@vzn/vx 0.0.641 → 0.0.642

package/src/util/hidden-prompt.ts

@@ -0,0 +1,74 @@
+// A secret asked for on the terminal: hidden, one line, only where someone can answer.
+
+/** Where a missing secret is asked for. */
+export interface SecretTerminal {
+  /** stdin and stderr are both terminals: someone can answer. */
+  interactive(): boolean
+  /** Ask `question` on stderr with the answer hidden; resolves the line typed. */
+  ask(question: string): Promise<string>
+}
+
+interface HiddenInput {
+  isRaw?: boolean
+  setRawMode(mode: boolean): unknown
+  on(event: 'data', fn: (chunk: Buffer | string) => void): unknown
+  off(event: 'data', fn: (chunk: Buffer | string) => void): unknown
+  resume(): unknown
+  pause(): unknown
+}
+
+/**
+ * Read one line from a raw-mode terminal, echoing nothing; backspace edits.
+ * Ctrl-D answers nothing. Raw mode delivers no SIGINT, so Ctrl-C answers
+ * nothing and raises it: the run stops as it would at any other moment.
+ */
+function askHidden(
+  question: string,
+  input: HiddenInput,
+  output: { write(s: string): unknown },
+  interrupt: () => void,
+): Promise<string> {
+  output.write(question)
+  const wasRaw = input.isRaw === true
+  input.setRawMode(true)
+  input.resume()
+  return new Promise((resolve) => {
+    let line = ''
+    const done = () => {
+      input.off('data', onData)
+      input.setRawMode(wasRaw)
+      input.pause()
+      output.write('\n')
+    }
+    const onData = (chunk: Buffer | string) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n') {
+          done()
+          resolve(line)
+          return
+        }
+        if (ch === '\u0003' || ch === '\u0004') {
+          done()
+          resolve('')
+          if (ch === '\u0003') interrupt()
+          return
+        }
+        if (ch === '\u007f' || ch === '\b') line = line.replace(/.$/u, '')
+        else if (ch >= ' ') line += ch
+      }
+    }
+    input.on('data', onData)
+  })
+}
+
+/** A process's terminal: asked only when its stdin and stderr are both TTYs. */
+export function terminalOf(
+  stdin: HiddenInput & { isTTY?: boolean },
+  stderr: { isTTY?: boolean; write(s: string): unknown },
+  interrupt: () => void = () => process.kill(process.pid, 'SIGINT'),
+): SecretTerminal {
+  return {
+    interactive: () => stdin.isTTY === true && stderr.isTTY === true,
+    ask: (question) => askHidden(question, stdin, stderr, interrupt),
+  }
+}

package/src/util/index.ts

@@ -58,9 +58,8 @@ export {
   GLOB_WILDCARDS,
   normalizeBunGlob,
   normalizeGlob,
-  namesNodeModules,
-  OUTPUT_NEVER,
   outputMatcher,
+  outputNever,
   restorableOutput,
   printable,
   relPosix,
@@ -74,6 +73,7 @@ export {
   taskGlob,
   wholeSubtreePrefixes,
   slashBraceExpansions,
+  braceAlternatives,
 } from './paths.js'
 export {
   claimExitForSignal,
@@ -119,3 +119,13 @@ export {
   secretNamed,
   type SecretMask,
 } from './secret-mask.js'
+export {
+  isSecretUnavailable,
+  SecretBroker,
+  type PluginSecrets,
+  type SecretRequest,
+  type SecretStore,
+  type SecretUnavailable,
+  type SecretUnavailableReason,
+} from './secrets.js'
+export { terminalOf, type SecretTerminal } from './hidden-prompt.js'

package/src/util/paths.ts

@@ -387,18 +387,36 @@ export function outputMatcher(globs: readonly string[]): (rel: string) => boolea
 }
 
