@vzn/vx 0.0.641 → 0.0.643

package/src/workspace/affected.ts

@@ -14,6 +14,7 @@ import {
   gitSpawnRefusal,
   isExecutableMissing,
   isInstalledPath,
+  isUserError,
   notAWorkTree,
   relPosix,
   UserError,
@@ -73,7 +74,14 @@ export interface AffectedArgs {
   workspaceRoot: string
   /** Git ref / commit / branch to compare against. Required. */
   since: string
-  projects: readonly ProjectMeta[]
+  /** A promise when the caller is still discovering them: the git calls start first. */
+  projects: readonly ProjectMeta[] | Promise<readonly ProjectMeta[]>
+  /**
+   * False skips the scan of what each `vx.config` imports (every config
+   * read): the cache scope's split, where a wrong answer costs a miss,
+   * never a stale hit, and the scan was most of a 1,000-project diff.
+   */
+  configImports?: false
   /**
    * Which projects declare a `inputs.workspaceFiles` glob matching one of
    * these workspace-relative paths.
@@ -122,7 +130,10 @@ export interface FingerprintClaims {
     file: string
     before: Uint8Array | null
     after: Uint8Array | null
+    extras?: ReadonlyMap<string, { before: Uint8Array | null; after: Uint8Array | null }>
   }): Promise<ReadonlySet<string> | undefined>
+  /** The files a claimed file names that its claimant keys too; absent = it reads none. */
+  extraFiles?(file: string, bytes: Uint8Array): readonly string[] | undefined
 }
 
 /**
@@ -252,6 +263,8 @@ export async function affectedChanges(
       gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']))(),
   ])
 
