@vzn/vx 0.0.595 → 0.0.597

package/src/workspace/affected.ts

@@ -84,7 +84,10 @@ export interface AffectedArgs {
    * (item 954). The `--affected` sugar's graph walk has already staged every
    * config, so there it costs nothing more.
    */
-  workspaceGlobOwners?: (changedPaths: readonly string[]) => Promise<Iterable<string>>
+  workspaceGlobOwners?: (
+    changedPaths: readonly string[],
+    nested: readonly string[],
+  ) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
    * answer for a change to one. Resolved lazily: loading the workspace
@@ -142,6 +145,12 @@ export interface AffectedChanges {
   /** Project → its changed paths, relative to the project's directory. */
   paths: ReadonlyMap<string, readonly string[]>
   whole: ReadonlySet<string>
+  /**
+   * The changed paths that are nested repositories (a submodule, an
+   * embedded repository), workspace-relative: each stands for every file
+   * in it, so a `workspaceFiles` glob that reaches under one is reached.
+   */
+  nested?: readonly string[]
 }
 
 export async function affectedChanges(
@@ -221,16 +230,10 @@ export async function affectedChanges(
     // submodules (`diff.ignoreSubmodules`, `submodule.<name>.ignore`), and
     // then an edit inside one, or a committed bump, was no change here while
     // the task's key moved (item 951).
-    gitPaths(args.workspaceRoot, [
-      'diff',
-      '--no-renames',
-      '--ignore-submodules=none',
-      '--relative',
-      '--name-only',
-      '-z',
-      '--end-of-options',
-      base,
-    ]),
+    //
+    // `--raw` for each path's mode: a gitlink (160000) is a nested
+    // repository, one path standing for every file in it (`nested` below).
+    gitDiffPaths(args.workspaceRoot, base),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
@@ -244,9 +247,13 @@ export async function affectedChanges(
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
-  const changed = [...diffed, ...untracked.filter((s) => !isInstalledPath(s))].filter(
+  const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
     (s) => s !== LOCKFILE_NAME,
   )
+  // The nested repositories git reports as one path: a gitlink, or an
+  // untracked embedded repository (`dir/`, the only path git prints so).
+  const nested = new Set(diffed.gitlinks)
+  for (const rel of untracked) if (rel.endsWith('/')) nested.add(rel)
 
   // A lockfile or workspace-definition change re-keys EVERY task, because the
   // workspace fingerprint folds those files into every cache key. Mapping
@@ -316,6 +323,7 @@ export async function affectedChanges(
   const owned = projectsContaining(
     args.workspaceRoot,
     changed,
+    nested,
     args.projects,
     realDirs,
     perTask
@@ -371,15 +379,21 @@ export async function affectedChanges(
     projects: args.projects,
     changed,
     skip: perTask ? new Set() : owned,
-    realDirs,
   })) {
     owned.add(name)
     whole.add(name)
   }
 
-  const done = (): AffectedChanges => ({ projects: owned, changed, paths, whole })
+  const nestedDirs = [...nested].map((rel) => rel.replace(/\/$/, ''))
+  const done = (): AffectedChanges => ({
+    projects: owned,
+    changed,
+    paths,
+    whole,
+    ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
+  })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
-  for (const name of await args.workspaceGlobOwners(changed)) owned.add(name)
+  for (const name of await args.workspaceGlobOwners(changed, nestedDirs)) owned.add(name)
   return done()
 }
 
@@ -645,6 +659,37 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
   return stdout.split('\0').filter((s) => s.length > 0)
 }
 
+/**
+ * `git diff --raw -z <base>`'s paths, and those that are a gitlink on
+ * either side: one the change removed took its files with it. Each record
+ * is `:<mode> <mode> <oid> <oid> <status>` then its path (one path:
+ * `--no-renames`).
+ */
+async function gitDiffPaths(
+  workspaceRoot: string,
+  base: string,
+): Promise<{ paths: string[]; gitlinks: string[] }> {
+  const fields = await gitPaths(workspaceRoot, [
+    'diff',
+    '--no-renames',
+    '--ignore-submodules=none',
+    '--relative',
+    '--raw',
+    '-z',
+    '--end-of-options',
+    base,
+  ])
+  const paths: string[] = []
+  const gitlinks: string[] = []
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    const rel = fields[i + 1]!
+    paths.push(rel)
+    const head = fields[i]!
+    if (head.startsWith('160000 ', 1) || head.startsWith('160000 ', 8)) gitlinks.push(rel)
+  }
+  return { paths, gitlinks }
+}
+
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
@@ -826,17 +871,11 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   )
 }
 
