@vzn/vx 0.0.596 → 0.0.598

package/src/workspace/affected.ts

@@ -84,7 +84,10 @@ export interface AffectedArgs {
    * (item 954). The `--affected` sugar's graph walk has already staged every
    * config, so there it costs nothing more.
    */
-  workspaceGlobOwners?: (changedPaths: readonly string[]) => Promise<Iterable<string>>
+  workspaceGlobOwners?: (
+    changedPaths: readonly string[],
+    nested: readonly string[],
+  ) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
    * answer for a change to one. Resolved lazily: loading the workspace
@@ -142,6 +145,12 @@ export interface AffectedChanges {
   /** Project → its changed paths, relative to the project's directory. */
   paths: ReadonlyMap<string, readonly string[]>
   whole: ReadonlySet<string>
+  /**
+   * The changed paths that are nested repositories (a submodule, an
+   * embedded repository), workspace-relative: each stands for every file
+   * in it, so a `workspaceFiles` glob that reaches under one is reached.
+   */
+  nested?: readonly string[]
 }
 
 export async function affectedChanges(
@@ -221,16 +230,10 @@ export async function affectedChanges(
     // submodules (`diff.ignoreSubmodules`, `submodule.<name>.ignore`), and
     // then an edit inside one, or a committed bump, was no change here while
     // the task's key moved (item 951).
-    gitPaths(args.workspaceRoot, [
-      'diff',
-      '--no-renames',
-      '--ignore-submodules=none',
-      '--relative',
-      '--name-only',
-      '-z',
-      '--end-of-options',
-      base,
-    ]),
+    //
+    // `--raw` for each path's mode: a gitlink (160000) is a nested
+    // repository, one path standing for every file in it (`nested` below).
+    gitDiffPaths(args.workspaceRoot, base),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
@@ -244,9 +247,13 @@ export async function affectedChanges(
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
-  const changed = [...diffed, ...untracked.filter((s) => !isInstalledPath(s))].filter(
+  const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
     (s) => s !== LOCKFILE_NAME,
   )
+  // The nested repositories git reports as one path: a gitlink, or an
+  // untracked embedded repository (`dir/`, the only path git prints so).
+  const nested = new Set(diffed.gitlinks)
+  for (const rel of untracked) if (rel.endsWith('/')) nested.add(rel)
 
   // A lockfile or workspace-definition change re-keys EVERY task, because the
   // workspace fingerprint folds those files into every cache key. Mapping
@@ -316,6 +323,7 @@ export async function affectedChanges(
   const owned = projectsContaining(
     args.workspaceRoot,
     changed,
+    nested,
     args.projects,
     realDirs,
     perTask
@@ -371,15 +379,21 @@ export async function affectedChanges(
     projects: args.projects,
     changed,
     skip: perTask ? new Set() : owned,
-    realDirs,
   })) {
     owned.add(name)
     whole.add(name)
   }
 
-  const done = (): AffectedChanges => ({ projects: owned, changed, paths, whole })
+  const nestedDirs = [...nested].map((rel) => rel.replace(/\/$/, ''))
+  const done = (): AffectedChanges => ({
+    projects: owned,
+    changed,
+    paths,
+    whole,
+    ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
+  })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
-  for (const name of await args.workspaceGlobOwners(changed)) owned.add(name)
+  for (const name of await args.workspaceGlobOwners(changed, nestedDirs)) owned.add(name)
   return done()
 }
 
@@ -645,6 +659,37 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
   return stdout.split('\0').filter((s) => s.length > 0)
 }
 
