@vzn/vx 0.0.596 → 0.0.598

package/src/orchestrator/run-lock.ts

@@ -43,7 +43,8 @@
 // waited for itself forever (nx#36473 reproduced on vx, 2026-09-24). So a
 // lock naming OUR pid is stale unless this process placed that entry and
 // has not left it (`placed`) — and on Linux the entry also carries the holder's start
-// time, so a pid another process now wears is stale too. Where the lock
+// time, so a pid another process now wears is stale too, and so is a
+// holder procfs shows as a zombie (killed, not yet reaped). Where the lock
 // cannot be made or read for any reason but "held" (a temp directory this
 // user cannot write), the run says so once and proceeds unlocked: the
 // lock is a courtesy between cooperating runs, and refusing to run would
@@ -65,7 +66,8 @@ import { rmdirSync, unlinkSync } from 'node:fs'
 import { mkdir, readdir, readFile, rename, rm, rmdir, unlink, writeFile } from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
-import { isTmpdirRefusal, procfsIsOwn, TMPDIR_HINT, xxh3hex } from '../util/index.js'
+import { VX_RUN_TASK_ENV, VX_RUN_WORKSPACE_ENV } from '../exec/index.js'
+import { isTmpdirRefusal, procfsIsOwn, TMPDIR_HINT, UserError, xxh3hex } from '../util/index.js'
 
 /** Runs in this process currently holding the lock, per lock directory. */
 const heldHere = new Map<string, number>()
@@ -183,7 +185,7 @@ function ownLockRoot(lockDir: string): void {
 
 interface Holder {
   pid: number
-  /** The holder's start time as `startTime` read it; null where the lock names none. */
+  /** The holder's start time as `procStat` read it; null where the lock names none. */
   start: string | null
   /** The entry in the lock directory that names it. */
   entry: string
@@ -223,17 +225,18 @@ async function holder(lockDir: string): Promise<Holder | 'free' | null> {
 }
 
 /**
- * When a process started, in clock ticks since boot: field 22 of
- * `/proc/<pid>/stat`. Two processes that wore one pid differ here. Null
- * off Linux, where the answer costs a `ps` spawn per run, under a procfs
- * mounted for another pid namespace, and for a pid procfs does not show.
+ * `/proc/<pid>/stat` from field 3 on: the state first, and at [19] field
+ * 22, the start time in clock ticks since boot, where two processes that
+ * wore one pid differ. Null off Linux, where the answer costs a `ps`
+ * spawn, under a procfs mounted for another pid namespace, and for a pid
+ * procfs does not show.
  */
-function startTime(pid: number | 'self'): string | null {
+function procStat(pid: number | 'self'): string[] | null {
   if (!procfsIsOwn()) return null
   try {
     const stat = readFileSync(`/proc/${pid}/stat`, 'utf8')
     // Fields after the LAST ')' start at field 3; comm may hold spaces.
-    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null
+    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')
   } catch {
     return null
   }
@@ -244,21 +247,24 @@ let ownId: string | undefined
 /** Tells this process's takings of a lock apart, and their staging names. */
 let takings = 0
 function nextEntry(): string {
-  ownId ??= `h-${process.pid}-${startTime('self') ?? 'x'}`
+  ownId ??= `h-${process.pid}-${procStat('self')?.[19] ?? 'x'}`
   return `${ownId}-${++takings}`
 }
 
 /**
- * Is the lock's holder a live run of another process? `sameAsLast`: this
- * holder's start time already matched on an earlier poll, so a wait reads
- * procfs once per holder, not once per poll.
+ * Is the lock's holder a live run of another process? Read on every poll:
+ * a holder killed whose parent does not reap it (a container's pid 1 that
+ * never waits) is a zombie, which signal 0 still reaches and whose start
+ * time still matches, and a wait that trusted either waited for it until
+ * the reaper came, or for good.
  */
-function holderLive(h: Holder, sameAsLast: boolean): boolean {
+function holderLive(h: Holder): boolean {
   if (h.pid === process.pid) return placed.has(h.entry)
   if (!alive(h.pid)) return false
-  if (h.start === null || sameAsLast) return true
-  const now = startTime(h.pid)
-  return now === null || now === h.start
+  const stat = procStat(h.pid)
+  if (stat === null) return true
+  if (stat[0] === 'Z' || stat[0] === 'X') return false
+  return h.start === null || stat[19] === h.start
 }
 
