@vzn/vx 0.0.645 → 0.0.648

package/src/cli/select.ts

@@ -4,27 +4,30 @@
 // here goes through the staged load, so the answer is the run's.
 
 import path from 'node:path'
+import { settingEnv } from '../settings.js'
 import fs from 'node:fs'
 import {
   affectedChanges,
   type AffectedChanges,
   affectedProjects,
-  refIsHead,
+  headBase,
   applyFilters,
   buildPackageGraph,
   configuredBaseBranch,
   defaultAffectedBase,
+  findProjectConfigs,
   findWorkspaceRoot,
   type FingerprintClaims,
   lockKey,
   NO_LOCK,
   parseFilter,
+  PROJECT_CONFIG_FILENAMES,
   type ProjectMeta,
   readLockfile,
 } from '../workspace/index.js'
 import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
-import { parseDependencySpec } from '../graph/index.js'
+import { isDefaultBuild, parseDependencySpec } from '../graph/index.js'
 import { declaresInput, workspaceFilesReachInto } from '../cache/index.js'
 import {
   isUserError,
@@ -32,8 +35,10 @@ import {
   maskedCommand,
   maskedLine,
   nearest,
+  relPosix,
   UserError,
   sayNotice,
+  ui,
 } from '../util/index.js'
 import {
   claimedAffected,
@@ -41,7 +46,6 @@ import {
   fingerprintClaims,
   gitOfDiscovery,
   hasHook,
-  isDefaultBuild,
   keepDiscoveryGraph,
 } from '../orchestrator/index.js'
 import {
@@ -49,6 +53,7 @@ import {
   discoverCliProjects,
   loadCliProjects,
   loadCliWorkspace,
+  stageCacheDir,
 } from './workspace-config.js'
 
 /**
@@ -69,10 +74,12 @@ export async function workspaceGlobOwners(
     loadCliProjects(root, projects, 'all', load),
   /** The changed nested repositories (`AffectedChanges.nested`). */
   nested: readonly string[] = [],
+  /** `AffectedChanges.dirLinks`. */
+  dirLinks: ReadonlySet<string> = new Set(),
 ): Promise<string[]> {
   const declaresMatch = (config: ProjectConfig): boolean => {
     for (const task of Object.values(config.tasks ?? {})) {
-      if (changed.some((rel) => declaresInput(task, null, rel))) return true
+      if (changed.some((rel) => declaresInput(task, null, rel, dirLinks.has(rel)))) return true
       if (nested.some((dir) => workspaceFilesReachInto(task, dir))) return true
     }
     return false
@@ -87,7 +94,7 @@ export async function workspaceGlobOwners(
   // "nothing affected" and exit 0 without ever reaching the run's own
   // refusal. The sweep reads each entry from the lock: it never evaluates.
   const lock = await readLockfile(root)
-  if (lock === null) throw new UserError(NO_LOCK)
+  if (lock === null) throw new UserError(NO_LOCK, 'VX_E_LOCK')
   const owners: string[] = []
   for (const meta of projects) {
     if (meta.configPath === null || meta.configPath === '') continue
@@ -117,19 +124,19 @@ async function workspaceFingerprintClaims(
   const claims = fingerprintClaims(ws.plugins)
   const ctx = {
     workspaceRoot: root,
-    cacheDir: load.cacheDir ?? ws.cacheDir,
-    warn: (m: string) => process.stderr.write(`${maskedLine(m)}\n`),
+    cacheDir: stageCacheDir(ws, load),
+    warn: (m: string) => ui.say('warn', maskedLine(m)),
     projects: projects.map((p) => ({ name: p.name, dir: p.dir })),
   }
   return {
     files: new Set(claims.keys()),
     affected: (change) => claimedAffected(claims.get(change.file)!, change, ctx),
-    extraFiles: (file, bytes) => claimedExtraFiles(claims.get(file)!, file, bytes),
+    extraFiles: (file, bytes) => claimedExtraFiles(claims.get(file)!, file, bytes, ctx),
   }
 }
 
