@vzn/vx 0.0.595 → 0.0.596

package/src/orchestrator/plugin.ts

@@ -142,9 +142,9 @@ export interface VxPlugin {
    * many times per run, so it must be cheap and synchronous; a throw, or
    * an answer that is a Promise, is reported once and the plugin admits
    * from then on — a policy never
-   * breaks a run. Restore-tier hits and tasks on an executor pool hold no
-   * local resources and are never asked. When several plugins answer, all
-   * must admit. Core keeps no notion of what a task needs: a plugin that
+   * breaks a run. Restore-tier hits, tasks on an executor pool and groups
+   * hold no local resources: never asked, never in `ctx.running`. When
+   * several plugins answer, all must admit. Core keeps no notion of what a task needs: a plugin that
    * packs memory or CPU learns or declares the numbers itself
    * (`@vzn/vx-schedule-history` packs what past executions used).
    */
@@ -341,7 +341,12 @@ export interface FingerprintContext extends BaseContext {
 }
 
 export interface AdmitContext {
-  /** The tasks executing on this machine right now, in dispatch order. */
+  /**
+   * The tasks holding a worker on this machine right now, in dispatch
+   * order. A persistent task leaves at ready, when it gives its worker
+   * back: it runs until the graph ends, so a policy that counted it would
+   * hold its dependants with no completion left to ask again.
+   */
   readonly running: readonly TaskNode[]
   /** The run's worker count — the ceiling the count gate already applies. */
   readonly concurrency: number
@@ -601,7 +606,8 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
   const { plugins, bus, workspaceRoot, cacheDir } = args
   const warn = args.warn ?? ((m) => console.error(m))
   const disposers: Array<() => void> = []
-  const disabled = new Set<string>()
+  // By object, not name: one package can export two plugins.
+  const disabled = new Set<Plugin>()
 
   for (const plugin of plugins) {
     if (typeof plugin.name !== 'string' || plugin.name.length === 0) {
@@ -615,6 +621,13 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
       throw new UserError(`plugin '${plugin.name}' setup is not a function`)
     }
 
+    const fail = (where: string, err: unknown): void => {
+      if (disabled.has(plugin)) return
+      disabled.add(plugin)
+      warn(
+        `[vx] plugin '${plugin.name}' threw in ${where}; disabled for this run: ${err instanceof Error ? err.message : String(err)}`,
+      )
+    }
     const ctx: PluginContext = {
       workspaceRoot,
       cacheDir,
@@ -625,7 +638,18 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
       bus: {
         emit: (event) => bus.emit(event),
         subscribe(subscriber) {
-          const dispose = bus.subscribe(subscriber)
+          // Isolated like an `on` handler: the bus itself swallows a throw.
+          const dispose = bus.subscribe((event) => {
+            if (disabled.has(plugin)) return
+            let ret: unknown
+            try {
+              ret = subscriber(event)
+            } catch (err) {
+              fail('a bus subscriber', err)
+              return
+            }
+            if (ret instanceof Promise) ret.catch((err: unknown) => fail('a bus subscriber', err))
+          })
           disposers.push(dispose)
           return dispose
         },
@@ -638,15 +662,9 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
             `ctx.on: unknown hook '${String(hook)}' (one of ${Object.keys(HOOK_NAMES).join(', ')})`,
           )
         }
-        const fail = (err: unknown): void => {
-          if (disabled.has(plugin.name)) return
-          disabled.add(plugin.name)
-          warn(
-            `[vx] plugin '${plugin.name}' threw in ${hook}; disabled for this run: ${err instanceof Error ? err.message : String(err)}`,
-          )
-        }
+        const onFail = (err: unknown): void => fail(hook, err)
         const dispose = bus.subscribe((event) => {
-          if (disabled.has(plugin.name)) return
+          if (disabled.has(plugin)) return
           // Not awaited: the bus is synchronous and plugin work runs off the
           // critical path. A handler's rejection is caught like its throw.
           let ret: unknown
@@ -681,10 +699,10 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
                 break
             }
           } catch (err) {
-            fail(err)
+            onFail(err)
             return
           }
-          if (ret instanceof Promise) ret.catch(fail)
+          if (ret instanceof Promise) ret.catch(onFail)
         })
         disposers.push(dispose)
       },
@@ -693,6 +711,9 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
     try {
       await plugin.setup(ctx)
     } catch (err) {
+      // Earlier plugins' subscriptions too: the caller never gets the
+      // disposer, and a bus that outlives the run would keep them.
+      for (const d of disposers) d()
       throw new PluginSetupError(
         plugin,
         `plugin '${plugin.name}' failed in setup: ${err instanceof Error ? err.message : String(err)}`,