+  const projects = await args.projects
+
   // .vx/projects.lock.json (workspace-root metadata) is excluded like a gitignored
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
@@ -288,7 +301,7 @@ export async function affectedChanges(
   //
   // Selection is not hashed, so widening it here changes no cache key.
   const everything = (file: string): AffectedChanges => {
-    const all = new Set(args.projects.map((p) => p.name))
+    const all = new Set(projects.map((p) => p.name))
     const wholeBy = new Map([...all].map((n) => [n, file]))
     return { projects: all, changed, paths: new Map(), whole: all, wholeBy }
   }
@@ -303,37 +316,84 @@ export async function affectedChanges(
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
-  // A patch bun.lock names folds into the key of the plugin that claims
-  // bun.lock (`bun()`; the lockfile records no hash of it), so its edit
-  // widens as a lockfile edit does. A patch the lockfile no longer names
-  // moved bun.lock itself.
-  if (changed.length > 0) {
-    const lock = await bytesOrNull(path.join(args.workspaceRoot, 'bun.lock'))
-    if (lock !== null) {
-      const patches = new Set(bunPatchFiles(lock))
-      const patch = changed.find((p) => patches.has(p))
-      if (patch !== undefined && (await loadClaims())?.files.has('bun.lock')) {
-        return everything(patch)
+  // A file a claimed lockfile names that its claimant keys but the
+  // lockfile does not pin (`FingerprintClaim.extraFiles`: bun.lock's
+  // patches, a `file:`, `link:` or `portal:` directory
+  // a manager copies or links) is part of
+  // that lockfile: a change to one, or under one, is a lockfile change the
+  // claimant answers with it. Only a path no project below the root owns
+  // can be one, so a diff inside the projects never loads the claims.
+  const extrasBy = new Map<
+    string,
+    Map<string, { before: Uint8Array | null; after: Uint8Array | null }>
+  >()
+  const rootDir = path.resolve(args.workspaceRoot)
+  const loose = changed.filter((rel) => {
+    const abs = path.join(rootDir, rel)
+    return !projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
+  })
+  const extraClaims = loose.length > 0 ? await loadClaims() : undefined
+  for (const file of extraClaims?.files ?? []) {
+    const after = await bytesOrNull(path.join(args.workspaceRoot, file))
+    const before = await gitBytesAt(args.workspaceRoot, base, file)
+    const namedAfter = after === null ? [] : extraClaims!.extraFiles?.(file, after)
+    const named = new Set([
+      ...(before === null ? [] : (extraClaims!.extraFiles?.(file, before) ?? [])),
+      ...(namedAfter ?? []),
+    ])
+    const extras = new Map<string, { before: Uint8Array | null; after: Uint8Array | null }>()
+    for (const rel of named) {
+      const at = path.posix.normalize(rel).replace(/\/+$/, '')
+      if (loose.includes(at)) {
+        extras.set(rel, {
+          before: await gitBytesAt(args.workspaceRoot, base, at),
+          after: await bytesOrNull(path.join(args.workspaceRoot, at)),
+        })
+        continue
+      }
+      // A directory's sides are not its bytes: a file under it changed,
+      // so they differ, and only the projects reaching it move.
+      const under = loose.filter((p) => p.startsWith(`${at}/`))
+      if (under.length > 0) {
+        extras.set(rel, { before: null, after: new TextEncoder().encode(under.join('\0')) })
       }
     }
+    if (extras.size > 0) extrasBy.set(file, extras)
+    else if (file === 'bun.lock' && after !== null && namedAfter === undefined) {
+      // A bun.lock claimant that names no file still folds the patches
+      // bun.lock names (the lockfile records no hash of them): it cannot
+      // say which projects one reaches, so its edit widens.
+      const patches = new Set(bunPatchFiles(after))
+      const patch = loose.find((p) => patches.has(p))
+      if (patch !== undefined) return everything(patch)
+    }
   }
   const claimedOwned = new Map<string, string>()
   const rootNamesChanged = changed.filter((p) => !p.includes('/'))
+  for (const file of extrasBy.keys()) {
+    if (!rootNamesChanged.includes(file)) rootNamesChanged.push(file)
+  }
   const claimed = rootNamesChanged.length > 0 ? await loadClaims() : undefined
   for (const file of rootNamesChanged) {
     if (claimed === undefined || !claimed.files.has(file)) continue
+    const extras = extrasBy.get(file)
     const answer = await claimed.affected({
       file,
       before: await gitBytesAt(args.workspaceRoot, base, file),
       after: await bytesOrNull(path.join(args.workspaceRoot, file)),
+      ...(extras !== undefined ? { extras } : {}),
     })
-    if (answer === undefined) return everything(file)
-    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, file)
+    const why =
+      extras === undefined || changed.includes(file)
+        ? file
+        : path.posix.normalize([...extras.keys()][0]!).replace(/\/+$/, '')
+    if (answer === undefined) return everything(why)
+    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, why)
   }
 
   const realDirs = new Map(
     await Promise.all(
-      args.projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
+      projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
     ),
   )
   const paths = new Map<string, string[]>()
@@ -342,7 +402,7 @@ export async function affectedChanges(
     args.workspaceRoot,
     changed,
     nested,
-    args.projects,
+    projects,
     realDirs,
     perTask
       ? {
@@ -362,7 +422,7 @@ export async function affectedChanges(
   const configs = changed.filter((rel) => CONFIG_NAMES.has(path.posix.basename(rel)))
   if (configs.length > 0) {
     const atBase = await gitBlobsAt(args.workspaceRoot, base, configs)
-    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, args.projects)) {
+    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, projects)) {
       owned.add(name)
       whole.add(name)
     }
@@ -376,12 +436,14 @@ export async function affectedChanges(
   // (`../../src/index.ts`), whose target is owned.
   // Per task, a project that owns the changed file still needs to know its
   // config imported it: that re-keys every task, whatever their inputs.
-  for (const name of await configImportOwners({
-    workspaceRoot: args.workspaceRoot,
-    projects: args.projects,
-    changed,
-    skip: perTask ? new Set() : owned,
-  })) {
+  for (const name of args.configImports === false
+    ? []
+    : await configImportOwners({
+        workspaceRoot: args.workspaceRoot,
+        projects: projects,
+        changed,
+        skip: perTask ? new Set() : owned,
+      })) {
     owned.add(name)
     whole.add(name)
   }
@@ -629,43 +691,35 @@ async function gitDiffPaths(
 }
 