-async function loadWorkspaceProjects(cwd: string): Promise<ProjectMeta[]> {
-  return await discoverCliProjects(await findWorkspaceRoot(cwd))
+async function loadWorkspaceProjects(cwd: string, load: CliLoadOptions): Promise<ProjectMeta[]> {
+  return await discoverCliProjects(await findWorkspaceRoot(cwd), load)
 }
 
 export async function findCwdProject(cwd: string): Promise<string | null> {
@@ -143,19 +150,17 @@ export async function findCwdProject(cwd: string): Promise<string | null> {
  */
 export async function findCwdSelection(
   cwd: string,
+  load: CliLoadOptions = {},
 ): Promise<{ name: string; discovered: { root: string; projects: ProjectMeta[] } } | null> {
   const root = await findWorkspaceRoot(cwd)
-  const projects = await discoverCliProjects(root)
+  const projects = await discoverCliProjects(root, load)
   const abs = path.resolve(cwd)
-  const within = (dirOf: (p: ProjectMeta) => string): string | null => {
-    let best: string | null = null
-    let bestLength = -1
+  const within = (dirOf: (p: ProjectMeta) => string): { name: string; dir: string } | null => {
+    let best: { name: string; dir: string } | null = null
     for (const p of projects) {
       const dir = dirOf(p)
-      if ((abs === dir || abs.startsWith(dir + path.sep)) && dir.length > bestLength) {
-        best = p.name
-        bestLength = dir.length
-      }
+      if ((abs === dir || abs.startsWith(dir + path.sep)) && dir.length > (best?.dir.length ?? -1))
+        best = { name: p.name, dir }
     }
     return best
   }
@@ -164,7 +169,7 @@ export async function findCwdSelection(
   // so inside such a member nothing matched and a run from there was "not
   // inside a project" (item 1025). Only then are the members realpathed:
   // one syscall each, paid only by a run no plain match could place.
-  const name =
+  const found =
     within((p) => p.dir) ??
     within((p) => {
       try {
@@ -173,7 +178,45 @@ export async function findCwdSelection(
         return p.dir
       }
     })
-  return name === null ? null : { name, discovered: { root, projects } }
+  await refuseUnlockedConfig(root, abs, found?.dir ?? null)
+  return found === null ? null : { name: found.name, discovered: { root, projects } }
+}
+
+/**
+ * A config `vx lock` would find between the cwd and the project placing it
+ * (the root, when none does): a config written after the lock is no project
+ * yet, so a run from its directory ran the locked project above it (the
+ * root's `build` for a new member) or said "not inside a project". One
+ * readdir per directory between them, none from a project's own; the
+ * listing that judges a config found is paid only when one is.
+ */
+async function refuseUnlockedConfig(
+  root: string,
+  abs: string,
+  placed: string | null,
+): Promise<void> {
+  const top = placed ?? root
+  if (abs !== top && !abs.startsWith(top + path.sep)) return
+  for (let dir = abs; ; dir = path.dirname(dir)) {
+    if (dir === placed) return
+    let names: string[]
+    try {
+      names = fs.readdirSync(dir)
+    } catch {
+      names = []
+    }
+    const file = PROJECT_CONFIG_FILENAMES.find((n) => names.includes(n))
+    if (file !== undefined) {
+      const { configs } = await findProjectConfigs(root)
+      const config = configs.find((c) => c.dir === dir)
+      if (config !== undefined) {
+        throw new UserError(
+          `${relPosix(root, config.configPath)} is not in the lock yet — run \`vx lock\``,
+        )
+      }
+    }
+    if (dir === root || dir === path.dirname(dir)) return
+  }
 }
 
 export type FilterResolution =
@@ -218,7 +261,7 @@ export function taskEdgesFrom(staged: ReadonlyMap<string, ProjectEntry>): Map<st
       for (const raw of task.dependsOn ?? []) {
         let spec
         try {
-          spec = parseDependencySpec(raw)
+          spec = parseDependencySpec(raw, 'dependsOn')
         } catch {
           continue
         }
@@ -244,18 +287,24 @@ function refusalOf(err: unknown): Refusal {
 