 function alive(pid: number): boolean {
@@ -324,9 +330,16 @@ export async function acquireRunLock(
   opts: RunLockOptions,
 ): Promise<() => Promise<void>> {
   const lockDir = runLockPath(workspaceRoot, opts.dir)
+  // A task's own process (`vx cache prune` in a task) would wait for the
+  // run that started it, which holds the lock until that task ends.
+  const outer = process.env[VX_RUN_WORKSPACE_ENV]
+  if (outer !== undefined && runLockPath(outer, opts.dir) === lockDir) {
+    throw new UserError(
+      `this vx runs inside task ${process.env[VX_RUN_TASK_ENV] ?? '<unknown>'} of a vx run on this workspace, which holds its run lock until it ends — run it before or after that run, not from one of its tasks`,
+    )
+  }
   const started = Date.now()
   let said = false
-  let lastLive: Holder | undefined
   const release = async (): Promise<void> => {
     const left = (heldHere.get(lockDir) ?? 1) - 1
     if (left > 0) {
@@ -377,7 +390,7 @@ export async function acquireRunLock(
           await rm(lockDir, { recursive: true, force: true })
           continue
         }
-      } else if (!holderLive(h, lastLive?.entry === h.entry && lastLive.start === h.start)) {
+      } else if (!holderLive(h)) {
         if (h.entry === LEGACY_PID) await rm(lockDir, { recursive: true, force: true })
         else await leave(lockDir, h.entry)
         continue
@@ -391,12 +404,9 @@ export async function acquireRunLock(
       )
       return async () => {}
     }
-    if (h !== null) {
-      lastLive = h
-      if (!said && Date.now() - started >= SAY_AFTER_MS) {
-        said = true
-        opts.log(`[vx] waiting for another vx run (pid ${h.pid}) on this workspace to finish…`)
-      }
+    if (h !== null && !said && Date.now() - started >= SAY_AFTER_MS) {
+      said = true
+      opts.log(`[vx] waiting for another vx run (pid ${h.pid}) on this workspace to finish…`)
     }
     await Bun.sleep(POLL_MS)
   }

package/src/orchestrator/run.ts

@@ -631,6 +631,7 @@ async function runOnBus(
       stopRun.abort(signal)
     },
     done: runLeft,
+    handsTerminal: holders.size > 0,
     // The grace, then one flush and each teardown at their own bound, and
     // slack for the summary and the cache close.
     boundMs:
@@ -1762,7 +1763,7 @@ function flakyCandidates(outcomes: readonly TaskOutcome[]): FlakyCandidate[] {
   const out: FlakyCandidate[] = []
   for (const o of outcomes) {
     if (o.status !== 'success' && o.status !== 'failed') continue
-    // "Same inputs, different outcome" is a claim only a task with declared
+    // "Same inputs, failed after passing" is a claim only a task with declared
     // inputs can make: a task with no `cache` block keys on its config alone
     // and runs every time, so one bad network day would read as a flake for
     // thirty days. Groups do no work.

