@vzn/vx 0.0.633 → 0.0.635

package/src/cli/init.ts

@@ -421,12 +421,17 @@ const INSTALL: Record<PackageManager, string> = {
 
 const EXEC: Record<PackageManager, string> = { pnpm: 'pnpm', yarn: 'yarn', bun: 'bunx', npm: 'npx' }
 
-/** Install what the workspace file imports, if missing, then run the repo's build. */
+/**
+ * Install what the workspace file imports, if missing, then run the repo's
+ * build. Pinned to this vx's version: every @vzn package releases in
+ * lockstep, and `latest` beside an older vx mismatched them (agent trial 2).
+ */
 export function adoptionNext(
   root: string,
   runner: 'turbo' | 'nx',
   source: string,
   needs: readonly string[] = ['@vzn/vx', '@vzn/vx-migrate'],
+  version: string = VERSION,
 ): string {
   const pm = LOCKFILES.find(([f]) => existsSync(path.join(root, f)))?.[1] ?? 'npm'
   const missing = needs.filter(
@@ -443,7 +448,9 @@ export function adoptionNext(
     pm === 'yarn' && !readText(path.join(root, 'yarn.lock')).includes('__metadata:')
       ? `${INSTALL.yarn} -W`
       : INSTALL[pm]
-  return `${install} ${missing.join(' ')} && ${run}`
+  // A source checkout is 0.0.0, which npm never had.
+  const pinned = version === '0.0.0' ? missing : missing.map((p) => `${p}@${version}`)
+  return `${install} ${pinned.join(' ')} && ${run}`
 }
 
 function readText(file: string): string {

package/src/cli/last.ts

@@ -384,7 +384,15 @@ export async function lastCmd(args: readonly string[]): Promise<number> {
       )
       const tasks = (detail?.tasks ?? []).map((t) => {
         const f = failures.get(`${t.project}#${t.task}`)
-        return f === undefined ? t : { ...t, output: f.output, locations: f.locations }
+        return f === undefined
+          ? t
+          : {
+              ...t,
+              output: f.output,
+              locations: f.locations,
+              ...(f.sandboxFix !== undefined ? { sandboxFix: f.sandboxFix } : {}),
+              ...(f.fixedIn !== undefined ? { fixedIn: f.fixedIn } : {}),
+            }
       })
       process.stdout.write(`${JSON.stringify({ invocation: inv, tasks })}\n`)
       return 0

package/src/cli/plan-format.ts

@@ -145,10 +145,12 @@ export interface PlanTaskJson {
   affected?: AffectedReason
 }
 
-export function formatPlanJson(plan: RunPlan): string {
+/** `affectedBase`: the ref a bare `--affected` guessed (or was given), so a reader knows what the diff was against. */
+export function formatPlanJson(plan: RunPlan, affectedBase?: string): string {
   return (
     JSON.stringify(
       {
+        ...(affectedBase !== undefined ? { affectedBase } : {}),
         tasks: plan.tasks.map((t): PlanTaskJson => {
           const description = shownDescription(t)
           return {