 /**
  * The filter `--affected[=<base>]` stands for: `...[<base>]`, the changed
- * projects and their dependents. An empty base is a plugin's (`setBranch`:
- * a pull request's base commit), else the merge base with `baseBranch`.
+ * projects and their dependents. An empty base is `VX_AFFECTED_BASE`'s,
+ * else a plugin's (`setBranch`: a pull request's base commit), else the
+ * merge base with `baseBranch`.
  */
-export async function affectedFilterFor(cwd: string, affected: string): Promise<string | Refusal> {
+export async function affectedFilterFor(
+  cwd: string,
+  affected: string,
+  /** What the verb does instead on the base branch (`defaultAffectedBase`). */
+  instead?: string,
+): Promise<string | Refusal> {
   const root = await findWorkspaceRoot(cwd)
-  let base = affected
+  let base = affected || ((settingEnv('affectedBase') as string | undefined) ?? '')
   if (base === '') {
     const ws = await loadCliWorkspace(root)
     try {
       base =
         ws.branch.base ??
-        (await defaultAffectedBase(root, configuredBaseBranch(ws.workspaceConfig)))
+        (await defaultAffectedBase(root, configuredBaseBranch(ws.workspaceConfig), instead))
     } catch (err) {
       if (!isUserError(err)) throw err
       return refusalOf(err)
@@ -270,9 +319,11 @@ export async function resolveFilters(
   load: CliLoadOptions = {},
   /** The raw filter `--affected` became: its diff is kept per path for the run. */
   affected?: string,
+  /** The verb a warning names: `vx show` and `vx watch` select as a run does. */
+  verb: 'run' | 'show' | 'watch' = 'run',
 ): Promise<FilterResolution> {
   const root = await findWorkspaceRoot(cwd)
-  const projects = await loadWorkspaceProjects(cwd)
+  const projects = await loadWorkspaceProjects(cwd, load)
   let parsed: ReturnType<typeof parseFilter>[]
   try {
     parsed = raw.map((r) => parseFilter(r, root))
@@ -330,8 +381,11 @@ export async function resolveFilters(
         workspaceRoot: root,
         since: f.gitSince,
         projects,
-        workspaceGlobOwners: (changed: readonly string[], nested: readonly string[]) =>
-          workspaceGlobOwners(root, projects, changed, load, stagedOnce, nested),
+        workspaceGlobOwners: (
+          changed: readonly string[],
+          nested: readonly string[],
+          dirLinks: ReadonlySet<string>,
+        ) => workspaceGlobOwners(root, projects, changed, load, stagedOnce, nested, dirLinks),
         fingerprintClaims: () => workspaceFingerprintClaims(root, projects, load),
         ...(git !== undefined
           ? {
@@ -344,6 +398,10 @@ export async function resolveFilters(
                 for (const [rel, oid] of g.trusted) if (oid.startsWith('120000:')) out.push(rel)
                 return out
               },
+              flagged: async () => {
+                const g = await git.start()
+                return g.scopes.includes('.') ? g.flagged : null
+              },
             }
           : {}),
       }
@@ -383,20 +441,21 @@ export async function resolveFilters(
     ...(tags !== undefined ? { tags } : {}),
     // A `[<since>]` selector matching nothing is the ordinary "nothing
     // changed" outcome, reported below; only a name/path pattern that
-    // matched nothing is worth flagging as a probable typo.
-    onNoMatch: (f) => {
-      if (f.gitSince === undefined) unmatched.push(f.raw)
-      else emptyDiffs.add(f)
+    // matched no project in the workspace, ref or not, is a probable typo.
+    onNoMatch: (f, emptyDiff) => {
+      if (emptyDiff) emptyDiffs.add(f)
+      else unmatched.push(f.raw)
     },
     // A pattern that matched, with nothing on the walk it asked for: the
     // fact to say, where "no projects matched" read as a typo (item 1030).
     onEmptyWalk: (f, matched) => {
       if (f.negate) return
       const which = matched.join(', ')
+      const several = matched.length > 1
       emptyWalks.push(
         f.onlyDeps
-          ? `filter "${f.raw}" matched ${which}, which depends on no project`
-          : `filter "${f.raw}" matched ${which}, and no project depends on it`,