 /**
- * What no output glob reaches. An output is otherwise taken as written —
- * `node_modules/**` IS an install task's output — but no task produces
- * these, and a root project declaring `**` would otherwise wipe its
- * repository and the cache it is restoring from (2026-09-16). `.vx` whole
- * and each `vx.lock.json` are vx's own: as outputs, the clean deleted an
- * uncommitted workspace config and a hit restored a lock or ignore file the
- * key does not see over the current one.
+ * What no output glob reaches, relative to the project: its root's `.git`
+ * and `.vx`, and the `vx.lock.json` beside its config. An output is
+ * otherwise taken as written — `node_modules/**` IS an install task's
+ * output — but a root project declaring `**` would otherwise wipe its
+ * repository and the cache it is restoring from (2026-09-16), the clean
+ * deleted an uncommitted workspace config, and a hit restored a lock or
+ * ignore file the key does not see over the current one. Only where vx
+ * writes them: reserved at any depth, a hit dropped a build's own
+ * `dist/.git/**` and `dist/sub/vx.lock.json` (2026-10-17).
  */
-export const OUTPUT_NEVER = ['**/.git/**', '**/.vx/**', '**/vx.lock.json']
+const OUTPUT_NEVER = ['.git/**', '.vx/**', 'vx.lock.json']
+
+/**
+ * `OUTPUT_NEVER` relative to the workspace root, for `outputs.workspaceFiles`:
+ * those globs cross into other projects, and every project's `vx.lock.json`
+ * is vx's.
+ */
+const WORKSPACE_OUTPUT_NEVER = [...OUTPUT_NEVER, '**/vx.lock.json']
+
+/**
+ * What `globs` may not reach in `scope`: its never-list, and every
+ * `node_modules` unless a glob names one.
+ */
+export function outputNever(globs: readonly string[], scope: 'project' | 'workspace'): string[] {
+  const never = scope === 'project' ? OUTPUT_NEVER : WORKSPACE_OUTPUT_NEVER
+  return namesNodeModules(globs) ? never : [...never, '**/node_modules/**']
+}
 
 /** Whether a positive glob in `globs` names a `node_modules` directory. */
-export function namesNodeModules(globs: readonly string[]): boolean {
+function namesNodeModules(globs: readonly string[]): boolean {
   return globs.some(
     (g) => !g.startsWith('!') && normalizeGlob(g).split('/').includes('node_modules'),
   )
@@ -411,11 +429,12 @@ export function namesNodeModules(globs: readonly string[]): boolean {
  * artifact naming anything else was not written by this task's save, and
  * none of it is restored (2026-10-16).
  */
-export function restorableOutput(globs: readonly string[]): (rel: string) => boolean {
+export function restorableOutput(
+  globs: readonly string[],
+  scope: 'project' | 'workspace' = 'project',
+): (rel: string) => boolean {
   const isOutput = outputMatcher(globs)
-  const never = anyTaskGlob(
-    namesNodeModules(globs) ? OUTPUT_NEVER : [...OUTPUT_NEVER, '**/node_modules/**'],
-  )
+  const never = anyTaskGlob(outputNever(globs, scope))
   return (rel) => isOutput(rel) && !never(rel)
 }
 
@@ -430,7 +449,7 @@ export function slashBraceExpansions(pattern: string): string[] {
 }
 
 /** `pattern` with every brace group of two or more alternatives expanded. */
-function braceAlternatives(pattern: string): string[] {
+export function braceAlternatives(pattern: string): string[] {
   return expandBraces(pattern, false)
 }
 

