@vzn/vx 0.0.613 → 0.0.615

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.613",
+  "version": "0.0.615",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.613",
-    "@vzn/vx-linux-arm64": "0.0.613",
-    "@vzn/vx-darwin-x64": "0.0.613",
-    "@vzn/vx-darwin-arm64": "0.0.613"
+    "@vzn/vx-linux-x64": "0.0.615",
+    "@vzn/vx-linux-arm64": "0.0.615",
+    "@vzn/vx-darwin-x64": "0.0.615",
+    "@vzn/vx-darwin-arm64": "0.0.615"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/help.ts

@@ -210,7 +210,8 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     "  vx show <pkg>#<task> Print a single task's resolved config.",
     '  vx show <task>       That task in every project declaring it.',
     "      --filter <pattern>  The list (or a task's projects) as `vx run --filter` selects.",
-    '      --affected[=<ref>]  Only what `vx run --affected` selects: changed and dependents.',
+    "      --affected[=<ref>]  A task's projects `vx run <task> --affected` runs; no task:",
+    '                       the changed projects and their dependents.',
     '      --format <fmt>   pretty (default) | json.',
     '  vx info              Workspace doctor: vx/bun/git versions, project +',
     '                       task counts, cache dir/entries/size, recent runs,',

package/src/cli/select.ts

@@ -360,6 +360,10 @@ export async function resolveFilters(
 
   const unmatched: string[] = []
   const emptyWalks: string[] = []
+  // The `[<since>]` includes whose diff itself matched nothing: only then is
+  // "nothing affected" the fact. A diff that matched, then lost every
+  // project to an exclusion or an empty walk, says which (X-146).
+  const emptyDiffs = new Set<(typeof parsed)[number]>()
   const selected = applyFilters({
     filters: parsed,
     projects,
@@ -371,11 +375,12 @@ export async function resolveFilters(
     // matched nothing is worth flagging as a probable typo.
     onNoMatch: (f) => {
       if (f.gitSince === undefined) unmatched.push(f.raw)
+      else emptyDiffs.add(f)
     },
     // A pattern that matched, with nothing on the walk it asked for: the
     // fact to say, where "no projects matched" read as a typo (item 1030).
     onEmptyWalk: (f, matched) => {
-      if (f.negate || f.gitSince !== undefined) return
+      if (f.negate) return
       const which = matched.join(', ')
       emptyWalks.push(
         f.onlyDeps
@@ -389,28 +394,35 @@ export async function resolveFilters(
     // commit must not red `vx run … --affected=origin/main`. Only report an
     // error when the user named something concrete that failed to resolve.
     const includes = parsed.filter((f) => !f.negate)
+    // Every pattern matched and an exclusion took them all back: "no
+    // projects matched filter(s): one, !one" read as a typo of `one`.
+    const negations = parsed.filter((f) => f.negate).map((f) => f.raw)
+    const excluded = `${negations.join(', ')} excluded every project the other filters matched`
     if (includes.length > 0 && includes.every((f) => f.gitSince !== undefined)) {
-      const refs = includes.map((f) => f.gitSince).join(', ')
-      // A base that IS HEAD (a single-branch clone whose `origin/HEAD` is
-      // the branch under test) can never mark anything affected, and this
-      // exit-0 note was the only sign (CI persona, 2026-09-16). Say so.
-      const self = includes.find((f) => refIsHead(root, f.gitSince!))
-      const hint =
-        self === undefined
-          ? ''
-          : ` — ${self.gitSince} is HEAD itself: compare with the branch you merge into (--affected=origin/main) or the previous commit (--affected=HEAD~1)`
-      return { empty: `nothing affected since ${refs}${hint}` }
+      if (includes.every((f) => emptyDiffs.has(f))) {
+        const refs = includes.map((f) => f.gitSince).join(', ')
+        // A base that IS HEAD (a single-branch clone whose `origin/HEAD` is
+        // the branch under test) can never mark anything affected, and this
+        // exit-0 note was the only sign (CI persona, 2026-09-16). Say so.
+        const self = includes.find((f) => refIsHead(root, f.gitSince!))
+        const hint =
+          self === undefined
+            ? ''
+            : ` — ${self.gitSince} is HEAD itself: compare with the branch you merge into (--affected=origin/main) or the previous commit (--affected=HEAD~1)`
+        return { empty: `nothing affected since ${refs}${hint}` }
+      }
+      // The diff matched and a walk or an exclusion left nothing: still the
+      // exit-0 outcome (`--affected --filter '!docs'` on a docs-only change
+      // must not red CI), said as what happened (X-146).
+      return {
+        empty: `no projects selected: ${emptyWalks.length > 0 ? emptyWalks.join('; ') : excluded}`,
+      }
     }
     if (unmatched.length === 0 && emptyWalks.length > 0) {
       return { error: `no projects selected: ${emptyWalks.join('; ')}` }
     }
-    // Every pattern matched and an exclusion took them all back: "no
-    // projects matched filter(s): one, !one" read as a typo of `one`.
-    const negations = parsed.filter((f) => f.negate).map((f) => f.raw)
     if (unmatched.length === 0 && negations.length > 0) {
-      return {
-        error: `no projects selected: ${negations.join(', ')} excluded every project the other filters matched`,
-      }
+      return { error: `no projects selected: ${excluded}` }
     }
     // One line, not a warning per pattern and then an error saying the same:
     // the patterns are in the error, and the nearest project name is the