+/**
+ * `git diff --raw -z <base>`'s paths, and those that are a gitlink on
+ * either side: one the change removed took its files with it. Each record
+ * is `:<mode> <mode> <oid> <oid> <status>` then its path (one path:
+ * `--no-renames`).
+ */
+async function gitDiffPaths(
+  workspaceRoot: string,
+  base: string,
+): Promise<{ paths: string[]; gitlinks: string[] }> {
+  const fields = await gitPaths(workspaceRoot, [
+    'diff',
+    '--no-renames',
+    '--ignore-submodules=none',
+    '--relative',
+    '--raw',
+    '-z',
+    '--end-of-options',
+    base,
+  ])
+  const paths: string[] = []
+  const gitlinks: string[] = []
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    const rel = fields[i + 1]!
+    paths.push(rel)
+    const head = fields[i]!
+    if (head.startsWith('160000 ', 1) || head.startsWith('160000 ', 8)) gitlinks.push(rel)
+  }
+  return { paths, gitlinks }
+}
+
 /**
  * Resolve the default base for `--affected` with no explicit value.
  * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
@@ -826,17 +871,11 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   )
 }
 
-function isDirectory(abs: string): boolean {
-  try {
-    return statSync(abs).isDirectory()
-  } catch {
-    return false
-  }
-}
-
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
+  /** The changed paths that are nested repositories (`nested` in `affectedChanges`). */
+  nested: ReadonlySet<string>,
   projects: readonly ProjectMeta[],
   realDirs: ReadonlyMap<string, string>,
   /** Told each owned path relative to its project, and each nested repository's projects. */
@@ -868,37 +907,35 @@ function projectsContaining(
   }
   const owned = new Set<string>()
   for (const rel of changedRelPaths) {
+    const repo = nested.has(rel)
     let dir = path.resolve(workspaceRoot, rel).normalize('NFC')
-    let hit = false
     for (;;) {
       const name = dirToName.get(dir)
       if (name !== undefined) {
         owned.add(name)
         on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')))
-        hit = true
+        // Its files are the project's inputs, and none of them is this
+        // path: a task's globs cannot say whether they reach inside.
+        if (repo) on?.repo(name)
         break
       }
       const parent = path.dirname(dir)
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
-    if (hit) continue
-    // A changed path that is a DIRECTORY on disk is a nested repository —
-    // a submodule whose checkout moved or is dirty (`vendor/sub`), an
-    // embedded repository left untracked (`vendor/nested/`) — because git
-    // reports nothing else as a directory. The workspace repository sees
-    // the nested one as that single path, so a change inside is a change
-    // to it, and every project under it is affected. Its own enumeration
-    // already keys those projects on their files (git-inputs.ts); without
-    // this, `--affected` after an edit inside selected none of them.
-    const abs = path.resolve(workspaceRoot, rel)
-    if (isDirectory(abs)) {
-      const prefix = abs.normalize('NFC') + path.sep
-      for (const [dir, name] of dirToName) {
-        if (!dir.startsWith(prefix)) continue
-        owned.add(name)
-        on?.repo(name)
-      }
+    if (!repo) continue
+    // A submodule whose checkout moved or is dirty (`vendor/sub`), an
+    // embedded repository left untracked (`vendor/nested/`): the workspace
+    // repository sees the nested one as that single path, so a change
+    // inside is a change to it, and every project under it is affected.
+    // Its own enumeration already keys those projects on their files
+    // (git-inputs.ts); without this, `--affected` after an edit inside
+    // selected none of them.
+    const prefix = path.resolve(workspaceRoot, rel).normalize('NFC') + path.sep
+    for (const [dir, name] of dirToName) {
+      if (!dir.startsWith(prefix)) continue
+      owned.add(name)
+      on?.repo(name)
     }
   }
   return owned