package/src/util/secrets.ts

@@ -0,0 +1,150 @@
+// A plugin's secrets, kept in the OS keychain (`Bun.secrets`) under the
+// plugin's own name, and asked for on the terminal when a plugin offers a
+// prompt and someone can answer (owner, 2026-10-17). Core reads no
+// environment here: a variable, an option or a config file is the
+// plugin's to check first, so the keychain is always the last source.
+
+import { type SecretTerminal, terminalOf } from './hidden-prompt.js'
+
+/** What `ctx.secret` is asked: the entry's name, and the question to ask on a terminal. */
+export interface SecretRequest {
+  /** The entry's name within the plugin's keychain service: one per remote, say. */
+  readonly key: string
+  /** Asked when the keychain lacks the entry. Omitted: never asked, a miss is `not-found`. */
+  readonly prompt?: string
+}
+
+/** A plugin's keychain, on the contexts of the hooks that run before the first task. */
+export interface PluginSecrets {
+  /**
+   * The entry, else the terminal's answer (then saved), else a rejection a
+   * `isSecretUnavailable` guard names. Once per run per key: concurrent asks
+   * share the answer.
+   */
+  secret(req: SecretRequest): Promise<string>
+  /** Delete the entry (a server refused it), so the next run asks again. Never throws. */
+  forgetSecret(req: { readonly key: string }): Promise<void>
+}
+
+/**
+ * Why `secret` had nothing: the keychain lacks it and no prompt was given
+ * (`not-found`), a prompt was given and nobody can answer — CI, no TTY, or
+ * the status line already up (`no-terminal`), the answer was empty
+ * (`declined`), or there is no keychain and no answer (`store-unavailable`).
+ */
+export type SecretUnavailableReason = 'not-found' | 'no-terminal' | 'declined' | 'store-unavailable'
+
+export interface SecretUnavailable extends Error {
+  readonly reason: SecretUnavailableReason
+}
+
+const NAME = 'SecretUnavailable'
+
+/** A `secret` rejection that is a missing secret, not a fault. By name: a plugin may load its own copy of core. */
+export function isSecretUnavailable(err: unknown): err is SecretUnavailable {
+  return err instanceof Error && err.name === NAME && 'reason' in err
+}
+
+function unavailable(key: string, reason: SecretUnavailableReason): SecretUnavailable {
+  return Object.assign(new Error(`secret '${key}' unavailable: ${reason}`), { name: NAME, reason })
+}
+
+/** The keychain as the broker reads and writes it: `Bun.secrets`, or a test's stand-in. */
+export interface SecretStore {
+  get(o: { service: string; name: string }): Promise<string | null>
+  set(o: { service: string; name: string; value: string }): Promise<void>
+  delete(o: { service: string; name: string }): Promise<boolean>
+}
+
+// Reached only when asked: touching `process.stdin` opens the stream.
+const processTerminal: SecretTerminal = {
+  interactive: () => terminalOf(process.stdin, process.stderr).interactive(),
+  ask: (question) => terminalOf(process.stdin, process.stderr).ask(question),
+}
+
+/**
+ * One run's secrets for every plugin. A prompt waits for the one before
+ * it, so two plugins never ask at once, and none is asked once
+ * `closePrompts` says the status line is up.
+ */
+export class SecretBroker {
+  private readonly memo = new Map<string, Promise<string>>()
+  private prompting: Promise<unknown> = Promise.resolve()
+  private closed = false
+
+  constructor(
+    private readonly ci: boolean,
+    private readonly warn: (message: string) => void,
+    private readonly store: SecretStore = Bun.secrets,
+    private readonly terminal: SecretTerminal = processTerminal,
+    /** Quiets the terminal's live region until the release it returns. */
+    private readonly quiet: () => () => void = () => () => undefined,
+  ) {}
+
+  /** `plugin`'s keychain: its entries live under its package name. */
+  for(plugin: string): PluginSecrets {
+    return {
+      secret: (req) => {
+        const memoKey = `${plugin}\0${req.key}`
+        let pending = this.memo.get(memoKey)
+        if (pending === undefined) {
+          pending = this.resolve(plugin, req)
+          this.memo.set(memoKey, pending)
+        }
+        return pending
+      },
+      forgetSecret: async ({ key }) => {
+        this.memo.delete(`${plugin}\0${key}`)
+        try {
+          await this.store.delete({ service: plugin, name: key })
+        } catch {
+          // no keychain to delete from
+        }
+      },
+    }
+  }
+
+  /** The status line is about to start: from here a prompt would be drawn over. */
+  closePrompts(): void {
+    this.closed = true
+  }
+
+  private async resolve(service: string, req: SecretRequest): Promise<string> {
+    const entry = { service, name: req.key }
+    let storeDown = false
+    try {
+      const stored = await this.store.get(entry)
+      if (stored) return stored
+    } catch {
+      // No keychain (headless Linux without libsecret).
+      storeDown = true
+    }
+    if (req.prompt === undefined)
+      throw unavailable(req.key, storeDown ? 'store-unavailable' : 'not-found')
+    const asked = this.prompting.then(() => this.ask(req.key, req.prompt!))
+    this.prompting = asked.catch(() => undefined)
+    const answer = await asked
+    try {
+      await this.store.set({ ...entry, value: answer })
+    } catch (err) {
+      this.warn(
+        `[vx] could not save '${req.key}' to the OS keychain (${err instanceof Error ? err.message : String(err)}); used for this run only`,
+      )
+    }
+    return answer
+  }
+
+  private async ask(key: string, prompt: string): Promise<string> {
+    if (this.ci || this.closed || !this.terminal.interactive())
+      throw unavailable(key, 'no-terminal')
+    const release = this.quiet()
+    let answer: string
+    try {
+      answer = (await this.terminal.ask(prompt)).trim()
+    } finally {
+      release()
+    }
+    if (answer === '') throw unavailable(key, 'declined')
+    return answer
+  }
+}

