@vzn/vx 0.0.596 → 0.0.597

package/src/orchestrator/summary.ts

@@ -264,7 +264,7 @@ export function formatSummarySection(
   let spread = ''
   if (stats.spread !== null && stats.spread.count > 0) {
     const { maxMs, minMs, sumMs, count } = stats.spread
-    spread = ` ${dim(`\u00b7 max ${formatDuration(maxMs)} \u00b7 avg ${formatDuration(sumMs / count)} \u00b7 min ${formatDuration(minMs)}`)}`
+    spread = ` ${dim(`\u00b7 max ${formatElapsed(maxMs)} \u00b7 avg ${formatElapsed(sumMs / count)} \u00b7 min ${formatElapsed(minMs)}`)}`
   }
   // Run-shape footer (final summary only): worker pool + cache mode,
   // grouped with time under a blank line below the meters.
@@ -280,15 +280,15 @@ export function formatSummarySection(
     // (2026-09-15), so the line says it is a sum.
     if (stats.held !== undefined && stats.held.count > 0) {
       info.push(
-        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatDuration(stats.held.sumMs)} in all`,
+        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatElapsed(stats.held.sumMs)} in all`,
       )
     }
-    lines.push('', row('info', join(info)), row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('info', join(info)), row('time', `${formatElapsed(totalMs)}${spread}`))
     // The run in one line, last, where the eye lands: what a Turbo user
     // reads first in its own summary (tasks, cached, time), in vx's words.
     if (stats.total > 0) lines.push(row('result', resultLine(stats, hits, totalMs, colors)))
   } else {
-    lines.push('', row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('time', `${formatElapsed(totalMs)}${spread}`))
   }
   return lines
 }
@@ -320,7 +320,7 @@ function resultLine(
         : `${hits} cached (${Math.floor((hits / cacheable) * 100)}%)`,
     )
   if (noCache > 0) parts.push(paint('', `${noCache} no-cache`, colors, { dim: true }))
-  parts.push(formatDuration(totalMs))
+  parts.push(formatElapsed(totalMs))
   return parts.join(` ${paint('', '\u00b7', colors, { dim: true })} `)
 }
 
@@ -426,7 +426,3 @@ export function neverStarted(
 ): boolean {
   return o.status === 'aborted' && o.wallclockStartNs === undefined
 }
-
-export function formatDuration(ms: number): string {
-  return formatElapsed(ms)
-}

package/src/orchestrator/task-hash.ts

@@ -16,8 +16,8 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { InputFile, TaskInputs } from '../exec/index.js'
-import type { TaskNode, TaskOutcome } from '../graph/index.js'
-import { span, relPosix, xxh3hex } from '../util/index.js'
+import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import { isUserError, relPosix, secretMask, span, UserError, xxh3hex } from '../util/index.js'
 import { expandGroupUpstream, filterUpstreamHashes } from './upstream.js'
 
 /**
@@ -296,6 +296,13 @@ async function resolveKeyInput(
           projectFilesCache: args.hashCache.projectFiles,
         }
       : {}),
+  }).catch((err: unknown) => {
+    // A failed probe's message quotes its command and output, and the probe
+    // runs in vx's own environment: `echo $NPM_TOKEN` printed the token in
+    // the task's stream and `--dry`'s stderr.
+    if (!isUserError(err)) throw err
+    const secrets = secretMask([process.env, cfg.exec?.env?.define], cfg.exec?.env?.secret)
+    throw secrets === null ? err : new UserError(secrets.mask(err.message))
   })
 
   const upstreamPairs = filterUpstreamHashes(
@@ -338,7 +345,10 @@ async function resolveKeyInput(
     fileHashes,
   )
 
-  const effectiveForwardArgs = args.node.requested ? (args.forwardArgs ?? []) : []
+  // Args after `--` reach a requested command; the default build (a keyed
+  // group) runs none, and folded, they moved every key that folds its own.
+  const effectiveForwardArgs =
+    args.node.requested && !isGroupTask(args.node) ? (args.forwardArgs ?? []) : []
 
   const input: CacheKeyInput = {
     taskId: args.node.id,

package/src/orchestrator/upstream.ts

@@ -28,6 +28,17 @@ export function keyUpstream(node: TaskNode, upstream: TaskOutcome[]): TaskOutcom
   return node.excludedUpstream === undefined ? keyed : [...keyed, ...node.excludedUpstream]
 }
 
