@vzn/vx 0.0.642 → 0.0.644

package/src/settings.ts

@@ -17,7 +17,8 @@ export type SettingKind =
   | { readonly type: 'concurrency' }
   // `zero`: 0 is a value ("wait for nothing not already done"), not a typo.
   | { readonly type: 'duration'; readonly timer?: true; readonly zero?: true }
-  | { readonly type: 'size' }
+  // `off`: `false` is a value, 0 bytes (the thing the size bounds is off).
+  | { readonly type: 'size'; readonly off?: true }
   | { readonly type: 'bool' }
   | { readonly type: 'enum'; readonly values: readonly string[] }
   | { readonly type: 'string' }
@@ -43,6 +44,12 @@ export interface Setting {
 const SCHEDULES = ['most-work', 'critical-path', 'direct-dependents', 'ready-order'] as const
 
 export const SETTINGS: readonly Setting[] = [
+  {
+    path: 'baseBranch',
+    kind: { type: 'string' },
+    default: "origin/HEAD's branch, then main, then master",
+    doc: 'The default branch: a run on it has no cache scope and a bare `--affected` no base; elsewhere both use the merge base with `origin/<baseBranch>`.',
+  },
   {
     path: 'run.concurrency',
     kind: { type: 'concurrency' },
@@ -57,12 +64,6 @@ export const SETTINGS: readonly Setting[] = [
     doc: 'Which ready task starts first when there are more than workers.',
     flag: { verb: 'run', name: '--schedule' },
   },
-  {
-    path: 'run.affectedBase',
-    kind: { type: 'string' },
-    default: 'origin/HEAD, then the trunk, else HEAD~1',
-    doc: 'The git ref a bare `--affected` compares with.',
-  },
   {
     path: 'run.branch',
     kind: { type: 'string' },
@@ -115,18 +116,6 @@ export const SETTINGS: readonly Setting[] = [
     doc: 'Where the cache lives, relative to the workspace root; named, it holds the whole cache.',
     flag: { verb: 'run', name: '--cache-dir' },
   },
-  {
-    path: 'cache.retention.maxSize',
-    kind: { type: 'size' },
-    default: 'none',
-    doc: "Evict least-recently-used entries at each run's end until the cache is under this (`'10GB'`).",
-  },
-  {
-    path: 'cache.retention.olderThan',
-    kind: { type: 'duration' },
-    default: 'none',
-    doc: "Evict entries unused for this long at each run's end (`'30d'`).",
-  },
   {
     path: 'cache.policy',
     kind: { type: 'string' },
@@ -137,9 +126,30 @@ export const SETTINGS: readonly Setting[] = [
   {
     path: 'cache.scope',
     kind: { type: 'string' },
-    default: 'none (the default keys)',
-    doc: "Where cache writes land (`'pr-123'`): reads try the default key, then the scope's.",
-    flag: { verb: 'run', name: '--cache-scope' },
+    default: "the branch's, `<owner>/<repo>:<branch>`, with a remote cache off `baseBranch`",
+    doc: "A branch's remote entries (`'vznjs/vx:feat-x'`): tasks the branch changed read the scope's key, the rest the default key; the local cache never uses it. Empty: no scope.",
+    config: false,
+  },
+  {
+    path: 'cache.concurrency.download',
+    kind: { type: 'int', min: 1 },
+    default: 'min(96, max(cores × 3, 64))',
+    doc: 'Remote downloads at once.',
+    flag: { verb: 'run', name: '--cache-concurrency-download' },
+  },
+  {
+    path: 'cache.concurrency.upload',
+    kind: { type: 'int', min: 1 },
+    default: 'min(96, max(cores × 3, 64))',
+    doc: 'Uploads at once, per remote.',
+    flag: { verb: 'run', name: '--cache-concurrency-upload' },
+  },
+  {
+    path: 'cache.concurrency.restore',
+    kind: { type: 'int', min: 1 },
+    default: 'twice `run.concurrency`',
+    doc: 'Local hits restoring outputs at once.',
+    flag: { verb: 'run', name: '--cache-concurrency-restore' },
   },
   {
     path: 'cache.download',
@@ -170,6 +180,24 @@ export const SETTINGS: readonly Setting[] = [
     task: 'cache.outputs.clean',
     env: false,
   },
+  {
+    path: 'cache.store.embeddings',
+    kind: { type: 'size', off: true },
+    default: "'32KiB'",
+    doc: 'Keep an entry up to this size inside the cache index, one zstd tar, rather than as files; `false` keeps none.',
+  },
+  {
+    path: 'cache.store.decompress',
+    kind: { type: 'bool' },
+    default: 'true',
+    doc: 'Keep a larger entry as its plain files, which a hit copies or clones out; off, as one `.tar.zst`.',
+  },
+  {
+    path: 'cache.store.verify',
+    kind: { type: 'enum', values: ['stat', 'hash', 'none'] },
+    default: 'stat',
+    doc: "What a hit on plain files checks first: each file's size and mtime, every byte, or nothing.",
+  },
   {
     path: 'cache.upload.failures',
     kind: { type: 'enum', values: ['ci', 'local', 'always'] },
@@ -220,7 +248,7 @@ export const SETTINGS: readonly Setting[] = [
   },
 ]
 