package/src/orchestrator/prepare.ts

@@ -368,8 +368,11 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     ? options.projects.filter((p) => projects.has(p))
     : [...projects.keys()]
 
-  const requested = expandRequested(tasks, candidateProjects, projects)
-  let unresolvedTasks = unresolvedRequests(tasks, candidateProjects, projects)
+  // A bare name skips the default `build`: it runs nothing, and matched,
+  // `vx run build` in a project declaring none ran 0 tasks, exit 0 (X-102).
+  // A dependant's `^build` still reaches it, and `lib#build` names it.
+  const requested = expandRequested(tasks, candidateProjects, projects, isDefaultBuild)
+  let unresolvedTasks = unresolvedRequests(tasks, candidateProjects, projects, isDefaultBuild)
   if (options.selectedByDiff === true && unresolvedTasks.some((t) => !t.includes('#'))) {
     // A name a loaded project declares is no typo, whether or not the load
     // was whole: an unaffected dependency loaded for the closure declared
@@ -750,14 +753,20 @@ async function declaredNowhere(
   return undeclaredIn(unresolved, all.projects)
 }
 
-/** The bare names in `unresolved` no project in `projects` declares; `a#b` forms pass through. */
+/**
+ * The bare names in `unresolved` no project in `projects` declares; `a#b`
+ * forms pass through. Every project has a `build`, its default one if
+ * nothing declares it, and a bare name does not select that (X-102).
+ */
 function undeclaredIn(
   unresolved: readonly string[],
   projects: LoadedProjects['projects'],
 ): string[] {
   const declared = new Set<string>()
   for (const p of projects.values()) {
-    for (const t of Object.keys(p.config.tasks ?? {})) declared.add(t)
+    for (const [t, task] of Object.entries(p.config.tasks ?? {})) {
+      if (!isDefaultBuild(task)) declared.add(t)
+    }
   }
   return unresolved.filter((t) => t.includes('#') || !declared.has(t))
 }

package/src/orchestrator/run-artifacts.ts

@@ -18,6 +18,7 @@ import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 import { tallyOutcomes, type Tally } from './tally.js'
 import type { FlakyFinding } from './failure-mode.js'
 import { isCacheHit } from './telemetry.js'
+import { ranNoCache } from './events.js'
 
 export interface SummarizeArgs {
   /** Empty string → default path; otherwise the explicit file path. */
@@ -92,7 +93,7 @@ function taskEntry(o: TaskOutcome, flaky?: FlakyFinding): SummaryTaskJson {
     // the flag a consumer computing a hit rate cannot tell a miss from a
     // task that could never hit (its `hash` is still set — dependents fold
     // it). Present only when true, so every other row is byte-identical.
-    ...(o.node.config.cache === undefined ? { noCache: true } : {}),
+    ...(ranNoCache(o) ? { noCache: true } : {}),
     // Present only when the run proved the task flaky: this exact key has
     // both passed and failed on record (this run counted), or the task
     // needed a retry. A consumer gating on `failed` can tell a break from a

