@vzn/vx 0.0.594 → 0.0.596

package/src/workspace/affected.ts

@@ -176,6 +176,14 @@ export async function affectedChanges(
         `("${since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
     )
   }
+  // `^main` is rev-list's exclusion, not a ref: merge-base refused it, it
+  // verified, and `git diff ^main` diffed from main itself, so changes
+  // only main made were selected (`^` is illegal in a ref name).
+  if (since.startsWith('^')) {
+    throw new UserError(
+      `git ref "${since}" is an exclusion, not a ref: pass the base alone ("${since.replace(/^\^+/, '') || 'HEAD'}").`,
+    )
+  }
   // Diff from the MERGE BASE of `since` and HEAD, not from `since` itself:
   // on a branch whose base has moved on, `git diff <base>` reports every
   // file OTHER people changed on the base (over-selection that defeats a
@@ -432,7 +440,17 @@ async function dependentsAtBase(
     ) {
       continue
     }
-    byDir.set(dir, { name: pkg.name, dir, packageJson: pkg, configPath: null })
+    // Today's catalogs, or both graphs would differ on every `catalog:`
+    // entry. A catalog edit is a `pnpm-workspace.yaml` or root manifest
+    // edit, which the fingerprint widening and the root's own change answer.
+    const catalogs = projects[0]?.catalogs
+    byDir.set(dir, {
+      name: pkg.name,
+      dir,
+      packageJson: pkg,
+      configPath: null,
+      ...(catalogs === undefined ? {} : { catalogs }),
+    })
     if (nameNow.get(dir) !== pkg.name) gone.add(pkg.name)
   }
   const now = buildPackageGraph([...projects])
@@ -468,8 +486,10 @@ function parentsOfNewNested(
   projects: readonly ProjectMeta[],
 ): Set<string> {
   const out = new Set<string>()
+  // Keyed NFC: macOS git reports paths NFC (core.precomposeunicode) while a
+  // dir discovered by readdir keeps the spelling it was created with.
   const dirToName = new Map<string, string>()
-  for (const p of projects) dirToName.set(p.dir, p.name)
+  for (const p of projects) dirToName.set(p.dir.normalize('NFC'), p.name)
   for (const [rel, bytes] of atBase) {
     const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
     if (!dirToName.has(dir)) continue
@@ -829,8 +849,10 @@ function projectsContaining(
   // O(files · path-depth) instead of O(files · projects): independent of the
   // project count, which is what a big --affected diff on a 1000-project repo
   // pays for.
+  // Keyed NFC: macOS git reports paths NFC (core.precomposeunicode) while a
+  // dir discovered by readdir keeps the spelling it was created with.
   const dirToName = new Map<string, string>()
-  for (const p of projects) dirToName.set(p.dir, p.name)
+  for (const p of projects) dirToName.set(p.dir.normalize('NFC'), p.name)
   // A member linked in from elsewhere in the tree (`pkgs/b -> ../ext/b`) is
   // indexed by its link, and git reports its files at their real place
   // (`ext/b/src/a.txt`), which resolved to no project: an edit there
@@ -841,18 +863,18 @@ function projectsContaining(
     const real = realDirs.get(p.dir) ?? p.dir
     const rel = path.relative(realRoot, real)
     if (rel.startsWith('..') || path.isAbsolute(rel)) continue
-    const spelled = path.resolve(workspaceRoot, rel)
-    if (spelled !== p.dir && !dirToName.has(spelled)) dirToName.set(spelled, p.name)
+    const spelled = path.resolve(workspaceRoot, rel).normalize('NFC')
+    if (!dirToName.has(spelled)) dirToName.set(spelled, p.name)
   }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
-    let dir = path.resolve(workspaceRoot, rel)
+    let dir = path.resolve(workspaceRoot, rel).normalize('NFC')
     let hit = false
     for (;;) {
       const name = dirToName.get(dir)
       if (name !== undefined) {
         owned.add(name)
-        on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel)))
+        on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')))
         hit = true
         break
       }
@@ -871,7 +893,7 @@ function projectsContaining(
     // this, `--affected` after an edit inside selected none of them.
     const abs = path.resolve(workspaceRoot, rel)
     if (isDirectory(abs)) {
-      const prefix = abs + path.sep
+      const prefix = abs.normalize('NFC') + path.sep
       for (const [dir, name] of dirToName) {
         if (!dir.startsWith(prefix)) continue
         owned.add(name)