-/** The `.vx/workspace` groups that hold settings; `plugins` is the other key. */
+/** The `.vx/workspace` groups that hold settings; `baseBranch` and `plugins` are the other keys. */
 export const SETTING_GROUPS = ['run', 'cache', 'lock', 'watch'] as const
 
 const BY_PATH = new Map(SETTINGS.map((s) => [s.path, s]))
@@ -229,7 +257,7 @@ export function setting(path: string): Setting {
   return BY_PATH.get(path)!
 }
 
-/** `run.affectedBase` → `VX_RUN_AFFECTED_BASE`. */
+/** `run.branch` → `VX_RUN_BRANCH`. */
 export function envName(path: string): string {
   return `VX_${path
     .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
@@ -250,7 +278,7 @@ export function kindHint(kind: SettingKind): string {
         ? "a duration like '500ms', '30s' or '5m', at most 24 days"
         : "a duration like '45s', '12h' or '30d'"
     case 'size':
-      return "a size like '500MB' or '10GB'"
+      return kind.off === true ? "false, or a size like '32KiB'" : "a size like '500MB' or '10GB'"
     case 'bool':
       return 'true or false'
     case 'enum':
@@ -298,6 +326,7 @@ export function parseSettingValue(kind: SettingKind, raw: unknown): unknown {
       return kind.timer === true && n > MAX_TIMEOUT_MS ? null : n
     }
     case 'size':
+      if (kind.off === true && (raw === false || raw === 'false')) return 0
       return typeof raw === 'string' ? parseSize(raw) : null
     case 'bool':
       if (typeof raw === 'boolean') return raw

package/src/util/index.ts

@@ -55,6 +55,7 @@ export {
   EXTGLOB,
   grantPrefix,
   isLiteralPattern,
+  literalPath,
   GLOB_WILDCARDS,
   normalizeBunGlob,
   normalizeGlob,

package/src/util/paths.ts

@@ -48,7 +48,15 @@ export function relPosix(from: string, to: string): string {
  * Every glob reaching here is user-written, so every one takes the rule.
  */
 export function staticPrefix(rawGlob: string): string {
-  return prefixOf(normalizeGlob(rawGlob), GLOB_WILDCARDS)
+  // An escaped character is part of the prefix and names itself:
+  // `app/\[id\]/**` is rooted at the directory `app/[id]`.
+  const g = normalizeGlob(rawGlob)
+  if (!g.includes('\\')) return prefixOf(g, GLOB_WILDCARDS)
+  const masked = g.replace(/\\./g, '\0\0')
+  const prefix = prefixOf(masked, GLOB_WILDCARDS)
+  return prefix === '.' || prefix === '/'
+    ? prefix
+    : g.slice(0, prefix.length).replace(/\\(.)/g, '$1')
 }
 