package/src/orchestrator/run.ts

@@ -6,7 +6,13 @@ import type { ProjectEntry } from '../workspace/index.js'
 import { loadWorkspace, unreachedHint, unreachedPackages } from '../workspace/index.js'
 import { realpathSync } from 'node:fs'
 import path from 'node:path'
-import { Cache, type CacheLayer, type CachePolicy, stopRuntimeProbes } from '../cache/index.js'
+import {
+  Cache,
+  type CacheLayer,
+  type CachePolicy,
+  cachesNothing,
+  stopRuntimeProbes,
+} from '../cache/index.js'
 import { VERSION } from '../version.js'
 import {
   resetSandbox,
@@ -44,6 +50,7 @@ import {
   secretMask,
 } from '../util/index.js'
 import { keyedProjects } from './keyed-projects.js'
+import { isDefaultBuild } from './projects.js'
 import { prepareSandbox } from './sandbox-request.js'
 import type { OutputDirSnapshot, SaveFacts } from './miss-save.js'
 import { admitTasks, taintTracker } from './admission.js'
@@ -1017,6 +1024,7 @@ async function runOnBus(
     // is one probe of the failed-row index.
     const flaky: FlakyFinding[] = []
     const historyDb = prepared.localCache.dbHandle()
+    const cacheOff = cachesNothing(policy)
     const judgeFlaky = (o: TaskOutcome): void => {
       const candidates = flakyCandidates([o])
       if (candidates.length === 0) return
@@ -1044,6 +1052,7 @@ async function runOnBus(
         log.taskStart?.(node)
       },
       onFinish: (o) => {
+        if (cacheOff) o.cacheOff = true
         taint.settled(o)
         judgeFlaky(o)
         log.taskComplete(o.node, o)
@@ -1346,6 +1355,8 @@ async function runOnBus(
     // task's own facts (flaky, blocked) ride its row. Only a kept server's
     // own output follows.
     if (options.summaryTable === true) for (const line of formatOutcomeTable(list)) log.status(line)
+    const above = options.beforeFooter?.(list, ok)
+    if (above) log.status(above.replace(/\n$/, ''))
     for (const line of formatRunSummary(list, totalMs, colors, runContext)) log.status(line)
 
     // Edge case the summary already reported: the user requested a
@@ -1430,7 +1441,9 @@ async function runOnBus(
       await summarize(ok && first.code === 0, final)
       if (historyAfterWait) {
         recordHistory(() => {
-          const local = Cache.inspect(prepared.cacheDir)
+          // A writer's open: another vx version may have reset the index
+          // to its schema during the session, and a mismatch resets silently.
+          const local = new Cache(prepared.cacheDir, undefined, prepared.workspaceRoot)
           try {
             local.recordRunBundle(recordsOf(final, ok && first.code === 0))
           } finally {
@@ -1632,7 +1645,7 @@ async function initHint(prepared: {
   // Single-project mode with packages the root's missing `workspaces`
   // never reaches: `vx init` would find no scripts either (item 248).
   const unreached = await unreachedPackages(await loadWorkspace(prepared.workspaceRoot))
-  if (unreached.length > 0) return ` ${unreachedHint(unreached)}`
+  if (unreached.length > 0) return ` ${unreachedHint(unreached, prepared.workspaceRoot)}`
   return ' No package declares a vx.config — run `vx init` to write one per package from its package.json scripts.'
 }
 
@@ -1649,8 +1662,11 @@ function didYouMean(
   elsewhere: readonly string[] = [],
 ): string {
   const tasksOf = (p: ProjectEntry | undefined): string[] => Object.keys(p?.config.tasks ?? {})
+  // What a bare name can select: a default `build` is no match (X-102).
   const allTasks = new Set<string>()
-  for (const p of projects.values()) for (const t of tasksOf(p)) allTasks.add(t)
+  for (const p of projects.values()) {
+    for (const t of tasksOf(p)) if (!isDefaultBuild(p.config.tasks![t])) allTasks.add(t)
+  }
   // A Set: two typos of the same task hint it once, not once per typo.
   const hints = new Set<string>()
   // A typo past two edits named nothing to pick from (M-56): with no near

