@vzn/vx 0.0.635 → 0.0.637

package/src/cli/run.ts

@@ -1,7 +1,7 @@
 import { appendFileSync, mkdirSync } from 'node:fs'
 import path from 'node:path'
 import { isatty } from 'node:tty'
-import { findWorkspaceRoot } from '../workspace/index.js'
+import { cacheScopeError, findWorkspaceRoot, isCacheScope } from '../workspace/index.js'
 import { translateForeign } from './foreign-flags.js'
 import { flagHint, formatValue, refuse, seeHelp } from './help.js'
 import {
@@ -14,6 +14,8 @@ import {
 } from '../orchestrator/index.js'
 import type { ContinueMode, TaskOutcome } from '../graph/index.js'
 import {
+  applyCacheFlags,
+  type CacheFlags,
   type CachePolicy,
   FULL_CACHE_POLICY,
   gitRefusal,
@@ -21,7 +23,8 @@ import {
 } from '../cache/index.js'
 import { affectedFilterFor, findCwdSelection, pickTask, resolveFilters } from './select.js'
 import { nxTargetHint, taskNamesHere } from './task-verb.js'
-import { MAX_TIMEOUT_MS, parseDecimalInt, machineParallelism } from '../util/index.js'
+import { parseDecimalInt } from '../util/index.js'
+import { kindHint, parseSettingValue, type Setting, SETTINGS, settingRefusal } from '../settings.js'
 import { formatGraphDot, formatPlanJson, formatPlanText } from './plan-format.js'
 
 export interface RunArgs {
@@ -42,30 +45,29 @@ export interface RunArgs {
    * `[...names]` → drop only these specific dep names.
    */
   excludeDependencies: 'all' | string[]
-  concurrency: number | undefined
   /**
-   * Resolved 4-axis cache policy after applying `--cache` / `--no-cache`
+   * The settings a flag set, by path (`run.timeout` → ms): each flag
+   * src/settings.ts names for the verb, parsed by its kind.
+   */
+  settings: Record<string, unknown>
+  /**
+   * Resolved 4-axis cache policy after applying `--cache-policy` / `--no-cache`
    * / `--force` in precedence order. Defaults to all-on.
    */
   cache: CachePolicy
-  /** `--cache` named a remote axis (`remote:r`, `:w`, `:rw`): the run says so when no plugin serves one. */
+  /**
+   * Neither `--cache-policy` nor `VX_CACHE_POLICY` named a spec: the run starts from the
+   * workspace's `cache.policy` and applies these on top.
+   */
+  cacheFlags?: CacheFlags
+  /** The policy named a remote axis (`remote:r`, `:w`, `:rw`): the run says so when no plugin serves one. */
   remoteRequested?: boolean
   /** `--cache-dir <path>`: override the cache directory (cwd-relative). */
   cacheDir: string | undefined
-  frozen: boolean
-  /**
-   * `--retry <n>` / `--retry=<n>`: run-level retry default for tasks
-   * without their own `exec.retries`. Undefined when not passed.
-   */
-  retries: number | undefined
-  /**
-   * `--timeout <ms>` / `--timeout=<ms>`: run-level default task timeout for
-   * tasks without their own `exec.timeout`. Sits above the `VX_TASK_TIMEOUT`
-   * env and workspace `timeout` defaults. Undefined when not passed.
-   */
-  timeout: number | undefined
-  outputLogs?: 'full' | 'errors-only' | 'none' | 'hash-only'
-  download?: 'all' | 'toplevel' | 'none'
+  /** `--cache-scope <name>`: this run's `cache.scope`, above `VX_CACHE_SCOPE` and the workspace's. */
+  cacheScope?: string
+  /** `vx watch --poll` (`watch.poll`). */
+  poll?: true
   forwardArgs: string[]
   verbosity: number
   dry: 'text' | 'json' | undefined
@@ -98,25 +100,42 @@ export interface RunArgs {
 // quoted literal, so the doc-drift test does not count it as an accepted flag.
 const RETIRED_EXCLUDE_DEPENDENCIES = /^--excludeDependencies(=|$)/
 
