@vzn/vx 0.0.645 → 0.0.648

package/src/cli/upgrade.ts

@@ -1,6 +1,7 @@
 // `vx upgrade [TAG]` — bring this vx to a newer release, the way it was
 // installed. A compiled binary installed by hand replaces itself: it reads
-// its platform package (`@vzn/vx-<os>-<arch>`) from the npm registry,
+// its platform package (`@vzn/vx-<os>-<arch>`) from the npm registry the
+// user configured (`resolveRegistry`: .npmrc, bunfig, npmjs.org last),
 // checks npm's registry signature over `name@version:integrity` against
 // the key pinned below, checks the tarball's SHA-512 against that signed
 // integrity, and only then extracts the binary, stages it beside the old
@@ -19,12 +20,12 @@ import { constants, existsSync, readFileSync } from 'node:fs'
 import { createPublicKey, verify } from 'node:crypto'
 import { access, chmod, chown, link, mkdtemp, rename, rm, stat } from 'node:fs/promises'
 import path from 'node:path'
-import { flagHint, seeHelp } from './help.js'
+import { flagHint, refuse, seeHelp } from './help.js'
+import { resolveRegistry, type Registry } from './registry.js'
 import { UserError, sayNotice, ui } from '../util/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { VERSION } from '../version.js'
 
-const REGISTRY = 'https://registry.npmjs.org'
 const PACKAGE = '@vzn/vx'
 
 /**
@@ -68,7 +69,6 @@ export function isCompiledBinary(): boolean {
 }
 
 /**
- * The package dir/**
  * The package directory that owns `execPath` when it sits under a
  * `node_modules` — an npm install's platform binary, which the launcher
  * runs as `…/node_modules/@vzn/vx-<os>-<arch>/vx`. That file is npm's:
@@ -101,7 +101,10 @@ export function versionSpec(tag: string | undefined): string {
   if (tag === undefined) return 'latest'
   const v = tag.startsWith('v') ? tag.slice(1) : tag
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(v)) {
-    throw new UserError(`vx upgrade: ${tag} is not a version (expected v<major>.<minor>.<patch>)`)
+    throw new UserError(
+      `vx upgrade: ${tag} is not a version (expected v<major>.<minor>.<patch>)`,
+      'VX_E_USAGE',
+    )
   }
   return v
 }
@@ -157,17 +160,25 @@ export async function fetchManifest(
   pkg: string,
   spec: string,
   verb = 'vx upgrade',
+  registry: Registry = resolveRegistry(pkg.split('/')[0]!),
 ): Promise<unknown> {
-  const url = `${REGISTRY}/${pkg}/${spec}`
+  const url = `${registry.url}${pkg}/${spec}`
   const res = await fetchOrRefuse(
     url,
-    { redirect: 'follow', headers: { Accept: 'application/json', 'User-Agent': `vx/${VERSION}` } },
+    {
+      redirect: 'follow',
+      headers: {
+        Accept: 'application/json',
+        'User-Agent': `vx/${VERSION}`,
+        ...authHeader(registry, url),
+      },
+    },
     'read the release',
     verb,
   )
   if (!res.ok) {
     throw new UserError(
-      `${verb}: could not read ${pkg}@${spec} from the npm registry (${res.status})${res.status === 404 && spec !== 'latest' ? ` — is ${spec} a published version?` : ''}`,
+      `${verb}: could not read ${pkg}@${spec} from ${new URL(url).host} (${res.status})${res.status === 404 && spec !== 'latest' ? ` — is ${spec} a published version?` : ''}${res.status === 401 || res.status === 403 ? ' — check the registry credentials in .npmrc or bunfig.toml' : ''}`,
     )
   }
   // A body that is not JSON (a captive portal's page, a proxy's error
@@ -175,6 +186,11 @@ export async function fetchManifest(
   return await readOrRefuse(() => res.json(), url, 'read the release', verb)
 }
 