package/src/cli/plugin-templates.ts

@@ -10,7 +10,7 @@ export const PLUGIN_TEMPLATES: Readonly<Record<string, { plugin: string; test: s
   },
   cache: {
     plugin:
-      "// `cache`: where artifacts live. A directory stands in for a remote store;\n// `LayeredCache` puts it behind the local cache, so a remote error is a\n// miss and a warning, never a failed run.\nimport { mkdir, rename } from 'node:fs/promises'\nimport path from 'node:path'\nimport { definePlugin, LayeredCache, type RemoteCacheLayer, type VxPlugin } from '@vzn/vx'\n\nclass DirRemote implements RemoteCacheLayer {\n  constructor(readonly endpoint: string) {}\n  async has(hash: string): Promise<boolean> {\n    return Bun.file(path.join(this.endpoint, hash)).exists()\n  }\n  async get(hash: string) {\n    const file = Bun.file(path.join(this.endpoint, hash))\n    return (await file.exists()) ? { body: file, durationMs: undefined } : null\n  }\n  async put(hash: string, body: Blob): Promise<void> {\n    await mkdir(this.endpoint, { recursive: true })\n    // Written aside, then renamed: a reader never sees half an artifact.\n    const tmp = path.join(this.endpoint, `.${hash}.${process.pid}`)\n    await Bun.write(tmp, body)\n    await rename(tmp, path.join(this.endpoint, hash))\n  }\n}\n\nexport function dirCache(dir: string): VxPlugin {\n  return definePlugin(import.meta, {\n    cache(ctx) {\n      return new LayeredCache(ctx.localCache, new DirRemote(dir), {\n        policy: ctx.policy,\n        onRemoteError: (err) => ctx.warn(`dir-cache: ${err.message}`),\n      })\n    },\n  })\n}\n",
+      "// `cache`: where artifacts live. A directory stands in for a remote store;\n// `LayeredCache` puts it behind the local cache, so a remote error is a\n// miss and a warning, never a failed run.\nimport { link, mkdir, unlink } from 'node:fs/promises'\nimport path from 'node:path'\nimport { definePlugin, LayeredCache, type RemoteCacheLayer, type VxPlugin } from '@vzn/vx'\n\nclass DirRemote implements RemoteCacheLayer {\n  constructor(readonly endpoint: string) {}\n  async has(hash: string): Promise<boolean> {\n    return Bun.file(path.join(this.endpoint, hash)).exists()\n  }\n  async get(hash: string) {\n    const file = Bun.file(path.join(this.endpoint, hash))\n    return (await file.exists()) ? { body: file, durationMs: undefined } : null\n  }\n  async put(hash: string, body: Blob): Promise<void> {\n    await mkdir(this.endpoint, { recursive: true })\n    // Written aside, then linked: on a shared directory a rename can swap\n    // the file under a reader, while a link never replaces an existing one.\n    // EEXIST is success: the same hash means the same bytes.\n    const tmp = path.join(this.endpoint, `.${hash}.${process.pid}`)\n    await Bun.write(tmp, body)\n    try {\n      await link(tmp, path.join(this.endpoint, hash))\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err\n    } finally {\n      await unlink(tmp)\n    }\n  }\n}\n\nexport function dirCache(dir: string): VxPlugin {\n  return definePlugin(import.meta, {\n    cache(ctx) {\n      return new LayeredCache(ctx.localCache, new DirRemote(dir), {\n        policy: ctx.policy,\n        onRemoteError: (err) => ctx.warn(`dir-cache: ${err.message}`),\n      })\n    },\n  })\n}\n",
     test: "// A test for the example `cache` plugin beside it: a throwaway workspace\n// declares the plugin and vx's own run() drives it. `bun test` runs it.\nimport { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { afterEach, beforeEach, expect, it } from 'bun:test'\nimport { run, type Logger } from '@vzn/vx'\n\nlet root: string\nbeforeEach(async () => {\n  root = await mkdtemp(path.join(os.tmpdir(), 'vx-plugin-cache-'))\n  await writeFile(path.join(root, 'package.json'), JSON.stringify({ name: 'ws', private: true }))\n  await writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages:\\n  - \"packages/*\"\\n')\n  Bun.spawnSync({ cmd: ['git', 'init', '-q'], cwd: root })\n})\nafterEach(async () => {\n  await rm(root, { recursive: true, force: true })\n})\n\n/** A package `name` whose `vx.config.mjs` is `config`. */\nasync function pkg(\n  name: string,\n  config: string,\n  scripts?: Record<string, string>,\n): Promise<string> {\n  const dir = path.join(root, 'packages', name)\n  await mkdir(dir, { recursive: true })\n  await writeFile(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name, version: '1.0.0', ...(scripts ? { scripts } : {}) }),\n  )\n  await writeFile(path.join(dir, 'vx.config.mjs'), config)\n  return dir\n}\n\n/** A `vx.workspace.mjs` declaring `call`, e.g. `dirCache()`, from the plugin file beside this test. */\nasync function workspace(call: string): Promise<void> {\n  const from = JSON.stringify(path.join(import.meta.dir, 'cache.ts'))\n  await writeFile(\n    path.join(root, 'vx.workspace.mjs'),\n    `import { dirCache } from ${from}\\nexport default { plugins: [${call}] }\\n`,\n  )\n}\n\nfunction log(order: string[] = []): Logger {\n  return {\n    status() {},\n    taskStart(node) {\n      order.push(`start ${node.id}`)\n    },\n    taskStdout() {},\n    taskStderr() {},\n    taskComplete(node) {\n      order.push(`end ${node.id}`)\n    },\n  }\n}\n\nit('a run on an empty local cache restores from the directory', async () => {\n  const dir = await pkg(\n    'a',\n    `export default { tasks: { build: {\n      exec: { command: 'mkdir -p dist && echo built > dist/out.txt' },\n      cache: { inputs: { files: ['package.json'] }, outputs: { files: ['dist/**'] } },\n    } } }`,\n  )\n  await workspace(`dirCache(${JSON.stringify(path.join(root, 'remote'))})`)\n  const first = await run({ cwd: root, tasks: ['build'], log: log(), handleSignals: false })\n  expect(first.outcomes.map((o) => o.status)).toEqual(['success'])\n  await rm(path.join(root, '.vx'), { recursive: true, force: true })\n  await rm(path.join(dir, 'dist'), { recursive: true, force: true })\n  const second = await run({ cwd: root, tasks: ['build'], log: log(), handleSignals: false })\n  expect(second.outcomes.map((o) => o.status)).toEqual(['cache-hit-remote'])\n  expect(await Bun.file(path.join(dir, 'dist', 'out.txt')).text()).toBe('built\\n')\n}, 20_000)\n",
   },
   commands: {