package/src/workspace/config-cache.ts

@@ -606,8 +606,12 @@ export function configEvalKeyFromIdentities(a: {
  * `node_modules`, the config itself excluded. `vx watch` watches these: a
  * shared preset outside the project (`../../shared/preset.mjs`, the way
  * configs compose) changed what a run evaluates and no watcher saw it
- * (item 949). A file that cannot be read or resolved ends its branch.
+ * (item 949). A file that cannot be read or resolved ends its branch; one
+ * that cannot be resolved is still listed, by the name it would have.
  */
+// The names an extensionless relative import may resolve to, as Bun tries them.
+const IMPORT_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']
+
 export async function configImports(configPath: string): Promise<string[]> {
   const seen = new Set<string>([configPath])
   const out: string[] = []
@@ -635,6 +639,16 @@ export async function configImports(configPath: string): Promise<string[]> {
         dir ??= realDirOf(file)
         resolved = realPath(Bun.resolveSync(spec, dir))
       } catch {
+        // Missing for now, still imported: the config that names it fails
+        // to load until it is back, and a list without it left `vx watch`
+        // deaf to its return. Named as written, and not walked.
+        if (dir === undefined) continue
+        for (const ext of path.extname(spec) === '' ? IMPORT_EXTENSIONS : ['']) {
+          const missing = path.resolve(dir, spec + ext)
+          if (seen.has(missing)) continue
+          seen.add(missing)
+          out.push(missing)
+        }
         continue
       }
       if (seen.has(resolved) || resolved.split(path.sep).includes('node_modules')) continue

package/src/workspace/config-eval.ts

@@ -103,6 +103,23 @@ const nonJsonPaths = ${nonJsonPaths.toString()}
     throw new Error('process.exit(' + (code ?? '') + ') in a config: ' + ${JSON.stringify(CONFIG_EXIT)})
   }
 }
+// Bun's resolver reads \\ as a separator, so a config under a\\b is served
+// from the path as written (project-loader.ts's LITERAL_QUERY), read now.
+let literal = false
+const serveLiteral = () => {
+  if (literal) return
+  literal = true
+  globalThis.Bun.plugin({
+    name: 'vx-config-literal',
+    setup(build) {
+      build.onResolve({ filter: /\\?vx-literal$/ }, (args) => ({ path: args.path, namespace: 'file' }))
+      build.onLoad({ filter: /\\?vx-literal$/ }, async (args) => {
+        const file = args.path.slice(0, -'?vx-literal'.length)
+        return { contents: await globalThis.Bun.file(file).text(), loader: /\\.[cm]?ts$/.test(file) ? 'ts' : 'js' }
+      })
+    },
+  })
+}
 self.onmessage = async (e) => {
   const { id, path, env } = e.data
   // A Worker starts with the process's STARTUP environment, not the
@@ -155,7 +172,9 @@ self.onmessage = async (e) => {
     if (umaskIn !== null && globalThis.process.umask() !== umaskIn) globalThis.process.umask(umaskIn)
   }
   try {
-    const ns = await import(path)
+    const literalPath = path.includes('\\\\')
+    if (literalPath) serveLiteral()
+    const ns = await import(literalPath ? path + '?vx-literal' : path)
     // Awaited as the in-process load's async return flattens it: a Promise
     // default loaded on a run and was refused as "an instance of Promise"
     // on every later evaluation in the process (D-5).
@@ -185,12 +204,16 @@ self.onmessage = async (e) => {
         : thrown
     const report = changed()
     umaskBack()
+    // A thrown string or plain object has no message, and String() of a
+    // null-prototype object throws here, inside the catch.
+    const isError = err !== null && typeof err === 'object' && typeof err.message === 'string'
     postMessage({
       id,
       ok: false,
-      name: err?.name ?? 'Error',
-      message: err?.message ?? String(err),
-      stack: err?.stack ?? null,
+      thrown: isError ? null : globalThis.Bun.inspect(err, { compact: true }),
+      name: isError ? (err.name ?? 'Error') : 'Error',
+      message: isError ? err.message : '',
+      stack: isError ? (err.stack ?? null) : null,
       changed: report,
       position:
         err?.position && typeof err.position === 'object'
@@ -214,6 +237,8 @@ interface WorkerReply {
   nonJson: NonJsonValue[]
   name: string
   message: string
+  /** What a config threw that is not an Error, as `thrownValueMessage` shows it; null for an Error. */
+  thrown?: string | null
   stack: string | null
   /** A transpile error's location — `BuildMessage.position`, trimmed to what the loader reads. */
   position: { file?: string; line?: number; column?: number } | null
@@ -222,6 +247,16 @@ interface WorkerReply {
 interface Pending {
   resolve: (reply: WorkerReply) => void
   reject: (err: Error) => void
+  configPath: string
+}
+
+/**
+ * A config threw something that is not an Error: `throw 'no'` printed
+ * `vx: no`, naming no file, and a null-prototype object crashed vx's own
+ * error printer with a stack.
+ */
+export function thrownValueMessage(kind: string, configPath: string, shown: string): string {
+  return `${kind} config ${configPath} threw ${shown}, which is not an Error`
 }
 