package/src/workspace/config-cache.ts

@@ -409,6 +409,16 @@ function keySeed(workspaceFingerprint: string): bigint {
 
 const EXPLICIT_EXT = /\.(?:m?[jt]s|cjs|cts)$/
 
+/**
+ * A file's identity as the key folds it. `hashFile` names an executable
+ * `100755:<oid>`, the slow path's `hashBytes` the bare oid; the mode moves
+ * no evaluation, and with it the warm key of an executable config never
+ * met the stored one, so every load read and re-keyed it.
+ */
+function contentIdentity(identity: string): string {
+  return identity.startsWith('100755:') ? identity.slice(7) : identity
+}
+
 /**
  * The canonical directory Bun resolves `file`'s imports from: its REAL
  * path's, so a config linked in from elsewhere imports its neighbours
@@ -482,7 +492,7 @@ export async function configEvalKey(a: ConfigEvalKeyArgs): Promise<ConfigEvalKey
     const identity = a.hashBytes
       ? a.hashBytes(bytes, file)
       : a.hashFile
-        ? await a.hashFile(file)
+        ? contentIdentity(await a.hashFile(file))
         : await hashOf(file, bytes)
     h = xxh3(`${file}\0${identity}`, h)
     closure.push(file)
@@ -542,6 +552,14 @@ export async function configEvalKey(a: ConfigEvalKeyArgs): Promise<ConfigEvalKey
   return { key: h.toString(16).padStart(16, '0'), closure, indexable }
 }
 
+// `hashFile` names a symlink by its target string (git's mode 120000), not
+// the bytes the evaluation read, so no stored key can match a fold of it.
+// Only a linked config with no relative import is indexed at all; with no
+// warm key it joins the round lookup on its slow key instead of paying a
+// single lookup and an index rewrite per load. The identity is from the
+// lstat `hashFiles` already took: no syscall is added.
+const LINK_IDENTITY = '120000:'
+
 /**
  * The warm path: the key for a config whose ordered closure the store
  * remembers, from per-file identities alone — no read, no scan. The fold is
@@ -561,7 +579,10 @@ export async function configEvalKeyFromClosure(a: {
   } catch {
     return null
   }
-  for (let i = 0; i < a.closure.length; i++) h = xxh3(`${a.closure[i]}\0${identities[i]}`, h)
+  if (identities.some((id) => id.startsWith(LINK_IDENTITY))) return null
+  for (let i = 0; i < a.closure.length; i++) {
+    h = xxh3(`${a.closure[i]}\0${contentIdentity(identities[i]!)}`, h)
+  }
   return h.toString(16).padStart(16, '0')
 }
 
@@ -574,8 +595,8 @@ export function configEvalKeyFromIdentities(a: {
   let h = keySeed(a.workspaceFingerprint)
   for (const file of a.closure) {
     const id = a.identities.get(file)
-    if (id === undefined) return null
-    h = xxh3(`${file}\0${id}`, h)
+    if (id === undefined || id.startsWith(LINK_IDENTITY)) return null
+    h = xxh3(`${file}\0${contentIdentity(id)}`, h)
   }
   return h.toString(16).padStart(16, '0')
 }

package/src/workspace/config-imports.ts

@@ -20,9 +20,9 @@
 //     the lockfile moves, which the workspace fingerprint already covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
-//   - Descend only through files owned by NO project, or by a ROOT project
+//   - Descend only through files owned by NO project, by a ROOT project
 //     (whose own files are the shared tooling that is otherwise unowned,
-//     D-41). A config reaching into another project (say a site's
+//     D-41), or by the importing file's own project. A config reaching into another project (say a site's
 //     `vx.config.ts` importing `../core/src/index.ts`) records that edge
 //     and STOPS there — following it would drag substantially all of that
 //     project's `src/` into the closure, and the containment channel
@@ -305,7 +305,7 @@ function selfReference(pkg: string, fromDir: string): boolean {
     const manifest = path.join(dir, 'package.json')
     if (existsSync(manifest)) {
       try {
-        const json = JSON.parse(readFileSync(manifest, 'utf8')) as {
+        const json = JSON.parse(readFileSync(manifest, 'utf8').replace(/^\uFEFF/, '')) as {
           name?: unknown
           exports?: unknown
         }
@@ -486,16 +486,18 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
+      const from = ownerOf(file, dirToName)
       for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)
         if (list) list.push(file)
         else importedBy.set(target, [file])
-        // Descend ONLY through unowned files, or the root project's own:
-        // see the header.
+        // Descend ONLY through unowned files, the root project's own, or
+        // the importer's own project's (a config split into `./tasks.mjs`
+        // that imports shared tooling): see the header.
         const owner = ownerOf(target, dirToName)
-        if (owner === undefined || owner === rootOwner) frontier.push(target)
+        if (owner === undefined || owner === rootOwner || owner === from) frontier.push(target)
       }
     }
   }