+          ? `filter "${f.raw}" matched ${which}, which ${several ? 'depend' : 'depends'} on no project`
+          : `filter "${f.raw}" matched ${which}, and no project depends on ${several ? 'them' : 'it'}`,
       )
     },
   })
@@ -408,18 +467,23 @@ export async function resolveFilters(
     // Every pattern matched and an exclusion took them all back: "no
     // projects matched filter(s): one, !one" read as a typo of `one`.
     const negations = parsed.filter((f) => f.negate).map((f) => f.raw)
-    const excluded = `${negations.join(', ')} excluded every project the other filters matched`
-    if (includes.length > 0 && includes.every((f) => f.gitSince !== undefined)) {
+    // With no include the base is every project: there is no "other filter".
+    const excluded = `${negations.join(', ')} excluded every project${includes.length > 0 ? ' the other filters matched' : ''}`
+    if (
+      unmatched.length === 0 &&
+      includes.length > 0 &&
+      includes.every((f) => f.gitSince !== undefined)
+    ) {
       if (includes.every((f) => emptyDiffs.has(f))) {
-        const refs = includes.map((f) => f.gitSince).join(', ')
+        const refs = [...new Set(includes.map((f) => f.gitSince))].join(', ')
         // A base that IS HEAD (a single-branch clone whose `origin/HEAD` is
         // the branch under test) can never mark anything affected, and this
         // exit-0 note was the only sign (CI persona, 2026-09-16). Say so.
-        const self = includes.find((f) => refIsHead(root, f.gitSince!))
+        const self = includes.map((f) => headBase(root, f.gitSince!)).find((b) => b !== undefined)
         const hint =
           self === undefined
             ? ''
-            : ` — ${self.gitSince} is HEAD itself: compare with the branch you merge into (--affected=origin/main) or the previous commit (--affected=HEAD~1)`
+            : ` — ${self} is HEAD itself: compare with the branch you merge into (--affected=origin/main) or the previous commit (--affected=HEAD~1)`
         return { empty: `nothing affected since ${refs}${hint}` }
       }
       // The diff matched and a walk or an exclusion left nothing: still the
@@ -437,18 +501,19 @@ export async function resolveFilters(
     }
     // One line, not a warning per pattern and then an error saying the same:
     // the patterns are in the error, and the nearest project name is the
-    // hint a typo needs.
-    return {
-      error: `no projects matched filter(s): ${raw.join(', ')}${didYouMean(unmatched, projects, tags)}`,
-    }
+    // hint a typo needs. Only the ones that matched nothing: `app !app apq` named
+    // app, and `--affected` a `...[<base>]` nobody typed.
+    const hint =
+      (await unlockedHint(root, parsed, unmatched)) ?? didYouMean(unmatched, projects, tags)
+    return { error: `no projects matched filter(s): ${unmatched.join(', ')}${hint}` }
   }
   // Something matched, so the run proceeds; a pattern that matched nothing
   // alongside it is still worth a line — it is probably a typo.
   for (const f of unmatched)
     sayNotice(
       'warn',
-      'vx run',
-      `filter "${f}" matched no projects${didYouMean([f], projects, tags)}`,
+      `vx ${verb}`,
+      `filter "${f}" matched no projects${(await unlockedHint(root, parsed, [f])) ?? didYouMean([f], projects, tags)}`,
     )
   // Each include is a union: what `--filter other` selected runs its tasks
   // whether or not the `--affected` diff reaches them, and an exclude
@@ -502,7 +567,7 @@ export async function pickTask(
   /** The projects `--filter` / `--affected` selected; every project when absent. */
   only?: ReadonlySet<string>,
 ): Promise<PickedTask | null | 'interrupted'> {
-  const projects = await loadWorkspaceProjects(cwd)
+  const projects = await loadWorkspaceProjects(cwd, load)
   // The staged load: a task a `project` plugin gave a config-less package
   // is on the menu, as it is in a run.
   const staged = await loadCliProjects(await findWorkspaceRoot(cwd), projects, 'all', load)
@@ -597,13 +662,42 @@ export async function pickTask(
   }
 }
 