package/src/workspace/affected.ts

@@ -122,7 +122,10 @@ export interface FingerprintClaims {
     file: string
     before: Uint8Array | null
     after: Uint8Array | null
+    extras?: ReadonlyMap<string, { before: Uint8Array | null; after: Uint8Array | null }>
   }): Promise<ReadonlySet<string> | undefined>
+  /** The files a claimed file names that its claimant keys too; absent = it reads none. */
+  extraFiles?(file: string, bytes: Uint8Array): readonly string[] | undefined
 }
 
 /**
@@ -303,32 +306,79 @@ export async function affectedChanges(
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
-  // A patch bun.lock names folds into the key of the plugin that claims
-  // bun.lock (`bun()`; the lockfile records no hash of it), so its edit
-  // widens as a lockfile edit does. A patch the lockfile no longer names
-  // moved bun.lock itself.
-  if (changed.length > 0) {
-    const lock = await bytesOrNull(path.join(args.workspaceRoot, 'bun.lock'))
-    if (lock !== null) {
-      const patches = new Set(bunPatchFiles(lock))
-      const patch = changed.find((p) => patches.has(p))
-      if (patch !== undefined && (await loadClaims())?.files.has('bun.lock')) {
-        return everything(patch)
+  // A file a claimed lockfile names that its claimant keys but the
+  // lockfile does not pin (`FingerprintClaim.extraFiles`: bun.lock's
+  // patches, a `file:`, `link:` or `portal:` directory
+  // a manager copies or links) is part of
+  // that lockfile: a change to one, or under one, is a lockfile change the
+  // claimant answers with it. Only a path no project below the root owns
+  // can be one, so a diff inside the projects never loads the claims.
+  const extrasBy = new Map<
+    string,
+    Map<string, { before: Uint8Array | null; after: Uint8Array | null }>
+  >()
+  const rootDir = path.resolve(args.workspaceRoot)
+  const loose = changed.filter((rel) => {
+    const abs = path.join(rootDir, rel)
+    return !args.projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
+  })
+  const extraClaims = loose.length > 0 ? await loadClaims() : undefined
+  for (const file of extraClaims?.files ?? []) {
+    const after = await bytesOrNull(path.join(args.workspaceRoot, file))
+    const before = await gitBytesAt(args.workspaceRoot, base, file)
+    const namedAfter = after === null ? [] : extraClaims!.extraFiles?.(file, after)
+    const named = new Set([
+      ...(before === null ? [] : (extraClaims!.extraFiles?.(file, before) ?? [])),
+      ...(namedAfter ?? []),
+    ])
+    const extras = new Map<string, { before: Uint8Array | null; after: Uint8Array | null }>()
+    for (const rel of named) {
+      const at = path.posix.normalize(rel).replace(/\/+$/, '')
+      if (loose.includes(at)) {
+        extras.set(rel, {
+          before: await gitBytesAt(args.workspaceRoot, base, at),
+          after: await bytesOrNull(path.join(args.workspaceRoot, at)),
+        })
+        continue
+      }
+      // A directory's sides are not its bytes: a file under it changed,
+      // so they differ, and only the projects reaching it move.
+      const under = loose.filter((p) => p.startsWith(`${at}/`))
+      if (under.length > 0) {
+        extras.set(rel, { before: null, after: new TextEncoder().encode(under.join('\0')) })
       }
     }
+    if (extras.size > 0) extrasBy.set(file, extras)
+    else if (file === 'bun.lock' && after !== null && namedAfter === undefined) {
+      // A bun.lock claimant that names no file still folds the patches
+      // bun.lock names (the lockfile records no hash of them): it cannot
+      // say which projects one reaches, so its edit widens.
+      const patches = new Set(bunPatchFiles(after))
+      const patch = loose.find((p) => patches.has(p))
+      if (patch !== undefined) return everything(patch)
+    }
   }
   const claimedOwned = new Map<string, string>()
   const rootNamesChanged = changed.filter((p) => !p.includes('/'))
+  for (const file of extrasBy.keys()) {
+    if (!rootNamesChanged.includes(file)) rootNamesChanged.push(file)
+  }
   const claimed = rootNamesChanged.length > 0 ? await loadClaims() : undefined
   for (const file of rootNamesChanged) {
     if (claimed === undefined || !claimed.files.has(file)) continue
+    const extras = extrasBy.get(file)
     const answer = await claimed.affected({
       file,
       before: await gitBytesAt(args.workspaceRoot, base, file),
       after: await bytesOrNull(path.join(args.workspaceRoot, file)),
+      ...(extras !== undefined ? { extras } : {}),
     })
-    if (answer === undefined) return everything(file)
-    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, file)
+    const why =
+      extras === undefined || changed.includes(file)
+        ? file
+        : path.posix.normalize([...extras.keys()][0]!).replace(/\/+$/, '')
+    if (answer === undefined) return everything(why)
+    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, why)
   }
 