 /**
@@ -98,10 +106,10 @@ export function wholeSubtreePrefixes(globs: readonly string[]): string[] | null
   if (globs.length === 0) return null
   const out: string[] = []
   for (const g of globs.map(normalizeGlob)) {
-    const m = /^([^*?{}!]+?)\/\*\*$/.exec(g)
-    const whole = m?.[1] ?? (isLiteralPattern(g) && !g.startsWith('!') ? g : null)
-    if (whole === null) return null
-    const dir = whole.replace(/\/+$/, '')
+    const named = /^(.+?)\/\*\*$/.exec(g)?.[1] ?? g
+    if (g.startsWith('!') || !namesOnePath(named)) return null
+    // An escaped bracket names itself: `app/\[id\]/**` is the tree `app/[id]`.
+    const dir = named.replace(/\\(.)/g, '$1').replace(/\/+$/, '')
     if (dir === '' || dir === '.' || dir.startsWith('/') || dir.split('/').includes('..'))
       return null
     out.push(dir)
@@ -136,10 +144,6 @@ function normalizeWith(glob: string, wildcards: RegExp): string {
   let g = neg ? glob.slice(1) : glob
   g = g.replace(/\/{2,}/g, '/').replace(/(^|\/)(\.\/)+/g, '$1')
   if (g === '.') g = ''
-  // Where a bracket is literal, Turbo's escaped spelling `\[id\]` names the
-  // same path as `[id]`; one spelling is what lets every literal fast path
-  // (string compare, `settleLiterals`, `asTrees`) see it as a literal.
-  if (wildcards === GLOB_WILDCARDS && g.includes('\\')) g = g.replace(/\\([[\]])/g, '$1')
   if (wildcards.test(g) && g.endsWith('/')) g = `${g.replace(/\/+$/, '')}/**`
   return neg ? `!${g}` : g
 }
@@ -172,21 +176,19 @@ export function isLiteralPattern(glob: string): boolean {
  * class written out nine times — a spelling that drifts is how two guards
  * come to answer differently for one pattern.
  *
- * `[` and `]` are NOT in it: a bracket is a literal character in a task
- * glob, and there are no character classes (item 667). Route directories
- * are named `[id]` across Next.js, SvelteKit and Astro, and read as a class
- * `app/[id]/**` matched `app/i/…` and `app/d/…` and never the route: the
- * file never entered the key (a stale hit) and the output clean deleted an
- * unrelated `app/i/page.js`. {@link taskGlob} is how such a glob reaches
- * `Bun.Glob`, whose own alphabet still reads the class.
+ * A task glob is a standard glob (M, 2026-10-18): `[...]` is a character
+ * class and `\[id\]` names the route directory `[id]`. An escape counts as
+ * a wildcard too: such a pattern is matched by `Bun.Glob`, which reads the
+ * escape, never compared as a string; `asTrees` still reads an escaped-only
+ * pattern as one path.
  */
-export const GLOB_WILDCARDS = /[*?{}]/
+export const GLOB_WILDCARDS = /[*?{}[\]\\]/
 
 /**
- * `Bun.Glob`'s own alphabet, the class included, for the globs vx does not
- * own: package-manager workspace members and `--filter` path globs follow
- * npm/pnpm semantics, and a sandbox grant's prefix must stop where the scan
- * that expands the grant (`Bun.Glob`, `MOUNT_WILDCARDS`) sees a wildcard.
+ * `Bun.Glob`'s own alphabet, for the globs vx does not own: package-manager
+ * workspace members and `--filter` path globs follow npm/pnpm semantics,
+ * and a sandbox grant's prefix must stop where the scan that expands the
+ * grant (`Bun.Glob`, `MOUNT_WILDCARDS`) sees a wildcard.
  */
 export const BUN_GLOB_WILDCARDS = /[*?[\]{}]/
 
@@ -200,11 +202,7 @@ export const BUN_GLOB_WILDCARDS = /[*?[\]{}]/
  */
 export const EXTGLOB = /[!@+*?]\(/
 