package/src/orchestrator/sandbox-request.ts

@@ -271,7 +271,7 @@ export async function sandboxRequestFor(
     // could copy a key into an output the cache shares (L-41).
     baseDenyRead: [
       ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
-      ...credentialStores(workspaceRoot),
+      ...(await credentialStores(workspaceRoot, config.allowWrite)),
     ],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
@@ -464,11 +464,13 @@ async function prepareOutputsForBind(
       await mkdir(abs, { recursive: true }).catch(() => undefined)
       continue
     }
-    if (hasWildcard || g.endsWith('/')) {
-      const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
-      await mkdir(abs, { recursive: true })
-    } else {
-      const abs = path.join(projectDir, g)
+    const dir = hasWildcard || g.endsWith('/')
+    const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
+    try {
+      if (dir) {
+        await mkdir(abs, { recursive: true })
+        continue
+      }
       // Whatever is already there is what the task meant — a grant on the
       // project dir itself is a directory, and touching it as a file is
       // an EISDIR, not a missing bind. `lstat`, and an exclusive create: a
@@ -478,11 +480,33 @@ async function prepareOutputsForBind(
       await mkdir(path.dirname(abs), { recursive: true })
       await writeFile(abs, '', { flag: 'wx' })
       placeholders.push({ path: abs, mtimeMs: (await lstat(abs)).mtimeMs })
+    } catch (err) {
+      await sweepPlaceholders(placeholders)
+      const code = (err as NodeJS.ErrnoException).code
+      if (code !== 'EEXIST' && code !== 'ENOTDIR') throw err
+      // A file stands where the grant needs a directory: `out.txt/` over a
+      // file, or `a.txt/x/*.js`. It reached the user as an internal error.
+      const blocker = await fileOnPath(projectDir, dir ? abs : path.dirname(abs))
+      throw new UserError(
+        `exec.sandbox.allow.write: "${g}" needs a directory at ${blocker}, and a file is ` +
+          `there — remove the file, or grant a path beside it`,
+      )
     }
   }
   return placeholders
 }
 
+/** The first path from `from` down to `to` that exists and is not a directory. */
+async function fileOnPath(from: string, to: string): Promise<string> {
+  let at = from
+  for (const part of path.relative(from, to).split(path.sep)) {
+    at = path.join(at, part)
+    const st = await lstat(at).catch(() => undefined)
+    if (st !== undefined && !st.isDirectory()) return at
+  }
+  return to
+}
+
 /**
  * The walls a project's grants stop at: its nested projects, the
  * repository and vx's directory (item 1010). A read grant around one is
@@ -589,13 +613,35 @@ const CREDENTIAL_STORES = [
   '.npmrc',
   '.yarnrc.yml',
   '.pypirc',
+  // Registry and service tokens of the same kind: Bun's global bunfig
+  // (`[install.scopes]` tokens) at either of its homes, Cargo's, RubyGems'.
+  '.bunfig.toml',
+  '.config/.bunfig.toml',
+  '.cargo/credentials',
+  '.cargo/credentials.toml',
+  '.gem/credentials',
+  '.config/hub',
+  '.config/containers/auth.json',
+  '.terraform.d/credentials.tfrc.json',
+  '.vault-token',
+  '.pgpass',
 ]
 
 /** The stores present on this host, learned once per home. */
 let presentStores: { home: string; paths: string[] } | undefined
 
-/** The credential stores to deny, less any that holds the workspace. */
-function credentialStores(workspaceRoot: string): string[] {
+/**
+ * The credential stores to deny, less any that holds the workspace, and
+ * punched around the task's write grants: a grant names a store as a read
+ * does. Denied whole, the store's mask landed on the grant's bind (a file
+ * grant binds its directory on Linux), so `write: ['~/.npmrc']` wrote to
+ * /dev/null with exit 0, and `~/.aws/config` left `~/.aws/credentials`
+ * readable. A grant above a store does not name it, so it stays denied.
+ */
+async function credentialStores(
+  workspaceRoot: string,
+  writes: readonly string[],
+): Promise<string[]> {
   const home = homedir()
   if (presentStores?.home !== home) {
     presentStores = {
@@ -603,9 +649,19 @@ function credentialStores(workspaceRoot: string): string[] {
       paths: CREDENTIAL_STORES.map((rel) => path.join(home, rel)).filter((p) => existsSync(p)),
     }
   }
-  return presentStores.paths.filter(
+  const stores = presentStores.paths.filter(
     (p) => workspaceRoot !== p && !workspaceRoot.startsWith(p + path.sep),
   )
+  return (await Promise.all(stores.map((p) => denyAround(toRealPath(p), writes)))).flat()
+}
+
+/** `dir` denied, or its entries no write grant lies under or at when one is inside it. */
+async function denyAround(dir: string, writes: readonly string[]): Promise<string[]> {
+  const inside = writes.filter((w) => atOrUnder(w, dir))
+  if (inside.length === 0) return [dir]
+  if (inside.includes(dir)) return []
+  const entries = await readdir(dir).catch(() => [])
+  return (await Promise.all(entries.map((e) => denyAround(path.join(dir, e), inside)))).flat()
 }
 
