@vzn/vx 0.0.594 → 0.0.596

package/src/orchestrator/run.ts

@@ -6,7 +6,13 @@ import type { ProjectEntry } from '../workspace/index.js'
 import { loadWorkspace, unreachedHint, unreachedPackages } from '../workspace/index.js'
 import { realpathSync } from 'node:fs'
 import path from 'node:path'
-import { Cache, type CacheLayer, type CachePolicy, stopRuntimeProbes } from '../cache/index.js'
+import {
+  Cache,
+  type CacheLayer,
+  type CachePolicy,
+  cachesNothing,
+  stopRuntimeProbes,
+} from '../cache/index.js'
 import { VERSION } from '../version.js'
 import {
   resetSandbox,
@@ -44,6 +50,7 @@ import {
   secretMask,
 } from '../util/index.js'
 import { keyedProjects } from './keyed-projects.js'
+import { isDefaultBuild } from './projects.js'
 import { prepareSandbox } from './sandbox-request.js'
 import type { OutputDirSnapshot, SaveFacts } from './miss-save.js'
 import { admitTasks, taintTracker } from './admission.js'
@@ -87,8 +94,12 @@ import {
   detectCi,
 } from './run-context.js'
 import { startRemotePrefetch } from './remote-prefetch.js'
-import { startLocalShortCircuit, type ShortCircuit } from './local-shortcircuit.js'
-import { probesAfterWrites } from './stable-keys.js'
+import {
+  restoreTierExclusions,
+  startLocalShortCircuit,
+  type ShortCircuit,
+} from './local-shortcircuit.js'
+import { deriveStableKeys, probesAfterWrites } from './stable-keys.js'
 
 import { assembleRunRecords } from './run-records.js'
 import { hasEnded, selectKeepAlive, shutdownPersistent } from './persistent.js'
@@ -1013,6 +1024,7 @@ async function runOnBus(
     // is one probe of the failed-row index.
     const flaky: FlakyFinding[] = []
     const historyDb = prepared.localCache.dbHandle()
+    const cacheOff = cachesNothing(policy)
     const judgeFlaky = (o: TaskOutcome): void => {
       const candidates = flakyCandidates([o])
       if (candidates.length === 0) return
@@ -1040,6 +1052,7 @@ async function runOnBus(
         log.taskStart?.(node)
       },
       onFinish: (o) => {
+        if (cacheOff) o.cacheOff = true
         taint.settled(o)
         judgeFlaky(o)
         log.taskComplete(o.node, o)
@@ -1086,8 +1099,6 @@ async function runOnBus(
     ).filter((c) => endedBeforeStop?.has(persistentRegistry.get(c.id)!) ?? true)
 
     mark('run graph')
-    // Clear the status line for good before the summary prints.
-    log.runEnd?.()
 
     // A server that died on its own before the stop failed, whatever its
     // outcome said when it became ready: the footer counted it a success
@@ -1097,8 +1108,11 @@ async function runOnBus(
     const failServer = (id: string, code: number | string): void => {
       const o = outcomes.get(id)
       if (o === undefined) return
-      const exitCode = typeof code === 'number' ? code : signalExitCode(code)
-      outcomes.set(id, { ...o, status: 'failed', exitCode })
+      // In place: the renderer holds this outcome (events carry live refs)
+      // and closes the server's output block from it at runEnd, where a
+      // copy left it reading `running` under its exit line (WD-10).
+      o.status = 'failed'
+      o.exitCode = typeof code === 'number' ? code : signalExitCode(code)
     }
     for (const c of crashedPersistent) failServer(c.id, c.code)
     keepAlive.nodes.forEach((n, i) => {
@@ -1107,6 +1121,8 @@ async function runOnBus(
       if (endedBeforeStop !== undefined && !endedBeforeStop.has(child)) return
       failServer(n.id, child.exitCode ?? child.signalCode ?? 'unknown')
     })
+    // Clear the status line for good before the summary prints.
+    log.runEnd?.()
     const list = [...outcomes.values()]
     const ok = list.every((o) => isPassStatus(o.status))
 
