@vzn/vx 0.0.636 → 0.0.638

package/src/workspace/affected.ts

@@ -6,25 +6,23 @@
 // index + unstaged — so it captures everything you touched and nothing
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
-import { realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
 import path from 'node:path'
 import {
   executablePath,
-  UserError,
+  gitEnv,
   gitSpawnRefusal,
   isExecutableMissing,
   isInstalledPath,
   notAWorkTree,
   relPosix,
+  UserError,
 } from '../util/index.js'
 import { LOCKFILE_NAME } from './lockfile.js'
 import { configImportOwners, realpathOr } from './config-imports.js'
-import { configImports } from './config-cache.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
-import { bunPatchFiles, WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
-import { buildPackageGraph } from './package-graph.js'
-import type { PackageJson, ProjectMeta } from './workspace.js'
+import { bunPatchFiles } from './fingerprint.js'
+import { PROJECT_CONFIG_FILENAMES, type ProjectMeta } from './workspace.js'
 
 /**
  * Every git call here goes through these two: a git that is not on PATH
@@ -38,7 +36,13 @@ function spawnGitSync(
   stderr: 'pipe' | 'ignore' = 'pipe',
 ): ReturnType<typeof Bun.spawnSync> {
   try {
-    return Bun.spawnSync({ cmd: [executablePath('git'), ...args], cwd, stdout: 'pipe', stderr })
+    return Bun.spawnSync({
+      cmd: [executablePath('git'), ...args],
+      env: gitEnv(),
+      cwd,
+      stdout: 'pipe',
+      stderr,
+    })
   } catch (err) {
     if (isExecutableMissing(err)) throw gitSpawnRefusal(cwd)
     throw err
@@ -53,6 +57,7 @@ function spawnGit(
   try {
     return Bun.spawn({
       cmd: [executablePath('git'), ...args],
+      env: gitEnv(),
       cwd,
       stdin: stdin ?? 'ignore',
       stdout: 'pipe',
@@ -91,17 +96,10 @@ export interface AffectedArgs {
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
    * answer for a change to one. Resolved lazily: loading the workspace
-   * file costs an evaluation, and a diff that touches no fingerprint file
-   * — the common one — never needs it.
+   * file costs an evaluation, and a diff that touches no root file — the
+   * common one — never needs it.
    */
   fingerprintClaims?: () => Promise<FingerprintClaims>
-  /**
-   * The cross-project `dependsOn` edges, project → the projects its tasks
-   * name. Asked only when a package's name moved or it was removed: a
-   * config naming `dependsOn: ['lib#build']` breaks on it, which the
-   * package graph cannot see (item 1085).
-   */
-  taskEdges?: () => Promise<ReadonlyMap<string, readonly string[]>>
   /**
    * The untracked files, workspace-relative, from a walk the caller shares
    * with the run (`GitEnumeration.untracked`); null or absent spawns `git
@@ -135,7 +133,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
  * projects, each one's changed paths relative to it, and the projects a
  * change reaches as a whole — every task in one is affected whatever its
  * inputs say, because the reason was no path of its own (a lockfile claim,
- * a manifest edge at the base, a config import, a nested repository, a
+ * a config import, a nested repository, a
  * workspace-wide file).
  */
 export interface AffectedChanges {
@@ -145,6 +143,8 @@ export interface AffectedChanges {
   /** Project → its changed paths, relative to the project's directory. */
   paths: ReadonlyMap<string, readonly string[]>
   whole: ReadonlySet<string>
+  /** A whole project → the workspace-wide file that made it so (a workspace config, a claimed root file). */
+  wholeBy?: ReadonlyMap<string, string>
   /**
    * The changed paths that are nested repositories (a submodule, an
    * embedded repository), workspace-relative: each stands for every file
@@ -246,7 +246,7 @@ export async function affectedChanges(
       gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']))(),
   ])
 