package/src/orchestrator/sandbox-request.ts

@@ -326,8 +326,11 @@ export interface WithheldLink {
  * task is granted and what it is not.
  *
  * One level deep, plus one level inside a `@scope/` directory — the shape
- * a package manager writes. Anything already inside a granted directory
- * is dropped; what is left is a sibling project's real path.
+ * a package manager writes — and then the same in the `node_modules` of
+ * each granted target, so a dependency's own workspace dependencies are
+ * reached as the runtime reaches them. A target inside the granted
+ * `node_modules` or inside the package holding the link is dropped; what
+ * is left is a sibling project's real path.
  *
  * A link to the task's OWN project, or to a directory holding it, is
  * dropped too: npm and Yarn classic link every workspace package at the
@@ -371,20 +374,39 @@ async function linkedDeps(
     }
     return found
   }
+  const keyedDirs =
+    keyed === undefined ? undefined : new Set(await Promise.all([...keyed].map((d) => realpath(d))))
+  const grants = (target: string): boolean =>
+    keyedDirs === undefined || !atOrUnder(target, root) || keyedDirs.has(target)
   // Merged in `dirs` order, so the link a hint names is the project's own
-  // when both have one.
+  // when both have one. A granted package is scanned in turn: pnpm and
+  // Bun link a dependency's own workspace dependencies only under ITS
+  // `node_modules`, so `app -> ui -> core` left core hidden and the import
+  // of ui failed with ENOENT, unreported.
   const targets = new Map<string, { link: string; name: string }>()
-  for (const found of await Promise.all(dirs.map((d) => scan(d, '')))) {
-    for (const [target, link, name] of found) {
-      if (!targets.has(target)) targets.set(target, { link, name })
+  let frontier: Array<[nodeModules: string, owner: string | undefined]> = dirs.map((d) => [
+    d,
+    undefined,
+  ])
+  while (frontier.length > 0) {
+    const next: typeof frontier = []
+    const scans = await Promise.all(frontier.map(([d]) => scan(d, '')))
+    for (const [i, found] of scans.entries()) {
+      const owner = frontier[i]![1]
+      for (const [target, link, name] of found) {
+        if (targets.has(target) || (owner !== undefined && atOrUnder(target, owner))) continue
+        targets.set(target, { link, name })
+        if (grants(target)) {
+          next.push([path.join(target, 'node_modules'), target])
+        }
+      }
     }
+    frontier = next
   }
-  if (keyed === undefined) return { granted: [...targets.keys()], withheld: [] }
-  const keyedDirs = new Set(await Promise.all([...keyed].map((d) => realpath(d))))
   const granted: string[] = []
   const withheld: WithheldLink[] = []
   for (const [target, { link, name }] of targets) {
-    if (!atOrUnder(target, root) || keyedDirs.has(target)) granted.push(target)
+    if (grants(target)) granted.push(target)
     else
       withheld.push({
         dir: target,

package/src/orchestrator/signals.ts

@@ -2,8 +2,8 @@
 // — the scheduler dispatches nothing more, and the signal is forwarded to
 // everything live, SIGKILLed after a bounded grace — then waits, bounded,
 // for run() to leave its own end-of-run path (telemetry flush, each
-// plugin's teardown, the cache close), and exits 128+signo (130/143). A
-// second signal exits at once. Without the forward, a
+// plugin's teardown, the cache close), and dies of the signal (130/143 to
+// its parent). A second signal does so at once. Without the forward, a
 // programmatic signal to the vx process alone (CI cancellation,
 // `kill <pid>`) orphans every running child — terminal Ctrl-C only worked
 // via process-group propagation. Without the escalation (added
@@ -14,7 +14,7 @@
 // them to the runner around every spawn.
 
 import { signalExitCode } from '../exec/index.js'
-import { claimExitForSignal, killGraceMs, settleWithin } from '../util/index.js'
+import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
 import type { Logger } from './logger.js'
 
@@ -111,6 +111,13 @@ export function forwardSignals(args: {
   done: Promise<void>
   /** How long a signal waits for `done` before it exits anyway. */
   boundMs: number
+  /**
+   * A task may be handed the terminal (`exec.interactive` on a TTY) and may
+   * leave it raw or without echo. Bun puts back the terminal it started
+   * with when it exits, not when a signal kills it, so this run exits with
+   * the signal's code rather than dying of the signal.
+   */
+  handsTerminal?: boolean
   /** In-flight children; the runner adds and removes each around its spawn. */
   liveChildren: ReadonlySet<Child>
   /** Ready persistent tasks the orchestrator owns until the graph finishes. */
@@ -124,6 +131,16 @@ export function forwardSignals(args: {
     } catch {
       // double-close race with the normal path; we're exiting anyway
     }
+    // Die of the signal once the exit hooks have run: a shell running vx
+    // in a script stops it on Ctrl-C only when its child died of SIGINT,
+    // and a 130 exit ran the script's next line. The code stays the
+    // fallback should the signal not land.
+    if (args.handsTerminal !== true) {
+      process.once('exit', () => {
+        process.removeAllListeners(signal)
+        process.kill(process.pid, signal)
+      })
+    }
     process.exit(signalExitCode(signal))
   }
   let stopping: StopSignal | undefined
@@ -158,7 +175,8 @@ export function forwardSignals(args: {
   if (args.enabled) {
     process.on('SIGINT', onSigint)
     process.on('SIGTERM', onSigterm)
-    process.on('SIGHUP', onSighup)
+    // A hang-up vx was started deaf to (nohup) stays ignored.
+    if (!hangupIgnored()) process.on('SIGHUP', onSighup)
   }
   return {
     remove: () => {

package/src/orchestrator/stable-keys.ts

@@ -17,7 +17,7 @@ import { isLiteralPattern, normalizeGlob, relPosix } from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
 import { foldedDeps } from './keyed-projects.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyUpstream } from './upstream.js'
+import { filterUpstreamHashes, keyedOutcome, keyUpstream } from './upstream.js'
 
 export interface DeriveStableKeysArgs {
   nodes: Map<string, TaskNode>
@@ -382,9 +382,7 @@ function foldedBy(
 }
 