package/src/cli/show.ts

@@ -9,12 +9,19 @@
 import path from 'node:path'
 import type { ProjectConfig, TaskConfig } from '../config.js'
 import { declaredTask } from '../graph/index.js'
-import { isDefaultBuild } from '../orchestrator/index.js'
+import { affectedTaskProjects, isDefaultBuild } from '../orchestrator/index.js'
 import { flagHint, formatValue, seeHelp } from './help.js'
 import { listed, nearMatches, relPosix, secretMask, UserError } from '../util/index.js'
 import { affectedFilterFor, resolveFilters } from './select.js'
-import { discoverCliProjects, loadCliProjects } from './workspace-config.js'
 import {
+  discoverCliProjects,
+  loadCliProjects,
+  loadCliWorkspace,
+  warnToStderr,
+} from './workspace-config.js'
+import {
+  type AffectedChanges,
+  buildPackageGraph,
   findWorkspaceRoot,
   type LoadReads,
   loadWorkspace,
@@ -124,6 +131,9 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   // `turbo ls --filter` / `nx show projects --affected`: the list, and a
   // task's projects, narrowed by the selection `vx run` would make.
   let selected: Set<string> | undefined
+  // A task's projects under `--affected` are the ones whose task the run
+  // keeps: the change reaches another project only along a task edge.
+  let byDiff: { changes: AffectedChanges; outright?: readonly string[] | undefined } | undefined
   if (parsed.filters.length > 0 || parsed.affected !== undefined) {
     if (scope !== 'all') {
       throw new UserError(
@@ -142,6 +152,8 @@ export async function showCmd(args: readonly string[]): Promise<number> {
     if ('error' in r) throw new UserError(`vx show: ${r.error}`)
     if ('empty' in r) process.stderr.write(`vx show: ${r.empty}\n`)
     selected = new Set('empty' in r ? [] : r.names)
+    if ('names' in r && r.affected !== undefined)
+      byDiff = { changes: r.affected, outright: r.outright }
   }
   const inSelection = (name: string): boolean => selected === undefined || selected.has(name)
 
@@ -171,7 +183,27 @@ export async function showCmd(args: readonly string[]): Promise<number> {
         `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names], '', 'projects and tasks')}`,
       )
     }
-    const shown = declaring.filter((p) => inSelection(p.name))
+    let shown = declaring.filter((p) => inSelection(p.name))
+    if (byDiff !== undefined) {
+      const ws = await loadCliWorkspace(root)
+      const kept = new Set(
+        await affectedTaskProjects({
+          task: projectName!,
+          candidates: shown.map((p) => p.name),
+          changes: byDiff.changes,
+          outright: byDiff.outright,
+          projects,
+          packageGraph: buildPackageGraph(metas),
+          projectMetas: metas,
+          plugins: ws.plugins,
+          workspaceRoot: root,
+          cacheDir: ws.cacheDir,
+          rules: ws.workspaceConfig?.rules,
+          warn: warnToStderr,
+        }),
+      )
+      shown = shown.filter((p) => kept.has(p.name))
+    }
     process.stdout.write(renderTaskAcross(root, shown, projectName!, parsed.format))
     return 0
   }

package/src/graph/task-graph.ts

@@ -2,6 +2,7 @@ import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
   isLiteralPattern,
+  normalizeGlob,
   relPosix,
   splitNegations,
   staticPrefix,
@@ -1152,6 +1153,64 @@ function collideAcross(
  */
 const GLOB_HEAD_END = /[*?{}\\!]/
 