 /** `~/x` against the user's home; anything else unchanged. */

package/src/orchestrator/save-lane.ts

@@ -21,22 +21,22 @@ export interface SaveLane {
 
 export function createSaveLane(cap: number, onError: (err: unknown) => void): SaveLane {
   const queue: Array<{ save: () => Promise<void>; settle: () => void }> = []
-  const running = new Set<Promise<void>>()
+  let running = 0
   const start = (save: () => Promise<void>, settle: () => void): void => {
-    const p = save()
+    void save()
       .catch(onError)
       .then(() => {
-        running.delete(p)
+        running--
         settle()
         const next = queue.shift()
         if (next !== undefined) start(next.save, next.settle)
       })
-    running.add(p)
+    running++
   }
   return {
     defer(save) {
       return new Promise<void>((settle) => {
-        if (running.size < cap) start(save, settle)
+        if (running < cap) start(save, settle)
         else queue.push({ save, settle })
       })
     },

package/src/orchestrator/summary.ts

@@ -6,7 +6,7 @@
 import type { TaskOutcome } from '../graph/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { tallyOutcomes } from './tally.js'
-import { outcomeLabel, projectOutcome } from './events.js'
+import { outcomeLabel, projectOutcome, ranNoCache } from './events.js'
 import { isGroupTask } from '../graph/index.js'
 import { formatElapsed } from '../util/index.js'
 
@@ -365,9 +365,7 @@ export function formatRunSummary(
   // distinction — it never consulted the cache, so it is not a miss.
   const noCache = outcomes.filter(
     (o) =>
-      !isGroupTask(o.node) &&
-      (o.status === 'success' || o.status === 'failed') &&
-      o.node.config.cache === undefined,
+      !isGroupTask(o.node) && (o.status === 'success' || o.status === 'failed') && ranNoCache(o),
   ).length
   const t = tallyOutcomes(outcomes)
   // Spread over executed tasks only — `success`/`failed` statuses ran

package/src/orchestrator/telemetry.ts

@@ -481,6 +481,15 @@ export interface TelemetrySource {
 /** How often a running task's process tree is sampled. */
 const SAMPLE_MS = 1000
 
+/** Call `fn` every `ms` until the returned stop is called. */
+type Every = (ms: number, fn: () => Promise<void>) => () => void
+
+const everyInterval: Every = (ms, fn) => {
+  const timer = setInterval(() => void fn(), ms)
+  timer.unref()
+  return () => clearInterval(timer)
+}
+
 const DEFAULT_KINDS: ReadonlyArray<TelemetryRecord['kind']> = [
   'run.start',
   'task.start',
@@ -508,6 +517,8 @@ export function createTelemetrySource(args: {
   owners?: ReadonlyMap<TelemetrySink, string>
   /** The run's task graph, to see a group dependency through to the tasks behind it. */
   nodes?: ReadonlyMap<string, TaskNode>
+  /** The sampler's clock; a test ticks it by hand instead of waiting on the wall. */
+  every?: Every
 }): TelemetrySource {
   const { sinks, run, warn } = args
   const runId = run.runId
@@ -543,12 +554,13 @@ export function createTelemetrySource(args: {
   // only while one runs; a tick still reading when the next is due is not
   // doubled.
   const tracked = new Map<string, number>()
-  let timer: ReturnType<typeof setInterval> | undefined
+  const every = args.every ?? everyInterval
+  let stopEvery: (() => void) | undefined
   let sampling = false
   let ended = false
   const stopTimer = (): void => {
-    if (timer !== undefined) clearInterval(timer)
-    timer = undefined
+    stopEvery?.()
+    stopEvery = undefined
   }
   const untrack = (taskId: string, pid: number): void => {
     if (tracked.get(taskId) === pid) tracked.delete(taskId)
@@ -587,10 +599,7 @@ export function createTelemetrySource(args: {
   const track = (taskId: string, pid: number): (() => void) => {
     if (ended) return () => {}
     tracked.set(taskId, pid)
-    if (timer === undefined) {
-      timer = setInterval(() => void tick(), SAMPLE_MS)
-      timer.unref()
-    }
+    stopEvery ??= every(SAMPLE_MS, tick)
     return () => untrack(taskId, pid)
   }
 