-/**
- * `--concurrency <n>` is a positive decimal integer, or `<n>%` of the
- * cores this process may use (`50%` on eight cores is 4, never below 1;
- * over 100% is allowed for I/O-bound work; a container's CPU quota caps
- * the count the way it caps the default). The percent form resolves
- * here, at parse time, so the run sees one number and the summary says
- * what it ran with.
- */
-export function parseConcurrency(v: string, cpus = machineParallelism()): number | null {
-  const pct = /^(\d+)%$/.exec(v)
-  if (pct) {
-    const n = parseDecimalInt(pct[1]!)
-    if (n === null || n < 1) return null
-    return Math.max(1, Math.round((Math.max(1, cpus) * n) / 100))
+/** `name` when `a` is it, bare or with `=`. */
+function flagOf(a: string | undefined, name: string): string | undefined {
+  return a === name || a?.startsWith(`${name}=`) ? name : undefined
+}
+
+// The settings parsed by their kind alone; the cache flags, `--continue`
+// and `--cache-dir` keep their own branches above.
+const GENERIC_FLAGS = SETTINGS.filter(
+  (s) =>
+    s.flag?.verb === 'run' &&
+    !['run.continue', 'cache.dir', 'cache.policy', 'cache.scope'].includes(s.path),
+)
+
+/** The setting a flag names. */
+function settingFlagOf(a: string): { s: Setting; name: string } | undefined {
+  for (const s of GENERIC_FLAGS) {
+    const name = s.flag!.name
+    if (flagOf(a, name) !== undefined) return { s, name }
   }
-  const n = parseDecimalInt(v)
-  return n === null || n < 1 ? null : n
+  return undefined
 }
 
+/** Each setting a flag sets, and the RunOptions field it lands in. */
+const SETTING_OPTIONS = [
+  ['run.concurrency', 'concurrency'],
+  ['run.schedule', 'schedule'],
+  ['run.branch', 'branch'],
+  ['run.timeout', 'timeout'],
+  ['run.retries', 'retries'],
+  ['run.outputLogs', 'outputLogs'],
+  ['run.killGrace', 'killGrace'],
+  ['run.teardownTimeout', 'teardownTimeout'],
+  ['run.readyNotice', 'readyNotice'],
+  ['cache.download', 'download'],
+] as const satisfies readonly (readonly [string, keyof RunOptions])[]
+
 /** `verb` is the one being parsed for: `vx watch` reads `vx run`'s flags, and
  * its flag hints named `vx run` (M-58). The caller appends the help pointer. */
 export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' = 'run'): RunArgs {
@@ -125,12 +144,9 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
     filters: [],
     all: false,
     excludeDependencies: [],
-    concurrency: undefined,
+    settings: {},
     cache: { ...FULL_CACHE_POLICY },
     cacheDir: undefined,
-    frozen: false,
-    retries: undefined,
-    timeout: undefined,
     forwardArgs: [],
     verbosity: 0,
     dry: undefined,
@@ -153,11 +169,12 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
   out.forwardArgs = sepIdx === -1 ? [] : args.slice(sepIdx + 1)
 
   // Cache policy is resolved AFTER the loop in precedence order:
-  // start all-true → apply each `--cache` spec → `--no-cache` forces
+  // start all-true → apply each `--cache-policy` spec → `--no-cache` forces
   // all false → `--force` forces both reads false. So `--no-cache`
-  // beats `--force`, and `--cache` is the base both may override.
+  // beats `--force`, and `--cache-policy` is the base both may override.
   let cachePolicy: CachePolicy = { ...FULL_CACHE_POLICY }
   let cacheSpecError: string | undefined
+  let cacheFlag = false
   let noCacheFlag = false
   let forceFlag = false
 