+/** `firstSegment`'s answer for a glob that can start anywhere. */
+const ANYWHERE = ''
+
+/** Where a glob's first segment ends: a separator, or anything `GLOB_HEAD_END` stops at. */
+const FIRST_SEGMENT_END = /[*?{}\\!/]/
+
+const firstSegments = new Map<string, string>()
+
+/**
+ * The first path segment every path a glob (or its `asTrees` twin) can
+ * match starts with, or `ANYWHERE`. A task glob matches whole paths, so
+ * two globs with different first segments select disjoint sets, and none
+ * of `outputsOverlap`'s three cases can hold for them. Memoised by the
+ * raw string: a pure function, and one glob (`src/**`) recurs in every
+ * project.
+ */
+function firstSegment(raw: string): string {
+  let seg = firstSegments.get(raw)
+  if (seg !== undefined) return seg
+  const g = normalizeGlob(raw)
+  const cut = g.search(FIRST_SEGMENT_END)
+  seg = cut === -1 ? g : g[cut] === '/' ? g.slice(0, cut) : ANYWHERE
+  if (seg === '.' || seg === '..') seg = ANYWHERE
+  firstSegments.set(raw, seg)
+  return seg
+}
+
+/**
+ * False only when no pair `overlapCandidates` could return can overlap:
+ * every glob starts in a named segment and no two members (on different
+ * sides, given `sideOf`) share one. The per-project buckets are nearly
+ * all of this shape (`src/**` read, `dist/**` written), and building the
+ * indexes for each cost the warm run's graph stage tens of milliseconds
+ * at 1,090 projects (X-148).
+ */
+function mayOverlap<T>(
+  tasks: readonly T[],
+  globsOf: (n: T) => readonly string[] | undefined,
+  sideOf?: (n: T) => boolean,
+): boolean {
+  // Per segment: the first member seen (one side) or the sides seen as a mask.
+  const seen = new Map<string, number>()
+  for (let i = 0; i < tasks.length; i++) {
+    const mark = sideOf === undefined ? i : sideOf(tasks[i]!) ? 2 : 1
+    for (const g of globsOf(tasks[i]!) ?? []) {
+      const seg = firstSegment(g)
+      if (seg === ANYWHERE) return true
+      const was = seen.get(seg)
+      if (was === undefined) seen.set(seg, mark)
+      else if (sideOf === undefined) {
+        if (was !== i) return true
+      } else if ((was | mark) === 3) return true
+      else seen.set(seg, was | mark)
+    }
+  }
+  return false
+}
+
 /**
  * The pairs `[i, j]`, `i < j`, of `tasks` whose declared outputs CAN
  * overlap, ascending by `i` then `j`: a superset of the pairs
@@ -1181,6 +1240,7 @@ function overlapCandidates<T>(
   globsOf: (n: T) => readonly string[] | undefined,
   sideOf?: (n: T) => boolean,
 ): Array<[number, number]> {
+  if (!mayOverlap(tasks, globsOf, sideOf)) return []
   const sides = sideOf === undefined ? 1 : 2
   // The index a member of side `s` looks up: its own side's, or the other's.
   const across = (s: number): number => (sides === 1 ? s : 1 - s)
@@ -1356,6 +1416,7 @@ function refuseSelfClean(node: TaskNode): void {
   const cache = node.config.cache
   if (cache === undefined) return
   for (const field of ['files', 'workspaceFiles'] as const) {
+    if (!coversAny(cache.inputs[field], cache.outputs[field])) continue
     const inputs = splitNegations(cache.inputs[field] ?? [])
     const out = splitNegations(cache.outputs[field] ?? [])
     const outputs = out.positive
@@ -1384,6 +1445,39 @@ function refuseSelfClean(node: TaskNode): void {
   }
 }
 