+/** A dependency as a key reads it: only `node` and `hash` matter. */
+export function keyedOutcome(node: TaskNode, hash: string | undefined): TaskOutcome {
+  return {
+    node,
+    status: 'success',
+    exitCode: 0,
+    durationMs: 0,
+    ...(hash !== undefined ? { hash } : {}),
+  }
+}
+
 /** `node.deps` less its ordering-only edges: the dependencies a key may fold. */
 export function keyedDeps(node: TaskNode): readonly string[] {
   const order = node.orderOnly

package/src/util/hangup.ts

@@ -0,0 +1,42 @@
+// Did this process start with SIGHUP ignored? `nohup` and a supervisor
+// that wants a job to outlive its terminal say so through the inherited
+// disposition, and a `process.on('SIGHUP')` replaces it: vx under nohup
+// stopped its run and exited 129 when the terminal closed. The POSIX idiom
+// is to ask before installing; Node has no API for it, so Linux reads
+// `/proc/self/status` (self is this process in any pid namespace's procfs)
+// and macOS asks `sigaction` itself. Read once, before the first handler.
+
+import { readFileSync } from 'node:fs'
+import { dlopen, FFIType, ptr } from 'bun:ffi'
+
+let ignored: boolean | undefined
+
+export function hangupIgnored(): boolean {
+  ignored ??= read()
+  return ignored
+}
+
+function read(): boolean {
+  try {
+    if (process.platform === 'linux') {
+      const mask = /^SigIgn:\s*([0-9a-f]+)$/m.exec(readFileSync('/proc/self/status', 'utf8'))
+      return mask !== null && (BigInt(`0x${mask[1]}`) & 1n) === 1n
+    }
+    if (process.platform === 'darwin') return darwinIgnored()
+  } catch {}
+  return false
+}
+
+function darwinIgnored(): boolean {
+  // Opened only here: bun:ffi compiles a trampoline per call site, ~1 ms.
+  const lib = dlopen('/usr/lib/libSystem.B.dylib', {
+    sigaction: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+  })
+  try {
+    // `struct sigaction` opens with the handler; SIG_IGN is 1. SIGHUP is 1.
+    const old = new BigUint64Array(4)
+    return lib.symbols.sigaction(1, null, ptr(old)) === 0 && old[0] === 1n
+  } finally {
+    lib.close()
+  }
+}

package/src/util/index.ts

@@ -43,6 +43,7 @@ export {
   relPosix,
   splitNegations,
   staticPrefix,
+  stripTrailingSlash,
   anyTaskGlob,
   isInstalledPath,
   taskGlob,
@@ -72,6 +73,7 @@ export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
 export { executablePath, shellArgv, taskShell } from './which.js'
 export { procfsIsOwn } from './procfs.js'
+export { hangupIgnored } from './hangup.js'
 export { realPath } from './real-path.js'
 export {
   maskedCommand,

package/src/util/paths.ts

@@ -272,7 +272,7 @@ function regExpSource(pattern: string): string | null {
   return out
 }
 
-function stripTrailingSlash(p: string): string {
+export function stripTrailingSlash(p: string): string {
   return p.replace(/\/+$/, '')
 }
 

package/src/workspace/affected.ts

@@ -84,7 +84,10 @@ export interface AffectedArgs {
    * (item 954). The `--affected` sugar's graph walk has already staged every
    * config, so there it costs nothing more.
    */
-  workspaceGlobOwners?: (changedPaths: readonly string[]) => Promise<Iterable<string>>
+  workspaceGlobOwners?: (
+    changedPaths: readonly string[],
+    nested: readonly string[],
+  ) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
    * answer for a change to one. Resolved lazily: loading the workspace
@@ -142,6 +145,12 @@ export interface AffectedChanges {
   /** Project → its changed paths, relative to the project's directory. */
   paths: ReadonlyMap<string, readonly string[]>
   whole: ReadonlySet<string>
+  /**
+   * The changed paths that are nested repositories (a submodule, an
+   * embedded repository), workspace-relative: each stands for every file
+   * in it, so a `workspaceFiles` glob that reaches under one is reached.
+   */
+  nested?: readonly string[]
 }
 