package/src/cli/run.ts

@@ -479,7 +479,9 @@ function onCI(v: string | undefined): boolean {
 async function scopeFilters(
   parsed: RunArgs,
   cwd: string,
-): Promise<{ filterStrings: string[]; affectedFilter?: string } | { error: string }> {
+): Promise<
+  { filterStrings: string[]; affectedFilter?: string } | { error: string; code?: string }
+> {
   // `--affected[=<base>]` is sugar for `--filter '...[<base>]'`: the
   // changed projects AND their dependents — what a CI gate must run, what
   // the flag's name says, what the guides promised while the sugar was the
@@ -521,7 +523,9 @@ export async function resolveRunOptions(
   cwd: string,
   tasks: readonly string[],
   verb: 'run' | 'watch' = 'run',
-): Promise<RunOptions | { error: string } | { nothingSelected: string }> {
+  /** Given, it learns the ref `--affected` diffed from (`--dry=json` states it). */
+  scopeOut?: { affectedBase?: string },
+): Promise<RunOptions | { error: string; code?: string } | { nothingSelected: string }> {
   for (const t of tasks) {
     const idx = t.indexOf('#')
     if (idx >= 0) {
@@ -536,6 +540,9 @@ export async function resolveRunOptions(
   const scope = await scopeFilters(parsed, cwd)
   if ('error' in scope) return scope
   const { filterStrings, affectedFilter } = scope
+  // `...[<base>]`: the base alone.
+  if (scopeOut !== undefined && affectedFilter !== undefined)
+    scopeOut.affectedBase = affectedFilter.slice(4, -1)
 