+/**
+ * False only when no positive output can cover a positive input: each
+ * starts in a named first segment and no input shares one with an output
+ * (`firstSegment`). The common task reads `src/**` and writes `dist/**`.
+ */
+function coversAny(
+  inputs: readonly string[] | undefined,
+  outputs: readonly string[] | undefined,
+): boolean {
+  if (inputs === undefined || outputs === undefined) return false
+  let anyOutput = false
+  for (const go of outputs) {
+    if (go.startsWith('!')) continue
+    anyOutput = true
+    if (firstSegment(go) === ANYWHERE) return true
+  }
+  if (!anyOutput) return false
+  for (const gi of inputs) {
+    if (gi.startsWith('!')) continue
+    const seg = firstSegment(gi)
+    if (seg === ANYWHERE) return true
+    for (const go of outputs) if (!go.startsWith('!') && firstSegment(go) === seg) return true
+  }
+  return false
+}
+
+/** A glob list's positive entries: the list itself when it takes nothing back. */
+function positives(globs: readonly string[] | undefined): readonly string[] {
+  if (globs === undefined) return []
+  for (const g of globs) if (g.startsWith('!')) return splitNegations(globs).positive
+  return globs
+}
+
 /** One task's inputs (`reads`) or outputs in one namespace, for `detectInputOverlaps`. */
 interface Side {
   node: TaskNode
@@ -1431,8 +1525,8 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   for (const n of nodes.values()) {
     const cache = n.config.cache
     if (cache === undefined) continue
-    const outFiles = splitNegations(cache.outputs.files).positive
-    const outWs = splitNegations(cache.outputs.workspaceFiles ?? []).positive
+    const outFiles = positives(cache.outputs.files)
+    const outWs = positives(cache.outputs.workspaceFiles ?? [])
     if (outFiles.length > 0) {
       bucket(n.projectName).push({ node: n, globs: outFiles, reads: false })
       filesWriters.push(n)
@@ -1443,8 +1537,8 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       wsWriters.push(side)
     }
     if (isGroupTask(n)) continue
-    const inFiles = splitNegations(cache.inputs.files).positive
-    const inWs = splitNegations(cache.inputs.workspaceFiles ?? []).positive
+    const inFiles = positives(cache.inputs.files)
+    const inWs = positives(cache.inputs.workspaceFiles ?? [])
     if (inFiles.length > 0) {
       bucket(n.projectName).push({ node: n, globs: inFiles, reads: true })
       filesReaders.push(n)
@@ -1471,7 +1565,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     const sides = [...wsWriters]
     for (const node of filesReaders) {
       const rel = relPosix(workspaceRoot, node.projectDir)
-      const globs = splitNegations(node.config.cache!.inputs.files).positive.map((g) =>
+      const globs = positives(node.config.cache!.inputs.files).map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )
       sides.push({ node, globs, reads: true, rel })
@@ -1488,7 +1582,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
       const rel = relPosix(workspaceRoot, node.projectDir)
-      const globs = splitNegations(node.config.cache!.outputs.files).positive.map((g) =>
+      const globs = positives(node.config.cache!.outputs.files).map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )
       rooted.push({ node, globs, reads: false, rel })

package/src/orchestrator/affected-tasks.ts

@@ -4,9 +4,12 @@
 // behind `^build` runs when `ui#build` (or what it depends on) is reached,
 // and a spec edit `ui#build`'s inputs leave out stops at `ui`'s own tasks.
 
+import type { WorkspaceRules } from '../config.js'
 import { declaresInput, workspaceFilesReachInto } from '../cache/index.js'
 import {
+  buildTaskGraph,
   compileTaskPattern,
+  expandRequested,
   isGroupTask,
   isTaskPattern,
   parseDependencySpec,
@@ -17,7 +20,12 @@ import {
   type PackageGraph,
   PROJECT_CONFIG_FILENAMES,
   type ProjectEntry,
+  type ProjectMeta,
 } from '../workspace/index.js'
+import { applyGraphStage } from './graph-stage.js'
+import { hasHook } from './plugin-host.js'
+import type { VxPlugin } from './plugin.js'
+import { isDefaultBuild } from './projects.js'
 