package/src/util/paths.ts

@@ -198,6 +198,12 @@ export function taskGlob(pattern: string): Bun.Glob {
   // A `]` with no `[` before it is already literal to `Bun.Glob`.
   const source = pattern.includes('[') ? pattern.replace(/(?<!\\)[[\]]/g, '\\$&') : pattern
   const glob = new Bun.Glob(source)
+  const alternatives = braceAlternatives(pattern)
+  if (alternatives.length > 1) {
+    const any = anyTaskGlob(alternatives)
+    glob.match = (rel: string): boolean => any(rel)
+    return glob
+  }
   const re = regExpSource(pattern)
   if (re === null) return glob
   const compiled = new RegExp(`^${re}$`, 'u')
@@ -216,8 +222,13 @@ export function taskGlob(pattern: string): Bun.Glob {
  * RegExp for the lot when every pattern has one, else a glob each. An input
  * file was matched against a dozen globs (its positives, the always-ignored
  * list, its negatives) one native call at a time.
+ *
+ * A brace is expanded first, never matched by `Bun.Glob`: its match reads a
+ * `**` that ends an alternative as one name, so `{src/**,lib/**}` took
+ * `src/a.ts` and never `src/deep/a.ts`, and an edit there was a stale hit.
  */
-export function anyTaskGlob(patterns: readonly string[]): (rel: string) => boolean {
+export function anyTaskGlob(rawPatterns: readonly string[]): (rel: string) => boolean {
+  const patterns = rawPatterns.flatMap(braceAlternatives)
   if (patterns.length === 0) return () => false
   const sources = patterns.map(regExpSource)
   const globs = patterns.map(taskGlob)
@@ -339,6 +350,15 @@ export function outputMatcher(globs: readonly string[]): (rel: string) => boolea
  * is left to the glob.
  */
 export function slashBraceExpansions(pattern: string): string[] {
+  return expandBraces(pattern, true)
+}
+
+/** `pattern` with every brace group of two or more alternatives expanded. */
+function braceAlternatives(pattern: string): string[] {
+  return expandBraces(pattern, false)
+}
+
+function expandBraces(pattern: string, slashOnly: boolean): string[] {
   if (pattern.includes('\\')) return [pattern]
   for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
     let depth = 0
@@ -352,14 +372,14 @@ export function slashBraceExpansions(pattern: string): string[] {
     }
     if (close === -1) return [pattern]
     const body = pattern.slice(open + 1, close)
-    if (cuts.length === 0 || !body.includes('/')) continue
+    if (cuts.length === 0 || (slashOnly && !body.includes('/'))) continue
     const head = pattern.slice(0, open)
     const tail = pattern.slice(close + 1)
     const bounds = [open, ...cuts, close]
     const out: string[] = []
     for (let k = 0; k + 1 < bounds.length; k++) {
       const alt = pattern.slice(bounds[k]! + 1, bounds[k + 1])
-      out.push(...slashBraceExpansions(head + alt + tail))
+      out.push(...expandBraces(head + alt + tail, slashOnly))
     }
     return [...new Set(out)]
   }