@@ -1339,6 +1355,8 @@ async function runOnBus(
     // task's own facts (flaky, blocked) ride its row. Only a kept server's
     // own output follows.
     if (options.summaryTable === true) for (const line of formatOutcomeTable(list)) log.status(line)
+    const above = options.beforeFooter?.(list, ok)
+    if (above) log.status(above.replace(/\n$/, ''))
     for (const line of formatRunSummary(list, totalMs, colors, runContext)) log.status(line)
 
     // Edge case the summary already reported: the user requested a
@@ -1396,7 +1414,9 @@ async function runOnBus(
         })
       })
       const node = keepAlive.nodes[first.i]!
-      const others = keepAlive.nodes.length - 1
+      // Only the ones still up are stopped: a kept server already dead was
+      // counted as one (WD-11).
+      const others = keepAlive.children.filter((c, j) => j !== first.i && !hasEnded(c)).length
       // Not when the run was stopped: the server ended because the user
       // stopped it, and "exited with code 130" read as a crash after every
       // Ctrl-C once a stop let run() finish its own path (item 852).
@@ -1421,7 +1441,9 @@ async function runOnBus(
       await summarize(ok && first.code === 0, final)
       if (historyAfterWait) {
         recordHistory(() => {
-          const local = Cache.inspect(prepared.cacheDir)
+          // A writer's open: another vx version may have reset the index
+          // to its schema during the session, and a mismatch resets silently.
+          const local = new Cache(prepared.cacheDir, undefined, prepared.workspaceRoot)
           try {
             local.recordRunBundle(recordsOf(final, ok && first.code === 0))
           } finally {
@@ -1526,12 +1548,13 @@ export async function planRun(options: RunOptions): Promise<RunPlan> {
     // Its own mark: a dry run's plan (every task's hash, the cache lookups,
     // the history p50s) was booked under `close`, the next mark, and read
     // as 105 ms of closing a cache at 1,000 projects (item 601).
+    const policy = effectiveCachePolicy(prepared.cachePolicy, prepared.hasRemoteLayer)
     const planned = await plan({
       nodes: prepared.nodes,
       workspaceRoot: prepared.workspaceRoot,
       workspaceFingerprint: prepared.workspaceFingerprint,
       cache: prepared.cache,
-      cachePolicy: effectiveCachePolicy(prepared.cachePolicy, prepared.hasRemoteLayer),
+      cachePolicy: policy,
       forwardArgs: options.forwardArgs,
       nestedDirsByProject: prepared.nestedDirsByProject,
       gitFilesCache: prepared.gitFilesCache,
@@ -1548,6 +1571,7 @@ export async function planRun(options: RunOptions): Promise<RunPlan> {
       // the same plugin-factory call `prepareRun` already makes for the
       // cache capability, so plan mode gains no new class of side effect.
       ...(await planExecutorOf(prepared, log, options.download ?? 'all')),
+      ...(await planRestorable(prepared, policy, options.forwardArgs)),
     })
     mark('plan')
     return planned
@@ -1564,6 +1588,39 @@ export async function planRun(options: RunOptions): Promise<RunPlan> {
   }
 }
 
+/**
+ * What the run's short-circuit would restore ahead of its deps, so the plan
+ * can tell a server nobody needs from one that starts: `--dry` called a
+ * server every dependant of which was a local hit `would exec`, and the run
+ * never spawned it. The run's own gates (`shouldShortCircuit`, stable keys,
+ * workspace-output reach), asked only when a server could idle.
+ */
+async function planRestorable(
+  prepared: PreparedRun,
+  policy: CachePolicy,
+  forwardArgs: readonly string[] | undefined,
+): Promise<{ restorable?: Set<string> }> {
+  const { nodes } = prepared
+  const serves = [...nodes.values()].some(
+    (n) => n.config.exec?.persistent !== undefined && !n.requested && n.surfaced !== true,
+  )
+  if (!serves || !shouldShortCircuit(nodes, policy, prepared.cache)) return {}
+  const keptOut = restoreTierExclusions(nodes, prepared.workspaceRoot)
+  const stable = await deriveStableKeys({
+    nodes,
+    cache: prepared.cache,
+    workspaceRoot: prepared.workspaceRoot,
+    workspaceFingerprint: prepared.workspaceFingerprint,
+    forwardArgs,
+    nestedDirsByProject: prepared.nestedDirsByProject,
+    gitFilesCache: prepared.gitFilesCache,
+    hashCache: prepared.hashCache,
+  })
+  return {
+    restorable: new Set(stable.map((k) => k.node.id).filter((id) => !keptOut.has(id))),
+  }
+}
+
 /** The names a project outside the run's selection declares, and how to reach them. */
 function elsewhereHint(names: readonly string[]): string {
   if (names.length === 0) return ''
@@ -1588,7 +1645,7 @@ async function initHint(prepared: {
   // Single-project mode with packages the root's missing `workspaces`
   // never reaches: `vx init` would find no scripts either (item 248).
   const unreached = await unreachedPackages(await loadWorkspace(prepared.workspaceRoot))
-  if (unreached.length > 0) return ` ${unreachedHint(unreached)}`
+  if (unreached.length > 0) return ` ${unreachedHint(unreached, prepared.workspaceRoot)}`
   return ' No package declares a vx.config — run `vx init` to write one per package from its package.json scripts.'
 }
 