 /** Every file in this set re-keys each of its project's tasks, whatever their inputs. */
 const KEYED_BY_EVERY_TASK = new Set(['package.json', ...PROJECT_CONFIG_FILENAMES])
@@ -146,3 +154,60 @@ export function affectedRoots(
   }
   return ids.filter(reaches)
 }
+
+/**
+ * The requested tasks `--affected` keeps, in their order: one the user
+ * named (`pkg#task`), one in a project another include selected outright
+ * (X-10), and one whose closure the change reaches.
+ */
+export function keptByAffected<R extends { project: string; task: string }>(
+  nodes: ReadonlyMap<string, TaskNode>,
+  requested: readonly R[],
+  changes: AffectedChanges,
+  projects: ReadonlyMap<string, ProjectEntry>,
+  packageGraph: PackageGraph,
+  keep: { named?: ReadonlySet<string>; outright?: ReadonlySet<string> } = {},
+): R[] {
+  const ids = requested.map((r) => `${r.project}#${r.task}`)
+  const reached = new Set(affectedRoots(nodes, ids, changes, projects, packageGraph))
+  return requested.filter(
+    (r, i) =>
+      keep.named?.has(ids[i]!) === true ||
+      keep.outright?.has(r.project) === true ||
+      reached.has(ids[i]!),
+  )
+}
+
+/**
+ * The projects whose `task` a `vx run <task> --affected` over `candidates`
+ * keeps (`vx show <task> --affected`): the run's graph, `graph` stage and
+ * selection, without opening a cache or keying a task.
+ */
+export async function affectedTaskProjects(args: {
+  task: string
+  candidates: readonly string[]
+  changes: AffectedChanges
+  outright?: readonly string[] | undefined
+  projects: Map<string, ProjectEntry>
+  packageGraph: PackageGraph
+  projectMetas: readonly ProjectMeta[]
+  plugins: readonly VxPlugin[]
+  workspaceRoot: string
+  cacheDir: string
+  rules?: WorkspaceRules | undefined
+  warn: (message: string) => void
+}): Promise<string[]> {
+  const requested = expandRequested([args.task], args.candidates, args.projects, isDefaultBuild)
+  const nodes = buildTaskGraph({
+    projects: args.projects,
+    packageGraph: args.packageGraph,
+    requested,
+    workspaceRoot: args.workspaceRoot,
+    rules: args.rules,
+  })
+  if (hasHook(args.plugins, 'graph')) await applyGraphStage(args.plugins, nodes, args)
+  const kept = keptByAffected(nodes, requested, args.changes, args.projects, args.packageGraph, {
+    outright: new Set(args.outright),
+  })
+  return kept.map((r) => r.project)
+}

package/src/orchestrator/graph-stage.ts

@@ -0,0 +1,48 @@
+// The `graph` stage as a run applies it, shared by `prepareRun` and the
+// CLI's `--affected` task selection (`vx show <task> --affected`), so both
+// select over the graph the hooks leave.
+
+import type { WorkspaceRules } from '../config.js'
+import type { TaskNode } from '../graph/index.js'
+import { type ProjectMeta, validateProjectConfig } from '../workspace/index.js'
+import { applyGraphHooks } from './plugin-host.js'
+import type { VxPlugin } from './plugin.js'
+import { isDefaultBuild } from './projects.js'
+
+export async function applyGraphStage(
+  plugins: readonly VxPlugin[],
+  nodes: Map<string, TaskNode>,
+  args: {
+    workspaceRoot: string
+    cacheDir: string
+    projectMetas: readonly ProjectMeta[]
+    warn: (message: string) => void
+    rules?: WorkspaceRules | undefined
+  },
+): Promise<void> {
+  // A hook edits each node's config in place, as `project` does, so the
+  // edit is held to what the loader accepts from a user: a misspelled
+  // `exec` field ran as an empty command and failed with no reason.
+  const configPaths = new Map(args.projectMetas.map((m) => [m.name, m.configPath]))
+  await applyGraphHooks(
+    plugins,
+    nodes,
+    {
+      workspaceRoot: args.workspaceRoot,
+      cacheDir: args.cacheDir,
+      warn: args.warn,
+      requested: [...nodes.values()].filter((n) => n.requested).map((n) => n.id),
+    },
+    (plugin) => {
+      for (const n of nodes.values()) {
+        if (isDefaultBuild(n.config)) continue
+        const where = configPaths.get(n.projectName) ?? `${n.projectName} (no config file)`
+        validateProjectConfig(
+          { tasks: { [n.taskName]: n.config } },
+          `${where} (after plugin '${plugin.name}')`,
+        )
+      }
+    },
+    args.rules,
+  )
+}