 /**
- * Resolve the default base for `--affected` with no explicit value.
- * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
- * etc.), then `origin/main`, `origin/master`, `main`, `master`, then
- * falls back to `HEAD~1`. A clone with no `origin/HEAD` and
- * no parent commit — a CI checkout at `fetch-depth: 1` — has no base at
- * all, and says so here rather than failing on a ref nobody typed.
+ * The base a bare `--affected` compares with: the merge base of HEAD and
+ * the base branch (`origin/<baseBranch>`, or the local branch in a clone
+ * with no remote; its tip when they share no history). On the base branch
+ * itself there is none (owner, 2026-10-17): what a push to main changed
+ * is the last good commit's to say (`--affected=<sha>`), and `HEAD~1`
+ * guessed it wrong after any multi-commit push.
  */
-export async function defaultAffectedBase(workspaceRoot: string): Promise<string> {
-  const probe = spawnGitSync(
-    ['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
-    workspaceRoot,
-    'ignore',
-  )
-  const out = new TextDecoder().decode(probe.stdout).trim()
-  // An origin/HEAD naming a branch the remote deleted (a pruned fetch keeps
-  // the symref) is no base either: it failed as `git ref "origin/master" did
-  // not resolve`, a ref nobody typed, where an unset one falls back.
-  if (probe.exitCode === 0 && out.length > 0 && revParse(workspaceRoot, out) !== undefined) {
-    return out
-  }
-  // No origin/HEAD: `git remote add` + fetch, as actions/checkout does, sets
-  // none, and `HEAD~1` saw only a feature branch's last commit where Turbo
-  // and Nx compare with `main` (D-93). The usual trunk names, remote first;
-  // one that IS HEAD (a push to main) falls through to `HEAD~1` as before.
-  const trunk = trunkBase(workspaceRoot)
-  if (trunk !== undefined) return trunk
-  if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
+export async function defaultAffectedBase(
+  workspaceRoot: string,
+  baseBranch: string | undefined,
+): Promise<string> {
+  const found = await baseBranchRef(workspaceRoot, baseBranch)
+  if (found === undefined) {
     const noHistory = noHistoryRefusal(workspaceRoot)
     if (noHistory !== undefined) throw noHistory
     throw new UserError(
-      '--affected has no base here: origin/HEAD is not set (or names a branch that is gone) and HEAD has no parent to compare ' +
-        'with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0) or name the ' +
-        'base: --affected=origin/main',
+      `--affected has no base here: ${baseBranch === undefined ? 'no origin/HEAD, main or master' : `no ${baseBranch} or origin/${baseBranch}`} ` +
+        'to compare with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0), ' +
+        'set `baseBranch`, or name the base: --affected=origin/main',
+      'VX_E_AFFECTED_BASE',
+    )
+  }
+  if (found.onIt) {
+    throw new UserError(
+      `--affected has no default on the base branch (${found.branch}): name the last good commit, --affected=<sha>`,
       'VX_E_AFFECTED_BASE',
     )
   }
-  return 'HEAD~1'
+  return found.ref
 }
 
 /**
@@ -687,30 +741,83 @@ function noHistoryRefusal(workspaceRoot: string): UserError | undefined {
   return undefined
 }
 
-const TRUNKS = ['origin/main', 'origin/master', 'main', 'master']
+/**
+ * What a branch changed, for which of its tasks read its cache scope
+ * (owner, 2026-10-17): from `base` (a plugin's: a pull request's base
+ * commit), else from the merge base with the base branch. No base, or
+ * one git cannot resolve (a CI checkout at `fetch-depth: 1`), is no
+ * change: every task reads the default key, which costs hits, never
+ * correctness, since a key must still match.
+ */
+export async function branchChanges(
+  workspaceRoot: string,
+  base: string | undefined,
+  baseBranch: string | undefined,
+  projects: Promise<readonly ProjectMeta[]>,
+  /** The run's own enumeration, so the diff walks nothing a second time. */
+  walked: Pick<AffectedArgs, 'untracked' | 'links'> = {},
+): Promise<AffectedChanges> {
+  const none: AffectedChanges = {
+    projects: new Set(),
+    changed: [],
+    paths: new Map(),
+    whole: new Set(),
+  }
+  const since = base ?? (await baseBranchRef(workspaceRoot, baseBranch))?.ref
+  if (since === undefined) return none
+  try {
+    return await affectedChanges({
+      workspaceRoot,
+      since,
+      projects,
+      configImports: false,
+      ...walked,
+    })
+  } catch (err) {
+    if (!isUserError(err)) throw err
+    return none
+  }
+}
 