   const realDirs = new Map(

package/src/workspace/config-schema.ts

@@ -378,16 +378,21 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
         }
       }
       if (plug.fingerprint !== undefined) {
-        const claim = plug.fingerprint as { files?: unknown; affected?: unknown } | null
+        const claim = plug.fingerprint as {
+          files?: unknown
+          affected?: unknown
+          extraFiles?: unknown
+        } | null
         if (
           claim === null ||
           typeof claim !== 'object' ||
           !Array.isArray(claim.files) ||
           claim.files.length === 0 ||
-          typeof claim.affected !== 'function'
+          typeof claim.affected !== 'function' ||
+          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function')
         ) {
           throw new UserError(
-            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function }`,
+            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function }`,
           )
         }
         for (const file of claim.files as unknown[]) {
@@ -770,6 +775,7 @@ export function validateProjectConfig(
         }
         assertPosixGlob(g, `${where}.inputs.files`, 'project')
         assertNoForeignToken(g, `${where}.inputs.files`)
+        assertInputGlob(g, `${where}.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
             `${where}.inputs.files: "${g}" names the project directory itself and selects nothing — use "**" for everything under it`,
@@ -1333,6 +1339,33 @@ function assertPosixGlob(glob: string, where: string, base: string): void {
   )
 }
 