 export async function affectedChanges(
@@ -221,16 +230,10 @@ export async function affectedChanges(
     // submodules (`diff.ignoreSubmodules`, `submodule.<name>.ignore`), and
     // then an edit inside one, or a committed bump, was no change here while
     // the task's key moved (item 951).
-    gitPaths(args.workspaceRoot, [
-      'diff',
-      '--no-renames',
-      '--ignore-submodules=none',
-      '--relative',
-      '--name-only',
-      '-z',
-      '--end-of-options',
-      base,
-    ]),
+    //
+    // `--raw` for each path's mode: a gitlink (160000) is a nested
+    // repository, one path standing for every file in it (`nested` below).
+    gitDiffPaths(args.workspaceRoot, base),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
@@ -244,9 +247,13 @@ export async function affectedChanges(
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
-  const changed = [...diffed, ...untracked.filter((s) => !isInstalledPath(s))].filter(
+  const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
     (s) => s !== LOCKFILE_NAME,
   )
+  // The nested repositories git reports as one path: a gitlink, or an
+  // untracked embedded repository (`dir/`, the only path git prints so).
+  const nested = new Set(diffed.gitlinks)
+  for (const rel of untracked) if (rel.endsWith('/')) nested.add(rel)
 
   // A lockfile or workspace-definition change re-keys EVERY task, because the
   // workspace fingerprint folds those files into every cache key. Mapping
@@ -316,6 +323,7 @@ export async function affectedChanges(
   const owned = projectsContaining(
     args.workspaceRoot,
     changed,
+    nested,
     args.projects,
     realDirs,
     perTask
@@ -371,15 +379,21 @@ export async function affectedChanges(
     projects: args.projects,
     changed,
     skip: perTask ? new Set() : owned,
-    realDirs,
   })) {
     owned.add(name)
     whole.add(name)
   }
 
-  const done = (): AffectedChanges => ({ projects: owned, changed, paths, whole })
+  const nestedDirs = [...nested].map((rel) => rel.replace(/\/$/, ''))
+  const done = (): AffectedChanges => ({
+    projects: owned,
+    changed,
+    paths,
+    whole,
+    ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
+  })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
-  for (const name of await args.workspaceGlobOwners(changed)) owned.add(name)
+  for (const name of await args.workspaceGlobOwners(changed, nestedDirs)) owned.add(name)
   return done()
 }
 
@@ -645,6 +659,37 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
   return stdout.split('\0').filter((s) => s.length > 0)
 }
 
+/**
+ * `git diff --raw -z <base>`'s paths, and those that are a gitlink on
+ * either side: one the change removed took its files with it. Each record
+ * is `:<mode> <mode> <oid> <oid> <status>` then its path (one path:
+ * `--no-renames`).
+ */
+async function gitDiffPaths(
+  workspaceRoot: string,
+  base: string,
+): Promise<{ paths: string[]; gitlinks: string[] }> {
+  const fields = await gitPaths(workspaceRoot, [
+    'diff',
+    '--no-renames',
+    '--ignore-submodules=none',
+    '--relative',
+    '--raw',
+    '-z',
+    '--end-of-options',
+    base,
+  ])
+  const paths: string[] = []
+  const gitlinks: string[] = []
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    const rel = fields[i + 1]!
+    paths.push(rel)
+    const head = fields[i]!
+    if (head.startsWith('160000 ', 1) || head.startsWith('160000 ', 8)) gitlinks.push(rel)
+  }
+  return { paths, gitlinks }
+}
+
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
@@ -826,17 +871,11 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   )
 }
 