   // Project scope applies to bare task names only. Anchored entries
   // (pkg#task) resolve directly to their own project regardless.
@@ -561,7 +568,7 @@ export async function resolveRunOptions(
           affectedFilter,
         )
       : undefined
-  if (resolved !== undefined && 'error' in resolved) return { error: resolved.error }
+  if (resolved !== undefined && 'error' in resolved) return resolved
   if (bareTasks.length === 0) {
     projects = undefined
   } else if (resolved !== undefined) {
@@ -691,11 +698,12 @@ export async function runCmd(args: readonly string[]): Promise<number> {
     // `--filter` / `--affected` scope the menu, as they scope a bare task:
     // the menu listed every project and the anchored pick ran outside it.
     const scope = await scopeFilters(parsed, cwd)
-    if ('error' in scope) return refuse('run', args, scope.error, 'VX_E_USAGE')
+    if ('error' in scope) return refuse('run', args, scope.error, scope.code ?? 'VX_E_USAGE')
     let only: ReadonlySet<string> | undefined
     if (scope.filterStrings.length > 0) {
       const selected = await resolveFilters(cwd, scope.filterStrings, load, scope.affectedFilter)
-      if ('error' in selected) return refuse('run', args, selected.error, 'VX_E_USAGE')
+      if ('error' in selected)
+        return refuse('run', args, selected.error, selected.code ?? 'VX_E_USAGE')
       if ('empty' in selected) {
         process.stderr.write(`vx run: ${selected.empty}\n`)
         return 0
@@ -709,8 +717,9 @@ export async function runCmd(args: readonly string[]): Promise<number> {
     tasks = [picked]
   }
 
-  const resolved = await resolveRunOptions(parsed, cwd, tasks)
-  if ('error' in resolved) return refuse('run', args, resolved.error, 'VX_E_USAGE')
+  const scopeOut: { affectedBase?: string } = {}
+  const resolved = await resolveRunOptions(parsed, cwd, tasks, 'run', scopeOut)
+  if ('error' in resolved) return refuse('run', args, resolved.error, resolved.code ?? 'VX_E_USAGE')
   if ('nothingSelected' in resolved) {
     process.stderr.write(`vx run: ${resolved.nothingSelected}\n`)
     return 0
@@ -769,7 +778,7 @@ export async function runCmd(args: readonly string[]): Promise<number> {
         }
       }
     } else if (parsed.dry === 'json') {
-      process.stdout.write(formatPlanJson(plan))
+      process.stdout.write(formatPlanJson(plan, scopeOut.affectedBase))
     } else {
       process.stdout.write(formatPlanText(plan))
     }

package/src/cli/select.ts

@@ -197,7 +197,7 @@ export type FilterResolution =
       /** What the other includes selected (`RunOptions.selectedOutright`). */
       outright?: string[]
     }
-  | { error: string }
+  | Refusal
   | { empty: string }
 
 /**
@@ -239,16 +239,23 @@ export function taskEdgesFrom(staged: ReadonlyMap<string, ProjectEntry>): Map<st
   return out
 }
 
+/** A refusal a resolver returns; `code` is the thrown one's own, when it has one. */
+type Refusal = { error: string; code?: string }
+
+function refusalOf(err: unknown): Refusal {
+  if (!(err instanceof Error)) return { error: String(err) }
+  return isUserError(err) && err.code !== 'VX_E_REFUSED'
+    ? { error: err.message, code: err.code }
+    : { error: err.message }
+}
+
 /**
  * The filter `--affected[=<base>]` stands for: `...[<base>]`, the changed
  * projects and their dependents. An empty base is the workspace's
  * `affectedBase` (or a plugin's `config` stage, from nx.json's
  * `defaultBase` or `TURBO_SCM_BASE`), then the guess.
  */
-export async function affectedFilterFor(
-  cwd: string,
-  affected: string,
-): Promise<string | { error: string }> {
+export async function affectedFilterFor(cwd: string, affected: string): Promise<string | Refusal> {
   const root = await findWorkspaceRoot(cwd)
   let base = affected
   if (base === '') base = (await loadCliWorkspace(root)).workspaceConfig?.affectedBase ?? ''
@@ -257,7 +264,7 @@ export async function affectedFilterFor(
       base = await defaultAffectedBase(root)
     } catch (err) {
       if (!isUserError(err)) throw err
-      return { error: err.message }
+      return refusalOf(err)
     }
   }
   return `...[${base}]`
@@ -276,7 +283,7 @@ export async function resolveFilters(
   try {
     parsed = raw.map((r) => parseFilter(r, root))
   } catch (err) {
-    return { error: err instanceof Error ? err.message : String(err) }
+    return refusalOf(err)
   }
   // `sinceViaDeps` (`e2e...[main]`) walks the changed projects' dependents.
   const walksGraph = parsed.some(
@@ -299,7 +306,7 @@ export async function resolveFilters(
     try {
       edges = taskEdgesFrom(await stagedOnce())
     } catch (err) {
-      return { error: err instanceof Error ? err.message : String(err) }
+      return refusalOf(err)
     }
   }
   // A tag lives in the config, so a `tag:` selector needs the staged load
@@ -309,7 +316,7 @@ export async function resolveFilters(
     try {
       tags = new Map([...(await stagedOnce()).values()].map((p) => [p.name, p.config.tags ?? []]))
     } catch (err) {
-      return { error: err instanceof Error ? err.message : String(err) }
+      return refusalOf(err)
     }
   }
   const graph = buildPackageGraph(projects, edges)
@@ -353,8 +360,7 @@ export async function resolveFilters(
       }
       affectedByFilter.set(f, names)
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err)
-      return { error: msg }
+      return refusalOf(err)
     }
   }
 