package/src/workspace/config-schema.ts

@@ -28,7 +28,7 @@ import {
   asTrees,
   isLiteralPattern,
 } from '../util/index.js'
-import { compileNameGlob } from './filter.js'
+import { compileNameGlob, parseFilter } from './filter.js'
 import { nonJsonMessage, nonJsonPaths } from './json-data.js'
 
 // Mirrors `WorkspaceConfig` in src/config.ts. Unknown keys are REJECTED for
@@ -78,6 +78,7 @@ const RETENTION_FIELDS = new Set(['olderThan', 'maxSize'])
 
 function validateRetention(retention: unknown, configPath: string): void {
   const where = `${configPath}: \`cacheRetention\``
+  const field = (key: string) => `${configPath}: \`cacheRetention.${key}\``
   if (retention === null || typeof retention !== 'object' || Array.isArray(retention)) {
     throw new UserError(`${where} must be { olderThan?: '30d', maxSize?: '10G' }`)
   }
@@ -91,23 +92,27 @@ function validateRetention(retention: unknown, configPath: string): void {
     olderThan !== undefined &&
     (typeof olderThan !== 'string' || parseDuration(olderThan) === null)
   ) {
-    throw new UserError(`${where}.olderThan must be a duration like '30d', '12h', '90m' or '45s'`)
+    throw new UserError(
+      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${JSON.stringify(olderThan)})`,
+    )
   }
   if (maxSize !== undefined && (typeof maxSize !== 'string' || parseSize(maxSize) === null)) {
-    throw new UserError(`${where}.maxSize must be a size like '10G', '500MB' or '64KB'`)
+    throw new UserError(
+      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${JSON.stringify(maxSize)})`,
+    )
   }
   // The bounds `vx cache prune` refuses, for the same reason: each evicts
   // every entry, and here it would do so at the end of every run, the
   // entries that run just saved included, so nothing ever hits (item 969).
   if (olderThan !== undefined && parseDuration(olderThan) === 0) {
-    throw new UserError(`${where}.olderThan of 0 evicts every entry after every run`)
+    throw new UserError(`${field('olderThan')} of 0 evicts every entry after every run`)
   }
   if (maxSize !== undefined && parseSize(maxSize) === 0) {
-    throw new UserError(`${where}.maxSize of 0 evicts every entry after every run`)
+    throw new UserError(`${field('maxSize')} of 0 evicts every entry after every run`)
   }
   if (maxSize !== undefined && /^\d+$/.test(maxSize)) {
     throw new UserError(
-      `${where}.maxSize '${maxSize}' reads as ${maxSize} bytes — give a unit (e.g. '${maxSize}M', '${maxSize}G')`,
+      `${field('maxSize')} '${maxSize}' reads as ${maxSize} bytes — give a unit (e.g. '${maxSize}M', '${maxSize}G')`,
     )
   }
 }
@@ -139,6 +144,11 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   ) {
     throw new UserError(`${configPath}: \`cacheDir\` is only whitespace — name a directory`)
   }
+  // No path can carry one: the mkdir's argument error was reported as an
+  // unwritable workspace.
+  if (typeof config.cacheDir === 'string' && config.cacheDir.includes('\0')) {
+    throw new UserError(`${configPath}: \`cacheDir\` holds a NUL, which no path can carry`)
+  }
   if (config.timeout !== undefined) {
     if (
       typeof config.timeout !== 'number' ||
@@ -151,8 +161,12 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   }
   if (config.cacheRetention !== undefined) validateRetention(config.cacheRetention, configPath)
   if (config.affectedBase !== undefined) {
-    // A leading '-' would reach git as an option, not a ref.
-    if (typeof config.affectedBase !== 'string' || !/^[^-\s]\S*$/.test(config.affectedBase)) {
+    // A leading '-' would reach git as an option, not a ref; a NUL fails the
+    // spawn with an argument error naming nothing in this file.
+    if (
+      typeof config.affectedBase !== 'string' ||
+      !/^[^-\s\0][^\s\0]*$/.test(config.affectedBase)
+    ) {
       throw new UserError(`${configPath}: \`affectedBase\` must be a git ref like 'origin/main'`)
     }
   }
@@ -230,6 +244,12 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
         if (plug.commands === null || typeof plug.commands !== 'object') {
           throw new UserError(`${configPath}: \`plugins[${i}].commands\` must be an object`)
         }
+        // A list of commands loaded as the verbs `0`, `1`, … that help listed.