@@ -1605,8 +1662,11 @@ function didYouMean(
   elsewhere: readonly string[] = [],
 ): string {
   const tasksOf = (p: ProjectEntry | undefined): string[] => Object.keys(p?.config.tasks ?? {})
+  // What a bare name can select: a default `build` is no match (X-102).
   const allTasks = new Set<string>()
-  for (const p of projects.values()) for (const t of tasksOf(p)) allTasks.add(t)
+  for (const p of projects.values()) {
+    for (const t of tasksOf(p)) if (!isDefaultBuild(p.config.tasks![t])) allTasks.add(t)
+  }
   // A Set: two typos of the same task hint it once, not once per typo.
   const hints = new Set<string>()
   // A typo past two edits named nothing to pick from (M-56): with no near

package/src/orchestrator/sandbox-request.ts

@@ -271,7 +271,7 @@ export async function sandboxRequestFor(
     // could copy a key into an output the cache shares (L-41).
     baseDenyRead: [
       ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
-      ...credentialStores(workspaceRoot),
+      ...(await credentialStores(workspaceRoot, config.allowWrite)),
     ],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
@@ -464,11 +464,13 @@ async function prepareOutputsForBind(
       await mkdir(abs, { recursive: true }).catch(() => undefined)
       continue
     }
-    if (hasWildcard || g.endsWith('/')) {
-      const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
-      await mkdir(abs, { recursive: true })
-    } else {
-      const abs = path.join(projectDir, g)
+    const dir = hasWildcard || g.endsWith('/')
+    const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
+    try {
+      if (dir) {
+        await mkdir(abs, { recursive: true })
+        continue
+      }
       // Whatever is already there is what the task meant — a grant on the
       // project dir itself is a directory, and touching it as a file is
       // an EISDIR, not a missing bind. `lstat`, and an exclusive create: a
@@ -478,11 +480,33 @@ async function prepareOutputsForBind(
       await mkdir(path.dirname(abs), { recursive: true })
       await writeFile(abs, '', { flag: 'wx' })
       placeholders.push({ path: abs, mtimeMs: (await lstat(abs)).mtimeMs })
+    } catch (err) {
+      await sweepPlaceholders(placeholders)
+      const code = (err as NodeJS.ErrnoException).code
+      if (code !== 'EEXIST' && code !== 'ENOTDIR') throw err
+      // A file stands where the grant needs a directory: `out.txt/` over a
+      // file, or `a.txt/x/*.js`. It reached the user as an internal error.
+      const blocker = await fileOnPath(projectDir, dir ? abs : path.dirname(abs))
+      throw new UserError(
+        `exec.sandbox.allow.write: "${g}" needs a directory at ${blocker}, and a file is ` +
+          `there — remove the file, or grant a path beside it`,
+      )
     }
   }
   return placeholders
 }
 