-function isDirectory(abs: string): boolean {
-  try {
-    return statSync(abs).isDirectory()
-  } catch {
-    return false
-  }
-}
-
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
+  /** The changed paths that are nested repositories (`nested` in `affectedChanges`). */
+  nested: ReadonlySet<string>,
   projects: readonly ProjectMeta[],
   realDirs: ReadonlyMap<string, string>,
   /** Told each owned path relative to its project, and each nested repository's projects. */
@@ -868,37 +907,35 @@ function projectsContaining(
   }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
+    const repo = nested.has(rel)
     let dir = path.resolve(workspaceRoot, rel).normalize('NFC')
-    let hit = false
     for (;;) {
       const name = dirToName.get(dir)
       if (name !== undefined) {
         owned.add(name)
         on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')))
-        hit = true
+        // Its files are the project's inputs, and none of them is this
+        // path: a task's globs cannot say whether they reach inside.
+        if (repo) on?.repo(name)
         break
       }
       const parent = path.dirname(dir)
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
-    if (hit) continue
-    // A changed path that is a DIRECTORY on disk is a nested repository —
-    // a submodule whose checkout moved or is dirty (`vendor/sub`), an
-    // embedded repository left untracked (`vendor/nested/`) — because git
-    // reports nothing else as a directory. The workspace repository sees
-    // the nested one as that single path, so a change inside is a change
-    // to it, and every project under it is affected. Its own enumeration
-    // already keys those projects on their files (git-inputs.ts); without
-    // this, `--affected` after an edit inside selected none of them.
-    const abs = path.resolve(workspaceRoot, rel)
-    if (isDirectory(abs)) {
-      const prefix = abs.normalize('NFC') + path.sep
-      for (const [dir, name] of dirToName) {
-        if (!dir.startsWith(prefix)) continue
-        owned.add(name)
-        on?.repo(name)
-      }
+    if (!repo) continue
+    // A submodule whose checkout moved or is dirty (`vendor/sub`), an
+    // embedded repository left untracked (`vendor/nested/`): the workspace
+    // repository sees the nested one as that single path, so a change
+    // inside is a change to it, and every project under it is affected.
+    // Its own enumeration already keys those projects on their files
+    // (git-inputs.ts); without this, `--affected` after an edit inside
+    // selected none of them.
+    const prefix = path.resolve(workspaceRoot, rel).normalize('NFC') + path.sep
+    for (const [dir, name] of dirToName) {
+      if (!dir.startsWith(prefix)) continue
+      owned.add(name)
+      on?.repo(name)
     }
   }
   return owned

package/src/workspace/config-eval.ts

@@ -185,12 +185,16 @@ self.onmessage = async (e) => {
         : thrown
     const report = changed()
     umaskBack()
+    // A thrown string or plain object has no message, and String() of a
+    // null-prototype object throws here, inside the catch.
+    const isError = err !== null && typeof err === 'object' && typeof err.message === 'string'
     postMessage({
       id,
       ok: false,
-      name: err?.name ?? 'Error',
-      message: err?.message ?? String(err),
-      stack: err?.stack ?? null,
+      thrown: isError ? null : globalThis.Bun.inspect(err, { compact: true }),
+      name: isError ? (err.name ?? 'Error') : 'Error',
+      message: isError ? err.message : '',
+      stack: isError ? (err.stack ?? null) : null,
       changed: report,
       position:
         err?.position && typeof err.position === 'object'
@@ -214,6 +218,8 @@ interface WorkerReply {
   nonJson: NonJsonValue[]
   name: string
   message: string
+  /** What a config threw that is not an Error, as `thrownValueMessage` shows it; null for an Error. */
+  thrown?: string | null
   stack: string | null
   /** A transpile error's location — `BuildMessage.position`, trimmed to what the loader reads. */
   position: { file?: string; line?: number; column?: number } | null
@@ -222,6 +228,16 @@ interface WorkerReply {
 interface Pending {
   resolve: (reply: WorkerReply) => void
   reject: (err: Error) => void
+  configPath: string
+}
+
+/**
+ * A config threw something that is not an Error: `throw 'no'` printed
+ * `vx: no`, naming no file, and a null-prototype object crashed vx's own
+ * error printer with a stack.
+ */
+export function thrownValueMessage(kind: string, configPath: string, shown: string): string {
+  return `${kind} config ${configPath} threw ${shown}, which is not an Error`
 }
 