-function isDirectory(abs: string): boolean {
-  try {
-    return statSync(abs).isDirectory()
-  } catch {
-    return false
-  }
-}
-
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
+  /** The changed paths that are nested repositories (`nested` in `affectedChanges`). */
+  nested: ReadonlySet<string>,
   projects: readonly ProjectMeta[],
   realDirs: ReadonlyMap<string, string>,
   /** Told each owned path relative to its project, and each nested repository's projects. */
@@ -868,37 +907,35 @@ function projectsContaining(
   }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
+    const repo = nested.has(rel)
     let dir = path.resolve(workspaceRoot, rel).normalize('NFC')
-    let hit = false
     for (;;) {
       const name = dirToName.get(dir)
       if (name !== undefined) {
         owned.add(name)
         on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')))
-        hit = true
+        // Its files are the project's inputs, and none of them is this
+        // path: a task's globs cannot say whether they reach inside.
+        if (repo) on?.repo(name)
         break
       }
       const parent = path.dirname(dir)
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
-    if (hit) continue
-    // A changed path that is a DIRECTORY on disk is a nested repository —
-    // a submodule whose checkout moved or is dirty (`vendor/sub`), an
-    // embedded repository left untracked (`vendor/nested/`) — because git
-    // reports nothing else as a directory. The workspace repository sees
-    // the nested one as that single path, so a change inside is a change
-    // to it, and every project under it is affected. Its own enumeration
-    // already keys those projects on their files (git-inputs.ts); without
-    // this, `--affected` after an edit inside selected none of them.
-    const abs = path.resolve(workspaceRoot, rel)
-    if (isDirectory(abs)) {
-      const prefix = abs.normalize('NFC') + path.sep
-      for (const [dir, name] of dirToName) {
-        if (!dir.startsWith(prefix)) continue
-        owned.add(name)
-        on?.repo(name)
-      }
+    if (!repo) continue
+    // A submodule whose checkout moved or is dirty (`vendor/sub`), an
+    // embedded repository left untracked (`vendor/nested/`): the workspace
+    // repository sees the nested one as that single path, so a change
+    // inside is a change to it, and every project under it is affected.
+    // Its own enumeration already keys those projects on their files
+    // (git-inputs.ts); without this, `--affected` after an edit inside
+    // selected none of them.
+    const prefix = path.resolve(workspaceRoot, rel).normalize('NFC') + path.sep
+    for (const [dir, name] of dirToName) {
+      if (!dir.startsWith(prefix)) continue
+      owned.add(name)
+      on?.repo(name)
     }
   }
   return owned

package/src/workspace/config-eval.ts

@@ -185,12 +185,16 @@ self.onmessage = async (e) => {
         : thrown
     const report = changed()
     umaskBack()
+    // A thrown string or plain object has no message, and String() of a
+    // null-prototype object throws here, inside the catch.
+    const isError = err !== null && typeof err === 'object' && typeof err.message === 'string'
     postMessage({
       id,
       ok: false,
-      name: err?.name ?? 'Error',
-      message: err?.message ?? String(err),
-      stack: err?.stack ?? null,
+      thrown: isError ? null : globalThis.Bun.inspect(err, { compact: true }),
+      name: isError ? (err.name ?? 'Error') : 'Error',
+      message: isError ? err.message : '',
+      stack: isError ? (err.stack ?? null) : null,
       changed: report,
       position:
         err?.position && typeof err.position === 'object'
@@ -214,6 +218,8 @@ interface WorkerReply {
   nonJson: NonJsonValue[]
   name: string
   message: string
+  /** What a config threw that is not an Error, as `thrownValueMessage` shows it; null for an Error. */
+  thrown?: string | null
   stack: string | null
   /** A transpile error's location — `BuildMessage.position`, trimmed to what the loader reads. */
   position: { file?: string; line?: number; column?: number } | null
@@ -222,6 +228,16 @@ interface WorkerReply {
 interface Pending {
   resolve: (reply: WorkerReply) => void
   reject: (err: Error) => void
+  configPath: string
+}
+
+/**
+ * A config threw something that is not an Error: `throw 'no'` printed
+ * `vx: no`, naming no file, and a null-prototype object crashed vx's own
+ * error printer with a stack.
+ */
+export function thrownValueMessage(kind: string, configPath: string, shown: string): string {
+  return `${kind} config ${configPath} threw ${shown}, which is not an Error`
 }
 
 /**
@@ -236,10 +252,11 @@ export function evalBudgetMs(): number {
   // BOUND on a worker that may be wedged, with no "no limit" reading. Falls
   // back rather than clamping, because honouring ~24.8 days would hang
   // `vx watch` forever on a worker the OS killed — and unbounded makes it 1 ms,
-  // so EVERY config load times out instead. Both ends break the same feature.
+  // so EVERY config load times out instead. Both ends break the same feature,
+  // and `0` is the second end: it fired on the next tick (D-157).
   if (raw !== undefined && /^[0-9]+$/.test(raw)) {
     const n = Number(raw)
-    if (n <= MAX_TIMEOUT_MS) return n
+    if (n > 0 && n <= MAX_TIMEOUT_MS) return n
   }
   return 30_000
 }
@@ -287,6 +304,10 @@ function acquireWorker(): Worker {
       p.resolve(msg)
       return
     }
+    if (typeof msg.thrown === 'string') {
+      p.reject(new UserError(thrownValueMessage('Project', p.configPath, msg.thrown)))
+      return
+    }
     // Rebuild the error the config actually threw. Name, message, stack
     // and a transpile error's position all survive the hop, so a broken
     // config reports the same text it would from an in-process import.
@@ -365,7 +386,7 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
     // evaluation costs, so it can only fire on a genuine wedge.
     const budget = evalBudgetMs()
     const reply = await new Promise<WorkerReply>((resolve, reject) => {
-      pending.set(id, { resolve, reject })
+      pending.set(id, { resolve, reject, configPath })
       timer = setTimeout(() => {
         rejectAll(new Error(`config worker did not answer within ${budget}ms`))
         if (worker !== null) {