-/** The first of `TRUNKS` that exists and is not HEAD's commit, in one spawn. */
-function trunkBase(workspaceRoot: string): string | undefined {
-  const proc = spawnGitSync(
-    [
+/**
+ * The base branch as a ref: `origin/<name>`, else the local branch (a
+ * clone with no remote), and whether HEAD is on it. The name is the
+ * configured one, else `origin/HEAD`'s, else `main`, else `master`. Its
+ * spawns run at once, off the event loop.
+ */
+async function baseBranchRef(
+  workspaceRoot: string,
+  configured: string | undefined,
+): Promise<{ ref: string; branch: string; onIt: boolean } | undefined> {
+  const text = async (args: string[]): Promise<string> => {
+    const proc = spawnGit(args, workspaceRoot)
+    const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+    return exit === 0 ? out.trim() : ''
+  }
+  const names = configured === undefined ? ['main', 'master'] : [configured]
+  const [remoteHead, refs, head] = await Promise.all([
+    configured === undefined
+      ? text(['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'])
+      : Promise.resolve(''),
+    text([
       'for-each-ref',
-      '--format=%(refname:short) %(objectname)',
+      '--format=%(refname:short)',
       '--end-of-options',
-      ...TRUNKS.map((t) => (t.startsWith('origin/') ? `refs/remotes/${t}` : `refs/heads/${t}`)),
-    ],
-    workspaceRoot,
-    'ignore',
-  )
-  if (proc.exitCode !== 0) return undefined
-  const at = new Map(
-    new TextDecoder()
-      .decode(proc.stdout)
-      .split('\n')
-      .filter((l) => l !== '')
-      .map((l) => l.split(' ') as [string, string]),
-  )
-  const head = revParse(workspaceRoot, 'HEAD')
-  return TRUNKS.find((t) => at.has(t) && at.get(t) !== head)
+      ...(configured === undefined
+        ? ['refs/remotes/origin']
+        : [`refs/remotes/origin/${configured}`]),
+      ...names.map((n) => `refs/heads/${n}`),
+    ]),
+    text(['symbolic-ref', '--short', '-q', 'HEAD']),
+  ])
+  const have = new Set(refs.split('\n'))
+  const at = (branch: string, ref: string) => ({ ref, branch, onIt: head === branch })
+  if (remoteHead.startsWith('origin/') && have.has(remoteHead)) {
+    return at(remoteHead.slice('origin/'.length), remoteHead)
+  }
+  for (const n of names) if (have.has(`origin/${n}`)) return at(n, `origin/${n}`)
+  for (const n of names) if (have.has(n)) return at(n, n)
+  return undefined
 }
 
 /**

package/src/workspace/config-schema.ts

@@ -44,14 +44,39 @@ import { nonJsonMessage, nonJsonPaths } from './json-data.js'
 // declared no plugins and ran the workspace bare, `cacheDirectory` left the
 // cache where it was — a config that loads and quietly does nothing it says.
 const CACHE_SCOPE_RULE =
-  "must be a scope name of letters, digits and . _ - / @ (at most 128), like 'pr-123'"
+  "must be a scope name of letters, digits and . _ - / @ : (at most 128), like 'vznjs/vx:feat-x'"
 