@@ -172,20 +189,6 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
           error: `--filter requires a value (a project name, glob or path, e.g. --filter app)`,
         }
       out.filters.push(v)
-    } else if (a === '--concurrency' || a?.startsWith('--concurrency=')) {
-      const v = a === '--concurrency' ? before[++i] : a.slice('--concurrency='.length)
-      if (v === undefined)
-        return {
-          ...out,
-          error: `--concurrency requires a value (a positive integer, or a share of the cores such as 50%)`,
-        }
-      const n = parseConcurrency(v)
-      if (n === null)
-        return {
-          ...out,
-          error: `--concurrency must be a positive integer, or a share of the cores such as 50% (got ${v})`,
-        }
-      out.concurrency = n
     } else if (a === '--all') {
       out.all = true
     } else if (RETIRED_EXCLUDE_DEPENDENCIES.test(a ?? '')) {
@@ -201,7 +204,7 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       // bare flag) and "drop none" (an empty list) are equally defensible
       // readings, and silently picking either does the opposite of what
       // half the callers mean. Reject and name both explicit forms; the
-      // sibling value flags (--retry=, --timeout=, --cache-dir=)
+      // sibling value flags (--retries=, --timeout=, --cache-dir=)
       // reject an empty `=` value the same way.
       if (raw === '') {
         return {
@@ -213,60 +216,6 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
         .split(',')
         .map((s) => s.trim())
         .filter((s) => s.length > 0)
-    } else if (a === '--frozen') {
-      out.frozen = true
-    } else if (a === '--retry' || a?.startsWith('--retry=')) {
-      const v = a === '--retry' ? before[++i] : a.slice('--retry='.length)
-      if (v === undefined)
-        return { ...out, error: `--retry requires a value (a non-negative integer)` }
-      const n = parseDecimalInt(v)
-      if (n === null) {
-        return { ...out, error: `--retry must be a non-negative integer (got ${v})` }
-      }
-      out.retries = n
-    } else if (a === '--timeout' || a?.startsWith('--timeout=')) {
-      const v = a === '--timeout' ? before[++i] : a.slice('--timeout='.length)
-      if (v === undefined)
-        return { ...out, error: `--timeout requires a value (a positive integer, in ms)` }
-      const n = parseDecimalInt(v)
-      if (n !== null && n > MAX_TIMEOUT_MS) {
-        // Not "effectively no limit" — setTimeout reduces a delay past 2^31-1
-        // to 1 ms, so this would kill every task the moment it spawned.
-        return {
-          ...out,
-          error:
-            `--timeout ${n} exceeds the maximum timer delay (${MAX_TIMEOUT_MS} ms, ~24.8 days); ` +
-            `larger values are silently reduced to 1 ms. Omit --timeout for no limit.`,
-        }
-      }
-      if (n === null || n <= 0) {
-        return { ...out, error: `--timeout must be a positive integer in ms (got ${v})` }
-      }
-      out.timeout = n
-    } else if (a === '--output-logs' || a?.startsWith('--output-logs=')) {
-      const v = a === '--output-logs' ? before[++i] : a.slice('--output-logs='.length)
-      if (v === undefined || v === '') {
-        return {
-          ...out,
-          error: `--output-logs requires a value (full, errors-only, hash-only, or none)`,
-        }
-      }
-      if (v !== 'full' && v !== 'errors-only' && v !== 'none' && v !== 'hash-only') {
-        return {
-          ...out,
-          error: `--output-logs must be full, errors-only, hash-only, or none (got ${v})`,
-        }
-      }
-      out.outputLogs = v
-    } else if (a === '--download' || a?.startsWith('--download=')) {
-      const v = a === '--download' ? before[++i] : a.slice('--download='.length)
-      if (v === undefined || v === '') {
-        return { ...out, error: `--download requires a value (all, toplevel, or none)` }
-      }
-      if (v !== 'all' && v !== 'toplevel' && v !== 'none') {
-        return { ...out, error: `--download must be all, toplevel, or none (got ${v})` }
-      }
-      out.download = v
     } else if (a === '--cache-dir' || a?.startsWith('--cache-dir=')) {
       const v = a === '--cache-dir' ? before[++i] : a.slice('--cache-dir='.length)
       if (v === undefined || v === '') return { ...out, error: `--cache-dir requires a path` }
@@ -282,14 +231,21 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
         }
       }
       out.cacheDir = v
-    } else if (a === '--cache' || a?.startsWith('--cache=')) {