 /**
@@ -236,10 +271,11 @@ export function evalBudgetMs(): number {
   // BOUND on a worker that may be wedged, with no "no limit" reading. Falls
   // back rather than clamping, because honouring ~24.8 days would hang
   // `vx watch` forever on a worker the OS killed — and unbounded makes it 1 ms,
-  // so EVERY config load times out instead. Both ends break the same feature.
+  // so EVERY config load times out instead. Both ends break the same feature,
+  // and `0` is the second end: it fired on the next tick (D-157).
   if (raw !== undefined && /^[0-9]+$/.test(raw)) {
     const n = Number(raw)
-    if (n <= MAX_TIMEOUT_MS) return n
+    if (n > 0 && n <= MAX_TIMEOUT_MS) return n
   }
   return 30_000
 }
@@ -287,6 +323,10 @@ function acquireWorker(): Worker {
       p.resolve(msg)
       return
     }
+    if (typeof msg.thrown === 'string') {
+      p.reject(new UserError(thrownValueMessage('Project', p.configPath, msg.thrown)))
+      return
+    }
     // Rebuild the error the config actually threw. Name, message, stack
     // and a transpile error's position all survive the hop, so a broken
     // config reports the same text it would from an in-process import.
@@ -365,7 +405,7 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
     // evaluation costs, so it can only fire on a genuine wedge.
     const budget = evalBudgetMs()
     const reply = await new Promise<WorkerReply>((resolve, reject) => {
-      pending.set(id, { resolve, reject })
+      pending.set(id, { resolve, reject, configPath })
       timer = setTimeout(() => {
         rejectAll(new Error(`config worker did not answer within ${budget}ms`))
         if (worker !== null) {

package/src/workspace/config-imports.ts

@@ -20,13 +20,13 @@
 //     the lockfile moves, which the workspace fingerprint already covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
-//   - Descend only through files owned by NO project, by a ROOT project
-//     (whose own files are the shared tooling that is otherwise unowned,
-//     D-41), or by the importing file's own project. A config reaching into another project (say a site's
-//     `vx.config.ts` importing `../core/src/index.ts`) records that edge
-//     and STOPS there — following it would drag substantially all of that
-//     project's `src/` into the closure, and the containment channel
-//     already selects the project that owns it.
+//   - One reversed BFS from every config at once, each file read once
+//     however many configs reach it. It descends through every file in
+//     the workspace, another project's included: a site's `vx.config.ts`
+//     importing `../core/src/index.ts` evaluates what that file imports
+//     too, so an edit there moves the site's key. The walk stopped at the
+//     first file of another project, and containment selected core alone
+//     while the site's key moved (X-128).
 
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
@@ -393,32 +393,6 @@ export interface ConfigImportOwnersArgs {
   changed: readonly string[]
   /** Already-selected projects; their configs need no scan. */
   skip: ReadonlySet<string>
-  /**
-   * Each project dir's realpath, when the caller already has them: the
-   * containment pass needs the same answers, and asking twice cost 5,000
-   * realpaths at 5,000 projects (D-24).
-   */
-  realDirs?: ReadonlyMap<string, string>
-}
-
-/**
- * Project dir → name, REALPATH'D — which is why this cannot reuse the index
- * the containment pass builds. `Bun.resolveSync` hands back realpath'd
- * targets, and on darwin a workspace under `os.tmpdir()` lives at
- * `/var/folders/…` while its realpath is `/private/var/folders/…`; comparing
- * the two matches nothing and fails exactly like "found no imports".
- */
-async function realDirIndex(
-  projects: readonly ProjectMeta[],
-  known: ReadonlyMap<string, string> | undefined,
-): Promise<Map<string, string>> {
-  const out = new Map<string, string>()
-  await Promise.all(
-    projects.map(async (p) => {
-      out.set(known?.get(p.dir) ?? (await realpath(p.dir).catch(() => p.dir)), p.name)
-    }),
-  )
-  return out
 }
 
