@vzn/vx 0.0.589 → 0.0.591

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.589",
+  "version": "0.0.591",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.589",
-    "@vzn/vx-linux-arm64": "0.0.589",
-    "@vzn/vx-darwin-x64": "0.0.589",
-    "@vzn/vx-darwin-arm64": "0.0.589"
+    "@vzn/vx-linux-x64": "0.0.591",
+    "@vzn/vx-linux-arm64": "0.0.591",
+    "@vzn/vx-darwin-x64": "0.0.591",
+    "@vzn/vx-darwin-arm64": "0.0.591"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/select.ts

@@ -31,6 +31,7 @@ import {
   claimedAffected,
   fingerprintClaims,
   gitOfDiscovery,
+  hasHook,
   isDefaultBuild,
   keepDiscoveryGraph,
 } from '../orchestrator/index.js'
@@ -300,6 +301,15 @@ export async function resolveFilters(
       if (f.raw === affected) {
         changes = await affectedChanges(args)
         names = changes.projects
+        // A `graph` plugin may tie any task to a changed path (an edge, an
+        // input), and the run alone builds that graph: every project is a
+        // candidate, and the run keeps the tasks its final graph reaches.
+        if (
+          changes.changed.length > 0 &&
+          hasHook((await loadCliWorkspace(root)).plugins, 'graph')
+        ) {
+          names = new Set(projects.map((p) => p.name))
+        }
       } else {
         names = await affectedProjects(args)
       }

package/src/orchestrator/affected-tasks.ts

@@ -88,8 +88,13 @@ export function affectedRoots(
     return false
   }
   const seeded = (n: TaskNode): boolean => {
-    if (!changes.projects.has(n.projectName)) return false
     const cache = n.config.cache
+    // Asked of every node, not only the changed projects' (the
+    // `workspaceFiles` owners): a `graph` hook may have given the glob.
+    if (cache !== undefined && changes.changed.some((rel) => declaresInput(cache, null, rel))) {
+      return true
+    }
+    if (!changes.projects.has(n.projectName)) return false
     // A group runs nothing; only the default `build` (projects.ts) is keyed.
     // An uncached task reads its project: a root file another task of it
     // declares (`workspaceFiles`) is no change there.
@@ -97,10 +102,7 @@ export function affectedRoots(
       return !isGroupTask(n) && (whole.has(n.projectName) || changes.paths.has(n.projectName))
     }
     if (whole.has(n.projectName)) return true
-    if ((changes.paths.get(n.projectName) ?? []).some((rel) => declaresInput(cache, rel, null))) {
-      return true
-    }
-    return changes.changed.some((rel) => declaresInput(cache, null, rel))
+    return (changes.paths.get(n.projectName) ?? []).some((rel) => declaresInput(cache, rel, null))
   }
   const reached = new Map<string, boolean>()
   const reaches = (id: string): boolean => {

package/src/orchestrator/plugin.ts

@@ -294,7 +294,11 @@ export interface ProjectHookContext extends BaseContext {
 }
 
 export interface GraphHookContext extends BaseContext {
-  /** Task ids the user asked for (the rest were pulled in by `dependsOn`). */
+  /**
+   * Task ids the user asked for (the rest were pulled in by `dependsOn`).
+   * Under `--affected` this is every candidate: the selection reads the
+   * graph the hooks leave and cuts it down afterwards.
+   */
   readonly requested: readonly string[]
 }
 