package/src/workspace/config-imports.ts

@@ -20,13 +20,13 @@
 //     the lockfile moves, which the workspace fingerprint already covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
-//   - Descend only through files owned by NO project, by a ROOT project
-//     (whose own files are the shared tooling that is otherwise unowned,
-//     D-41), or by the importing file's own project. A config reaching into another project (say a site's
-//     `vx.config.ts` importing `../core/src/index.ts`) records that edge
-//     and STOPS there — following it would drag substantially all of that
-//     project's `src/` into the closure, and the containment channel
-//     already selects the project that owns it.
+//   - One reversed BFS from every config at once, each file read once
+//     however many configs reach it. It descends through every file in
+//     the workspace, another project's included: a site's `vx.config.ts`
+//     importing `../core/src/index.ts` evaluates what that file imports
+//     too, so an edit there moves the site's key. The walk stopped at the
+//     first file of another project, and containment selected core alone
+//     while the site's key moved (X-128).
 
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
@@ -393,32 +393,6 @@ export interface ConfigImportOwnersArgs {
   changed: readonly string[]
   /** Already-selected projects; their configs need no scan. */
   skip: ReadonlySet<string>
-  /**
-   * Each project dir's realpath, when the caller already has them: the
-   * containment pass needs the same answers, and asking twice cost 5,000
-   * realpaths at 5,000 projects (D-24).
-   */
-  realDirs?: ReadonlyMap<string, string>
-}
-
-/**
- * Project dir → name, REALPATH'D — which is why this cannot reuse the index
- * the containment pass builds. `Bun.resolveSync` hands back realpath'd
- * targets, and on darwin a workspace under `os.tmpdir()` lives at
- * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
- * the two matches nothing and fails exactly like "found no imports".
- */
-async function realDirIndex(
-  projects: readonly ProjectMeta[],
-  known: ReadonlyMap<string, string> | undefined,
-): Promise<Map<string, string>> {
-  const out = new Map<string, string>()
-  await Promise.all(
-    projects.map(async (p) => {
-      out.set(known?.get(p.dir) ?? (await realpath(p.dir).catch(() => p.dir)), p.name)
-    }),
-  )
-  return out
 }
 
 const TS_EXT = new Set(['.ts', '.mts', '.cts'])
@@ -426,18 +400,6 @@ const TS_EXT = new Set(['.ts', '.mts', '.cts'])
 /** The extensions Bun tries for a specifier that names none. */
 const RESOLVED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']
 
-/** The deepest project containing `file`, or undefined when none does. */
-function ownerOf(file: string, dirToName: ReadonlyMap<string, string>): string | undefined {
-  let dir = path.dirname(file)
-  for (;;) {
-    const name = dirToName.get(dir)
-    if (name !== undefined) return name
-    const parent = path.dirname(dir)
-    if (parent === dir) return undefined
-    dir = parent
-  }
-}
-
 /** Projects whose config file transitively imports one of `changed`. */
 export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set<string>> {
   const selected = new Set<string>()
@@ -453,10 +415,6 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
     }),
   )
   if (roots.size === 0) return selected
-  const dirToName = await realDirIndex(a.projects, a.realDirs)
-  // A root project owns every file no member owns: the shared tooling the
-  // walk descends through when the root is no project (D-41).
-  const rootOwner = dirToName.get(workspaceRoot)
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
@@ -486,18 +444,13 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
-      const from = ownerOf(file, dirToName)
       for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)
         if (list) list.push(file)
         else importedBy.set(target, [file])
-        // Descend ONLY through unowned files, the root project's own, or
-        // the importer's own project's (a config split into `./tasks.mjs`
-        // that imports shared tooling): see the header.
-        const owner = ownerOf(target, dirToName)
-        if (owner === undefined || owner === rootOwner || owner === from) frontier.push(target)
+        frontier.push(target)
       }
     }
   }

package/src/workspace/config-schema.ts

@@ -76,6 +76,16 @@ function validateRules(rules: unknown, configPath: string): void {
 
 const RETENTION_FIELDS = new Set(['olderThan', 'maxSize'])
 