-      const v = a === '--cache' ? before[++i] : a.slice('--cache='.length)
+    } else if (a === '--cache-scope' || a?.startsWith('--cache-scope=')) {
+      const v = a === '--cache-scope' ? before[++i] : a.slice('--cache-scope='.length)
+      if (v === undefined || !isCacheScope(v))
+        return { ...out, error: cacheScopeError('--cache-scope') }
+      out.cacheScope = v
+    } else if (flagOf(a, '--cache-policy')) {
+      cacheFlag = true
+      const name = flagOf(a, '--cache-policy')!
+      const v = a === name ? before[++i] : a!.slice(name.length + 1)
       if (v === undefined)
         return {
           ...out,
-          error: `--cache requires a value (a spec like local:r, local:rw, remote:, or local:,remote:rw)`,
+          error: `${name} requires a value (a spec like local:r, local:rw, remote:, or local:,remote:rw)`,
         }
-      // A spec with no segment at all applies NOTHING, so `--cache=`
+      // A spec with no segment at all applies NOTHING, so `--cache-policy=`
       // (an empty shell var, or someone reaching for "no cache") left
       // all four axes ON — the opposite of the intent. Reject it; an
       // empty flag list for a NAMED layer (`local:`) stays valid and
@@ -297,14 +253,14 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       if (!v.split(',').some((seg) => seg.trim().length > 0)) {
         return {
           ...out,
-          error: `--cache needs a spec like local:r, local:rw, remote:, or local:,remote:rw — pass --no-cache to disable every axis`,
+          error: `${name} needs a spec like local:r, local:rw, remote:, or local:,remote:rw — pass --no-cache to disable every axis`,
         }
       }
       try {
         cachePolicy = parseCachePolicy(v, cachePolicy)
         if (/remote:[rw]/.test(v)) out.remoteRequested = true
       } catch (err) {
-        cacheSpecError = err instanceof Error ? err.message : String(err)
+        cacheSpecError = `--cache-policy: ${err instanceof Error ? err.message : String(err)}`
       }
     } else if (a === '--no-cache') {
       noCacheFlag = true
@@ -397,6 +353,16 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
         return { ...out, error: `--report must be markdown (got ${fmt})` }
       }
       out.report = fmt
+    } else if (verb === 'watch' && a === '--poll') {
+      out.poll = true
+    } else if (a !== undefined && settingFlagOf(a) !== undefined) {
+      const { s: set, name } = settingFlagOf(a)!
+      const v = a === name ? before[++i] : a.slice(name.length + 1)
+      if (v === undefined || v === '')
+        return { ...out, error: `${name} requires a value (${kindHint(set.kind)})` }
+      const value = parseSettingValue(set.kind, v)
+      if (value === null) return { ...out, error: settingRefusal(set.path, name, v) }
+      out.settings[set.path] = value
     } else if (a !== undefined && a.startsWith('-')) {
       return { ...out, error: `unknown flag: ${a}${flagHint(verb, a)}` }
     } else if (a !== undefined) {
@@ -407,15 +373,32 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
   if (cacheSpecError !== undefined) {
     return { ...out, error: cacheSpecError }
   }
-  // Precedence: --no-cache (all off) beats --force (reads off, writes
-  // kept), both layered on top of any --cache spec.
-  if (noCacheFlag) {
-    cachePolicy = { localRead: false, localWrite: false, remoteRead: false, remoteWrite: false }
+  // `VX_CACHE_POLICY` is the spec a run takes when no flag names one.
+  const envSpec = process.env['VX_CACHE_POLICY'] || undefined
+  if (!cacheFlag && envSpec !== undefined) {
+    if (!envSpec.split(',').some((seg) => seg.trim().length > 0))
+      return {
+        ...out,
+        error: `VX_CACHE_POLICY needs a spec like local:r, local:rw, remote:, or local:,remote:rw`,
+      }
+    try {
+      cachePolicy = parseCachePolicy(envSpec, cachePolicy)
+    } catch (err) {
+      return {
+        ...out,
+        error: `VX_CACHE_POLICY: ${err instanceof Error ? err.message : String(err)}`,
+      }
+    }
+    if (/remote:[rw]/.test(envSpec)) out.remoteRequested = true
   }
-  if (forceFlag) {
-    cachePolicy = { ...cachePolicy, localRead: false, remoteRead: false }
+  // --no-cache (all off) beats --force (reads off, writes kept), both
+  // layered on top of the spec; with none named, on the workspace's.
+  const flags: CacheFlags = {
+    ...(noCacheFlag ? { noCache: true } : {}),
+    ...(forceFlag ? { force: true } : {}),
   }
-  out.cache = cachePolicy
+  out.cache = applyCacheFlags(cachePolicy, flags)
+  if (!cacheFlag && envSpec === undefined) out.cacheFlags = flags
 