-  // vx-lock.json (workspace-root metadata) is excluded like a gitignored
+  // .vx/projects.lock.json (workspace-root metadata) is excluded like a gitignored
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
@@ -258,62 +258,61 @@ export async function affectedChanges(
   const nested = new Set(diffed.gitlinks)
   for (const rel of untracked) if (rel.endsWith('/')) nested.add(rel)
 
-  // A lockfile or workspace-definition change re-keys EVERY task, because the
-  // workspace fingerprint folds those files into every cache key. Mapping
-  // changed paths to project directories cannot see that — they sit at the
-  // root and belong to no project — so `--affected` selected ZERO projects for
-  // a change that invalidates the entire cache. `vx run test --affected` after
-  // a `pnpm update` exited 0 having run nothing, which is precisely the
-  // failure `docs/cli.md` warns against in the sentence it states as a
-  // principle: "input hashing sees it, so `--affected` must too."
+  // A root file a plugin CLAIMS (`VxPlugin.fingerprint`: a lockfile, an
+  // install setting) re-keys tasks through what its claimant folds, and it
+  // sits at the root, owned by no project or by the root alone: mapping
+  // paths to directories selected ZERO projects for a lockfile bump that
+  // re-keyed them all, and `vx run test --affected` after a `pnpm update`
+  // exited 0 having run nothing — the failure `docs/cli.md` warns against:
+  // "input hashing sees it, so `--affected` must too." So selection asks the
+  // claimant the question its key answers, with the bytes at the base ref
+  // and in the working tree; the answer is unioned with the path-owned
+  // projects below, and only "cannot tell" widens. Core keys no root file
+  // itself, so an unclaimed one is a path like any other.
   //
   // Selection is not hashed, so widening it here changes no cache key.
-  //
-  // A file a plugin CLAIMS is the exception: the key folds what the plugin
-  // says per project, so selection asks the plugin the same question, with
-  // the bytes at the base ref and in the working tree. Its answer is
-  // unioned with the path-owned projects below; only "cannot tell" widens.
-  const everything = (): AffectedChanges => {
+  const everything = (file: string): AffectedChanges => {
     const all = new Set(args.projects.map((p) => p.name))
-    return { projects: all, changed, paths: new Map(), whole: all }
+    const wholeBy = new Map([...all].map((n) => [n, file]))
+    return { projects: all, changed, paths: new Map(), whole: all, wholeBy }
   }
-  if (await workspaceConfigChanged(args.workspaceRoot, changed)) return everything()
-  const fingerprintChanged = changed.filter((p) => FINGERPRINT_SET.has(p))
-  // A patch bun.lock names folds into every key, core's fingerprint and
-  // `bun()`'s claim alike, so its edit widens as a lockfile edit does. A
-  // patch the lockfile no longer names moved bun.lock itself.
+  // The workspace config's plugins shape every project's resolved config,
+  // so its edit can re-key any task and selection cannot tell which (item
+  // 953). No key folds the file; selection is not hashed, so widening here
+  // changes no key.
+  const wsConfig = WORKSPACE_CONFIG_FILENAMES.find((n) => changed.includes(n))
+  if (wsConfig !== undefined) return everything(wsConfig)
+  // Loading the workspace file costs an evaluation; only a changed ROOT
+  // name can be claimed, so a diff inside the projects never loads it.
+  let claims: FingerprintClaims | undefined
+  const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
+    (claims ??= await args.fingerprintClaims?.())
+  // A patch bun.lock names folds into the key of the plugin that claims
+  // bun.lock (`bun()`; the lockfile records no hash of it), so its edit
+  // widens as a lockfile edit does. A patch the lockfile no longer names
+  // moved bun.lock itself.
   if (changed.length > 0) {
     const lock = await bytesOrNull(path.join(args.workspaceRoot, 'bun.lock'))
     if (lock !== null) {
       const patches = new Set(bunPatchFiles(lock))
-      if (changed.some((p) => patches.has(p))) return everything()
+      const patch = changed.find((p) => patches.has(p))
+      if (patch !== undefined && (await loadClaims())?.files.has('bun.lock')) {
+        return everything(patch)
+      }
     }
   }
-  const claimedOwned = new Set<string>()
-  // A claim may also name a root file core does not fold (`turbo.json`,
-  // read by `turbo()`'s stages): it re-keys tasks through their resolved
-  // configs and belongs to no project (item 961). Only a changed ROOT name
-  // can be one, so a diff inside the projects never loads the claims.
-  const rootNamesChanged = changed.filter((p) => !p.includes('/') && !FINGERPRINT_SET.has(p))
-  let claims: FingerprintClaims | undefined
-  if (
-    (fingerprintChanged.length > 0 || rootNamesChanged.length > 0) &&
-    args.fingerprintClaims !== undefined
-  ) {
-    claims = await args.fingerprintClaims()
-    for (const file of rootNamesChanged) if (claims.files.has(file)) fingerprintChanged.push(file)
-  }
-  if (fingerprintChanged.length > 0) {
-    for (const file of fingerprintChanged) {
-      if (claims === undefined || !claims.files.has(file)) return everything()
-      const answer = await claims.affected({
-        file,
-        before: await gitBytesAt(args.workspaceRoot, base, file),
-        after: await bytesOrNull(path.join(args.workspaceRoot, file)),
-      })
-      if (answer === undefined) return everything()
-      for (const name of answer) claimedOwned.add(name)
-    }
+  const claimedOwned = new Map<string, string>()
+  const rootNamesChanged = changed.filter((p) => !p.includes('/'))
+  const claimed = rootNamesChanged.length > 0 ? await loadClaims() : undefined
+  for (const file of rootNamesChanged) {
+    if (claimed === undefined || !claimed.files.has(file)) continue
+    const answer = await claimed.affected({
+      file,
+      before: await gitBytesAt(args.workspaceRoot, base, file),
+      after: await bytesOrNull(path.join(args.workspaceRoot, file)),
+    })
+    if (answer === undefined) return everything(file)
+    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, file)
   }
 