-/** `cache.scope`'s rule, shared with `VX_CACHE_SCOPE`. */
+/** A cache scope's rule, for `VX_CACHE_SCOPE` and a plugin's `setBranch`. */
 export function isCacheScope(v: unknown): v is string {
-  return typeof v === 'string' && /^[\w.@/-]{1,128}$/.test(v)
+  return typeof v === 'string' && /^[\w.@/:-]{1,128}$/.test(v)
 }
 
-/** Why a `VX_CACHE_SCOPE` or `--cache-scope` value is refused, in `cache.scope`'s words. */
+/**
+ * A branch's cache scope, `<owner>/<repo>:<branch>`: what CI writes for a
+ * branch and a laptop on it reads (owner, 2026-10-17). The repository's
+ * identity, not a remote's local name, so a clone whose `origin` is a fork
+ * names the fork. A name may hold characters a scope may not; each
+ * becomes `_`.
+ */
+const BASE_BRANCH_RULE = "must be a branch name like 'main'"
+
+/**
+ * A branch name git takes after `origin/`: a leading '-' would reach git
+ * as an option, and whitespace, `..`, `~^:?*[\\` are no ref's.
+ */
+function isBaseBranch(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    /^[^-\s\0~^:?*[\\][^\s\0~^:?*[\\]*$/.test(value) &&
+    !value.includes('..')
+  )
+}
+
+export function branchCacheScope(repo: string, branch: string): string {
+  return `${repo.toLowerCase()}:${branch}`.replace(/[^\w.@/:-]/g, '_').slice(0, 128)
+}
+
+/** Why a `VX_CACHE_SCOPE` value is refused. */
 export function cacheScopeError(source = 'VX_CACHE_SCOPE'): string {
   return `${source} ${CACHE_SCOPE_RULE}`
 }
@@ -61,6 +86,15 @@ export function cacheScopeEnvError(): UserError {
   return new UserError(cacheScopeError())
 }
 
+/** `baseBranch`: `VX_BASE_BRANCH`, else the workspace's; undefined lets git name it. */
+export function configuredBaseBranch(workspace: WorkspaceConfig | null): string | undefined {
+  const env = settingEnv('baseBranch')
+  if (env !== undefined && !isBaseBranch(env)) {
+    throw new UserError(`VX_BASE_BRANCH ${BASE_BRANCH_RULE}`, 'VX_E_USAGE')
+  }
+  return (env as string | undefined) ?? workspace?.baseBranch
+}
+
 const STRATEGIES = ['immutable', 'mutable', 'unchecked'] as const
 const SEVERITIES = ['warn', 'error'] as const
 const INPUT_STABILITY_FIELDS = new Set(['strategy', 'severity'])
@@ -98,7 +132,7 @@ export function inputStabilityEnv(): InputStability {
   }
 }
 
-const WORKSPACE_FIELDS = new Set<string>([...SETTING_GROUPS, 'plugins'])
+const WORKSPACE_FIELDS = new Set<string>([...SETTING_GROUPS, 'baseBranch', 'plugins'])
 
 /**
  * `.vx/workspace`'s settings, as `src/settings.ts` lists them: each group's
@@ -126,7 +160,7 @@ function validateSettingsAt(value: unknown, at: string, configPath: string): voi
       if (at === 'cache')
         // Turbo's and Nx's workspace `cache: true` is a task's own `cache` in vx (D-98).
         throw new UserError(
-          `${where} must be an object like { dir, policy, scope }; a task caches through its own \`cache\` in its project's vx.config`,
+          `${where} must be an object like { dir, policy }; a task caches through its own \`cache\` in its project's vx.config`,
         )
       throw new UserError(`${where} must be an object (fields: ${[...fields].join(', ')})`)
     }
@@ -197,18 +231,12 @@ function validateSettingsExtra(config: WorkspaceConfig, configPath: string): voi
     // unwritable workspace.
     throw new UserError(`${configPath}: \`cache.dir\` holds a NUL, which no path can carry`)
   }
-  const base = config.run?.affectedBase
-  // A leading '-' would reach git as an option, not a ref; a NUL fails the
-  // spawn with an argument error naming nothing in this file.
-  if (base !== undefined && !/^[^-\s\0][^\s\0]*$/.test(base)) {
-    throw new UserError(`${configPath}: \`run.affectedBase\` must be a git ref like 'origin/main'`)
+  const base = config.baseBranch
+  if (base !== undefined && !isBaseBranch(base)) {
+    throw new UserError(`${configPath}: \`baseBranch\` ${BASE_BRANCH_RULE}`)
   }
   // `policy`'s grammar is the cache module's (`parseCachePolicy`), which
   // this module may not import: the run parses it before any task (prepare.ts).
-  const scope = config.cache?.scope
-  if (scope !== undefined && !isCacheScope(scope)) {
-    throw new UserError(`${configPath}: \`cache.scope\` ${CACHE_SCOPE_RULE}`)
-  }
   if (config.cache?.retention !== undefined) validateRetention(config.cache.retention, configPath)
 }
 
