@vzn/vx 0.0.581 → 0.0.584

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.581",
+  "version": "0.0.584",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.581",
-    "@vzn/vx-linux-arm64": "0.0.581",
-    "@vzn/vx-darwin-x64": "0.0.581",
-    "@vzn/vx-darwin-arm64": "0.0.581"
+    "@vzn/vx-linux-x64": "0.0.584",
+    "@vzn/vx-linux-arm64": "0.0.584",
+    "@vzn/vx-darwin-x64": "0.0.584",
+    "@vzn/vx-darwin-arm64": "0.0.584"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/lock.ts

@@ -90,8 +90,8 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   if (leaks.length > 0) {
     process.stderr.write(
       `vx lock: ${LOCKFILE_NAME} is committed, and these configs evaluated to a secret value:\n` +
-        leaks.map((l) => `  ${l}\n`).join('') +
-        `let the shell expand it ($API_TOKEN in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
+        leaks.map((l) => `  ${l.at}\n`).join('') +
+        `let the shell expand it ($${leaks[0]!.name} in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
     )
     return 1
   }
@@ -111,7 +111,7 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
  * such a value would be published, and masking it would freeze a `***`
  * that `--frozen` runs (L-42).
  */
-function secretsIn(projects: Record<string, LockfileEntry>): string[] {
+function secretsIn(projects: Record<string, LockfileEntry>): Array<{ at: string; name: string }> {
   const named = new Set<string>()
   for (const entry of Object.values(projects)) {
     for (const task of Object.values(entry.config.tasks ?? {}))
@@ -123,11 +123,11 @@ function secretsIn(projects: Record<string, LockfileEntry>): string[] {
       secrets.push([value, name])
   }
   if (secrets.length === 0) return []
-  const found: string[] = []
+  const found: Array<{ at: string; name: string }> = []
   const walk = (project: string, at: string, v: unknown): void => {
     if (typeof v === 'string') {
       for (const [value, name] of secrets)
-        if (v.includes(value)) found.push(`${project}: ${at} holds $${name}`)
+        if (v.includes(value)) found.push({ at: `${project}: ${at} holds $${name}`, name })
     } else if (Array.isArray(v)) {
       v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
     } else if (v !== null && typeof v === 'object') {

package/src/cli/watch-filter.ts

@@ -270,10 +270,9 @@ export function makeRootEventFilter(
  * project nested there: the key's boundary (`computeNestedProjectDirs`)
  * leaves such a file out, so it is no edit of `ownDir`'s. A root project
  * watched its whole tree and ran a cycle for every edit in a nested one
- * (X-42). The fences are the projects with a config, which fence a key
- * whatever the plugins; a config-less one may not, and an edit there
- * still counts. The fence's own config is let through: it coming or going
- * moves the boundary, and the cycle it starts re-reads the set.
+ * (X-42). The fences are every project, config or not, as the key's are
+ * (X-57). The fence's own config is let through: it may give the project
+ * tasks, and the cycle it starts re-reads the set.
  */
 export function makeFence(fenceDirs: readonly string[]): (ownDir: string, abs: string) => boolean {
   const fences = fenceDirs.map((d) => path.resolve(d))

package/src/cli/watch.ts

@@ -316,14 +316,13 @@ interface WatchLoopArgs {
   memberBases: readonly string[]
   /** Every package's directory, in scope or not: a member base's other entries are packages still to come. */
   packageDirs: ReadonlySet<string>
-  /** Every project with a config, in scope or not: a project's key leaves out what lies in one nested under it. */
+  /** Every project, in scope or not: a project's key leaves out what lies in one nested under it. */
   fenceDirs: readonly string[]
   /** The watched set again, after a cycle that followed an event which can change it. */
   rediscover: () => Promise<Rediscovered>
 }
 
-const fenceDirs = (all: readonly ProjectMeta[]): string[] =>
-  all.filter((p) => p.configPath !== null).map((p) => p.dir)
+const fenceDirs = (all: readonly ProjectMeta[]): string[] => all.map((p) => p.dir)
 
 interface Rediscovered {
   projects: readonly ProjectMeta[]

package/src/graph/scheduler.ts

@@ -267,6 +267,9 @@ export interface ScheduleOptions {
    *     output is reported `cache-hit` regardless of a dep failing);
    *   - leaves the tier when `execute` throws `RestoreDemoted`, and is
    *     dispatched again once its deps are done, with the dep check.
+   * A persistent task nobody requested whose every dependant is in the
+   * tier starts only when one of them is demoted; once they have all
+   * finished it settles without an outcome, never spawned.
    * It still runs through `execute()` (so the logger frame is unchanged);
    * the orchestrator's execute reuses the up-front probe, so there is no
    * second cache.get. When undefined/empty, behavior is byte-identical.
@@ -463,6 +466,13 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // they are exec-tier tasks, gated on their deps like any other.
   const demoted = new Set<string>()
   const inRestoreTier = (id: string): boolean => restoreTier?.has(id) === true && !demoted.has(id)
+  // A server pulled in only for restore-tier hits serves nobody: it waits
+  // (`dormant`) until a dependant is demoted, which starts it, or until
+  // every dependant has finished, which settles it unspawned. Settled
+  // without an outcome: it is not part of the run, as a pruned task is not.
+  const idle = idleServers(nodes, dependents, restoreTier)
+  const dormant = new Set<string>()
+  let settledIdle = 0
   const execReady = new ReadyHeap(priority)
   const restoreReady = new ReadyHeap(priority)
   // A restore-tier task is dep-independent (a stable hit's restore needs
@@ -580,6 +590,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     const finishOne = (id: string, outcome: TaskOutcome): void => {
       if (continueMode === 'never' && outcome.status === 'failed') failFastTripped = true
       outcomes.set(id, outcome)
+      // A dormant server is asked again: the dispatch settles it once its
+      // last dependant is in.
+      if (dormant.size > 0) {
+        for (const p of (nodes.get(id) as TaskNode).deps) if (dormant.delete(p)) execReady.push(p)
+      }
       // Observer hook (the logger's taskComplete). Crash-isolated: a
       // throwing observer must NOT break scheduling — it would otherwise
       // skip the dependent-enqueue + tick below and hang the run. Same
@@ -724,7 +739,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           while (execReady.size > 0) {
             const seq = execReady.peekSeq()
             const id = execReady.pop() as string
-            if (willSkip(id)) return id
+            if (willSkip(id) || idle.has(id)) return id
             if (exclusive?.has(id) === true) {
               if (!busy() && (!admitActive || admits(id))) return id
               parked.push([id, seq])
@@ -779,6 +794,14 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           })
           continue
         }
+        if (idle.has(id)) {
+          readyAt.delete(id)
+          if (dependents.get(id)!.every((d) => outcomes.has(d))) {
+            settledIdle++
+            release(id)
+          } else dormant.add(id)
+          continue
+        }
 