   const realDirs = new Map(
@@ -322,7 +321,7 @@ export async function affectedChanges(
     ),
   )
   const paths = new Map<string, string[]>()
-  const whole = new Set<string>(claimedOwned)
+  const whole = new Set<string>(claimedOwned.keys())
   const owned = projectsContaining(
     args.workspaceRoot,
     changed,
@@ -340,29 +339,13 @@ export async function affectedChanges(
         }
       : undefined,
   )
-  for (const name of claimedOwned) owned.add(name)
-
-  // A manifest edit can drop an edge today's graph no longer shows: a
-  // package the change REMOVED is no project now (a `git rm -r pkgs/lib`,
-  // or `lib` dropped from `workspaces`, item 959), and one whose `version`
-  // or `name` moved no longer satisfies what a dependent declares. Either
-  // re-keys the dependent through its upstream, while containment maps the
-  // change to the package alone and the dependents walk sees only today's
-  // graph, so `--affected` left `app#build` out (D-3).
-  const manifests = changed.filter((rel) => path.posix.basename(rel) === 'package.json')
-  if (manifests.length > 0) {
-    const atBase = await gitBlobsAt(args.workspaceRoot, base, manifests)
-    const dependents = await dependentsAtBase(
-      args.workspaceRoot,
-      atBase,
-      args.projects,
-      args.taskEdges,
-    )
-    if (dependents === undefined) return everything()
-    for (const name of dependents) {
-      owned.add(name)
-      whole.add(name)
-    }
+  for (const name of claimedOwned.keys()) owned.add(name)
+
+  // A config that makes an existing directory a project took files from
+  // the project above it.
+  const configs = changed.filter((rel) => CONFIG_NAMES.has(path.posix.basename(rel)))
+  if (configs.length > 0) {
+    const atBase = await gitBlobsAt(args.workspaceRoot, base, configs)
     for (const name of parentsOfNewNested(args.workspaceRoot, atBase, args.projects)) {
       owned.add(name)
       whole.add(name)
@@ -393,6 +376,7 @@ export async function affectedChanges(
     changed,
     paths,
     whole,
+    ...(claimedOwned.size > 0 ? { wholeBy: claimedOwned } : {}),
     ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
   })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
@@ -400,102 +384,16 @@ export async function affectedChanges(
   return done()
 }
 