-/**
- * Compile a task glob for `Bun.Glob`, with every bare bracket escaped so it
- * matches itself (item 667). Every task glob is compiled here and nowhere
- * else: one site that forgot is a route directory that keys nothing.
- */
+/** Compile a task glob for `Bun.Glob`. Every task glob is compiled here and nowhere else. */
 export function taskGlob(pattern: string): Bun.Glob {
   const memo = memoFor(taskGlobs)
   let glob = memo.get(pattern)
@@ -230,9 +228,7 @@ function memoFor<T>(memos: WeakMap<object, Map<string, T>>): Map<string, T> {
 }
 
 function compileTaskGlob(pattern: string): Bun.Glob {
-  // A `]` with no `[` before it is already literal to `Bun.Glob`.
-  const source = pattern.includes('[') ? pattern.replace(/(?<!\\)[[\]]/g, '\\$&') : pattern
-  const glob = new Bun.Glob(source)
+  const glob = new Bun.Glob(pattern)
   const alternatives = braceAlternatives(pattern)
   if (alternatives.length > 1) {
     const any = anyTaskGlob(alternatives)
@@ -288,12 +284,12 @@ const REGEXP_SYNTAX = /[\\^$.*+?()[\]{}|]/g
  * The RegExp source of a task glob, matching what `Bun.Glob` matches
  * (`tests/util-paths.test.ts` holds the two to the same verdict on every
  * shape): `*` any run within a name, `?` one character, a `**` segment any
- * number of directories, a bracket itself. Null for the syntax left to
- * `Bun.Glob`: a brace, an escape, a leading `!`, an empty, `.` or `..`
+ * number of directories. Null for the syntax left to `Bun.Glob`: a brace,
+ * a character class, an escape, a leading `!`, an empty, `.` or `..`
  * segment, a `**` inside a name, or two `**` segments in a row.
  */
 function regExpSource(pattern: string): string | null {
-  if (/[\\{}]/.test(pattern) || pattern.startsWith('!')) return null
+  if (/[\\{}[\]]/.test(pattern) || pattern.startsWith('!')) return null
   const segments = pattern.split('/')
   let out = ''
   for (let i = 0; i < segments.length; i++) {
@@ -342,7 +338,7 @@ export function asTrees(patterns: readonly string[]): string[] {
   const out: string[] = []
   for (const raw of patterns) {
     const p = normalizeGlob(raw)
-    if (!isLiteralPattern(p)) {
+    if (!namesOnePath(p)) {
       out.push(p)
       continue
     }
@@ -353,6 +349,19 @@ export function asTrees(patterns: readonly string[]): string[] {
   return out
 }
 
+/**
+ * The one path a task glob names, an escaped one included (`app/\[id\]`
+ * names `app/[id]`), or null for a pattern.
+ */
+export function literalPath(glob: string): string | null {
+  if (isLiteralPattern(glob)) return glob
+  return isLiteralPattern(glob.replace(/\\./g, '_')) ? glob.replace(/\\(.)/g, '$1') : null
+}
+
+function namesOnePath(glob: string): boolean {
+  return literalPath(glob) !== null
+}
+
 /**
  * An output list's positive globs, and what its `!` entries take back
  * (A-44). A reader that only needs where outputs MIGHT land (an overlap

package/src/util/size.ts

@@ -4,13 +4,13 @@ import { parseDecimalInt } from './num.js'
 
 /**
  * Parse a byte-size string: a bare integer (`"1048576"`) or an integer
- * with a K/M/G/T suffix, powers of 1024, optional trailing `B`
- * (`"512MB"`, `"8G"`). Returns `null` for anything else — including
+ * with a K/M/G/T suffix, powers of 1024, optional trailing `B` or `iB`
+ * (`"512MB"`, `"8G"`, `"32KiB"`). Returns `null` for anything else — including
  * fractional sizes (`"1.5GB"`); callers wanting fractions must express
  * them in a smaller unit.
  */
 export function parseSize(input: string): number | null {
-  const m = input.match(/^(\d+)([KMGT])?B?$/i)
+  const m = input.match(/^(\d+)(?:([KMGT])(?:i?B)?|B)?$/i)
   if (!m) return null
   // Digits past 2^53 parse to a different number than the user typed.
   const n = parseDecimalInt(m[1]!)
@@ -49,8 +49,7 @@ export function parseDuration(input: string): number | null {
 