   if (out.dry !== undefined && out.graph !== undefined) {
     return { ...out, error: '--dry and --graph are mutually exclusive' }
@@ -471,9 +454,6 @@ export function detectFlow(
 }
 
 /** `CI=0` / `CI=false` are not CI, as the output flow reads them. */
-function onCI(v: string | undefined): boolean {
-  return v !== undefined && v !== '' && v !== '0' && v !== 'false'
-}
 
 /** The filters a run's scope comes from: `--filter`s, with `--affected` as its `...[<base>]`. */
 async function scopeFilters(
@@ -561,10 +541,7 @@ export async function resolveRunOptions(
       ? await resolveFilters(
           cwd,
           filterStrings,
-          {
-            ...(parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {}),
-            ...(parsed.frozen ? { frozen: true } : {}),
-          },
+          parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {},
           affectedFilter,
         )
       : undefined
@@ -609,18 +586,18 @@ export async function resolveRunOptions(
   const opts: RunOptions = {
     cwd,
     tasks: [...tasks],
-    cache: parsed.cache,
+    ...(parsed.cacheFlags !== undefined
+      ? { cacheFlags: parsed.cacheFlags }
+      : { cache: parsed.cache }),
     ...(parsed.remoteRequested ? { remoteRequested: true } : {}),
+    ...(parsed.cacheScope !== undefined ? { cacheScope: parsed.cacheScope } : {}),
     // A laptop reads the shared cache and never writes it (owner,
-    // 2026-10-03); naming the remote in `--cache` is asking to.
+    // 2026-10-03); naming the remote in `--cache-policy` is asking to.
     ...(!parsed.remoteRequested && !onCI(process.env['CI'])
-      ? { defaultCacheScope: 'read-only' }
+      ? { remoteReadOnlyByDefault: true }
       : {}),
     flow: detectFlow(parsed),
-    ...(parsed.frozen ? { frozen: true } : {}),
-    ...(parsed.outputLogs !== undefined ? { outputLogs: parsed.outputLogs } : {}),
     ...(parsed.verbosity > 0 ? { summaryTable: true } : {}),
-    ...(parsed.download !== undefined ? { download: parsed.download } : {}),
     ...(parsed.continueMode !== undefined ? { continueMode: parsed.continueMode } : {}),
     forwardArgs: parsed.forwardArgs,
     // isatty, not process.stdin: touching the stream opens it, and a config
@@ -638,10 +615,10 @@ export async function resolveRunOptions(
   if (outright !== undefined) opts.selectedOutright = outright
   if (staged !== undefined) opts.staged = staged
   if (discovered !== undefined) opts.discovered = discovered
-  if (parsed.retries !== undefined) opts.retries = parsed.retries
-  if (parsed.timeout !== undefined) opts.timeout = parsed.timeout
   if (parsed.cacheDir !== undefined) opts.cacheDir = parsed.cacheDir
-  if (parsed.concurrency !== undefined) opts.concurrency = parsed.concurrency
+  for (const [path, field] of SETTING_OPTIONS) {
+    if (parsed.settings[path] !== undefined) Object.assign(opts, { [field]: parsed.settings[path] })
+  }
   if (parsed.summarize !== undefined) opts.summarize = parsed.summarize
   if (parsed.format === 'json') opts.json = true
   if (parsed.profile !== undefined) opts.profile = parsed.profile
@@ -691,10 +668,7 @@ export async function runCmd(args: readonly string[]): Promise<number> {
       process.stderr.write(`${refusal.message}\n`)
       return 1
     }
-    const load = {
-      ...(parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {}),
-      ...(parsed.frozen ? { frozen: true } : {}),
-    }
+    const load = parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {}
     // `--filter` / `--affected` scope the menu, as they scope a bare task:
     // the menu listed every project and the anchored pick ran outside it.
     const scope = await scopeFilters(parsed, cwd)
@@ -843,6 +817,11 @@ export async function runCmd(args: readonly string[]): Promise<number> {
       }
     }
   }
-  if (summary.json !== undefined) process.stdout.write(`${JSON.stringify(summary.json, null, 2)}\n`)
+  if (summary.json !== undefined) process.stdout.write(`${JSON.stringify(summary.json)}\n`)
   return summary.ok ? 0 : 1
 }
+
+/** CI=0 and CI=false are "not CI": several vendors set CI=true. */
+function onCI(v: string | undefined): boolean {
+  return v !== undefined && v !== '' && v !== '0' && v !== 'false'
+}