-/**
- * The projects whose workspace dependencies at the base differ from
- * today's: the package graph is built again over the changed manifests as
- * the base had them, and every project whose `directDeps` (the edges its
- * key folds) moved is selected. `undefined` (every project) when the root
- * manifest's `workspaces` moved: which packages left is a discovery at the
- * base, and selection cannot tell cheaply. `atBase` holds each changed
- * manifest as the base had it, read in one `git cat-file --batch`.
- */
-async function dependentsAtBase(
-  workspaceRoot: string,
-  atBase: ReadonlyMap<string, Uint8Array | null>,
-  projects: readonly ProjectMeta[],
-  taskEdges: AffectedArgs['taskEdges'],
-): Promise<Set<string> | undefined> {
-  const byDir = new Map<string, ProjectMeta>()
-  for (const p of projects) byDir.set(p.dir, p)
-  const nameNow = new Map(projects.map((p) => [p.dir, p.name]))
-  // Base names no project holds today: a removed or renamed package.
-  const gone = new Set<string>()
-  const changedDirs = new Set<string>()
-  for (const rel of atBase.keys()) {
-    if (rel === 'package.json') {
-      const workspacesOf = (bytes: Uint8Array | null): string => {
-        if (bytes === null) return ''
-        try {
-          return JSON.stringify(
-            (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).workspaces ?? null,
-          )
-        } catch {
-          return 'unreadable'
-        }
-      }
-      const before = workspacesOf(atBase.get(rel) ?? null)
-      const after = workspacesOf(await bytesOrNull(path.join(workspaceRoot, rel)))
-      if (before !== after) return undefined
-    }
-    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
-    changedDirs.add(dir)
-    byDir.delete(dir)
-    const bytes = atBase.get(rel)
-    if (bytes === undefined || bytes === null) continue
-    let pkg: PackageJson
-    try {
-      pkg = JSON.parse(new TextDecoder().decode(bytes)) as PackageJson
-    } catch {
-      // A manifest that did not parse at the base named no package.
-      continue
-    }
-    if (
-      pkg === null ||
-      typeof pkg !== 'object' ||
-      typeof pkg.name !== 'string' ||
-      pkg.name === ''
-    ) {
-      continue
-    }
-    // Today's catalogs, or both graphs would differ on every `catalog:`
-    // entry. A catalog edit is a `pnpm-workspace.yaml` or root manifest
-    // edit, which the fingerprint widening and the root's own change answer.
-    const catalogs = projects[0]?.catalogs
-    byDir.set(dir, {
-      name: pkg.name,
-      dir,
-      packageJson: pkg,
-      configPath: null,
-      ...(catalogs === undefined ? {} : { catalogs }),
-    })
-    if (nameNow.get(dir) !== pkg.name) gone.add(pkg.name)
-  }
-  const now = buildPackageGraph([...projects])
-  const then = buildPackageGraph([...byDir.values()])
-  const out = new Set<string>()
-  for (const p of projects) {
-    // A project whose own manifest changed is owned by containment.
-    if (changedDirs.has(p.dir)) continue
-    const a = now.directDeps(p.name)
-    const b = then.directDeps(p.name)
-    if (a.length !== b.length || a.some((d, i) => d !== b[i])) out.add(p.name)
-  }
-  if (gone.size > 0 && taskEdges !== undefined) {
-    for (const [project, targets] of await taskEdges()) {
-      if (targets.some((t) => gone.has(t))) out.add(project)
-    }
-  }
-  return out
-}
+const CONFIG_NAMES: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
 