+/**
+ * A refused value as a message quotes it. A workspace file is evaluated
+ * in-process and no JSON rule precedes its schema, so a value here may be
+ * one `JSON.stringify` throws on (`30n`) or drops (a symbol): the refusal
+ * became a TypeError with a stack.
+ */
+function shown(v: unknown): string {
+  return typeof v === 'bigint' ? `${v}n` : (JSON.stringify(v) ?? String(v))
+}
+
 function validateRetention(retention: unknown, configPath: string): void {
   const where = `${configPath}: \`cacheRetention\``
   const field = (key: string) => `${configPath}: \`cacheRetention.${key}\``
@@ -93,12 +103,12 @@ function validateRetention(retention: unknown, configPath: string): void {
     (typeof olderThan !== 'string' || parseDuration(olderThan) === null)
   ) {
     throw new UserError(
-      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${JSON.stringify(olderThan)})`,
+      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${shown(olderThan)})`,
     )
   }
   if (maxSize !== undefined && (typeof maxSize !== 'string' || parseSize(maxSize) === null)) {
     throw new UserError(
-      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${JSON.stringify(maxSize)})`,
+      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${shown(maxSize)})`,
     )
   }
   // The bounds `vx cache prune` refuses, for the same reason: each evicts
@@ -179,7 +189,7 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       throw new UserError(`${configPath}: \`plugins\` must be an array of plugin objects`)
     }
     const verbOwners = new Map<string, string>()
-    const fileClaimants = new Map<string, string>()
+    const fileClaimants = new Map<string, { name: string; at: number }>()
     for (const [i, p] of config.plugins.entries()) {
       if (p === null || typeof p !== 'object') {
         // Nx's nx.json lists plugins by module name (`'@nx/vite/plugin'`);
@@ -199,6 +209,13 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       // one whose `name` was overwritten after the stamp, is refused here —
       // the one boundary every plugin crosses.
       const pkg = (p as Record<symbol, unknown>)[PLUGIN_PACKAGE]
+      // An async factory called without `await` was told its plugin did not
+      // come from definePlugin — it had (D-159).
+      if (pkg === undefined && typeof (p as { then?: unknown }).then === 'function') {
+        throw new UserError(
+          `${configPath}: \`plugins[${i}]\` is a Promise — await the factory that returns the plugin`,
+        )
+      }
       if (typeof pkg !== 'string' || pkg.length === 0) {
         throw new UserError(
           `${configPath}: \`plugins[${i}]\` must come from definePlugin(import.meta, { … }) — a plugin's name is its package name`,
@@ -317,16 +334,23 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
             /[/\\]/.test(file)
           ) {
             throw new UserError(
-              `${configPath}: plugin '${plug.name}' claims fingerprint file ${JSON.stringify(file)}, which is not a file name at the workspace root`,
+              `${configPath}: plugin '${plug.name}' claims fingerprint file ${shown(file)}, which is not a file name at the workspace root`,
             )
           }
           const owner = fileClaimants.get(file)
+          // One package twice (`plugins: [bun(), bun()]`) read "plugins 'x'
+          // and 'x' both claim" (D-158).
+          if (owner !== undefined && owner.name === plug.name) {
+            throw new UserError(
+              `${configPath}: plugin '${plug.name}' claims fingerprint file '${file}' twice (plugins[${owner.at}] and plugins[${i}]) — a file has one claimant; declare the plugin once`,
+            )
+          }
           if (owner !== undefined) {
             throw new UserError(
-              `${configPath}: plugins '${owner}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
+              `${configPath}: plugins '${owner.name}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
             )
           }
-          fileClaimants.set(file, plug.name)
+          fileClaimants.set(file, { name: plug.name, at: i })
         }
       }
       // A plugin must contribute at least one capability or lifecycle hook

package/src/workspace/lockfile.ts

@@ -152,7 +152,8 @@ export async function frozenProjectConfigs(
 ): Promise<ProjectConfig[]> {
   const entries = metas.map((meta) => {
     const rel = relPosix(root, meta.configPath)
-    const entry = lock.projects[meta.name]
+    // Own entries only: `constructor` read Object's, "locked" at undefined (D-152).
+    const entry = Object.hasOwn(lock.projects, meta.name) ? lock.projects[meta.name] : undefined
     if (entry !== undefined && entry.configPath !== rel) {
       // A renamed or moved config: "has no entry for a" named an entry the
       // lock holds, under its old path (D-88).