+        if (Array.isArray(plug.commands)) {
+          throw new UserError(
+            `${configPath}: \`plugins[${i}].commands\` must be an object keyed by verb, not an array`,
+          )
+        }
         for (const [verb, cmd] of Object.entries(plug.commands as Record<string, unknown>)) {
           const c = cmd as { description?: unknown; run?: unknown } | null
           if (
@@ -345,6 +365,15 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
   ) {
     throw new UserError(`${configPath}: \`tags\` must be an array of non-empty strings`)
   }
+  for (const tag of (tags ?? []) as string[]) {
+    const why = tagProblem(tag)
+    if (why !== null) {
+      throw new UserError(
+        `${configPath}: tag ${JSON.stringify(tag)} ${why} — \`--filter tag:<name>\` could not ` +
+          `name it. Rename the tag.`,
+      )
+    }
+  }
   const tasks = config.tasks
   if (tasks === undefined) return
   if (typeof tasks !== 'object' || tasks === null || Array.isArray(tasks)) {
@@ -443,6 +472,8 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `(got "${wild}") — list explicit env var names instead`,
             )
           }
+          for (const n of passThrough as string[])
+            assertShellName(n, `${where}.exec.env.passThrough`)
         }
         const secret = (env as { secret?: unknown }).secret
         if (
@@ -469,6 +500,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `${where}.exec.env.define: ${JSON.stringify(k)} is not an env var name (non-empty, no '=' or NUL)`,
               )
             }
+            assertShellName(k, `${where}.exec.env.define`)
             if (typeof val !== 'string' || val.includes('\0')) {
               throw new UserError(`${where}.exec.env.define.${k} must be a string with no NUL`)
             }
@@ -1330,8 +1362,19 @@ function specForm(spec: string): SpecForm {
  * A name an environment can hold. An `=` splits at the first one, so
  * `define: { 'A=B': 'x' }` gave the child `A` with the value `B=x`; `''`
  * was dropped; a NUL failed the spawn with a hint about exit 127 (item
- * 999). Refused at load, where the config is named.
+ * 999). And the task runs under `sh -c`, whose dash (Linux) drops a
+ * variable whose name is no shell identifier: `my.var` reached a task
+ * under macOS's bash and nothing on Linux. Refused at load, where the
+ * config is named.
  */
+function assertShellName(name: string, field: string): void {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new UserError(
+      `${field}: ${JSON.stringify(name)} is not a shell variable name ([A-Za-z_][A-Za-z0-9_]*); sh would drop it before the task runs`,
+    )
+  }
+}
+
 function isEnvName(name: unknown): name is string {
   return typeof name === 'string' && name.length > 0 && !name.includes('=') && !name.includes('\0')
 }
@@ -1367,6 +1410,22 @@ export function taskNameProblem(name: string): string | null {
             : null
 }
 
+/**
+ * Why `--filter tag:<tag>` cannot name `tag`, or null. Asked of the filter
+ * parser itself, so a suffix it learns to read is refused here too: `v1...`
+ * read as a dependency walk from `v1`, `v[2]` as `v` changed since ref `2`.
+ */
+function tagProblem(tag: string): string | null {
+  if (tag.trim() !== tag) return 'has surrounding whitespace'
+  if (tag.includes('*')) return "holds '*', which makes it a pattern"
+  const f = parseFilter(`tag:${tag}`, '/')
+  if (f.gitSince !== undefined) {
+    return `ends in "[${f.gitSince}]", which a filter reads as a git range`
+  }
+  if (f.withDeps || f.onlyDeps) return "ends in '...', which a filter reads as a dependency walk"
+  return null
+}
+
 /**
  * Refuse a non-empty glob list made up ENTIRELY of negations.
  *
@@ -1488,6 +1547,12 @@ function assertStringArray(v: unknown, where: string): void {
   if (!Array.isArray(v) || v.some((s) => typeof s !== 'string' || s.length === 0)) {
     throw new UserError(`${where} must be an array of non-empty strings`)
   }
+  // No path, host or name holds a NUL; a write grant with one reached the
+  // placeholder create as an internal error.
+  const nul = (v as string[]).find((s) => s.includes('\0'))
+  if (nul !== undefined) {
+    throw new UserError(`${where}: ${JSON.stringify(nul)} holds a NUL byte`)
+  }
 }
 