package/src/cli/select.ts

@@ -14,11 +14,9 @@ import {
   buildPackageGraph,
   defaultAffectedBase,
   findWorkspaceRoot,
-  type LoadReads,
   type FingerprintClaims,
-  FROZEN_WITHOUT_LOCK,
-  loadProjectConfig,
-  loadWorkspace,
+  lockKey,
+  NO_LOCK,
   parseFilter,
   type ProjectMeta,
   readLockfile,
@@ -49,15 +47,15 @@ import {
   loadCliProjects,
   loadCliWorkspace,
 } from './workspace-config.js'
+import { resolveSetting } from '../settings.js'
 
 /**
  * The projects whose tasks declare a `cache.inputs.workspaceFiles` glob
  * matching a changed path, one inside another project included (item
  * 954): `--affected` selects them, since the glob is that task's input. Through the run
  * path's staged load, so a glob a `project` plugin gave a config-less
- * package counts; evaluated live as a default run does, or read from the
- * lock as a `--frozen` run does. A load that fails drops to the config files that
- * do load, one by one — a broken out-of-scope config does not fail a
+ * package counts; read from the lock as a run does. A load that fails drops to the lock's
+ * entries, one by one — a project the lock does not hold does not fail a
  * scoped run, and must not fail its selection either.
  */
 export async function workspaceGlobOwners(
@@ -85,26 +83,23 @@ export async function workspaceGlobOwners(
   } catch {
     // Fall through to the per-file sweep.
   }
-  // A frozen run with no lock is refused here, before the tolerant sweep
-  // below could answer "nothing affected" and exit 0 without ever reaching
-  // the run's own refusal. Asked only once the staged load failed: a
-  // frozen load that succeeded read the lock, and a second read parsed it
-  // again (1,000 projects: a 1.1 MB lock, ~10 ms).
-  if (load.frozen === true && (await readLockfile(root)) === null) {
-    throw new UserError(FROZEN_WITHOUT_LOCK)
-  }
+  // No lock is refused here, before the tolerant sweep below could answer
+  // "nothing affected" and exit 0 without ever reaching the run's own
+  // refusal. The sweep reads each entry from the lock: it never evaluates.
+  const lock = await readLockfile(root)
+  if (lock === null) throw new UserError(NO_LOCK)
   const owners: string[] = []
-  await Promise.all(
-    projects.map(async (meta) => {
-      if (meta.configPath === null || meta.configPath === '') return
-      try {
-        if (declaresMatch(await loadProjectConfig(meta.configPath))) owners.push(meta.name)
-      } catch {
-        // A config that will not load cannot be shown to declare a matching
-        // glob; surfacing it here would fail a run the loader itself tolerates.
-      }
-    }),
-  )
+  for (const meta of projects) {
+    if (meta.configPath === null || meta.configPath === '') continue
+    const dir = lockKey(root, meta.dir)
+    if (!Object.hasOwn(lock.projects, dir)) continue
+    try {
+      if (declaresMatch(lock.projects[dir]!.config)) owners.push(meta.name)
+    } catch {
+      // A hand-edited entry that will not read cannot be shown to declare a
+      // matching glob; surfacing it here would fail a run the load tolerates.
+    }
+  }
   return owners
 }
 