package/src/workspace/config-imports.ts

@@ -20,9 +20,9 @@
 //     the lockfile moves, which the workspace fingerprint already covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
-//   - Descend only through files owned by NO project, or by a ROOT project
+//   - Descend only through files owned by NO project, by a ROOT project
 //     (whose own files are the shared tooling that is otherwise unowned,
-//     D-41). A config reaching into another project (say a site's
+//     D-41), or by the importing file's own project. A config reaching into another project (say a site's
 //     `vx.config.ts` importing `../core/src/index.ts`) records that edge
 //     and STOPS there — following it would drag substantially all of that
 //     project's `src/` into the closure, and the containment channel
@@ -486,16 +486,18 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
+      const from = ownerOf(file, dirToName)
       for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)
         if (list) list.push(file)
         else importedBy.set(target, [file])
-        // Descend ONLY through unowned files, or the root project's own:
-        // see the header.
+        // Descend ONLY through unowned files, the root project's own, or
+        // the importer's own project's (a config split into `./tasks.mjs`
+        // that imports shared tooling): see the header.
         const owner = ownerOf(target, dirToName)
-        if (owner === undefined || owner === rootOwner) frontier.push(target)
+        if (owner === undefined || owner === rootOwner || owner === from) frontier.push(target)
       }
     }
   }

package/src/workspace/config-schema.ts

@@ -144,6 +144,11 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   ) {
     throw new UserError(`${configPath}: \`cacheDir\` is only whitespace — name a directory`)
   }
+  // No path can carry one: the mkdir's argument error was reported as an
+  // unwritable workspace.
+  if (typeof config.cacheDir === 'string' && config.cacheDir.includes('\0')) {
+    throw new UserError(`${configPath}: \`cacheDir\` holds a NUL, which no path can carry`)
+  }
   if (config.timeout !== undefined) {
     if (
       typeof config.timeout !== 'number' ||
@@ -156,8 +161,12 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   }
   if (config.cacheRetention !== undefined) validateRetention(config.cacheRetention, configPath)
   if (config.affectedBase !== undefined) {
-    // A leading '-' would reach git as an option, not a ref.
-    if (typeof config.affectedBase !== 'string' || !/^[^-\s]\S*$/.test(config.affectedBase)) {
+    // A leading '-' would reach git as an option, not a ref; a NUL fails the
+    // spawn with an argument error naming nothing in this file.
+    if (
+      typeof config.affectedBase !== 'string' ||
+      !/^[^-\s\0][^\s\0]*$/.test(config.affectedBase)
+    ) {
       throw new UserError(`${configPath}: \`affectedBase\` must be a git ref like 'origin/main'`)
     }
   }
@@ -463,6 +472,8 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `(got "${wild}") — list explicit env var names instead`,
             )
           }
+          for (const n of passThrough as string[])
+            assertShellName(n, `${where}.exec.env.passThrough`)
         }
         const secret = (env as { secret?: unknown }).secret
         if (
@@ -489,6 +500,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `${where}.exec.env.define: ${JSON.stringify(k)} is not an env var name (non-empty, no '=' or NUL)`,
               )
             }
+            assertShellName(k, `${where}.exec.env.define`)
             if (typeof val !== 'string' || val.includes('\0')) {
               throw new UserError(`${where}.exec.env.define.${k} must be a string with no NUL`)
             }
@@ -1350,8 +1362,19 @@ function specForm(spec: string): SpecForm {
  * A name an environment can hold. An `=` splits at the first one, so
  * `define: { 'A=B': 'x' }` gave the child `A` with the value `B=x`; `''`
  * was dropped; a NUL failed the spawn with a hint about exit 127 (item
- * 999). Refused at load, where the config is named.
+ * 999). And the task runs under `sh -c`, whose dash (Linux) drops a
+ * variable whose name is no shell identifier: `my.var` reached a task
+ * under macOS's bash and nothing on Linux. Refused at load, where the
+ * config is named.
  */
+function assertShellName(name: string, field: string): void {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new UserError(
+      `${field}: ${JSON.stringify(name)} is not a shell variable name ([A-Za-z_][A-Za-z0-9_]*); sh would drop it before the task runs`,
+    )
+  }
+}
+
 function isEnvName(name: unknown): name is string {
   return typeof name === 'string' && name.length > 0 && !name.includes('=') && !name.includes('\0')
 }