 /**

package/src/workspace/filter.ts

@@ -5,6 +5,8 @@
 //   {<dir>}          same as ./<dir>
 //   //               the workspace-root project only (Turbo's name for the root)
 //   tag:<pattern>    the projects whose config `tags` hold a match (Nx's `tag:`)
+//   <dir>/<glob>     a name with a `/` outside a scope that names no project:
+//                    ./<dir>/<glob> (Nx's `--projects 'apps/*'`)
 //   <pattern>...     pattern + its transitive workspace dependencies
 //   ...<pattern>     pattern + its transitive workspace dependents
 //   <pattern>^...    only the transitive deps of pattern (excluding the matched package)
@@ -58,6 +60,11 @@ export interface ParsedFilter {
   exactDir?: true
   /** `tag:<pattern>`: `matcher` is a glob over the projects' tags, not their names. */
   tag?: true
+  /**
+   * `apps/*`: a name pattern holding a `/` outside a scope, read as
+   * `./apps/*` when it names no project, as Nx's `--projects` reads it.
+   */
+  dirFallback?: ParsedFilter
 }
 
 export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
@@ -187,6 +194,15 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     }
   }
 
+  // A package name holds a `/` only after its `@scope`, so `apps/*` is a
+  // directory for every project named after its package.json; Nx matches
+  // a `--projects` entry by name, then by root (find-matching-projects,
+  // 23.2.1), and `-p 'apps/*'` matched nothing here.
+  const dirFallback =
+    !isPath && s.includes('/') && !s.startsWith('@')
+      ? parseFilter(`./${s}`, workspaceRoot)
+      : undefined
+
   return {
     raw,
     negate,
@@ -196,6 +212,7 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     onlyDependents,
     isPath,
     matcher,
+    ...(dirFallback !== undefined ? { dirFallback } : {}),
     ...(pathGlob !== undefined ? { pathGlob, pathRoot: workspaceRoot } : {}),
     ...(pathGlobBase !== undefined ? { pathGlobBase } : {}),
     ...(gitSince !== undefined ? { gitSince } : {}),
@@ -278,6 +295,8 @@ function matchSelector(
   for (const p of projects) {
     if (re.test(p.name)) out.push(p.name)
   }
+  if (out.length === 0 && filter.dirFallback !== undefined)
+    return matchSelector(filter.dirFallback, projects, tags)
   if (out.length > 0 || filter.matcher.includes('/')) return out
   // pnpm's rule: the scope may be left out (`--filter core` is
   // `@babel/core`), an exact name only when one package carries it. Nx

package/src/workspace/migrate-scripts.ts

@@ -429,7 +429,8 @@ function pmRunsMembers(script: string): boolean {
   return false
 }
 
-const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|[^\s;&|()]+)/g
+// A bare target may escape a space or paren (`cd packages/my\ app`).
+const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|(?:\\.|[^\s;&|()\\])+)/g
 
 /**
  * A `cd` into a member's directory, or one holding members, runs that
@@ -439,7 +440,8 @@ const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|[^\s;&|()]+)/g
  */
 function cdsToMembers(script: string, rootDir: string, memberDirs: readonly string[]): boolean {
   for (const m of script.matchAll(CD)) {
-    const target = m[1]!.replace(/^(["'])(.*)\1$/, '$2')
+    const quoted = /^(["'])(.*)\1$/.exec(m[1]!)
+    const target = quoted ? quoted[2]! : m[1]!.replace(/\\(.)/g, '$1')
     if (/[$`~*?]/.test(target) || target === '-') return true
     const dir = path.resolve(rootDir, target)
     const inside = (a: string, b: string): boolean => a === b || a.startsWith(b + path.sep)
@@ -541,7 +543,7 @@ function siblingRun(script: string, dir: string, others: readonly string[]): str
 function lernaPackages(dir: string): string[] | undefined {
   let json: unknown
   try {
-    json = JSON.parse(readFileSync(path.join(dir, 'lerna.json'), 'utf8'))
+    json = JSON.parse(readFileSync(path.join(dir, 'lerna.json'), 'utf8').replace(/^\uFEFF/, ''))
   } catch {
     return undefined
   }