@@ -378,16 +406,21 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
         }
       }
       if (plug.fingerprint !== undefined) {
-        const claim = plug.fingerprint as { files?: unknown; affected?: unknown } | null
+        const claim = plug.fingerprint as {
+          files?: unknown
+          affected?: unknown
+          extraFiles?: unknown
+        } | null
         if (
           claim === null ||
           typeof claim !== 'object' ||
           !Array.isArray(claim.files) ||
           claim.files.length === 0 ||
-          typeof claim.affected !== 'function'
+          typeof claim.affected !== 'function' ||
+          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function')
         ) {
           throw new UserError(
-            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function }`,
+            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function }`,
           )
         }
         for (const file of claim.files as unknown[]) {
@@ -770,6 +803,7 @@ export function validateProjectConfig(
         }
         assertPosixGlob(g, `${where}.inputs.files`, 'project')
         assertNoForeignToken(g, `${where}.inputs.files`)
+        assertInputGlob(g, `${where}.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
             `${where}.inputs.files: "${g}" names the project directory itself and selects nothing — use "**" for everything under it`,
@@ -1097,7 +1131,7 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         'a cache plugin in `plugins` (`turboCache()` or `nxCache()` from `@vzn/vx-migrate`)',
       parallel: '`run.concurrency`',
       cacheDirectory: '`cache.dir`',
-      defaultBase: '`run.affectedBase`',
+      defaultBase: '`baseBranch`',
       tasksRunnerOptions: 'a cache plugin in `plugins` (`nxCache()` from `@vzn/vx-migrate`)',
       globalPassThroughEnv: '`exec.env.passThrough` on the tasks it passes to',
       // pnpm-workspace.yaml's, Lerna's and the package.json's own keys
@@ -1333,6 +1367,33 @@ function assertPosixGlob(glob: string, where: string, base: string): void {
   )
 }
 
+const ONE_ALTERNATIVE_BRACE = /(?<!\\)\{[^{},]*\}/
+
+/**
+ * What every run would refuse, or silently key nothing for, refused at
+ * `vx lock` instead. `Bun.Glob` reads `{b}` as a brace of one alternative,
+ * so `src/{b}.ts` matches `src/b.ts` and never a file named `{b}.ts`:
+ * neither reading is sure to be the one meant, so both spellings are
+ * named. A path under `.git` is never listed by git, so it keyed nothing.
+ */
+function assertInputGlob(glob: string, where: string): void {
+  const m = ONE_ALTERNATIVE_BRACE.exec(glob)
+  if (m !== null) {
+    const inner = m[0].slice(1, -1)
+    throw new UserError(
+      `${where}: "${glob}" holds a brace with one alternative, which matches ` +
+        `"${inner}" and never a name holding "${m[0]}". Write "${glob.replace(m[0], inner)}", ` +
+        `or "${glob.replace(m[0], `\\{${inner}\\}`)}" for the braces themselves.`,
+    )
+  }
+  if (glob.replace(/^!/, '').split('/').includes('.git')) {
+    throw new UserError(
+      `${where}: "${glob}" names a path under .git, which git never lists, so it keys nothing — ` +
+        `inputs are the repository's files`,
+    )
+  }
+}
+
 /**
  * `!!x` INVERTS the input set instead of double-negating it.
  *
@@ -1565,6 +1626,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
     }
     assertPosixGlob(g, where, 'workspace-root')
     assertNoForeignToken(g, where)
+    if (negation) assertInputGlob(g, where)
     if (namesDirItself(g)) {
       throw new UserError(
         `${where}: "${g}" names the workspace root itself and selects nothing — use "**" for everything under it`,