package/src/orchestrator/prepare.ts

@@ -521,9 +521,43 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
           : {}),
       })
     let nodes = graphOf(requested)
+    const hasGraphHook = hasHook(plugins, 'graph')
+    const graphStage = async (): Promise<void> => {
+      // A hook edits each node's config in place, as `project` does, so the
+      // edit is held to what the loader accepts from a user: a misspelled
+      // `exec` field ran as an empty command and failed with no reason.
+      const configPaths = new Map(projectMetas.map((m) => [m.name, m.configPath]))
+      await applyGraphHooks(
+        plugins,
+        nodes,
+        {
+          workspaceRoot,
+          cacheDir,
+          warn: (m) => log.status(m),
+          requested: [...nodes.values()].filter((n) => n.requested).map((n) => n.id),
+        },
+        (plugin) => {
+          for (const n of nodes.values()) {
+            if (isDefaultBuild(n.config)) continue
+            const where = configPaths.get(n.projectName) ?? `${n.projectName} (no config file)`
+            validateProjectConfig(
+              { tasks: { [n.taskName]: n.config } },
+              `${where} (after plugin '${plugin.name}')`,
+            )
+          }
+        },
+        workspaceConfig?.rules,
+      )
+    }
+    // `--affected` selects over the FINAL graph: an edge or an input a
+    // `graph` hook adds moves a key, so the hooks run first, over every
+    // candidate, and the selection prunes what they left.
+    const hooksFirst = hasGraphHook && options.affected !== undefined
     // `--affected` keeps a bare request only when the diff reaches its
     // closure; a `pkg#task` the user named runs as it always does.
     if (options.affected !== undefined) {
+      const before = hooksFirst ? new Set(nodes.keys()) : null
+      if (hooksFirst) await graphStage()
       const named = new Set(tasks.filter((t) => t.includes('#')))
       const outright = new Set(options.selectedOutright)
       const ids = requested.map((r) => `${r.project}#${r.task}`)
@@ -532,7 +566,20 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
         (r, i) => named.has(ids[i]!) || outright.has(r.project) || reached.has(ids[i]!),
       )
       if (kept.length === 0) return emptyRun('none-affected')
-      if (kept.length < requested.length) {
+      if (before !== null) {
+        const asked = new Set(ids)
+        // What a hook added or asked for is the plugin's choice, kept as it
+        // would be on a run without the diff.
+        const roots = [
+          ...kept.map((r) => `${r.project}#${r.task}`),
+          ...[...nodes.values()]
+            .filter((n) => !before.has(n.id) || (n.requested && !asked.has(n.id)))
+            .map((n) => n.id),
+        ]
+        pruneToClosure(nodes, new Set(roots))
+        for (let i = unproven.length - 1; i >= 0; i--)
+          if (!nodes.has(unproven[i]![0])) unproven.splice(i, 1)
+      } else if (kept.length < requested.length) {
         unproven.length = 0
         nodes = graphOf(kept)
       }
@@ -605,33 +652,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       localCache,
     )
     mark('git enumeration')
-    if (hasHook(plugins, 'graph')) {
-      // A hook edits each node's config in place, as `project` does, so the
-      // edit is held to what the loader accepts from a user: a misspelled
-      // `exec` field ran as an empty command and failed with no reason.
-      const configPaths = new Map(projectMetas.map((m) => [m.name, m.configPath]))
-      await applyGraphHooks(
-        plugins,
-        nodes,
-        {
-          workspaceRoot,
-          cacheDir,
-          warn: (m) => log.status(m),
-          requested: [...nodes.values()].filter((n) => n.requested).map((n) => n.id),
-        },
-        (plugin) => {
-          for (const n of nodes.values()) {
-            if (isDefaultBuild(n.config)) continue
-            const where = configPaths.get(n.projectName) ?? `${n.projectName} (no config file)`
-            validateProjectConfig(
-              { tasks: { [n.taskName]: n.config } },
-              `${where} (after plugin '${plugin.name}')`,
-            )
-          }
-        },
-        workspaceConfig?.rules,
-      )
-    }
+    if (hasGraphHook && !hooksFirst) await graphStage()
     // Args after `--` go to requested commands only; with none among them
     // they reached nothing and the run passed, the `--watch` unheard.
     if ((options.forwardArgs?.length ?? 0) > 0) {
@@ -767,3 +788,23 @@ async function refuseUndeclaredDeps(
     if (!declared.has(name)) throw undeclaredDepsError(id, name)
   }
 }
+
+/**
+ * Drops every node outside the `dependsOn` closure of `roots`, and demotes a
+ * requested one only a kept task pulls in: what a rebuild from the kept
+ * requests would hold, with the `graph` hooks' edits kept.
+ */
+function pruneToClosure(nodes: Map<string, TaskNode>, roots: ReadonlySet<string>): void {
+  const keep = new Set<string>()
+  const stack = [...roots]
+  while (stack.length > 0) {
+    const id = stack.pop()!
+    if (keep.has(id)) continue
+    keep.add(id)
+    stack.push(...nodes.get(id)!.deps)
+  }
+  for (const [id, n] of nodes) {
+    if (!keep.has(id)) nodes.delete(id)
+    else if (!roots.has(id)) n.requested = false
+  }
+}

package/src/workspace/config-schema.ts

@@ -663,6 +663,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `let cleanOutputs delete files outside it)`,
           )
         }
+        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
         assertNoForeignToken(g, `${where}.cache.outputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
@@ -714,6 +715,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `use cache.inputs.workspaceFiles for workspace-root-relative inputs)`,
           )
         }
+        assertPosixGlob(g, `${where}.cache.inputs.files`, 'project')
         assertNoForeignToken(g, `${where}.cache.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
@@ -1196,6 +1198,39 @@ function isAbsoluteGlob(glob: string): boolean {
   return g.startsWith('/') || (g.includes('{') && /[{,]\//.test(g))
 }
 
+const DRIVE = /(^|[{,])[A-Za-z]:[\\/]+/g
+
+/**
+ * True when a backslash in the glob is a Windows separator. One before a
+ * bracket, a brace, a `!` or a backslash is an escape (`app/\[id\]`,
+ * `\{b\}`); one before anything else is a separator — `a\*b` reads as
+ * `a/*b` on Windows far more often than as a file named with a star, which
+ * `a?b` still selects.
+ */
+function hasBackslashSeparator(body: string): boolean {
+  for (let i = body.indexOf('\\'); i !== -1; i = body.indexOf('\\', i + 2)) {
+    if (!'[]{}!\\'.includes(body[i + 1] ?? '/')) return true
+  }
+  return false
+}
+
+/**
+ * A Windows spelling (`src\**`, `C:/src/**`) loaded with only a "matched no
+ * files" warning, and a task keyed on it never saw its source (X-67).
+ */
+function assertPosixGlob(glob: string, where: string, base: string): void {
+  const neg = glob.startsWith('!') ? '!' : ''
+  const body = glob.slice(neg.length)
+  DRIVE.lastIndex = 0
+  const drive = DRIVE.test(body)
+  if (!drive && !hasBackslashSeparator(body)) return
+  const write = neg + body.replace(DRIVE, '$1').replace(/\\(?![[\]{}!\\])/g, '/')
+  throw new UserError(
+    `${where}: "${glob}" ${drive ? 'starts with a Windows drive' : 'uses a backslash as a path separator'} — ` +
+      `task globs are ${base}-relative with forward slashes: write "${write}"`,
+  )
+}
+
 /**
  * `!!x` INVERTS the input set instead of double-negating it.
  *
@@ -1405,6 +1440,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
           `entries are workspace-root-relative and must stay within the workspace root`,
       )
     }
+    assertPosixGlob(g, where, 'workspace-root')
     assertNoForeignToken(g, where)
     if (namesDirItself(g)) {
       throw new UserError(