+/**
+ * `. packages/c/vx.config.ts is not in the lock yet — run \`vx lock\``
+ * for an unmatched `./dir` filter naming a directory `vx lock` would make
+ * a project: a config written after the lock is none yet, and "Projects:
+ * …" without it read as a typo of the path. Asked on the refusal's path only.
+ */
+async function unlockedHint(
+  root: string,
+  parsed: readonly ReturnType<typeof parseFilter>[],
+  unmatched: readonly string[],
+): Promise<string | undefined> {
+  const dirs = parsed
+    .filter((f) => f.isPath && f.pathGlob === undefined && unmatched.includes(f.raw))
+    .map((f) => f.matcher)
+  if (dirs.length === 0) return undefined
+  const { configs } = await findProjectConfigs(root)
+  const config = configs.find((c) => dirs.includes(c.dir))
+  if (config === undefined) return undefined
+  return `. ${relPosix(root, config.configPath)} is not in the lock yet — run \`vx lock\``
+}
+
+/** A pattern as a name: its `[<since>]` and graph operators aside. */
+// `^\.\.\.` anchored in one alternation with `!` kept `!...apq`'s dots.
+const typedName = (pattern: string): string =>
+  pattern
+    .replace(/\[[^\]]*\]$/, '')
+    .replace(/^!/, '')
+    .replace(/^\.\.\.|\.\.\.$|\^/g, '')
+
 /** The hint for the first unmatched pattern: a near tag for a `tag:` one, else a near project name. */
 function didYouMean(
   unmatched: readonly string[],
   projects: Iterable<{ name: string }>,
   tags: ReadonlyMap<string, readonly string[]> | undefined,
 ): string {
-  const first = unmatched[0]?.replace(/^!|\.\.\.$|^\.\.\.|\^/g, '')
+  const first = unmatched[0] === undefined ? undefined : typedName(unmatched[0])
   if (first?.startsWith('tag:') !== true) return didYouMeanProject(unmatched, projects)
   const known = [...new Set([...(tags?.values() ?? [])].flat())].sort()
   if (known.length === 0) return '. No project declares tags'
@@ -625,11 +719,16 @@ function didYouMeanProject(
     if (bare !== n) byBare.set(bare, [...(byBare.get(bare) ?? []), n])
   }
   for (const pattern of unmatched) {
-    const typed = pattern.replace(/^!|\.\.\.$|^\.\.\.|\^/g, '')
+    const typed = typedName(pattern)
     // Two edits from any two-letter name: `--filter //` hinted `ui` (X-13).
     if (typed === '//') {
       return '. `//` is the workspace root, which is no project here: add a vx.config there and run `vx lock`'
     }
+    // Nx's `--projects=a,b`: the edit distance hinted the first name alone.
+    const parts = pattern.split(',').filter((p) => p !== '')
+    if (parts.length > 1) {
+      return `. A filter is one pattern: ${parts.map((p) => `--filter ${p}`).join(' ')}`
+    }
     const best = nearest(typed, names)
     if (best !== undefined) return `. Did you mean ${best}?`
     const bare = byBare.has(typed) ? typed : nearest(typed, byBare.keys())