 /**
  * The projects a NEW nested project took files from. A project's inputs
- * stop at every project below it, so a `package.json` that makes an
- * existing directory a project re-keys the project above it — its
- * `**` lost the directory's files — while containment maps the change to
- * the new project alone, and `--affected` left the re-keyed parent out.
- * "New" is judged at the base: no manifest there, or one with no name,
- * which discovery skips. `atBase` holds each changed manifest there.
+ * stop at every project below it, so a config that makes an existing
+ * directory a project re-keys the project above it — its `**` lost the
+ * directory's files — while containment maps the change to the new
+ * project alone, and `--affected` left the re-keyed parent out. "New" is
+ * judged at the base: none of the changed configs in its directory was
+ * there. `atBase` holds each changed config there.
  */
 function parentsOfNewNested(
   workspaceRoot: string,
@@ -507,7 +405,10 @@ function parentsOfNewNested(
   // dir discovered by readdir keeps the spelling it was created with.
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir.normalize('NFC'), p.name)
-  for (const [rel, bytes] of atBase) {
+  const existed = new Set<string>()
+  for (const [rel, bytes] of atBase) if (bytes !== null) existed.add(path.posix.dirname(rel))
+  for (const rel of atBase.keys()) {
+    if (existed.has(path.posix.dirname(rel))) continue
     const dir = path.resolve(workspaceRoot, path.posix.dirname(rel))
     if (!dirToName.has(dir)) continue
     let parent: string | undefined
@@ -515,17 +416,7 @@ function parentsOfNewNested(
       parent = dirToName.get(d)
       if (path.dirname(d) === d) break
     }
-    if (parent === undefined || out.has(parent)) continue
-    let named = false
-    if (bytes !== null) {
-      try {
-        const name = (JSON.parse(new TextDecoder().decode(bytes)) as PackageJson).name
-        named = typeof name === 'string' && name !== ''
-      } catch {
-        // A manifest that did not parse at the base named no project.
-      }
-    }
-    if (!named) out.add(parent)
+    if (parent !== undefined) out.add(parent)
   }
   return out
 }
@@ -581,45 +472,6 @@ async function gitBlobsAt(
   return blobs
 }
 
-/**
- * Whether `changed` holds the workspace config or a file it imports by
- * relative specifier. Its plugins' `config` and `project` stages shape
- * every project's resolved config, so such an edit can re-key any task,
- * and selection cannot tell which: an edit that changed every key
- * selected nothing (item 953). The fingerprint leaves the file out (its
- * placement plugins must not split a cache between machines); a stage it
- * installs re-keys through the resolved configs instead. Selection is not
- * hashed, so widening here changes no key.
- */
-async function workspaceConfigChanged(
-  workspaceRoot: string,
-  changed: readonly string[],
-): Promise<boolean> {
-  if (changed.length === 0) return false
-  const set = new Set(changed)
-  if (WORKSPACE_CONFIG_FILENAMES.some((n) => set.has(n))) return true
-  const config = WORKSPACE_CONFIG_FILENAMES.map((n) => path.join(workspaceRoot, n)).find((f) => {
-    try {
-      return statSync(f).isFile()
-    } catch {
-      return false
-    }
-  })
-  if (config === undefined) return false
-  const root = realpathSync(workspaceRoot)
-  for (const file of await configImports(config)) {
-    if (set.has(relPosix(root, file))) return true
-  }
-  return false
-}
-
-/**
- * The fingerprint files as workspace-root-relative paths. Read from the same
- * constant the fingerprint itself walks, so a new lockfile format cannot be
- * taught to one surface and not the other.
- */
-const FINGERPRINT_SET: ReadonlySet<string> = new Set(WORKSPACE_FINGERPRINT_FILES)
-
 /**
  * A root file's bytes at `ref`, or null when the ref has no such file.
  * `./` anchors the path to the cwd (the workspace root) rather than the