 const TS_EXT = new Set(['.ts', '.mts', '.cts'])
@@ -426,18 +400,6 @@ const TS_EXT = new Set(['.ts', '.mts', '.cts'])
 /** The extensions Bun tries for a specifier that names none. */
 const RESOLVED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']
 
-/** The deepest project containing `file`, or undefined when none does. */
-function ownerOf(file: string, dirToName: ReadonlyMap<string, string>): string | undefined {
-  let dir = path.dirname(file)
-  for (;;) {
-    const name = dirToName.get(dir)
-    if (name !== undefined) return name
-    const parent = path.dirname(dir)
-    if (parent === dir) return undefined
-    dir = parent
-  }
-}
-
 /** Projects whose config file transitively imports one of `changed`. */
 export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set<string>> {
   const selected = new Set<string>()
@@ -453,10 +415,6 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
     }),
   )
   if (roots.size === 0) return selected
-  const dirToName = await realDirIndex(a.projects, a.realDirs)
-  // A root project owns every file no member owns: the shared tooling the
-  // walk descends through when the root is no project (D-41).
-  const rootOwner = dirToName.get(workspaceRoot)
 
   // target → the files that import it. Reversed up front so one BFS from the
   // changed set answers every root at once, instead of a walk per root.
@@ -486,18 +444,13 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
       if (entry === null) continue
       const { file, source } = entry
       const loader = TS_EXT.has(path.extname(file)) ? 'ts' : 'js'
-      const from = ownerOf(file, dirToName)
       for (const target of scanLocalImports(source, path.dirname(file), loader, tsconfigs)) {
         if (!target.startsWith(workspaceRoot + path.sep)) continue
         if (target.split(path.sep).includes('node_modules')) continue
         const list = importedBy.get(target)
         if (list) list.push(file)
         else importedBy.set(target, [file])
-        // Descend ONLY through unowned files, the root project's own, or
-        // the importer's own project's (a config split into `./tasks.mjs`
-        // that imports shared tooling): see the header.
-        const owner = ownerOf(target, dirToName)
-        if (owner === undefined || owner === rootOwner || owner === from) frontier.push(target)
+        frontier.push(target)
       }
     }
   }

package/src/workspace/config-schema.ts

@@ -76,6 +76,16 @@ function validateRules(rules: unknown, configPath: string): void {
 
 const RETENTION_FIELDS = new Set(['olderThan', 'maxSize'])
 