 /**
- * Synthetic upstream outcomes for key derivation. Only `node` + `hash`
- * are read by filterUpstreamHashes / computeGroupHash; the rest of
- * TaskOutcome is irrelevant here, so we cast a minimal shape.
+ * Synthetic upstream outcomes for key derivation (`keyedOutcome`).
  */
 function synthUpstream(
   node: TaskNode,
@@ -395,13 +393,7 @@ function synthUpstream(
   for (const dep of node.deps) {
     const depNode = nodes.get(dep)
     if (!depNode) continue
-    out.push({
-      node: depNode,
-      status: 'success',
-      exitCode: 0,
-      durationMs: 0,
-      hash: keyById.get(dep),
-    } as TaskOutcome)
+    out.push(keyedOutcome(depNode, keyById.get(dep)))
   }
   return keyUpstream(node, out)
 }

package/src/orchestrator/summary.ts

@@ -264,7 +264,7 @@ export function formatSummarySection(
   let spread = ''
   if (stats.spread !== null && stats.spread.count > 0) {
     const { maxMs, minMs, sumMs, count } = stats.spread
-    spread = ` ${dim(`\u00b7 max ${formatDuration(maxMs)} \u00b7 avg ${formatDuration(sumMs / count)} \u00b7 min ${formatDuration(minMs)}`)}`
+    spread = ` ${dim(`\u00b7 max ${formatElapsed(maxMs)} \u00b7 avg ${formatElapsed(sumMs / count)} \u00b7 min ${formatElapsed(minMs)}`)}`
   }
   // Run-shape footer (final summary only): worker pool + cache mode,
   // grouped with time under a blank line below the meters.
@@ -280,15 +280,15 @@ export function formatSummarySection(
     // (2026-09-15), so the line says it is a sum.
     if (stats.held !== undefined && stats.held.count > 0) {
       info.push(
-        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatDuration(stats.held.sumMs)} in all`,
+        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatElapsed(stats.held.sumMs)} in all`,
       )
     }
-    lines.push('', row('info', join(info)), row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('info', join(info)), row('time', `${formatElapsed(totalMs)}${spread}`))
     // The run in one line, last, where the eye lands: what a Turbo user
     // reads first in its own summary (tasks, cached, time), in vx's words.
     if (stats.total > 0) lines.push(row('result', resultLine(stats, hits, totalMs, colors)))
   } else {
-    lines.push('', row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('time', `${formatElapsed(totalMs)}${spread}`))
   }
   return lines
 }
@@ -320,7 +320,7 @@ function resultLine(
         : `${hits} cached (${Math.floor((hits / cacheable) * 100)}%)`,
     )
   if (noCache > 0) parts.push(paint('', `${noCache} no-cache`, colors, { dim: true }))
-  parts.push(formatDuration(totalMs))
+  parts.push(formatElapsed(totalMs))
   return parts.join(` ${paint('', '\u00b7', colors, { dim: true })} `)
 }
 
@@ -426,7 +426,3 @@ export function neverStarted(
 ): boolean {
   return o.status === 'aborted' && o.wallclockStartNs === undefined
 }
-
-export function formatDuration(ms: number): string {
-  return formatElapsed(ms)
-}

package/src/orchestrator/task-hash.ts

@@ -16,8 +16,8 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { InputFile, TaskInputs } from '../exec/index.js'
-import type { TaskNode, TaskOutcome } from '../graph/index.js'
-import { span, relPosix, xxh3hex } from '../util/index.js'
+import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import { isUserError, relPosix, secretMask, span, UserError, xxh3hex } from '../util/index.js'
 import { expandGroupUpstream, filterUpstreamHashes } from './upstream.js'
 