package/src/workspace/config-eval.ts

@@ -6,7 +6,7 @@
 // `import './preset.js'` inside a config resolves to the same key no
 // matter what query the entry carries — a busted entry re-evaluates
 // against a STALE preset. Shared presets are the documented composition
-// mechanism (`vx migrate` generates one), so through a whole `vx watch`
+// mechanism (`bunx @vzn/vx-migrate` generates one), so through a whole `vx watch`
 // session a preset edit was invisible; and because the resolved config
 // feeds the cache key, vx answered `up-to-date` for a command that had
 // changed on disk.
@@ -36,7 +36,7 @@
 // with the message the first load gives (item 701).
 
 import path from 'node:path'
-import { MAX_TIMEOUT_MS, UserError } from '../util/index.js'
+import { MAX_TIMEOUT_MS, parseDuration, UserError } from '../util/index.js'
 import { nonJsonMessage, nonJsonPaths, type NonJsonValue } from './json-data.js'
 
 /** Why a config's `process.exit` throws, on both load paths (D-65). */
@@ -76,10 +76,10 @@ export const WATCHED_BUILTIN_NAMES = [
 
 const WORKER_SRC = `
 const nonJsonPaths = ${nonJsonPaths.toString()}
-// The parent's stdout is a verb's JSON or vx mcp's JSON-RPC stream, and a
-// config printing on a repeat load wrote into it: the server's own redirect
-// covers the parent thread only (D-64). This worker only evaluates configs,
-// so every route to fd 1 is stderr's, Bun's own included (item 1069).
+// The parent's stdout is a verb's JSON, and a config printing on a repeat
+// load wrote into it: the parent's own redirect covers the parent thread
+// only (D-64). This worker only evaluates configs, so every route to fd 1
+// is stderr's, Bun's own included (item 1069).
 // Synchronous, before any message: an awaited import of the Console left
 // the first evaluation racing its own redirect (D-73).
 {
@@ -262,22 +262,17 @@ export function thrownValueMessage(kind: string, configPath: string, shown: stri
 /**
  * How long a single config evaluation may take, in the worker or in process
  * (D-66); in process a synchronous loop holds the thread the deadline needs. Real evaluations are ~10 ms; this exists only so a hung config or a
- * killed worker cannot stall a run or a long-lived process indefinitely. Read
- * per call so a test can drive the deadline instead of waiting it out.
+ * killed worker cannot stall a run or a long-lived process indefinitely.
+ * `config.workerTimeout` (`VX_CONFIG_WORKER_TIMEOUT`, read before any
+ * workspace loads), per call so a test can drive the deadline.
  */
 export function evalBudgetMs(): number {
-  const raw = process.env['VX_CONFIG_WORKER_TIMEOUT_MS']
-  // Same kind of value as the teardown deadline, so the same treatment: a
-  // BOUND on a worker that may be wedged, with no "no limit" reading. Falls
-  // back rather than clamping, because honouring ~24.8 days would hang
-  // `vx watch` forever on a worker the OS killed — and unbounded makes it 1 ms,
-  // so EVERY config load times out instead. Both ends break the same feature,
-  // and `0` is the second end: it fired on the next tick (D-157).
-  if (raw !== undefined && /^[0-9]+$/.test(raw)) {
-    const n = Number(raw)
-    if (n > 0 && n <= MAX_TIMEOUT_MS) return n
-  }
-  return 30_000
+  // A bound on a worker that may be wedged, with no "no limit" reading: 0
+  // fired on the next tick (D-157) and a timer past the platform's range at
+  // 1 ms, so both fall back. The CLI refuses either before a run
+  // (checkSettingsEnv); an embedder's falls back.
+  const n = parseDuration(process.env['VX_CONFIG_WORKER_TIMEOUT'] ?? '')
+  return n !== null && n > 0 && n <= MAX_TIMEOUT_MS ? n : 30_000
 }
 
 const pending = new Map<number, Pending>()