+function authHeader(registry: Registry, url: string): Record<string, string> {
+  const auth = registry.auth(url)
+  return auth === undefined ? {} : { Authorization: auth }
+}
+
 /** What a verified registry document names: the version, its tarball and the signed integrity. */
 export interface SignedRelease {
   version: string
@@ -228,7 +244,7 @@ export function verifiedRelease(
   const ours = signatures.filter((s) => s.keyid === key.id)
   if (ours.length === 0) {
     throw new UserError(
-      `vx upgrade: ${pkg}@${version} is signed with an npm key this vx does not know (${[...new Set(signatures.map((s) => s.keyid))].join(', ')}) — if npm rotated its signing key, this vx's installer needs updating: install the new release with npm install -g @vzn/vx@latest, or from https://github.com/vznjs/vx/releases. Nothing replaced`,
+      `vx upgrade: ${pkg}@${version} is signed with an npm key this vx does not know (${[...new Set(signatures.map((s) => s.keyid))].join(', ')}) — if npm rotated its signing key, this vx's installer needs updating: install the new release with bun add -g @vzn/vx@latest, or from https://github.com/vznjs/vx/releases. Nothing replaced`,
     )
   }
   const publicKey = createPublicKey({
@@ -253,9 +269,13 @@ export function verifiedRelease(
 }
 
 /** Download `release.tarball` and check its bytes against the signed SHA-512. */
-async function downloadVerified(release: SignedRelease): Promise<Uint8Array> {
+async function downloadVerified(release: SignedRelease, registry: Registry): Promise<Uint8Array> {
   const url = release.tarball
-  const res = await fetchOrRefuse(url, { redirect: 'follow' }, 'download the release')
+  const res = await fetchOrRefuse(
+    url,
+    { redirect: 'follow', headers: authHeader(registry, url) },
+    'download the release',
+  )
   if (!res.ok) {
     throw new UserError(
       `vx upgrade: download failed (${res.status}) — ${url} — nothing replaced; re-run`,
@@ -308,9 +328,10 @@ export function binaryFromTarball(tgz: Uint8Array): Uint8Array {
 /**
  * The binary of `pkg@spec`, verified: the registry document's signature,
  * then the tarball's integrity, then the extraction, each refusing before
- * the next step runs. Null when the release is `current`, the version of
- * the vx being replaced; `announce` hears the version before the download
- * starts.
+ * the next step runs. A signed version other than the one asked, or as
+ * `latest` one below `current`, is refused. Null when the release is
+ * `current`, the version of the vx being replaced; `announce` hears the
+ * version before the download starts.
  */
 export async function releaseBinary(
   pkg: string,
@@ -319,10 +340,24 @@ export async function releaseBinary(
   key: SigningKey = NPM_SIGNING_KEY,
   current = VERSION,
 ): Promise<Uint8Array | null> {
-  const release = verifiedRelease(await fetchManifest(pkg, spec), pkg, key)
+  const registry = resolveRegistry(pkg.split('/')[0]!)
+  const release = verifiedRelease(await fetchManifest(pkg, spec, undefined, registry), pkg, key)
+  // npm signs every version it published: the signature proves the bytes,
+  // not that they are the version asked for, so a mirror could hand back an
+  // older one.
+  if (spec !== 'latest' && release.version !== spec) {
+    throw new UserError(
+      `vx upgrade: the npm registry answered ${pkg}@${spec} with version ${release.version} — refusing to install; nothing replaced`,
+    )
+  }
   if (release.version === current) return null
+  if (spec === 'latest' && Bun.semver.order(release.version, current) < 0) {
+    throw new UserError(
+      `vx upgrade: the registry's latest ${pkg} is ${release.version}, below this vx's ${current} — nothing replaced; to go back, ask for it: vx upgrade v${release.version}`,
+    )
+  }
   announce(release.version)
-  return binaryFromTarball(await downloadVerified(release))
+  return binaryFromTarball(await downloadVerified(release, registry))
 }
 