package/src/cli/show.ts

@@ -145,12 +145,12 @@ export async function showCmd(args: readonly string[]): Promise<number> {
     let affected: string | undefined
     if (parsed.affected !== undefined) {
       const f = await affectedFilterFor(process.cwd(), parsed.affected)
-      if (typeof f === 'object') throw new UserError(`vx show: ${f.error}`, 'VX_E_USAGE')
+      if (typeof f === 'object') throw new UserError(`vx show: ${f.error}`, f.code ?? 'VX_E_USAGE')
       affected = f
       raw.unshift(f)
     }
     const r = await resolveFilters(process.cwd(), raw, { noCreate: true }, affected)
-    if ('error' in r) throw new UserError(`vx show: ${r.error}`, 'VX_E_USAGE')
+    if ('error' in r) throw new UserError(`vx show: ${r.error}`, r.code ?? 'VX_E_USAGE')
     if ('empty' in r) process.stderr.write(`vx show: ${r.empty}\n`)
     selected = new Set('empty' in r ? [] : r.names)
     if ('names' in r && r.affected !== undefined)

package/src/config.ts

@@ -46,6 +46,15 @@ export interface WorkspaceConfig {
    * folded into a cache key.
    */
   cacheScope?: string
+  /**
+   * Which ready task starts first when there are more than workers, with no
+   * timings: `most-work` (the default) the one the most work waits on at
+   * any depth, `critical-path` the head of the longest chain of tasks,
+   * `direct-dependents` the one the most tasks wait on directly (Nx's
+   * rule), `ready-order` the one that became ready first (Turbo's). A
+   * `schedule` plugin's weights still come first; this breaks their ties.
+   */
+  schedule?: 'most-work' | 'critical-path' | 'direct-dependents' | 'ready-order'
   /**
    * Graph rules a run checks before it schedules anything. Each is on unless
    * set to `false`; turning one off allows a shape vx handles correctly but
@@ -56,9 +65,11 @@ export interface WorkspaceConfig {
    * Plugins registered for this workspace, consulted in this order once
    * per `vx run`: each fills any of the pipeline stages and capabilities
    * below, and core's own executor and cache store sit at the tail of
-   * every list. See `docs/design/pipeline-2026-09.md`.
+   * every list. See `docs/design/pipeline-2026-09.md`. An `undefined`,
+   * `null` or `false` entry is skipped, so a factory that declines
+   * (`github()` off Actions) or `cond && plugin()` needs no filter.
    */
-  plugins?: readonly Plugin[]
+  plugins?: readonly (Plugin | undefined | null | false)[]
 }
 
 /** `WorkspaceConfig.rules`. */
@@ -479,6 +490,16 @@ export interface CacheConfig {
   inputs: CacheInputs
   /** What this task produces. Captured for restore on a cache hit. */
   outputs: CacheOutputs
+  /**
+   * What a write to an input while the command runs means. `'withhold'`
+   * (the default): the entry is not saved, whatever the file holds after,
+   * since an edit undone mid-run cannot be told from no edit. `'compare'`:
+   * a file rewritten to the bytes the key folded counts as unchanged, for
+   * a task that rewrites its own input identically (tsdown's
+   * `package.json`). `VX_REWRITTEN_INPUTS=compare` sets the default for
+   * every task that does not say.
+   */
+  rewrittenInputs?: 'withhold' | 'compare'
 }
 
 export interface CacheOutputs {

package/src/graph/priorities.ts

@@ -125,20 +125,26 @@ export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string
   }
 