package/src/cli/show.ts

@@ -9,7 +9,8 @@
 import path from 'node:path'
 import type { ProjectConfig, TaskConfig } from '../config.js'
 import { declaredTask } from '../graph/index.js'
-import { affectedTaskProjects, isDefaultBuild } from '../orchestrator/index.js'
+import { isDefaultBuild } from '../graph/index.js'
+import { affectedTaskProjects } from '../orchestrator/index.js'
 import { flagHint, formatValue, refuse, seeHelp } from './help.js'
 import {
   type ColorSupport,
@@ -18,6 +19,7 @@ import {
   nearMatches,
   relPosix,
   secretMask,
+  type SecretMask,
   UserError,
   sayNotice,
   ui,
@@ -32,6 +34,7 @@ import {
 import {
   type AffectedChanges,
   buildPackageGraph,
+  EMPTY_LOCK,
   findWorkspaceRoot,
   type ProjectEntry,
   type ProjectMeta,
@@ -55,17 +58,16 @@ export function parseShowArgs(args: readonly string[]): ShowArgs {
     let format: string | undefined
     if (a === '--format') format = args[++i] ?? ''
     else if (a.startsWith('--format=')) format = a.slice('--format='.length)
-    else if (a === '--filter') {
-      const v = args[++i]
+    else if (a === '--filter' || a.startsWith('--filter=')) {
+      const v = a === '--filter' ? args[++i] : a.slice('--filter='.length)
       // `--filter --format json` took `--format` as the pattern; no filter opens with `--`.
-      if (v === undefined || v === '' || v.startsWith('--'))
+      if (v === undefined || v === '' || (a === '--filter' && v.startsWith('--')))
         return {
           ...out,
           error: `--filter requires a value: a project name, glob or path${seeHelp('show')}`,
         }
       out.filters.push(v)
-    } else if (a.startsWith('--filter=')) out.filters.push(a.slice('--filter='.length))
-    else if (a === '--affected') out.affected = ''
+    } else if (a === '--affected') out.affected = ''
     else if (a.startsWith('--affected=')) out.affected = a.slice('--affected='.length)
     else if (a.startsWith('-'))
       return { ...out, error: `unknown flag: ${a}${flagHint('show', a)}${seeHelp('show')}` }
@@ -116,6 +118,12 @@ export async function showCmd(args: readonly string[]): Promise<number> {
         ? parsed.target
         : parsed.target.slice(0, hashAt)
   const taskName = hashAt === -1 ? undefined : parsed.target!.slice(hashAt + 1)
+  if (projectName === '' && taskName !== undefined && taskName !== '') {
+    throw new UserError(
+      `vx show: missing project name before '#' in "${parsed.target}" (vx show ${taskName} shows it in every project)`,
+      'VX_E_USAGE',
+    )
+  }
   if (taskName === '') {
     const list = projectName === '' ? 'vx show' : `vx show ${projectName}`
     throw new UserError(
@@ -152,12 +160,16 @@ export async function showCmd(args: readonly string[]): Promise<number> {
     const raw = [...parsed.filters]
     let affected: string | undefined
     if (parsed.affected !== undefined) {
-      const f = await affectedFilterFor(process.cwd(), parsed.affected)
+      const f = await affectedFilterFor(
+        process.cwd(),
+        parsed.affected,
+        'drop --affected to list them all',
+      )
       if (typeof f === 'object') throw new UserError(`vx show: ${f.error}`, f.code ?? 'VX_E_USAGE')
       affected = f
       raw.unshift(f)
     }
-    const r = await resolveFilters(process.cwd(), raw, {}, affected)
+    const r = await resolveFilters(process.cwd(), raw, {}, affected, 'show')
     if ('error' in r) throw new UserError(`vx show: ${r.error}`, r.code ?? 'VX_E_USAGE')
     if ('empty' in r) sayNotice('info', 'vx show', r.empty)
     selected = new Set('empty' in r ? [] : r.names)
@@ -173,7 +185,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
       sayNotice(
         'info',
         'vx show',
-        'no projects: no directory holds a vx.config — run `vx init` to write them, then `vx lock`',
+        `no projects: ${EMPTY_LOCK.charAt(0).toLowerCase()}${EMPTY_LOCK.slice(1)}`,
       )
     const shown = metas.filter((m) => inSelection(m.name))
     process.stdout.write(renderList(root, shown, projects, parsed.format, colorsOut()))
@@ -220,6 +232,17 @@ export async function showCmd(args: readonly string[]): Promise<number> {
       )
       shown = shown.filter((p) => kept.has(p.name))
     }
+    // An empty list printed nothing and exited 0, where the run says why.
+    if (shown.length === 0 && parsed.format === 'pretty') {
+      const n = declaring.length
+      sayNotice(
+        'info',
+        'vx show',
+        byDiff !== undefined
+          ? `no affected project's ${projectName} runs (${n} declare${n === 1 ? 's' : ''} it)`
+          : `no selected project declares ${projectName} (${n} outside the selection ${n === 1 ? 'does' : 'do'})`,
+      )
+    }
     process.stdout.write(renderTaskAcross(root, shown, projectName!, parsed.format, colorsOut()))
     return 0
   }
@@ -280,10 +303,26 @@ function projectDir(root: string, meta: ProjectMeta): string {
  * description) (L-11).
  */
 function shownTask(task: TaskConfig): TaskConfig {
-  const secrets = secretMask([process.env, task.exec?.env?.define], task.exec?.env?.secret)
+  const env = task.exec?.env
+  const secrets =
+    env?.define === undefined && (env?.secret ?? []).length === 0
+      ? envMask()
+      : secretMask([process.env, env?.define], env?.secret)
   return secrets === null ? task : (maskStrings(task, secrets.mask) as TaskConfig)
 }
 