package/src/workspace/migration.ts

@@ -406,7 +406,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
       : []
   if (empty && unreached.length > 0) {
     report.push(
-      `${verb}: ${unreachedHint(unreached)}`,
+      `${verb}: ${unreachedHint(unreached, root)}`,
       hasWorkspaceFile
         ? `${workspaceName} already exists.`
         : dry

package/src/workspace/package-graph.ts

@@ -73,7 +73,7 @@ export function buildPackageGraph(
     const dev = bucket(p.packageJson.devDependencies)
     const add = (key: string, spec: unknown, installed: boolean, into: Set<string>): void => {
       if (typeof spec !== 'string') return
-      const target = linked(key, spec.trim(), p.dir, installed)
+      const target = linked(key, fromCatalog(p, key, spec.trim()), p.dir, installed)
       if (target !== undefined && target !== p.name) into.add(target)
     }
     // Which entry is installed when a key sits in more than one field,
@@ -300,6 +300,19 @@ export function buildPackageGraph(
   }
 }
 
+/**
+ * The spec a `catalog:` / `catalog:<name>` entry stands for in the
+ * workspace's catalog, so it is an edge by the rule its range or protocol
+ * meets (zenstack's `nuxt: "catalog:"` is `4.3.1`, which the workspace's
+ * versionless `nuxt` sample does not satisfy). A catalog the graph was not
+ * given or that lacks the key leaves the spec, which keeps its edge.
+ */
+function fromCatalog(p: ProjectMeta, key: string, spec: string): string {
+  if (p.catalogs === undefined || !spec.startsWith('catalog:')) return spec
+  const resolved = p.catalogs.get(spec.slice('catalog:'.length).trim() || 'default')?.[key]
+  return typeof resolved === 'string' && !resolved.startsWith('catalog:') ? resolved.trim() : spec
+}
+
 function bucket(field: unknown): Readonly<Record<string, unknown>> {
   return typeof field === 'object' && field !== null ? (field as Record<string, unknown>) : {}
 }
@@ -377,8 +390,7 @@ function linkedTarget(
     if (!MAY_POINT_ELSEWHERE.test(spec)) {
       const local = byName.get(key)
       if (local === undefined) return undefined
-      // A catalog entry's range lives where the graph does not read
-      // (`pnpm-workspace.yaml`, bun's root `catalog`): it keeps the edge.
+      // A catalog entry its workspace's catalog did not resolve keeps the edge.
       if (!installed || spec.startsWith('catalog:')) return key
       return satisfies(local, spec) ? key : undefined
     }

package/src/workspace/project-loader.ts

@@ -127,10 +127,12 @@ function servableSource(bytes: Uint8Array, loader: 'ts' | 'js'): string | null {
 }
 
 // What makes Bun run a file as CommonJS is one of these names at the top
-// level (an escaped `\u006dodule` too, so any backslash counts). Source
+// level (an escaped `\u006dodule` too, so any backslash counts), or
+// TypeScript's `export =`, which spells none of them. Source
 // with none of them runs as a module whichever path loads it, so it skips
 // the parse: 16–20 µs a config, 1,000 cold configs (2026-10-03).
-const COMMONJS_HINT = /\b(?:module|exports|require|this|__dirname|__filename)\b|\\/
+const COMMONJS_HINT =
+  /\b(?:module|exports|require|this|__dirname|__filename)\b|\\|\bexport\s*=(?!=)/
 
 /** vx's module-cache query, which no user wrote: stripped from anything shown to them. */
 const BUST_QUERY = /\?vx-(?:bust|held)=[^'"\s]*/g
@@ -479,6 +481,7 @@ export async function loadProjectConfigs(
   let env: Readonly<Record<string, string | undefined>> = {}
   let cwd = ''
   let umask = -1
+  let unredirect: (() => void) | undefined
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
@@ -588,6 +591,7 @@ export async function loadProjectConfigs(
       else misses.push(i)
     }
     if (misses.length > 0) {
+      unredirect = stdoutToStderr()
       builtins = builtinSnapshot()
       env = { ...process.env }
       cwd = process.cwd()
@@ -651,6 +655,7 @@ export async function loadProjectConfigs(
       )
     return results.map((r) => (r as Loaded).config)
   } finally {
+    unredirect?.()
     endRound()
     if (store !== undefined && !tainted) {
       if (evals.length > 0) {
@@ -665,6 +670,72 @@ export async function loadProjectConfigs(
   }
 }
 