 /**
  * Human-readable byte size with KB/MB/GB/TB/PB suffixes and one
- * decimal of precision below 10 of any unit. Used by `vx info`, `vx cache clean` and the
- * run's `cacheRetention` line.
+ * decimal of precision below 10 of any unit. Used by `vx info` and `vx cache clean`.
  */
 export function formatBytes(n: number): string {
   if (n < 1024) return `${n} B`

package/src/workspace/affected.ts

@@ -14,6 +14,7 @@ import {
   gitSpawnRefusal,
   isExecutableMissing,
   isInstalledPath,
+  isUserError,
   notAWorkTree,
   relPosix,
   UserError,
@@ -73,7 +74,14 @@ export interface AffectedArgs {
   workspaceRoot: string
   /** Git ref / commit / branch to compare against. Required. */
   since: string
-  projects: readonly ProjectMeta[]
+  /** A promise when the caller is still discovering them: the git calls start first. */
+  projects: readonly ProjectMeta[] | Promise<readonly ProjectMeta[]>
+  /**
+   * False skips the scan of what each `vx.config` imports (every config
+   * read): the cache scope's split, where a wrong answer costs a miss,
+   * never a stale hit, and the scan was most of a 1,000-project diff.
+   */
+  configImports?: false
   /**
    * Which projects declare a `inputs.workspaceFiles` glob matching one of
    * these workspace-relative paths.
@@ -255,6 +263,8 @@ export async function affectedChanges(
       gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']))(),
   ])
 
+  const projects = await args.projects
+
   // .vx/projects.lock.json (workspace-root metadata) is excluded like a gitignored
   // file: re-running `vx lock` must not mark every project affected.
   // An untracked file under `node_modules` is an install, which the input
@@ -291,7 +301,7 @@ export async function affectedChanges(
   //
   // Selection is not hashed, so widening it here changes no cache key.
   const everything = (file: string): AffectedChanges => {
-    const all = new Set(args.projects.map((p) => p.name))
+    const all = new Set(projects.map((p) => p.name))
     const wholeBy = new Map([...all].map((n) => [n, file]))
     return { projects: all, changed, paths: new Map(), whole: all, wholeBy }
   }
@@ -320,7 +330,7 @@ export async function affectedChanges(
   const rootDir = path.resolve(args.workspaceRoot)
   const loose = changed.filter((rel) => {
     const abs = path.join(rootDir, rel)
-    return !args.projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
+    return !projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
   })
   const extraClaims = loose.length > 0 ? await loadClaims() : undefined
   for (const file of extraClaims?.files ?? []) {
@@ -383,7 +393,7 @@ export async function affectedChanges(
 
   const realDirs = new Map(
     await Promise.all(
-      args.projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
+      projects.map(async (p) => [p.dir, await realpath(p.dir).catch(() => p.dir)] as const),
     ),
   )
   const paths = new Map<string, string[]>()
@@ -392,7 +402,7 @@ export async function affectedChanges(
     args.workspaceRoot,
     changed,
     nested,
-    args.projects,
+    projects,
     realDirs,
     perTask
       ? {
@@ -412,7 +422,7 @@ export async function affectedChanges(
   const configs = changed.filter((rel) => CONFIG_NAMES.has(path.posix.basename(rel)))
   if (configs.length > 0) {
     const atBase = await gitBlobsAt(args.workspaceRoot, base, configs)
-    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, args.projects)) {
+    for (const name of parentsOfNewNested(args.workspaceRoot, atBase, projects)) {
       owned.add(name)
       whole.add(name)
     }
@@ -426,12 +436,14 @@ export async function affectedChanges(
   // (`../../src/index.ts`), whose target is owned.
   // Per task, a project that owns the changed file still needs to know its
   // config imported it: that re-keys every task, whatever their inputs.
-  for (const name of await configImportOwners({
-    workspaceRoot: args.workspaceRoot,
-    projects: args.projects,
-    changed,
-    skip: perTask ? new Set() : owned,
-  })) {
+  for (const name of args.configImports === false
+    ? []
+    : await configImportOwners({
+        workspaceRoot: args.workspaceRoot,
+        projects: projects,
+        changed,
+        skip: perTask ? new Set() : owned,
+      })) {
     owned.add(name)
     whole.add(name)
   }
@@ -679,43 +691,35 @@ async function gitDiffPaths(
 }
 