 /**
@@ -236,10 +252,11 @@ export function evalBudgetMs(): number {
   // BOUND on a worker that may be wedged, with no "no limit" reading. Falls
   // back rather than clamping, because honouring ~24.8 days would hang
   // `vx watch` forever on a worker the OS killed — and unbounded makes it 1 ms,
-  // so EVERY config load times out instead. Both ends break the same feature.
+  // so EVERY config load times out instead. Both ends break the same feature,
+  // and `0` is the second end: it fired on the next tick (D-157).
   if (raw !== undefined && /^[0-9]+$/.test(raw)) {
     const n = Number(raw)
-    if (n <= MAX_TIMEOUT_MS) return n
+    if (n > 0 && n <= MAX_TIMEOUT_MS) return n
   }
   return 30_000
 }
@@ -287,6 +304,10 @@ function acquireWorker(): Worker {
       p.resolve(msg)
       return
     }
+    if (typeof msg.thrown === 'string') {
+      p.reject(new UserError(thrownValueMessage('Project', p.configPath, msg.thrown)))
+      return
+    }
     // Rebuild the error the config actually threw. Name, message, stack
     // and a transpile error's position all survive the hop, so a broken
     // config reports the same text it would from an in-process import.
@@ -365,7 +386,7 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
     // evaluation costs, so it can only fire on a genuine wedge.
     const budget = evalBudgetMs()
     const reply = await new Promise<WorkerReply>((resolve, reject) => {
-      pending.set(id, { resolve, reject })
+      pending.set(id, { resolve, reject, configPath })
       timer = setTimeout(() => {
         rejectAll(new Error(`config worker did not answer within ${budget}ms`))
         if (worker !== null) {

package/src/workspace/config-imports.ts

@@ -20,13 +20,13 @@
 //     the lockfile moves, which the workspace fingerprint already covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
-//   - Descend only through files owned by NO project, or by a ROOT project
-//     (whose own files are the shared tooling that is otherwise unowned,
-//     D-41). A config reaching into another project (say a site's
-//     `vx.config.ts` importing `../core/src/index.ts`) records that edge
-//     and STOPS there — following it would drag substantially all of that
-//     project's `src/` into the closure, and the containment channel
-//     already selects the project that owns it.
+//   - One reversed BFS from every config at once, each file read once
+//     however many configs reach it. It descends through every file in
+//     the workspace, another project's included: a site's `vx.config.ts`
+//     importing `../core/src/index.ts` evaluates what that file imports
+//     too, so an edit there moves the site's key. The walk stopped at the
+//     first file of another project, and containment selected core alone
+//     while the site's key moved (X-128).
 
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
@@ -393,32 +393,6 @@ export interface ConfigImportOwnersArgs {
   changed: readonly string[]
   /** Already-selected projects; their configs need no scan. */
   skip: ReadonlySet<string>
-  /**
-   * Each project dir's realpath, when the caller already has them: the
-   * containment pass needs the same answers, and asking twice cost 5,000
-   * realpaths at 5,000 projects (D-24).
-   */
-  realDirs?: ReadonlyMap<string, string>
-}
-
-/**
- * Project dir → name, REALPATH'D — which is why this cannot reuse the index
- * the containment pass builds. `Bun.resolveSync` hands back realpath'd
- * targets, and on darwin a workspace under `os.tmpdir()` lives at
- * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
- * the two matches nothing and fails exactly like "found no imports".
- */
-async function realDirIndex(
-  projects: readonly ProjectMeta[],
-  known: ReadonlyMap<string, string> | undefined,
-): Promise<Map<string, string>> {
-  const out = new Map<string, string>()
-  await Promise.all(
-    projects.map(async (p) => {
-      out.set(known?.get(p.dir) ?? (await realpath(p.dir).catch(() => p.dir)), p.name)
-    }),
-  )
-  return out
 }
 
 const TS_EXT = new Set(['.ts', '.mts', '.cts'])
@@ -426,18 +400,6 @@ const TS_EXT = new Set(['.ts', '.mts', '.cts'])
 /** The extensions Bun tries for a specifier that names none. */
 const RESOLVED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']
 