+/**
+ * A refused value as a message quotes it. A workspace file is evaluated
+ * in-process and no JSON rule precedes its schema, so a value here may be
+ * one `JSON.stringify` throws on (`30n`) or drops (a symbol): the refusal
+ * became a TypeError with a stack.
+ */
+function shown(v: unknown): string {
+  return typeof v === 'bigint' ? `${v}n` : (JSON.stringify(v) ?? String(v))
+}
+
 function validateRetention(retention: unknown, configPath: string): void {
   const where = `${configPath}: \`cacheRetention\``
   const field = (key: string) => `${configPath}: \`cacheRetention.${key}\``
@@ -93,12 +103,12 @@ function validateRetention(retention: unknown, configPath: string): void {
     (typeof olderThan !== 'string' || parseDuration(olderThan) === null)
   ) {
     throw new UserError(
-      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${JSON.stringify(olderThan)})`,
+      `${field('olderThan')} must be a duration like '30d', '12h', '90m' or '45s' (got ${shown(olderThan)})`,
     )
   }
   if (maxSize !== undefined && (typeof maxSize !== 'string' || parseSize(maxSize) === null)) {
     throw new UserError(
-      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${JSON.stringify(maxSize)})`,
+      `${field('maxSize')} must be a size like '10G', '500MB' or '64KB' (got ${shown(maxSize)})`,
     )
   }
   // The bounds `vx cache prune` refuses, for the same reason: each evicts
@@ -179,7 +189,7 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       throw new UserError(`${configPath}: \`plugins\` must be an array of plugin objects`)
     }
     const verbOwners = new Map<string, string>()
-    const fileClaimants = new Map<string, string>()
+    const fileClaimants = new Map<string, { name: string; at: number }>()
     for (const [i, p] of config.plugins.entries()) {
       if (p === null || typeof p !== 'object') {
         // Nx's nx.json lists plugins by module name (`'@nx/vite/plugin'`);
@@ -199,6 +209,13 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
       // one whose `name` was overwritten after the stamp, is refused here —
       // the one boundary every plugin crosses.
       const pkg = (p as Record<symbol, unknown>)[PLUGIN_PACKAGE]
+      // An async factory called without `await` was told its plugin did not
+      // come from definePlugin — it had (D-159).
+      if (pkg === undefined && typeof (p as { then?: unknown }).then === 'function') {
+        throw new UserError(
+          `${configPath}: \`plugins[${i}]\` is a Promise — await the factory that returns the plugin`,
+        )
+      }
       if (typeof pkg !== 'string' || pkg.length === 0) {
         throw new UserError(
           `${configPath}: \`plugins[${i}]\` must come from definePlugin(import.meta, { … }) — a plugin's name is its package name`,
@@ -317,16 +334,23 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
             /[/\\]/.test(file)
           ) {
             throw new UserError(
-              `${configPath}: plugin '${plug.name}' claims fingerprint file ${JSON.stringify(file)}, which is not a file name at the workspace root`,
+              `${configPath}: plugin '${plug.name}' claims fingerprint file ${shown(file)}, which is not a file name at the workspace root`,
             )
           }
           const owner = fileClaimants.get(file)
+          // One package twice (`plugins: [bun(), bun()]`) read "plugins 'x'
+          // and 'x' both claim" (D-158).
+          if (owner !== undefined && owner.name === plug.name) {
+            throw new UserError(
+              `${configPath}: plugin '${plug.name}' claims fingerprint file '${file}' twice (plugins[${owner.at}] and plugins[${i}]) — a file has one claimant; declare the plugin once`,
+            )
+          }
           if (owner !== undefined) {
             throw new UserError(
-              `${configPath}: plugins '${owner}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
+              `${configPath}: plugins '${owner.name}' and '${plug.name}' both claim fingerprint file '${file}' — a file has one claimant`,
             )
           }
-          fileClaimants.set(file, plug.name)
+          fileClaimants.set(file, { name: plug.name, at: i })
         }
       }
       // A plugin must contribute at least one capability or lifecycle hook

package/src/workspace/lockfile.ts

@@ -152,7 +152,8 @@ export async function frozenProjectConfigs(
 ): Promise<ProjectConfig[]> {
   const entries = metas.map((meta) => {
     const rel = relPosix(root, meta.configPath)
-    const entry = lock.projects[meta.name]
+    // Own entries only: `constructor` read Object's, "locked" at undefined (D-152).
+    const entry = Object.hasOwn(lock.projects, meta.name) ? lock.projects[meta.name] : undefined
     if (entry !== undefined && entry.configPath !== rel) {
       // A renamed or moved config: "has no entry for a" named an entry the
       // lock holds, under its old path (D-88).

package/src/workspace/migrate-scripts.ts

@@ -847,7 +847,7 @@ export function migrateScripts(
     const names = runnable.filter((n) => taskNameProblem(n) === null)
     if (meta !== rootMeta && !('build' in scripts)) {
       const hook = LIFECYCLE_BUILD_HOOKS.find(
-        (h) => typeof scripts[h] === 'string' && BUILDER.test(scripts[h] as string),
+        (h) => typeof scripts[h] === 'string' && BUILDER.test(scripts[h]),
       )
       if (hook !== undefined) lifecycleBuilds.push([meta.name, hook, scripts[hook] as string])
     }