 /**
- * Resolve the default base for `--affected` with no explicit value.
- * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
- * etc.), then `origin/main`, `origin/master`, `main`, `master`, then
- * falls back to `HEAD~1`. A clone with no `origin/HEAD` and
- * no parent commit — a CI checkout at `fetch-depth: 1` — has no base at
- * all, and says so here rather than failing on a ref nobody typed.
+ * The base a bare `--affected` compares with: the merge base of HEAD and
+ * the base branch (`origin/<baseBranch>`, or the local branch in a clone
+ * with no remote; its tip when they share no history). On the base branch
+ * itself there is none (owner, 2026-10-17): what a push to main changed
+ * is the last good commit's to say (`--affected=<sha>`), and `HEAD~1`
+ * guessed it wrong after any multi-commit push.
  */
-export async function defaultAffectedBase(workspaceRoot: string): Promise<string> {
-  const probe = spawnGitSync(
-    ['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
-    workspaceRoot,
-    'ignore',
-  )
-  const out = new TextDecoder().decode(probe.stdout).trim()
-  // An origin/HEAD naming a branch the remote deleted (a pruned fetch keeps
-  // the symref) is no base either: it failed as `git ref "origin/master" did
-  // not resolve`, a ref nobody typed, where an unset one falls back.
-  if (probe.exitCode === 0 && out.length > 0 && revParse(workspaceRoot, out) !== undefined) {
-    return out
-  }
-  // No origin/HEAD: `git remote add` + fetch, as actions/checkout does, sets
-  // none, and `HEAD~1` saw only a feature branch's last commit where Turbo
-  // and Nx compare with `main` (D-93). The usual trunk names, remote first;
-  // one that IS HEAD (a push to main) falls through to `HEAD~1` as before.
-  const trunk = trunkBase(workspaceRoot)
-  if (trunk !== undefined) return trunk
-  if (revParse(workspaceRoot, 'HEAD~1') === undefined) {
+export async function defaultAffectedBase(
+  workspaceRoot: string,
+  baseBranch: string | undefined,
+): Promise<string> {
+  const found = await baseBranchRef(workspaceRoot, baseBranch)
+  if (found === undefined) {
     const noHistory = noHistoryRefusal(workspaceRoot)
     if (noHistory !== undefined) throw noHistory
     throw new UserError(
-      '--affected has no base here: origin/HEAD is not set (or names a branch that is gone) and HEAD has no parent to compare ' +
-        'with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0) or name the ' +
-        'base: --affected=origin/main',
+      `--affected has no base here: ${baseBranch === undefined ? 'no origin/HEAD, main or master' : `no ${baseBranch} or origin/${baseBranch}`} ` +
+        'to compare with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0), ' +
+        'set `baseBranch`, or name the base: --affected=origin/main',
+      'VX_E_AFFECTED_BASE',
+    )
+  }
+  if (found.onIt) {
+    throw new UserError(
+      `--affected has no default on the base branch (${found.branch}): name the last good commit, --affected=<sha>`,
       'VX_E_AFFECTED_BASE',
     )
   }
-  return 'HEAD~1'
+  return found.ref
 }
 
 /**
@@ -737,30 +741,83 @@ function noHistoryRefusal(workspaceRoot: string): UserError | undefined {
   return undefined
 }
 