-/** The deepest project containing `file`, or undefined when none does. */
-function ownerOf(file: string, dirToName: ReadonlyMap<string, string>): string | undefined {
-  let dir = path.dirname(file)
-  for (;;) {
-    const name = dirToName.get(dir)
-    if (name !== undefined) return name
-    const parent = path.dirname(dir)
-    if (parent === dir) return undefined
-    dir = parent
-  }
-}
-
 /** Projects whose config file transitively imports one of `changed`. */
 export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set<string>> {
   const selected = new Set<string>()
@@ -453,10 +415,6 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
     }),
   )
   if (roots.size === 0) return selected
-  const dirToName = await realDirIndex(a.projects, a.realDirs)
-  // A root project owns every file no member owns: the shared tooling the
-  // walk descends through when the root is no project (D-41).
-  const rootOwner = dirToName.get(workspaceRoot)
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
@@ -492,10 +450,7 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
         const list = importedBy.get(target)
         if (list) list.push(file)
         else importedBy.set(target, [file])
-        // Descend ONLY through unowned files, or the root project's own:
-        // see the header.
-        const owner = ownerOf(target, dirToName)
-        if (owner === undefined || owner === rootOwner) frontier.push(target)
+        frontier.push(target)
       }
     }
   }

package/src/workspace/config-schema.ts

@@ -76,6 +76,16 @@ function validateRules(rules: unknown, configPath: string): void {
 
 const RETENTION_FIELDS = new Set(['olderThan', 'maxSize'])
 