 /**
@@ -296,6 +296,13 @@ async function resolveKeyInput(
           projectFilesCache: args.hashCache.projectFiles,
         }
       : {}),
+  }).catch((err: unknown) => {
+    // A failed probe's message quotes its command and output, and the probe
+    // runs in vx's own environment: `echo $NPM_TOKEN` printed the token in
+    // the task's stream and `--dry`'s stderr.
+    if (!isUserError(err)) throw err
+    const secrets = secretMask([process.env, cfg.exec?.env?.define], cfg.exec?.env?.secret)
+    throw secrets === null ? err : new UserError(secrets.mask(err.message))
   })
 
   const upstreamPairs = filterUpstreamHashes(
@@ -338,7 +345,10 @@ async function resolveKeyInput(
     fileHashes,
   )
 
-  const effectiveForwardArgs = args.node.requested ? (args.forwardArgs ?? []) : []
+  // Args after `--` reach a requested command; the default build (a keyed
+  // group) runs none, and folded, they moved every key that folds its own.
+  const effectiveForwardArgs =
+    args.node.requested && !isGroupTask(args.node) ? (args.forwardArgs ?? []) : []
 
   const input: CacheKeyInput = {
     taskId: args.node.id,

package/src/orchestrator/upstream.ts

@@ -28,6 +28,17 @@ export function keyUpstream(node: TaskNode, upstream: TaskOutcome[]): TaskOutcom
   return node.excludedUpstream === undefined ? keyed : [...keyed, ...node.excludedUpstream]
 }
 
+/** A dependency as a key reads it: only `node` and `hash` matter. */
+export function keyedOutcome(node: TaskNode, hash: string | undefined): TaskOutcome {
+  return {
+    node,
+    status: 'success',
+    exitCode: 0,
+    durationMs: 0,
+    ...(hash !== undefined ? { hash } : {}),
+  }
+}
+
 /** `node.deps` less its ordering-only edges: the dependencies a key may fold. */
 export function keyedDeps(node: TaskNode): readonly string[] {
   const order = node.orderOnly

package/src/util/hangup.ts

@@ -0,0 +1,42 @@
+// Did this process start with SIGHUP ignored? `nohup` and a supervisor
+// that wants a job to outlive its terminal say so through the inherited
+// disposition, and a `process.on('SIGHUP')` replaces it: vx under nohup
+// stopped its run and exited 129 when the terminal closed. The POSIX idiom
+// is to ask before installing; Node has no API for it, so Linux reads
+// `/proc/self/status` (self is this process in any pid namespace's procfs)
+// and macOS asks `sigaction` itself. Read once, before the first handler.
+
+import { readFileSync } from 'node:fs'
+import { dlopen, FFIType, ptr } from 'bun:ffi'
+
+let ignored: boolean | undefined
+
+export function hangupIgnored(): boolean {
+  ignored ??= read()
+  return ignored
+}
+
+function read(): boolean {
+  try {
+    if (process.platform === 'linux') {
+      const mask = /^SigIgn:\s*([0-9a-f]+)$/m.exec(readFileSync('/proc/self/status', 'utf8'))
+      return mask !== null && (BigInt(`0x${mask[1]}`) & 1n) === 1n
+    }
+    if (process.platform === 'darwin') return darwinIgnored()
+  } catch {}
+  return false
+}
+
+function darwinIgnored(): boolean {
+  // Opened only here: bun:ffi compiles a trampoline per call site, ~1 ms.
+  const lib = dlopen('/usr/lib/libSystem.B.dylib', {
+    sigaction: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+  })
+  try {
+    // `struct sigaction` opens with the handler; SIG_IGN is 1. SIGHUP is 1.
+    const old = new BigUint64Array(4)
+    return lib.symbols.sigaction(1, null, ptr(old)) === 0 && old[0] === 1n
+  } finally {
+    lib.close()
+  }
+}

package/src/util/index.ts

@@ -43,6 +43,7 @@ export {
   relPosix,
   splitNegations,
   staticPrefix,
+  stripTrailingSlash,
   anyTaskGlob,
   isInstalledPath,
   taskGlob,
@@ -72,6 +73,7 @@ export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
 export { executablePath, shellArgv, taskShell } from './which.js'
 export { procfsIsOwn } from './procfs.js'
+export { hangupIgnored } from './hangup.js'
 export { realPath } from './real-path.js'
 export {
   maskedCommand,

package/src/util/paths.ts

@@ -272,7 +272,7 @@ function regExpSource(pattern: string): string | null {
   return out
 }
 
-function stripTrailingSlash(p: string): string {
+export function stripTrailingSlash(p: string): string {
   return p.replace(/\/+$/, '')
 }