   // Reverse-topo sweep: every direct dependent's closure is final
-  // before its dependency folds it in. closure[i] = bitset over node
-  // indices of i's transitive dependents.
+  // before its dependency folds it in. closure[t] = bitset over topo
+  // POSITIONS of the node at position t's transitive dependents. A
+  // dependent sits after its dependency, so a closure holds only bits
+  // past its own position, and each OR starts at the dependent's word:
+  // half the words of indexing by insertion order on a layered graph.
+  const pos = new Int32Array(n)
+  for (let t = 0; t < tail; t++) pos[topo[t]!] = t
   const closure = new Uint32Array(n * words)
   const counts = new Map<string, number>()
   for (let t = tail - 1; t >= 0; t--) {
     const i = topo[t]!
-    const base = i * words
-    for (const r of directReverse[i]!) {
+    const base = t * words
+    for (const ri of directReverse[i]!) {
+      const r = pos[ri]!
       closure[base + (r >>> 5)]! |= 1 << (r & 31)
       const rbase = r * words
-      for (let w = 0; w < words; w++) closure[base + w]! |= closure[rbase + w]!
+      for (let w = r >>> 5; w < words; w++) closure[base + w]! |= closure[rbase + w]!
     }
     let count = 0
-    for (let w = 0; w < words; w++) {
+    for (let w = t >>> 5; w < words; w++) {
       let v = closure[base + w]!
       v = v - ((v >>> 1) & 0x55555555)
       v = (v & 0x33333333) + ((v >>> 2) & 0x33333333)
@@ -153,6 +159,66 @@ export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string
   return counts
 }
 
+/**
+ * The ready-queue baseline a workspace may pick in place of the default
+ * (`schedule` in vx.workspace.ts). Each ranks with no timings; a `schedule`
+ * plugin's weights still sort above it, and it breaks their ties.
+ *   - `most-work`: transitive dependents (`computeReverseDepCount`), the default.
+ *   - `critical-path`: steps on the longest chain of dependents below a task.
+ *   - `direct-dependents`: direct dependents only, Nx's rule.
+ *   - `ready-order`: none; the task that became ready first starts first, Turbo's rule.
+ */
+export type ScheduleStrategy = 'most-work' | 'critical-path' | 'direct-dependents' | 'ready-order'
+
+/** The baseline for a strategy other than `most-work`, over the whole graph. */
+export function strategyPriorities(
+  nodes: Map<string, TaskNode>,
+  strategy: Exclude<ScheduleStrategy, 'most-work'>,
+): Map<string, number> {
+  const out = new Map<string, number>()
+  if (strategy === 'ready-order') {
+    for (const id of nodes.keys()) out.set(id, 0)
+    return out
+  }
+  const dependents = new Map<string, string[]>()
+  for (const node of nodes.values()) {
+    for (const dep of node.deps) {
+      if (!nodes.has(dep)) continue
+      const list = dependents.get(dep)
+      if (list === undefined) dependents.set(dep, [node.id])
+      else list.push(node.id)
+    }
+  }
+  if (strategy === 'direct-dependents') {
+    for (const id of nodes.keys()) out.set(id, dependents.get(id)?.length ?? 0)
+    return out
+  }
+  // Longest chain below each task, dependents first: a task's depth is one
+  // more than its deepest dependent's. Iterative, as a deep chain would
+  // overflow a recursive walk.
+  const left = new Map<string, number>()
+  const ready: string[] = []
+  for (const id of nodes.keys()) {
+    const n = dependents.get(id)?.length ?? 0
+    left.set(id, n)
+    if (n === 0) ready.push(id)
+  }
+  while (ready.length > 0) {
+    const id = ready.pop()!
+    let depth = 0
+    for (const d of dependents.get(id) ?? []) depth = Math.max(depth, out.get(d)! + 1)
+    out.set(id, depth)
+    for (const dep of nodes.get(id)!.deps) {
+      if (!nodes.has(dep)) continue
+      const n = left.get(dep)! - 1
+      left.set(dep, n)
+      if (n === 0) ready.push(dep)
+    }
+  }
+  for (const id of nodes.keys()) if (!out.has(id)) out.set(id, 0)
+  return out
+}
+
 export function mergePriorities(
   baseline: ReadonlyMap<string, number>,
   overrides: ReadonlyMap<string, number>,