+let envOnly: SecretMask | null | undefined
+
+/**
+ * The mask of a task that defines and names no variable: vx's own env's,
+ * built once. Built per task, its pattern was 10 of `vx show build`'s
+ * 58 ms over 100 projects.
+ */
+function envMask(): SecretMask | null {
+  if (envOnly === undefined) envOnly = secretMask([process.env])
+  return envOnly
+}
+
 function maskStrings(value: unknown, mask: (text: string) => string): unknown {
   if (typeof value === 'string') return mask(value)
   if (Array.isArray(value)) return value.map((v) => maskStrings(v, mask))
@@ -327,11 +366,7 @@ function renderList(
     }
   })
   if (format === 'json') {
-    return `${JSON.stringify(
-      rows.map(({ name, dir, tags, tasks }) => ({ name, dir, tags, tasks })),
-      null,
-      2,
-    )}\n`
+    return `${JSON.stringify(rows.map(({ name, dir, tags, tasks }) => ({ name, dir, tags, tasks })))}\n`
   }
   if (rows.length === 0) return ''
   const anyTags = rows.some((r) => r.tags.length > 0)
@@ -435,8 +470,9 @@ function taskReport(name: string, dir: string, taskName: string, task: TaskConfi
 function taskRows(raw: TaskConfig): ui.FieldRow[] {
   const task = shownTask(raw)
   const rows: ui.FieldRow[] = []
+  // An empty list is a value: a bare label read as a cut-off line.
   const list = (xs: readonly string[] | undefined): string | undefined =>
-    xs === undefined ? undefined : xs.join(', ')
+    xs === undefined ? undefined : xs.length === 0 ? 'none' : xs.join(', ')
   const add = (label: string, value: string | number | boolean | undefined): void => {
     if (value !== undefined) rows.push([label, String(value)])
   }
@@ -457,6 +493,7 @@ function taskRows(raw: TaskConfig): ui.FieldRow[] {
   )
   add('env.secret', list(exec?.env?.secret))
   add('remote', exec?.remote === undefined ? undefined : String(exec.remote))
+  add('platforms', list(exec?.platforms))
   add('sandbox', exec?.sandbox === undefined ? undefined : JSON.stringify(exec.sandbox))
   const persistent = exec?.persistent
   if (persistent !== undefined) {
@@ -479,6 +516,12 @@ function taskRows(raw: TaskConfig): ui.FieldRow[] {
   if (cache !== undefined) {
     add('outputs.files', list(cache.outputs.files))
     add('outputs.workspaceFiles', list(cache.outputs.workspaceFiles))
+    add(
+      'outputs.clean',
+      cache.outputs.clean === undefined ? undefined : cache.outputs.clean ? 'yes' : 'no',
+    )
+    add('inputStability.strategy', cache.inputStability?.strategy)
+    add('inputStability.severity', cache.inputStability?.severity)
   }
   return rows
 }

package/src/cli/task-verb.ts

@@ -4,7 +4,9 @@
 // does it. It stays a refusal: a verb that runs whatever task shares its
 // name would change meaning the day a plugin declares that verb.
 
-import { isDefaultBuild, nxProjectTarget, projectNamed } from '../orchestrator/index.js'
+import type { TaskConfig } from '../config.js'
+import { isDefaultBuild } from '../graph/index.js'
+import { nxProjectTarget, projectNamed } from '../orchestrator/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { nearest } from '../util/index.js'
 import { findCwdProject } from './select.js'
@@ -26,19 +28,27 @@ export async function taskVerbHint(
   if (projects === null) return null
   const tasks = new Set<string>()
   // The default build is no task `vx run` takes by name (X-145).
+  const declared = (task: TaskConfig | undefined): boolean =>
+    task !== undefined && !isDefaultBuild(task)
   for (const p of projects.values())
-    for (const [t, task] of Object.entries(p.config.tasks ?? {}))
-      if (!isDefaultBuild(task)) tasks.add(t)
+    for (const [t, task] of Object.entries(p.config.tasks ?? {})) if (declared(task)) tasks.add(t)
   const task = tasks.has(command) ? command : typo ? nearest(command, tasks) : undefined
   if (task === undefined) return null
   // Nx's `nx build app`: the word after the target is its project.
   const project = rest[0] === undefined ? undefined : projectNamed(rest[0], projects)
+  // A bare `vx run <task>` runs the cwd project's alone, and refuses where
+  // that project does not declare it.
+  const declaresHere = async (): Promise<boolean> => {
+    const here = await findCwdProject(cwd)
+    const own = here === null ? undefined : projects.get(here)?.config.tasks
+    return own !== undefined && Object.hasOwn(own, task) && declared(own[task])
+  }
   const run =
     project !== undefined
       ? `vx run ${task} --filter ${project}`
-      : (await findCwdProject(cwd)) === null
-        ? `vx run ${task} --all`
-        : `vx run ${task}`
+      : (await declaresHere())
+        ? `vx run ${task}`
+        : `vx run ${task} --all`
   return task === command
     ? `\`${command}\` is a task here, not a command (did you mean ${run}?)`
     : `unknown command: ${command}, a typo of the task \`${task}\` (did you mean ${run}?)`