sources: vx removes a task's outputs before it runs, so a formatter
+ * declaring `src/**` as both deleted every committed file under `src`,
+ * and its key read nothing (hunt 8). Always refused, whatever the rules.
+ */
+function refuseSelfClean(node: TaskNode): void {
+  const cache = node.config.cache
+  if (cache === undefined) return
+  for (const field of ['files', 'workspaceFiles'] as const) {
+    const inputs = splitNegations(cache.inputs[field] ?? [])
+    const out = splitNegations(cache.outputs[field] ?? [])
+    const outputs = out.positive
+    if (outputs.length === 0) continue
+    const roots = outputs.map((g) => rootless(staticPrefix(g)))
+    for (const gi of inputs.positive) {
+      // Only an output rooted at or above the input's prefix can cover it;
+      // the prefix test keeps the glob matchers off the common disjoint pair.
+      const pi = rootless(staticPrefix(gi))
+      const near = outputs.filter((_, k) => {
+        const r = roots[k]!
+        return r === '' || pi === r || pi.startsWith(`${r}/`)
+      })
+      // Taken back by the task's own `!` inputs, or by an output `!` (no
+      // output, so never cleaned: A-44), the entry reads what it says.
+      if (near.length === 0 || outputTakenBack(gi, inputs.negative)) continue
+      if (outputTakenBack(gi, out.negative)) continue
+      if (!outputTakenBack(gi, near)) continue
+      throw new UserError(
+        `${node.id}: every file ${JSON.stringify(gi)} in cache.inputs.${field} selects is also ` +
+          `its own output — vx removes a task's outputs before it runs, so the task would ` +
+          `delete its own sources. A task that rewrites files in place (a formatter) declares ` +
+          `no outputs.`,
+      )
+    }
+  }
+}
+
 /** One task's inputs (`reads`) or outputs in one namespace, for `detectInputOverlaps`. */
 interface Side {
   node: TaskNode