+/** The first path from `from` down to `to` that exists and is not a directory. */
+async function fileOnPath(from: string, to: string): Promise<string> {
+  let at = from
+  for (const part of path.relative(from, to).split(path.sep)) {
+    at = path.join(at, part)
+    const st = await lstat(at).catch(() => undefined)
+    if (st !== undefined && !st.isDirectory()) return at
+  }
+  return to
+}
+
 /**
  * The walls a project's grants stop at: its nested projects, the
  * repository and vx's directory (item 1010). A read grant around one is
@@ -589,13 +613,35 @@ const CREDENTIAL_STORES = [
   '.npmrc',
   '.yarnrc.yml',
   '.pypirc',
+  // Registry and service tokens of the same kind: Bun's global bunfig
+  // (`[install.scopes]` tokens) at either of its homes, Cargo's, RubyGems'.
+  '.bunfig.toml',
+  '.config/.bunfig.toml',
+  '.cargo/credentials',
+  '.cargo/credentials.toml',
+  '.gem/credentials',
+  '.config/hub',
+  '.config/containers/auth.json',
+  '.terraform.d/credentials.tfrc.json',
+  '.vault-token',
+  '.pgpass',
 ]
 
 /** The stores present on this host, learned once per home. */
 let presentStores: { home: string; paths: string[] } | undefined
 
-/** The credential stores to deny, less any that holds the workspace. */
-function credentialStores(workspaceRoot: string): string[] {
+/**
+ * The credential stores to deny, less any that holds the workspace, and
+ * punched around the task's write grants: a grant names a store as a read
+ * does. Denied whole, the store's mask landed on the grant's bind (a file
+ * grant binds its directory on Linux), so `write: ['~/.npmrc']` wrote to
+ * /dev/null with exit 0, and `~/.aws/config` left `~/.aws/credentials`
+ * readable. A grant above a store does not name it, so it stays denied.
+ */
+async function credentialStores(
+  workspaceRoot: string,
+  writes: readonly string[],
+): Promise<string[]> {
   const home = homedir()
   if (presentStores?.home !== home) {
     presentStores = {
@@ -603,9 +649,19 @@ function credentialStores(workspaceRoot: string): string[] {
       paths: CREDENTIAL_STORES.map((rel) => path.join(home, rel)).filter((p) => existsSync(p)),
     }
   }
-  return presentStores.paths.filter(
+  const stores = presentStores.paths.filter(
     (p) => workspaceRoot !== p && !workspaceRoot.startsWith(p + path.sep),
   )
+  return (await Promise.all(stores.map((p) => denyAround(toRealPath(p), writes)))).flat()
+}
+
+/** `dir` denied, or its entries no write grant lies under or at when one is inside it. */
+async function denyAround(dir: string, writes: readonly string[]): Promise<string[]> {
+  const inside = writes.filter((w) => atOrUnder(w, dir))
+  if (inside.length === 0) return [dir]
+  if (inside.includes(dir)) return []
+  const entries = await readdir(dir).catch(() => [])
+  return (await Promise.all(entries.map((e) => denyAround(path.join(dir, e), inside)))).flat()
 }
 
 /** `~/x` against the user's home; anything else unchanged. */

package/src/orchestrator/save-lane.ts

@@ -21,22 +21,22 @@ export interface SaveLane {
 
 export function createSaveLane(cap: number, onError: (err: unknown) => void): SaveLane {
   const queue: Array<{ save: () => Promise<void>; settle: () => void }> = []
-  const running = new Set<Promise<void>>()
+  let running = 0
   const start = (save: () => Promise<void>, settle: () => void): void => {
-    const p = save()
+    void save()
       .catch(onError)
       .then(() => {
-        running.delete(p)
+        running--
         settle()
         const next = queue.shift()
         if (next !== undefined) start(next.save, next.settle)
       })
-    running.add(p)
+    running++
   }
   return {
     defer(save) {
       return new Promise<void>((settle) => {
-        if (running.size < cap) start(save, settle)
+        if (running < cap) start(save, settle)
         else queue.push({ save, settle })
       })
     },

package/src/orchestrator/signals.ts

@@ -14,7 +14,7 @@
 // them to the runner around every spawn.
 
 import { signalExitCode } from '../exec/index.js'
-import { killGraceMs, settleWithin } from '../util/index.js'
+import { claimExitForSignal, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
 import type { Logger } from './logger.js'
 