+/**
+ * A refused value as a message quotes it. A workspace file is evaluated
+ * in-process and no JSON rule precedes its schema, so a value here may be
+ * one `JSON.stringify` throws on (`30n`) or drops (a symbol): the refusal
+ * became a TypeError with a stack.
+ */
+function shown(v: unknown): string {
+  return typeof v === 'bigint' ? `${v}n` : (JSON.stringify(v) ?? String(v))
+}
+
 function validateRetention(retention: unknown, configPath: string): void {
   const where = `${configPath}: \`cacheRetention\``
   const field = (key: string) => `${configPath}: \`cacheRetention.${key}\``
@@ -93,12 +103,12 @@ function validateRetention(retention: unknown, configPath: string): void {
     (typeof olderThan !== 'string' || parseDuration(olderThan) === null)
   ) {
     throw new UserError(
-      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${JSON.stringify(olderThan)})`,
+      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${shown(olderThan)})`,
     )
   }
   if (maxSize !== undefined && (typeof maxSize !== 'string' || parseSize(maxSize) === null)) {
     throw new UserError(
-      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${JSON.stringify(maxSize)})`,
+      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${shown(maxSize)})`,
     )
   }
   // The bounds `vx cache prune` refuses, for the same reason: each evicts
@@ -144,6 +154,11 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   ) {
     throw new UserError(`${configPath}: \`cacheDir\` is only whitespace — name a directory`)
   }
+  // No path can carry one: the mkdir's argument error was reported as an
+  // unwritable workspace.
+  if (typeof config.cacheDir === 'string' && config.cacheDir.includes('\0')) {
+    throw new UserError(`${configPath}: \`cacheDir\` holds a NUL, which no path can carry`)
+  }
   if (config.timeout !== undefined) {
     if (
       typeof config.timeout !== 'number' ||
@@ -156,8 +171,12 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
   }
   if (config.cacheRetention !== undefined) validateRetention(config.cacheRetention, configPath)
   if (config.affectedBase !== undefined) {
-    // A leading '-' would reach git as an option, not a ref.
-    if (typeof config.affectedBase !== 'string' || !/^[^-\s]\S*$/.test(config.affectedBase)) {
+    // A leading '-' would reach git as an option, not a ref; a NUL fails the
+    // spawn with an argument error naming nothing in this file.
+    if (
+      typeof config.affectedBase !== 'string' ||
+      !/^[^-\s\0][^\s\0]*$/.test(config.affectedBase)
+    ) {
       throw new UserError(`${configPath}: \`affectedBase\` must be a git ref like 'origin/main'`)
     }
   }
@@ -170,7 +189,7 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       throw new UserError(`${configPath}: \`plugins\` must be an array of plugin objects`)
     }
     const verbOwners = new Map<string, string>()
-    const fileClaimants = new Map<string, string>()
+    const fileClaimants = new Map<string, { name: string; at: number }>()
     for (const [i, p] of config.plugins.entries()) {
       if (p === null || typeof p !== 'object') {
         // Nx's nx.json lists plugins by module name (`'@nx/vite/plugin'`);
@@ -190,6 +209,13 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       // one whose `name` was overwritten after the stamp, is refused here —
       // the one boundary every plugin crosses.
       const pkg = (p as Record<symbol, unknown>)[PLUGIN_PACKAGE]
+      // An async factory called without `await` was told its plugin did not
+      // come from definePlugin — it had (D-159).
+      if (pkg === undefined && typeof (p as { then?: unknown }).then === 'function') {
+        throw new UserError(
+          `${configPath}: \`plugins[${i}]\` is a Promise — await the factory that returns the plugin`,
+        )
+      }
       if (typeof pkg !== 'string' || pkg.length === 0) {
         throw new UserError(
           `${configPath}: \`plugins[${i}]\` must come from definePlugin(import.meta, { … }) — a plugin's name is its package name`,
@@ -308,16 +334,23 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
             /[/\\]/.test(file)
           ) {
             throw new UserError(
-              `${configPath}: plugin '${plug.name}' claims fingerprint file ${JSON.stringify(file)}, which is not a file name at the workspace root`,
+              `${configPath}: plugin '${plug.name}' claims fingerprint file ${shown(file)}, which is not a file name at the workspace root`,
             )
           }
           const owner = fileClaimants.get(file)
+          // One package twice (`plugins: [bun(), bun()]`) read "plugins 'x'
+          // and 'x' both claim" (D-158).
+          if (owner !== undefined && owner.name === plug.name) {
+            throw new UserError(
+              `${configPath}: plugin '${plug.name}' claims fingerprint file '${file}' twice (plugins[${owner.at}] and plugins[${i}]) — a file has one claimant; declare the plugin once`,
+            )
+          }
           if (owner !== undefined) {
             throw new UserError(
-              `${configPath}: plugins '${owner}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
+              `${configPath}: plugins '${owner.name}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
             )
           }
-          fileClaimants.set(file, plug.name)
+          fileClaimants.set(file, { name: plug.name, at: i })
         }
       }
       // A plugin must contribute at least one capability or lifecycle hook
@@ -463,6 +496,8 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `(got "${wild}") — list explicit env var names instead`,
             )
           }
+          for (const n of passThrough as string[])
+            assertShellName(n, `${where}.exec.env.passThrough`)
         }
         const secret = (env as { secret?: unknown }).secret
         if (
@@ -489,6 +524,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
                 `${where}.exec.env.define: ${JSON.stringify(k)} is not an env var name (non-empty, no '=' or NUL)`,
               )
             }
+            assertShellName(k, `${where}.exec.env.define`)
             if (typeof val !== 'string' || val.includes('\0')) {
               throw new UserError(`${where}.exec.env.define.${k} must be a string with no NUL`)
             }
@@ -1350,8 +1386,19 @@ function specForm(spec: string): SpecForm {
  * A name an environment can hold. An `=` splits at the first one, so
  * `define: { 'A=B': 'x' }` gave the child `A` with the value `B=x`; `''`
  * was dropped; a NUL failed the spawn with a hint about exit 127 (item
- * 999). Refused at load, where the config is named.
+ * 999). And the task runs under `sh -c`, whose dash (Linux) drops a
+ * variable whose name is no shell identifier: `my.var` reached a task
+ * under macOS's bash and nothing on Linux. Refused at load, where the
+ * config is named.
  */
+function assertShellName(name: string, field: string): void {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new UserError(
+      `${field}: ${JSON.stringify(name)} is not a shell variable name ([A-Za-z_][A-Za-z0-9_]*); sh would drop it before the task runs`,
+    )
+  }
+}
+
 function isEnvName(name: unknown): name is string {
   return typeof name === 'string' && name.length > 0 && !name.includes('=') && !name.includes('\0')
 }

package/src/workspace/filter.ts

@@ -5,6 +5,8 @@
 //   {<dir>}          same as ./<dir>
 //   //               the workspace-root project only (Turbo's name for the root)
 //   tag:<pattern>    the projects whose config `tags` hold a match (Nx's `tag:`)
+//   <dir>/<glob>     a name with a `/` outside a scope that names no project:
+//                    ./<dir>/<glob> (Nx's `--projects 'apps/*'`)
 //   <pattern>...     pattern + its transitive workspace dependencies
 //   ...<pattern>     pattern + its transitive workspace dependents
 //   <pattern>^...    only the transitive deps of pattern (excluding the matched package)
@@ -58,6 +60,11 @@ export interface ParsedFilter {
   exactDir?: true
   /** `tag:<pattern>`: `matcher` is a glob over the projects' tags, not their names. */
   tag?: true
+  /**
+   * `apps/*`: a name pattern holding a `/` outside a scope, read as
+   * `./apps/*` when it names no project, as Nx's `--projects` reads it.
+   */
+  dirFallback?: ParsedFilter
 }
 
 export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
@@ -187,6 +194,15 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     }
   }
 