+/**
+ * Every route to fd 1 sent to stderr while configs evaluate in this
+ * process; returns the release. A verb's stdout is its output (`vx show
+ * --format json`), and a config's `console.log` came out ahead of the
+ * JSON. The worker does the same for a repeat load (D-64), `vx mcp` for
+ * its whole serve. Taken before a round's built-in snapshot and released
+ * after its check, so the guard sees no change of vx's own.
+ *
+ * Counted, because rounds overlap (`--affected`'s per-file sweep loads each
+ * config in a round of its own): a second install over the first moved
+ * `Bun.write` and `console` under the first round's snapshot, which refused
+ * the loads, and the undos ran out of order and left a redirect in place
+ * for good. The first taker installs; the last release restores.
+ */
+let redirectHolders = 0
+let undoRedirect = (): void => {}
+/**
+ * Bun's own `Console`, taken at load: the console a round finds may be a
+ * constructed one (`vx mcp` serves under its own), which has no `Console`.
+ * The global's, not `node:console`'s: the playground bundles this module
+ * for the browser, where that specifier is a stub.
+ */
+const BunConsole = (globalThis.console as { Console?: typeof console.Console }).Console
+
+function stdoutToStderr(): () => void {
+  if (redirectHolders++ === 0) undoRedirect = installRedirect()
+  return () => {
+    if (--redirectHolders === 0) undoRedirect()
+  }
+}
+
+function installRedirect(): () => void {
+  const out = process.stdout
+  const ownWrite = Object.getOwnPropertyDescriptor(out, 'write')
+  const ownConsole = globalThis.console
+  const bun = Bun as { write: typeof Bun.write }
+  const ownBunWrite = Bun.write
+  const ownWriter = Object.getOwnPropertyDescriptor(Bun.stdout, 'writer')
+  out.write = ((...args: Parameters<typeof process.stderr.write>) =>
+    process.stderr.write(...args)) as typeof out.write
+  bun.write = ((dest: unknown, ...rest: unknown[]) =>
+    (ownBunWrite as (...a: unknown[]) => Promise<number>)(
+      dest === Bun.stdout ? Bun.stderr : dest,
+      ...rest,
+    )) as typeof Bun.write
+  ;(Bun.stdout as { writer: typeof Bun.stdout.writer }).writer = ((
+    ...args: Parameters<typeof Bun.stderr.writer>
+  ) => Bun.stderr.writer(...args)) as typeof Bun.stdout.writer
+  // Bun's console adds `write`, which a constructed Console lacks.
+  globalThis.console = Object.assign(new BunConsole!(process.stderr, process.stderr), {
+    write: (...data: string[]) => {
+      const text = data.join('')
+      process.stderr.write(text)
+      return text.length
+    },
+  })
+  return () => {
+    if (ownWrite === undefined) delete (out as { write?: unknown }).write
+    else Object.defineProperty(out, 'write', ownWrite)
+    bun.write = ownBunWrite
+    if (ownWriter === undefined) delete (Bun.stdout as { writer?: unknown }).writer
+    else Object.defineProperty(Bun.stdout, 'writer', ownWriter)
+    globalThis.console = ownConsole
+  }
+}
+
 /**
  * The built-in prototypes a config's object is read through. A config that
  * set `Object.prototype.exec` gave every other project's task that
@@ -751,6 +822,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'sleep',
   'spawn',
   'spawnSync',
+  'stderr',
   'stdout',
   'stringWidth',
   'stripANSI',
@@ -1039,6 +1111,7 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
     // left out: it loads first in every run, filtered or not, so none
     // depends on what else loaded (D-122's case), and plugins' tests and
     // tools hand state through them.
+    const unredirect = stdoutToStderr()
     const builtins = builtinSnapshot('globalThis', true)
     const env = { ...process.env }
     const cwd = process.cwd()
@@ -1053,6 +1126,7 @@ export async function loadWorkspaceConfig(root: string): Promise<WorkspaceConfig
         ...restoreCwd(cwd),
         ...restoreUmask(umask),
       ]
+      unredirect()
       // eslint-disable-next-line no-unsafe-finally -- the refusal outranks the load's own error
       if (changed.length > 0) throw builtinsChanged(changed, configPath)
     }