@@ -69,7 +69,9 @@ export async function terminateChildren(
   signal: ForwardedSignal = 'SIGTERM',
   graceMs: number = killGraceMs(SIGNAL_SHUTDOWN_GRACE_MS),
 ): Promise<void> {
-  const children = live()
+  // A ready server is in both of run()'s lists: signalled twice, it read
+  // the second as a repeated Ctrl-C (force quit).
+  const children = [...new Set(live())]
   // On the group guard's list until the sweep below is done: a shell that
   // dies on the signal lets its group go while what it forked runs out
   // the grace (kill-tree.ts, `holdGroups`).
@@ -131,6 +133,7 @@ export function forwardSignals(args: {
     // that ended the run.
     if (stopping !== undefined) exit(stopping)
     stopping = signal
+    claimExitForSignal()
     // Clear the live worker/status region BEFORE exiting so a TTY isn't
     // left with a frozen region in the scrollback. runEnd is idempotent
     // and a no-op for non-TTY loggers.

package/src/orchestrator/summary.ts

@@ -6,7 +6,7 @@
 import type { TaskOutcome } from '../graph/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { tallyOutcomes } from './tally.js'
-import { outcomeLabel, projectOutcome } from './events.js'
+import { outcomeLabel, projectOutcome, ranNoCache } from './events.js'
 import { isGroupTask } from '../graph/index.js'
 import { formatElapsed } from '../util/index.js'
 
@@ -119,6 +119,8 @@ export interface SummaryStats {
   spread: { maxMs: number; minMs: number; sumMs: number; count: number } | null
   /** Tasks an `admit` policy held with a worker free, and the waits summed. Absent with no hold. */
   held?: { count: number; sumMs: number }
+  /** A run of groups only: their names, so `0 tasks` says why. */
+  emptyGroups?: readonly string[]
 }
 
 /**
@@ -213,7 +215,14 @@ export function formatSummarySection(
     // No legend line until the first bucket lands (live: all-gray bar).
     if (taskParts.length > 0) lines.push(legend(taskParts))
   } else {
-    lines.push(row('tasks', dim('0 tasks')))
+    const groups = stats.emptyGroups ?? []
+    // `vx run build` where no project gives build a command runs the default
+    // group alone: say so, or it reads like a selection that matched nothing.
+    const why =
+      groups.length > 0
+        ? ` ${dim('\u00b7')} ${dim(`${groups.join(', ')} ${groups.length === 1 ? 'has' : 'have'} no command in these projects`)}`
+        : ''
+    lines.push(row('tasks', dim('0 tasks') + why))
     // A stop before any task finished still names what it took down.
     if (taskParts.length > 0) lines.push(legend(taskParts))
   }
@@ -356,9 +365,7 @@ export function formatRunSummary(
   // distinction — it never consulted the cache, so it is not a miss.
   const noCache = outcomes.filter(
     (o) =>
-      !isGroupTask(o.node) &&
-      (o.status === 'success' || o.status === 'failed') &&
-      o.node.config.cache === undefined,
+      !isGroupTask(o.node) && (o.status === 'success' || o.status === 'failed') && ranNoCache(o),
   ).length
   const t = tallyOutcomes(outcomes)
   // Spread over executed tasks only — `success`/`failed` statuses ran
@@ -368,6 +375,9 @@ export function formatRunSummary(
     .map((o) => o.durationMs)
   const heldOutcomes = outcomes.filter((o) => o.admissionHeldMs !== undefined)
   const notRun = outcomes.filter((o) => neverStarted(o) && !isGroupTask(o.node)).length
+  const emptyGroups = outcomes.every((o) => isGroupTask(o.node))
+    ? [...new Set(outcomes.map((o) => o.node.taskName))]
+    : []
   return formatSummarySection(
     {
       failed: t.failed,
@@ -398,6 +408,7 @@ export function formatRunSummary(
             },
           }
         : {}),
+      ...(emptyGroups.length > 0 ? { emptyGroups } : {}),
     },
     totalMs,
     colors,

package/src/orchestrator/telemetry.ts

@@ -481,6 +481,15 @@ export interface TelemetrySource {
 /** How often a running task's process tree is sampled. */
 const SAMPLE_MS = 1000
 