package/src/graph/scheduler.ts

@@ -5,7 +5,13 @@ import {
   isUserError,
   OUT_OF_FDS_HINT,
 } from '../util/index.js'
-import { computeReverseDepCount, mergePriorities, tieredReverseDepCount } from './priorities.js'
+import {
+  computeReverseDepCount,
+  mergePriorities,
+  strategyPriorities,
+  tieredReverseDepCount,
+  type ScheduleStrategy,
+} from './priorities.js'
 import { isGroupTask, type TaskNode } from './task-graph.js'
 
 /**
@@ -202,6 +208,15 @@ export interface TaskOutcome {
    * inline in the task's block instead of as loose status output.
    */
   sandboxViolationLines?: string[]
+  /** The `exec.sandbox.allow` entries that would have granted the denials. */
+  sandboxFix?: {
+    read?: string[]
+    write?: string[]
+    network?: string[]
+    systemInfo?: string[]
+    /** Credential paths denied and left out of the grants: an agent applies the fix as given. */
+    withheld?: string[]
+  }
 }
 
 export type ContinueMode = 'never' | 'deps-ok' | 'always'
@@ -278,6 +293,11 @@ export interface ScheduleOptions {
    * heuristic (the default and historically the only behavior).
    */
   priorities?: ReadonlyMap<string, number>
+  /**
+   * The baseline ranking under `priorities` (`schedule` in vx.workspace.ts).
+   * Undefined or `most-work` is the reverse-deps count above.
+   */
+  strategy?: ScheduleStrategy
   /**
    * Restore-tier task ids: confirmed stable-key LOCAL cache hits (the
    * local short-circuit). A restore-tier task:
@@ -494,9 +514,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // use those weights. Falls back to the reverse-deps-count heuristic
   // for nodes the caller didn't score, so partial coverage works.
   const baseline =
-    options.restoreTier !== undefined && options.restoreTier.size > 0
-      ? tieredReverseDepCount(nodes, options.restoreTier)
-      : computeReverseDepCount(nodes)
+    options.strategy !== undefined && options.strategy !== 'most-work'
+      ? strategyPriorities(nodes, options.strategy)
+      : options.restoreTier !== undefined && options.restoreTier.size > 0
+        ? tieredReverseDepCount(nodes, options.restoreTier)
+        : computeReverseDepCount(nodes)
   const priority: ReadonlyMap<string, number> = options.priorities
     ? mergePriorities(baseline, options.priorities)
     : baseline
@@ -791,14 +813,16 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
       // tasks are never asked, so they never park.
       const takeFitting = (): string | undefined => {
         if (holding) return undefined
-        // No pools, no policy and a full exec lane: nothing on the
-        // exec queue can be admitted, so it is not scanned — scanning it
+        // No pools and a full exec lane: nothing on the exec queue can be
+        // admitted, so it is not scanned — an admit policy only narrows
+        // the count gate, never widens it (scanning under one cost the
+        // history plugin's cold bench run 10 s, 2026-10-09) — scanning it
         // would pop and re-park every ready exec task on every tick, and
         // with a wide frontier that is O(R) per tick, O(R²) per run (the
         // 6,000-task scale pin went 0.5 s → 28 s when the restore lane's
         // first cut let the scan run past a full exec lane, 2026-09-10).
         // This is the legacy O(1) gate, kept per lane.
-        const execAdmissible = poolOf !== undefined || admitActive || execRoom()
+        const execAdmissible = poolOf !== undefined || execRoom()
         if (execAdmissible) {
           while (execReady.size > 0) {
             const seq = execReady.peekSeq()