package/src/workspace/config-imports.ts

@@ -17,7 +17,7 @@
 // affordable at all:
 //
 //   - RELATIVE specifiers only. A bare specifier is a package; it moves when
-//     the lockfile moves, which the workspace fingerprint already covers.
+//     the lockfile moves, which a lockfile plugin's key covers.
 //     A tsconfig `paths` / `baseUrl` alias is the exception: Bun loads it
 //     from disk (D-27).
 //   - One reversed BFS from every config at once, each file read once
@@ -27,12 +27,15 @@
 //     too, so an edit there moves the site's key. The walk stopped at the
 //     first file of another project, and containment selected core alone
 //     while the site's key moved (X-128).
+//
+// `configImports` walks one config's relative closure forward, for the
+// files `vx watch` watches.
 
-import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
+import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
 import { builtinModules } from 'node:module'
 import path from 'node:path'
-import { isOutOfFds } from '../util/index.js'
+import { isOutOfFds, realPath } from '../util/index.js'
 import type { ProjectMeta } from './workspace.js'
 
 const BUILTINS = new Set(builtinModules)
@@ -467,3 +470,75 @@ export async function configImportOwners(a: ConfigImportOwnersArgs): Promise<Set
   }
   return selected
 }
+
+/**
+ * The canonical directory Bun resolves `file`'s imports from: its REAL
+ * path's, so a config linked in from elsewhere imports its neighbours
+ * there, not beside the link (item 950).
+ */
+function realDirOf(file: string): string {
+  if (lstatSync(file).isSymbolicLink()) return path.dirname(realPath(file))
+  return realPath(path.dirname(file))
+}
+
+/**
+ * Every file a config imports by relative specifier, transitively, outside
+ * `node_modules`, the config itself excluded. `vx watch` watches these: a
+ * shared preset outside the project (`../../shared/preset.mjs`, the way
+ * configs compose) changed what a run evaluates and no watcher saw it
+ * (item 949). A file that cannot be read ends its branch; an import that
+ * cannot be resolved is still listed, by the names it would have.
+ */
+export async function configImports(configPath: string): Promise<string[]> {
+  const seen = new Set<string>([configPath])
+  const out: string[] = []
+  const queue = [configPath]
+  while (queue.length > 0) {
+    const file = queue.shift()!
+    let source: string
+    try {
+      source = await Bun.file(file).text()
+    } catch {
+      continue
+    }
+    let specs: string[]
+    try {
+      specs = scanner(TS_EXT.has(path.extname(file)) ? 'ts' : 'js')
+        .scanImports(source)
+        .map((i) => i.path)
+    } catch {
+      // A source the parser refuses (mid-edit) keeps the imports a plain
+      // match sees: watching too few files is what this list exists to
+      // prevent.
+      specs = [...source.matchAll(/\bfrom\s*['"]([^'"]+)['"]|\bimport\s*['"]([^'"]+)['"]/g)].map(
+        (m) => (m[1] ?? m[2])!,
+      )
+    }
+    let dir: string | undefined
+    for (const spec of specs) {
+      if (!spec.startsWith('./') && !spec.startsWith('../')) continue
+      let resolved: string
+      try {
+        dir ??= realDirOf(file)
+        resolved = realPath(Bun.resolveSync(spec, dir))
+      } catch {
+        // Missing for now, still imported: the config that names it fails
+        // to load until it is back, and a list without it left `vx watch`
+        // deaf to its return. Named as written, and not walked.
+        if (dir === undefined) continue
+        for (const ext of path.extname(spec) === '' ? RESOLVED_EXTENSIONS : ['']) {
+          const missing = path.resolve(dir, spec + ext)
+          if (seen.has(missing)) continue
+          seen.add(missing)
+          out.push(missing)
+        }
+        continue
+      }
+      if (seen.has(resolved) || resolved.split(path.sep).includes('node_modules')) continue
+      seen.add(resolved)
+      out.push(resolved)
+      queue.push(resolved)
+    }
+  }
+  return out
+}