+/** Call `fn` every `ms` until the returned stop is called. */
+type Every = (ms: number, fn: () => Promise<void>) => () => void
+
+const everyInterval: Every = (ms, fn) => {
+  const timer = setInterval(() => void fn(), ms)
+  timer.unref()
+  return () => clearInterval(timer)
+}
+
 const DEFAULT_KINDS: ReadonlyArray<TelemetryRecord['kind']> = [
   'run.start',
   'task.start',
@@ -508,6 +517,8 @@ export function createTelemetrySource(args: {
   owners?: ReadonlyMap<TelemetrySink, string>
   /** The run's task graph, to see a group dependency through to the tasks behind it. */
   nodes?: ReadonlyMap<string, TaskNode>
+  /** The sampler's clock; a test ticks it by hand instead of waiting on the wall. */
+  every?: Every
 }): TelemetrySource {
   const { sinks, run, warn } = args
   const runId = run.runId
@@ -543,12 +554,13 @@ export function createTelemetrySource(args: {
   // only while one runs; a tick still reading when the next is due is not
   // doubled.
   const tracked = new Map<string, number>()
-  let timer: ReturnType<typeof setInterval> | undefined
+  const every = args.every ?? everyInterval
+  let stopEvery: (() => void) | undefined
   let sampling = false
   let ended = false
   const stopTimer = (): void => {
-    if (timer !== undefined) clearInterval(timer)
-    timer = undefined
+    stopEvery?.()
+    stopEvery = undefined
   }
   const untrack = (taskId: string, pid: number): void => {
     if (tracked.get(taskId) === pid) tracked.delete(taskId)
@@ -587,10 +599,7 @@ export function createTelemetrySource(args: {
   const track = (taskId: string, pid: number): (() => void) => {
     if (ended) return () => {}
     tracked.set(taskId, pid)
-    if (timer === undefined) {
-      timer = setInterval(() => void tick(), SAMPLE_MS)
-      timer.unref()
-    }
+    stopEvery ??= every(SAMPLE_MS, tick)
     return () => untrack(taskId, pid)
   }
 

package/src/util/index.ts

@@ -49,7 +49,13 @@ export {
   wholeSubtreePrefixes,
   slashBraceExpansions,
 } from './paths.js'
-export { killGraceMs, settleWithin, teardownTimeoutMs } from './settle.js'
+export {
+  claimExitForSignal,
+  exitClaimedBySignal,
+  killGraceMs,
+  settleWithin,
+  teardownTimeoutMs,
+} from './settle.js'
 export { formatBytes, parseDuration, parseSize } from './size.js'
 export {
   cgroupCpuQuota,