         const queuedMs = Date.now() - (readyAt.get(id) ?? Date.now())
         readyAt.delete(id)
@@ -847,6 +870,12 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
               leave()
               untrack()
               demoted.add(id)
+              for (const p of node.deps) {
+                if (idle.delete(p) && dormant.delete(p)) {
+                  execReady.push(p)
+                  readyAt.set(p, Date.now())
+                }
+              }
               if (pending.get(id) === 0) {
                 execReady.push(id)
                 readyAt.set(id, Date.now())
@@ -919,7 +948,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
       // takes none), so a task still holding one has no outcome yet, and
       // the lane counters could add nothing — deleting both from this
       // condition survived the whole core suite (item 644).
-      if (outcomes.size === nodes.size) {
+      if (outcomes.size + settledIdle === nodes.size) {
         resolved = true
         resolve(outcomes)
       }
@@ -928,3 +957,19 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     tick()
   })
 }
+
+/** Persistent tasks nobody asked for whose every dependant is a restore-tier hit. */
+function idleServers(
+  nodes: ReadonlyMap<string, TaskNode>,
+  dependents: ReadonlyMap<string, string[]>,
+  restoreTier: ReadonlySet<string> | undefined,
+): Set<string> {
+  const out = new Set<string>()
+  if (restoreTier === undefined || restoreTier.size === 0) return out
+  for (const n of nodes.values()) {
+    if (n.config.exec?.persistent === undefined || n.requested || n.surfaced === true) continue
+    const ds = dependents.get(n.id)
+    if (ds !== undefined && ds.every((d) => restoreTier.has(d))) out.add(n.id)
+  }
+  return out
+}

package/src/graph/task-graph.ts

@@ -929,6 +929,14 @@ function collideAcross(
           ;(files.outputsAddedToBy ??= []).push(...own)
           return
         }
+        // Already ordered: "make one depend on the other" would send the
+        // reader after an edge the config has. Name what keeps it out.
+        const outside = wsGlobs[own.indexOf(null)]!
+        throw new UserError(
+          `${head}. ${ws.id} depends on ${files.id}, but adding to its output needs every ` +
+            `cache.outputs.workspaceFiles entry inside ${rel === '' ? 'the workspace root' : rel}, ` +
+            `and ${JSON.stringify(outside)} is not. Give each task its own output path.`,
+        )
       }
       throw new UserError(
         `${head} and the run still reports success. Give each task its own output path` +

package/src/orchestrator/prepare.ts

@@ -357,12 +357,12 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   const { projects, configured: projectsWithConfigs } = loaded
   mark('load configs')
 
-  // Boundary geometry considers every config-bearing project in the
-  // workspace, loaded or not — an out-of-scope nested project must
-  // still fence its files off from its parent's globs.
-  const nestedDirsByProject = computeNestedProjectDirs(
-    projectsWithConfigs.map((m) => ({ name: m.name, dir: m.dir })),
-  )
+  // Boundary geometry considers every workspace project, loaded or not,
+  // config or not: `--affected` gives a changed path to the deepest project
+  // dir, and a config-less one keys its files under its default `build`, so
+  // a parent's glob that folded (or cleaned) them crossed a boundary the
+  // selection drew (X-57).
+  const nestedDirsByProject = computeNestedProjectDirs(projectMetas)
 
   const candidateProjects = options.projects
     ? options.projects.filter((p) => projects.has(p))

package/src/orchestrator/projects.ts

@@ -155,8 +155,7 @@ export interface LoadedProjects {
   projects: Map<string, ProjectEntry>
   /**
    * Every project that can carry tasks: it has a config file, or a plugin
-   * fills the `project` stage and may give it tasks. Boundary geometry
-   * fences all of them, loaded or not.
+   * fills the `project` stage and may give it tasks.
    */
   configured: readonly ProjectMeta[]
 }
@@ -179,7 +178,7 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
   // scripts mapped onto packages that never wrote a `vx.config.ts`). It
   // then loads as `{ tasks: {} }` — nothing to evaluate, nothing to freeze
   // — and the stage runs on that like on any loaded config. With no
-  // `project` plugin a plain run never seeds (or fences) a config-less
+  // `project` plugin a plain run never seeds a config-less
   // package, but loads one a loaded project's closure reaches: it gets the
   // default `build`, so a dependant bundling its source is keyed on it
   // behind `^build`. Left out, its edit replayed the dependant's stale