package/src/orchestrator/index.ts

@@ -3,6 +3,7 @@
 
 export { run, planRun, nxProjectTarget, projectNamed } from './run.js'
 export { prepareRun, type PreparedRun } from './prepare.js'
+export { affectedTaskProjects } from './affected-tasks.js'
 export {
   discoverProjects,
   gitOfDiscovery,

package/src/orchestrator/prepare.ts

@@ -39,7 +39,6 @@ import {
   resolveCacheDir,
   resolveStoreRoot,
   type ProjectEntry,
-  validateProjectConfig,
 } from '../workspace/index.js'
 import {
   buildTaskGraph,
@@ -51,7 +50,6 @@ import {
   unresolvedRequests,
 } from '../graph/index.js'
 import {
-  applyGraphHooks,
   applyKeyHooks,
   applyScheduleHooks,
   fingerprintClaims,
@@ -68,7 +66,8 @@ import {
   loadWorkspacePlugins,
   type LoadedProjects,
 } from './projects.js'
-import { affectedRoots } from './affected-tasks.js'
+import { keptByAffected } from './affected-tasks.js'
+import { applyGraphStage } from './graph-stage.js'
 import { keyExcludedDependencies } from './excluded-keys.js'
 import { FingerprintWatch } from './fingerprint-watch.js'
 import type { VxPlugin } from './plugin.js'
@@ -527,33 +526,14 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       })
     let nodes = graphOf(requested)
     const hasGraphHook = hasHook(plugins, 'graph')
-    const graphStage = async (): Promise<void> => {
-      // A hook edits each node's config in place, as `project` does, so the
-      // edit is held to what the loader accepts from a user: a misspelled
-      // `exec` field ran as an empty command and failed with no reason.
-      const configPaths = new Map(projectMetas.map((m) => [m.name, m.configPath]))
-      await applyGraphHooks(
-        plugins,
-        nodes,
-        {
-          workspaceRoot,
-          cacheDir,
-          warn: (m) => log.status(m),
-          requested: [...nodes.values()].filter((n) => n.requested).map((n) => n.id),
-        },
-        (plugin) => {
-          for (const n of nodes.values()) {
-            if (isDefaultBuild(n.config)) continue
-            const where = configPaths.get(n.projectName) ?? `${n.projectName} (no config file)`
-            validateProjectConfig(
-              { tasks: { [n.taskName]: n.config } },
-              `${where} (after plugin '${plugin.name}')`,
-            )
-          }
-        },
-        workspaceConfig?.rules,
-      )
-    }
+    const graphStage = (): Promise<void> =>
+      applyGraphStage(plugins, nodes, {
+        workspaceRoot,
+        cacheDir,
+        projectMetas,
+        warn: (m) => log.status(m),
+        rules: workspaceConfig?.rules,
+      })
     // `--affected` selects over the FINAL graph: an edge or an input a
     // `graph` hook adds moves a key, so the hooks run first, over every
     // candidate, and the selection prunes what they left.
@@ -563,16 +543,13 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     if (options.affected !== undefined) {
       const before = hooksFirst ? new Set(nodes.keys()) : null
       if (hooksFirst) await graphStage()
-      const named = new Set(tasks.filter((t) => t.includes('#')))
-      const outright = new Set(options.selectedOutright)
-      const ids = requested.map((r) => `${r.project}#${r.task}`)
-      const reached = new Set(affectedRoots(nodes, ids, options.affected, projects, packageGraph))
-      const kept = requested.filter(
-        (r, i) => named.has(ids[i]!) || outright.has(r.project) || reached.has(ids[i]!),
-      )
+      const kept = keptByAffected(nodes, requested, options.affected, projects, packageGraph, {
+        named: new Set(tasks.filter((t) => t.includes('#'))),
+        outright: new Set(options.selectedOutright),
+      })
       if (kept.length === 0) return emptyRun('none-affected')
       if (before !== null) {
-        const asked = new Set(ids)
+        const asked = new Set(requested.map((r) => `${r.project}#${r.task}`))
         // What a hook added or asked for is the plugin's choice, kept as it
         // would be on a run without the diff.
         const roots = [