+  // A package name holds a `/` only after its `@scope`, so `apps/*` is a
+  // directory for every project named after its package.json; Nx matches
+  // a `--projects` entry by name, then by root (find-matching-projects,
+  // 23.2.1), and `-p 'apps/*'` matched nothing here.
+  const dirFallback =
+    !isPath && s.includes('/') && !s.startsWith('@')
+      ? parseFilter(`./${s}`, workspaceRoot)
+      : undefined
+
   return {
     raw,
     negate,
@@ -196,6 +212,7 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     onlyDependents,
     isPath,
     matcher,
+    ...(dirFallback !== undefined ? { dirFallback } : {}),
     ...(pathGlob !== undefined ? { pathGlob, pathRoot: workspaceRoot } : {}),
     ...(pathGlobBase !== undefined ? { pathGlobBase } : {}),
     ...(gitSince !== undefined ? { gitSince } : {}),
@@ -278,6 +295,8 @@ function matchSelector(
   for (const p of projects) {
     if (re.test(p.name)) out.push(p.name)
   }
+  if (out.length === 0 && filter.dirFallback !== undefined)
+    return matchSelector(filter.dirFallback, projects, tags)
   if (out.length > 0 || filter.matcher.includes('/')) return out
   // pnpm's rule: the scope may be left out (`--filter core` is
   // `@babel/core`), an exact name only when one package carries it. Nx

package/src/workspace/lockfile.ts

@@ -152,7 +152,8 @@ export async function frozenProjectConfigs(
 ): Promise<ProjectConfig[]> {
   const entries = metas.map((meta) => {
     const rel = relPosix(root, meta.configPath)
-    const entry = lock.projects[meta.name]
+    // Own entries only: `constructor` read Object's, "locked" at undefined (D-152).
+    const entry = Object.hasOwn(lock.projects, meta.name) ? lock.projects[meta.name] : undefined
     if (entry !== undefined && entry.configPath !== rel) {
       // A renamed or moved config: "has no entry for a" named an entry the
       // lock holds, under its old path (D-88).

package/src/workspace/migrate-scripts.ts

@@ -429,7 +429,8 @@ function pmRunsMembers(script: string): boolean {
   return false
 }
 
-const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|[^\s;&|()]+)/g
+// A bare target may escape a space or paren (`cd packages/my\ app`).
+const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|(?:\\.|[^\s;&|()\\])+)/g
 
 /**
  * A `cd` into a member's directory, or one holding members, runs that
@@ -439,7 +440,8 @@ const CD = /(?:^|[\s;&|(])cd\s+("[^"]*"|'[^']*'|[^\s;&|()]+)/g
  */
 function cdsToMembers(script: string, rootDir: string, memberDirs: readonly string[]): boolean {
   for (const m of script.matchAll(CD)) {
-    const target = m[1]!.replace(/^(["'])(.*)\1$/, '$2')
+    const quoted = /^(["'])(.*)\1$/.exec(m[1]!)
+    const target = quoted ? quoted[2]! : m[1]!.replace(/\\(.)/g, '$1')
     if (/[$`~*?]/.test(target) || target === '-') return true
     const dir = path.resolve(rootDir, target)
     const inside = (a: string, b: string): boolean => a === b || a.startsWith(b + path.sep)
@@ -845,7 +847,7 @@ export function migrateScripts(
     const names = runnable.filter((n) => taskNameProblem(n) === null)
     if (meta !== rootMeta && !('build' in scripts)) {
       const hook = LIFECYCLE_BUILD_HOOKS.find(
-        (h) => typeof scripts[h] === 'string' && BUILDER.test(scripts[h] as string),
+        (h) => typeof scripts[h] === 'string' && BUILDER.test(scripts[h]),
       )
       if (hook !== undefined) lifecycleBuilds.push([meta.name, hook, scripts[hook] as string])
     }

package/src/workspace/migration.ts

@@ -406,7 +406,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
       : []
   if (empty && unreached.length > 0) {
     report.push(
-      `${verb}: ${unreachedHint(unreached)}`,
+      `${verb}: ${unreachedHint(unreached, root)}`,
       hasWorkspaceFile
         ? `${workspaceName} already exists.`
         : dry