@@ -133,9 +128,7 @@ async function workspaceFingerprintClaims(
 }
 
 async function loadWorkspaceProjects(cwd: string): Promise<ProjectMeta[]> {
-  const reads: LoadReads = new Map()
-  const root = await findWorkspaceRoot(cwd, reads)
-  return await discoverCliProjects(await loadWorkspace(root, reads))
+  return await discoverCliProjects(await findWorkspaceRoot(cwd))
 }
 
 export async function findCwdProject(cwd: string): Promise<string | null> {
@@ -150,9 +143,8 @@ export async function findCwdProject(cwd: string): Promise<string | null> {
 export async function findCwdSelection(
   cwd: string,
 ): Promise<{ name: string; discovered: { root: string; projects: ProjectMeta[] } } | null> {
-  const reads: LoadReads = new Map()
-  const root = await findWorkspaceRoot(cwd, reads)
-  const projects = await discoverCliProjects(await loadWorkspace(root, reads))
+  const root = await findWorkspaceRoot(cwd)
+  const projects = await discoverCliProjects(root)
   const abs = path.resolve(cwd)
   const within = (dirOf: (p: ProjectMeta) => string): string | null => {
     let best: string | null = null
@@ -251,14 +243,17 @@ function refusalOf(err: unknown): Refusal {
 
 /**
  * The filter `--affected[=<base>]` stands for: `...[<base>]`, the changed
- * projects and their dependents. An empty base is the workspace's
- * `affectedBase` (or a plugin's `config` stage, from nx.json's
+ * projects and their dependents. An empty base is `run.affectedBase`
+ * (its variable, then the workspace's, which a plugin's `config` stage may set from nx.json's
  * `defaultBase` or `TURBO_SCM_BASE`), then the guess.
  */
 export async function affectedFilterFor(cwd: string, affected: string): Promise<string | Refusal> {
   const root = await findWorkspaceRoot(cwd)
   let base = affected
-  if (base === '') base = (await loadCliWorkspace(root)).workspaceConfig?.affectedBase ?? ''
+  if (base === '') {
+    const ws = (await loadCliWorkspace(root)).workspaceConfig
+    base = (resolveSetting('run.affectedBase', ws).value as string | undefined) ?? ''
+  }
   if (base === '') {
     try {
       base = await defaultAffectedBase(root)
@@ -339,7 +334,6 @@ export async function resolveFilters(
         workspaceGlobOwners: (changed: readonly string[], nested: readonly string[]) =>
           workspaceGlobOwners(root, projects, changed, load, stagedOnce, nested),
         fingerprintClaims: () => workspaceFingerprintClaims(root, projects, load),
-        taskEdges: async () => edges ?? taskEdgesFrom(await stagedOnce()),
         ...(git !== undefined ? { untracked: async () => (await git.start()).untracked } : {}),
       }
       let names: Set<string>
@@ -524,7 +518,7 @@ export async function pickTask(
   }
   if (entries.length === 0) {
     process.stderr.write(
-      'vx run: no tasks declared in any project; declare one under `tasks` in a vx.config, or run `vx init` to write them from package.json scripts\n',
+      'vx run: no tasks declared in any project; declare one under `tasks` in a vx.config, or run `vx init` to write them from package.json scripts, then `vx lock`\n',
     )
     return null
   }
@@ -604,7 +598,7 @@ function didYouMeanProject(
   projects: Iterable<{ name: string }>,
 ): string {
   const names = [...projects].map((p) => p.name)
-  // A scoped name typed without its scope (`vx-mcp` for `@vzn/vx-mcp`) is
+  // A scoped name typed without its scope (`vx-otel` for `@vzn/vx-otel`) is
   // many edits from the whole name and none from the part after the `/`.
   const byBare = new Map<string, string[]>()
   for (const n of names) {
@@ -615,7 +609,7 @@ function didYouMeanProject(
     const typed = pattern.replace(/^!|\.\.\.$|^\.\.\.|\^/g, '')
     // Two edits from any two-letter name: `--filter //` hinted `ui` (X-13).
     if (typed === '//') {
-      return ". `//` is Turbo's root package, but the workspace root is no project here: give it a package.json name and a vx.config"
+      return '. `//` is the workspace root, which is no project here: add a vx.config there and run `vx lock`'
     }
     const best = nearest(typed, names)
     if (best !== undefined) return `. Did you mean ${best}?`