-const TRUNKS = ['origin/main', 'origin/master', 'main', 'master']
+/**
+ * What a branch changed, for which of its tasks read its cache scope
+ * (owner, 2026-10-17): from `base` (a plugin's: a pull request's base
+ * commit), else from the merge base with the base branch. No base, or
+ * one git cannot resolve (a CI checkout at `fetch-depth: 1`), is no
+ * change: every task reads the default key, which costs hits, never
+ * correctness, since a key must still match.
+ */
+export async function branchChanges(
+  workspaceRoot: string,
+  base: string | undefined,
+  baseBranch: string | undefined,
+  projects: Promise<readonly ProjectMeta[]>,
+  /** The run's own enumeration, so the diff walks nothing a second time. */
+  walked: Pick<AffectedArgs, 'untracked' | 'links'> = {},
+): Promise<AffectedChanges> {
+  const none: AffectedChanges = {
+    projects: new Set(),
+    changed: [],
+    paths: new Map(),
+    whole: new Set(),
+  }
+  const since = base ?? (await baseBranchRef(workspaceRoot, baseBranch))?.ref
+  if (since === undefined) return none
+  try {
+    return await affectedChanges({
+      workspaceRoot,
+      since,
+      projects,
+      configImports: false,
+      ...walked,
+    })
+  } catch (err) {
+    if (!isUserError(err)) throw err
+    return none
+  }
+}
 
-/** The first of `TRUNKS` that exists and is not HEAD's commit, in one spawn. */
-function trunkBase(workspaceRoot: string): string | undefined {
-  const proc = spawnGitSync(
-    [
+/**
+ * The base branch as a ref: `origin/<name>`, else the local branch (a
+ * clone with no remote), and whether HEAD is on it. The name is the
+ * configured one, else `origin/HEAD`'s, else `main`, else `master`. Its
+ * spawns run at once, off the event loop.
+ */
+async function baseBranchRef(
+  workspaceRoot: string,
+  configured: string | undefined,
+): Promise<{ ref: string; branch: string; onIt: boolean } | undefined> {
+  const text = async (args: string[]): Promise<string> => {
+    const proc = spawnGit(args, workspaceRoot)
+    const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+    return exit === 0 ? out.trim() : ''
+  }
+  const names = configured === undefined ? ['main', 'master'] : [configured]
+  const [remoteHead, refs, head] = await Promise.all([
+    configured === undefined
+      ? text(['symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'])
+      : Promise.resolve(''),
+    text([
       'for-each-ref',
-      '--format=%(refname:short) %(objectname)',
+      '--format=%(refname:short)',
       '--end-of-options',
-      ...TRUNKS.map((t) => (t.startsWith('origin/') ? `refs/remotes/${t}` : `refs/heads/${t}`)),
-    ],
-    workspaceRoot,
-    'ignore',
-  )
-  if (proc.exitCode !== 0) return undefined
-  const at = new Map(
-    new TextDecoder()
-      .decode(proc.stdout)
-      .split('\n')
-      .filter((l) => l !== '')
-      .map((l) => l.split(' ') as [string, string]),
-  )
-  const head = revParse(workspaceRoot, 'HEAD')
-  return TRUNKS.find((t) => at.has(t) && at.get(t) !== head)
+      ...(configured === undefined
+        ? ['refs/remotes/origin']
+        : [`refs/remotes/origin/${configured}`]),
+      ...names.map((n) => `refs/heads/${n}`),
+    ]),
+    text(['symbolic-ref', '--short', '-q', 'HEAD']),
+  ])
+  const have = new Set(refs.split('\n'))
+  const at = (branch: string, ref: string) => ({ ref, branch, onIt: head === branch })
+  if (remoteHead.startsWith('origin/') && have.has(remoteHead)) {
+    return at(remoteHead.slice('origin/'.length), remoteHead)
+  }
+  for (const n of names) if (have.has(`origin/${n}`)) return at(n, `origin/${n}`)
+  for (const n of names) if (have.has(n)) return at(n, n)
+  return undefined
 }
 
 /**