+const ONE_ALTERNATIVE_BRACE = /(?<!\\)\{[^{},]*\}/
+
+/**
+ * What every run would refuse, or silently key nothing for, refused at
+ * `vx lock` instead. `Bun.Glob` reads `{b}` as a brace of one alternative,
+ * so `src/{b}.ts` matches `src/b.ts` and never a file named `{b}.ts`:
+ * neither reading is sure to be the one meant, so both spellings are
+ * named. A path under `.git` is never listed by git, so it keyed nothing.
+ */
+function assertInputGlob(glob: string, where: string): void {
+  const m = ONE_ALTERNATIVE_BRACE.exec(glob)
+  if (m !== null) {
+    const inner = m[0].slice(1, -1)
+    throw new UserError(
+      `${where}: "${glob}" holds a brace with one alternative, which matches ` +
+        `"${inner}" and never a name holding "${m[0]}". Write "${glob.replace(m[0], inner)}", ` +
+        `or "${glob.replace(m[0], `\\{${inner}\\}`)}" for the braces themselves.`,
+    )
+  }
+  if (glob.replace(/^!/, '').split('/').includes('.git')) {
+    throw new UserError(
+      `${where}: "${glob}" names a path under .git, which git never lists, so it keys nothing — ` +
+        `inputs are the repository's files`,
+    )
+  }
+}
+
 /**
  * `!!x` INVERTS the input set instead of double-negating it.
  *
@@ -1565,6 +1598,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
     }
     assertPosixGlob(g, where, 'workspace-root')
     assertNoForeignToken(g, where)
+    if (negation) assertInputGlob(g, where)
     if (namesDirItself(g)) {
       throw new UserError(
         `${where}: "${g}" names the workspace root itself and selects nothing — use "**" for everything under it`,

package/src/workspace/project-loader.ts

@@ -640,6 +640,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'plugin',
   'randomUUIDv7',
   'resolveSync',
+  'secrets',
   'serve',
   'sleep',
   'sleepSync',

package/src/workspace/workspace.ts

@@ -188,14 +188,19 @@ export function linkDiscoveredEdges(
       [edge.reach, reach],
     ] as const) {
       for (const target of kind) {
-        const dir = path.resolve(root, target)
-        const rel = relPosix(root, dir)
-        const where = `plugin '${edge.by}' gave project "${edge.meta.name}" an edge to ${target}`
-        if (rel === '..' || rel.startsWith('../') || path.isAbsolute(rel)) {
-          throw new UserError(`${where}: outside the workspace root`)
+        // Every project lies inside the root (`discoveredProject` refuses
+        // one that does not), so a target naming one needs no other check:
+        // a plugin hands project dirs as they are, absolute, and resolving
+        // and judging each of 5,000 edges was ~15 ms at 1,000 projects.
+        const name = byDir.get(target) ?? byDir.get(path.resolve(root, target))
+        if (name === undefined) {
+          const rel = relPosix(root, path.resolve(root, target))
+          const where = `plugin '${edge.by}' gave project "${edge.meta.name}" an edge to ${target}`
+          if (rel === '..' || rel.startsWith('../') || path.isAbsolute(rel)) {
+            throw new UserError(`${where}: outside the workspace root`)
+          }
+          throw new UserError(`${where}: not a project`)
         }
-        const name = byDir.get(dir)
-        if (name === undefined) throw new UserError(`${where}: not a project`)
         let set = into.get(edge.meta)
         if (set === undefined) into.set(edge.meta, (set = new Set()))
         set.add(name)
@@ -417,12 +422,13 @@ export function lockedProjects(
  * The project a plugin's `discover` entry names: a new meta (`added`) for a
  * directory that is not a project yet, else the project already there,
  * renamed when its name was its path's. A config's `name` wins over the
- * plugin's; a name another plugin gave is not changed. `by` names the
- * plugin in a refusal.
+ * plugin's; a name another plugin gave is not changed. `known` is the
+ * projects by directory: a scan per entry was quadratic, 106 ms of a 5,000
+ * project warm run. `by` names the plugin in a refusal.
  */
 export async function discoveredProject(
   root: string,
-  known: readonly ProjectMeta[],
+  known: ReadonlyMap<string, ProjectMeta>,
   entry: {
     readonly dir: string
     readonly name?: string
@@ -456,7 +462,7 @@ export async function discoveredProject(
     throw new UserError(`${where}${named} at ${dir}: outside the workspace root`)
   }
   const shown = rel === '' ? '.' : rel
-  const meta = known.find((p) => p.dir === dir)
+  const meta = known.get(dir)
   if (meta !== undefined) {
     const from = namedBy.get(meta)
     if (name === undefined || name === meta.name || from === 'config') return { meta, added: false }