package/src/workspace/index.ts

@@ -6,6 +6,7 @@ export {
   type AffectedChanges,
   affectedProjects,
   defaultAffectedBase,
+  branchChanges,
   type FingerprintClaims,
   refIsHead,
 } from './affected.js'
@@ -35,8 +36,10 @@ export {
   WORKSPACE_CONFIG_FILENAMES,
 } from './project-loader.js'
 export {
+  branchCacheScope,
   cacheScopeEnvError,
   cacheScopeError,
+  configuredBaseBranch,
   inputStabilityEnv,
   isCacheScope,
   taskNameProblem,

package/src/workspace/project-loader.ts

@@ -640,6 +640,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'plugin',
   'randomUUIDv7',
   'resolveSync',
+  'secrets',
   'serve',
   'sleep',
   'sleepSync',

package/src/workspace/workspace.ts

@@ -188,14 +188,19 @@ export function linkDiscoveredEdges(
       [edge.reach, reach],
     ] as const) {
       for (const target of kind) {
-        const dir = path.resolve(root, target)
-        const rel = relPosix(root, dir)
-        const where = `plugin '${edge.by}' gave project "${edge.meta.name}" an edge to ${target}`
-        if (rel === '..' || rel.startsWith('../') || path.isAbsolute(rel)) {
-          throw new UserError(`${where}: outside the workspace root`)
+        // Every project lies inside the root (`discoveredProject` refuses
+        // one that does not), so a target naming one needs no other check:
+        // a plugin hands project dirs as they are, absolute, and resolving
+        // and judging each of 5,000 edges was ~15 ms at 1,000 projects.
+        const name = byDir.get(target) ?? byDir.get(path.resolve(root, target))
+        if (name === undefined) {
+          const rel = relPosix(root, path.resolve(root, target))
+          const where = `plugin '${edge.by}' gave project "${edge.meta.name}" an edge to ${target}`
+          if (rel === '..' || rel.startsWith('../') || path.isAbsolute(rel)) {
+            throw new UserError(`${where}: outside the workspace root`)
+          }
+          throw new UserError(`${where}: not a project`)
         }
-        const name = byDir.get(dir)
-        if (name === undefined) throw new UserError(`${where}: not a project`)
         let set = into.get(edge.meta)
         if (set === undefined) into.set(edge.meta, (set = new Set()))
         set.add(name)
@@ -417,12 +422,13 @@ export function lockedProjects(
  * The project a plugin's `discover` entry names: a new meta (`added`) for a
  * directory that is not a project yet, else the project already there,
  * renamed when its name was its path's. A config's `name` wins over the
- * plugin's; a name another plugin gave is not changed. `by` names the
- * plugin in a refusal.
+ * plugin's; a name another plugin gave is not changed. `known` is the
+ * projects by directory: a scan per entry was quadratic, 106 ms of a 5,000
+ * project warm run. `by` names the plugin in a refusal.
  */
 export async function discoveredProject(
   root: string,
-  known: readonly ProjectMeta[],
+  known: ReadonlyMap<string, ProjectMeta>,
   entry: {
     readonly dir: string
     readonly name?: string
@@ -456,7 +462,7 @@ export async function discoveredProject(
     throw new UserError(`${where}${named} at ${dir}: outside the workspace root`)
   }
   const shown = rel === '' ? '.' : rel
-  const meta = known.find((p) => p.dir === dir)
+  const meta = known.get(dir)
   if (meta !== undefined) {
     const from = namedBy.get(meta)
     if (name === undefined || name === meta.name || from === 'config') return { meta, added: false }