package/src/util/paths.ts

@@ -198,6 +198,12 @@ export function taskGlob(pattern: string): Bun.Glob {
   // A `]` with no `[` before it is already literal to `Bun.Glob`.
   const source = pattern.includes('[') ? pattern.replace(/(?<!\\)[[\]]/g, '\\$&') : pattern
   const glob = new Bun.Glob(source)
+  const alternatives = braceAlternatives(pattern)
+  if (alternatives.length > 1) {
+    const any = anyTaskGlob(alternatives)
+    glob.match = (rel: string): boolean => any(rel)
+    return glob
+  }
   const re = regExpSource(pattern)
   if (re === null) return glob
   const compiled = new RegExp(`^${re}$`, 'u')
@@ -216,8 +222,13 @@ export function taskGlob(pattern: string): Bun.Glob {
  * RegExp for the lot when every pattern has one, else a glob each. An input
  * file was matched against a dozen globs (its positives, the always-ignored
  * list, its negatives) one native call at a time.
+ *
+ * A brace is expanded first, never matched by `Bun.Glob`: its match reads a
+ * `**` that ends an alternative as one name, so `{src/**,lib/**}` took
+ * `src/a.ts` and never `src/deep/a.ts`, and an edit there was a stale hit.
  */
-export function anyTaskGlob(patterns: readonly string[]): (rel: string) => boolean {
+export function anyTaskGlob(rawPatterns: readonly string[]): (rel: string) => boolean {
+  const patterns = rawPatterns.flatMap(braceAlternatives)
   if (patterns.length === 0) return () => false
   const sources = patterns.map(regExpSource)
   const globs = patterns.map(taskGlob)
@@ -339,6 +350,15 @@ export function outputMatcher(globs: readonly string[]): (rel: string) => boolea
  * is left to the glob.
  */
 export function slashBraceExpansions(pattern: string): string[] {
+  return expandBraces(pattern, true)
+}
+
+/** `pattern` with every brace group of two or more alternatives expanded. */
+function braceAlternatives(pattern: string): string[] {
+  return expandBraces(pattern, false)
+}
+
+function expandBraces(pattern: string, slashOnly: boolean): string[] {
   if (pattern.includes('\\')) return [pattern]
   for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
     let depth = 0
@@ -352,14 +372,14 @@ export function slashBraceExpansions(pattern: string): string[] {
     }
     if (close === -1) return [pattern]
     const body = pattern.slice(open + 1, close)
-    if (cuts.length === 0 || !body.includes('/')) continue
+    if (cuts.length === 0 || (slashOnly && !body.includes('/'))) continue
     const head = pattern.slice(0, open)
     const tail = pattern.slice(close + 1)
     const bounds = [open, ...cuts, close]
     const out: string[] = []
     for (let k = 0; k + 1 < bounds.length; k++) {
       const alt = pattern.slice(bounds[k]! + 1, bounds[k + 1])
-      out.push(...slashBraceExpansions(head + alt + tail))
+      out.push(...expandBraces(head + alt + tail, slashOnly))
     }
     return [...new Set(out)]
   }

package/src/util/secret-mask.ts

@@ -49,6 +49,13 @@ export interface SecretMask {
    * the next chunk or `end`.
    */
   stream(): { push(chunk: string): string; end(): string }
+  /**
+   * `mask` for the two sides of a cut, where the text between them is
+   * gone: a value the cut split leaves a piece at the end of `head` or the
+   * start of `tail` that no whole-value match sees, so each piece is
+   * masked too.
+   */
+  maskCut(head: string, tail: string): [string, string]
 }
 
 /**
@@ -103,8 +110,37 @@ export function secretMask(
     }
     return longest
   }
+  /** The longest head of `text` that is a proper suffix of a value. */
+  const partialHead = (text: string): number => {
+    let longest = 0
+    for (const v of sorted) {
+      for (let k = Math.min(v.length - 1, text.length); k > longest; k--) {
+        if (text.startsWith(v.slice(v.length - k))) {
+          longest = k
+          break
+        }
+      }
+    }
+    return longest
+  }
   return {
     mask,
+    maskCut(head, tail) {
+      let h = head.length - partialTail(head)
+      pattern.lastIndex = 0
+      for (let m = pattern.exec(head); m !== null; m = pattern.exec(head)) {
+        if (m.index < h && m.index + m[0].length > h) h = m.index
+      }
+      let t = partialHead(tail)
+      pattern.lastIndex = 0
+      for (let m = pattern.exec(tail); m !== null; m = pattern.exec(tail)) {
+        if (m.index < t && m.index + m[0].length > t) t = m.index + m[0].length
+      }
+      return [
+        mask(head.slice(0, h)) + (h < head.length ? MASKED : ''),
+        (t > 0 ? MASKED : '') + mask(tail.slice(t)),
+      ]
+    },
     stream() {
       let carry = ''
       return {

package/src/util/settle.ts

@@ -68,3 +68,18 @@ export async function settleWithin(p: Promise<unknown>, ms: number): Promise<boo
     void p.catch(() => {})
   }
 }
+
+// Who ends the process. bin.ts exits once its verb has settled and the
+// streams have ended; a signal's handler exits by itself, with the
+// signal's code, once the run it stopped is done. The verb settles first,
+// with the run's verdict (1), so bin.ts asks before it exits.
+let signalOwnsExit = false
+
+/** A signal's handler will end the process: bin.ts leaves the exit to it. */
+export function claimExitForSignal(): void {
+  signalOwnsExit = true
+}
+
+export function exitClaimedBySignal(): boolean {
+  return signalOwnsExit
+}