 /**
@@ -417,12 +452,34 @@ export interface ManagedInstall {
 
 const FIELDS = ['devDependencies', 'dependencies', 'optionalDependencies'] as const
 
+/** `file` as a JSON object, or null where there is none; one that is not JSON is refused. */
 function readJson(file: string): Record<string, unknown> | null {
+  let text: string
+  try {
+    text = readFileSync(file, 'utf8')
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code
+    if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EISDIR') return null
+    throw new UserError(`vx upgrade: could not read ${file} (${(err as Error).message})`)
+  }
+  let v: unknown
+  try {
+    // A byte-order mark is stripped, as npm strips it.
+    v = JSON.parse(text.replace(/^\uFEFF/, ''))
+  } catch (err) {
+    // Read as absent, it sent the user to "no package.json lists vx".
+    throw new UserError(
+      `vx upgrade: ${file} is not JSON (${(err as Error).message}) — fix it, then run vx upgrade again`,
+    )
+  }
+  return typeof v === 'object' && v !== null ? (v as Record<string, unknown>) : null
+}
+
+function lockText(file: string): string {
   try {
-    const v: unknown = JSON.parse(readFileSync(file, 'utf8'))
-    return typeof v === 'object' && v !== null ? (v as Record<string, unknown>) : null
+    return readFileSync(file, 'utf8')
   } catch {
-    return null
+    return ''
   }
 }
 
@@ -441,8 +498,8 @@ const PLATFORM = /^@vzn\/vx-(?:darwin|linux)-(?:x64|arm64)$/
 /**
  * The `@vzn/vx-*` plugins `dir`'s package.json lists from the registry
  * (a `workspace:` or `file:` link is the repo's own). Every @vzn package
- * releases together, so they move with core in its one install (M,
- * 2026-10-16); one in another field would move fields under core's flag,
+ * releases together, so they move with core in its one install
+ * (2026-10-16); one in another field would move fields under core's flag,
  * so it is refused.
  */
 function pluginsBeside(dir: string, field: NonNullable<ManagedInstall['field']>): string[] {
@@ -511,7 +568,7 @@ export function managedInstall(execPath: string, cwd: string): ManagedInstall |
   const root = p.slice(0, `${p}/`.indexOf('/node_modules/'))
   if (p.includes('/_npx/') || /\/bunx-[^/]*\//.test(p)) {
     throw new UserError(
-      `vx upgrade: this vx runs from a package-manager cache (${execPath}) — nothing is installed to upgrade; ask for the version you want instead: npx @vzn/vx@latest, or bunx @vzn/vx@latest`,
+      `vx upgrade: this vx runs from a package-manager cache (${execPath}) — nothing is installed to upgrade; ask for the version you want instead: bunx @vzn/vx@latest`,
     )
   }
   if (p.includes('/.bun/install/global/')) return { manager: 'bun', scope: 'global', cwd: root }
@@ -523,7 +580,11 @@ export function managedInstall(execPath: string, cwd: string): ManagedInstall |
     const plugins = pluginsBeside(root, field)
     return { manager: projectManager(root, execPath), scope: 'project', cwd: root, field, plugins }
   }
-  for (let d = path.resolve(cwd); d.startsWith(root); d = path.dirname(d)) {
+  for (
+    let d = path.resolve(cwd);
+    d === root || d.startsWith(`${root}${path.sep}`);
+    d = path.dirname(d)
+  ) {
     const f = listingField(d)
     if (f !== undefined) {
       const plugins = pluginsBeside(d, f)
@@ -569,6 +630,14 @@ export function upgradeArgv(install: ManagedInstall, version: string): string[]
   // pnpm refuses an `add` at a workspace's root without saying it means the root.
   if (manager === 'pnpm' && existsSync(path.join(install.cwd, 'pnpm-workspace.yaml')))
     argv.push('--workspace-root')
+  // Yarn 1 refuses one there without -W; Berry, whose lockfile carries
+  // `__metadata`, has no such flag.
+  if (
+    manager === 'yarn' &&
+    readJson(path.join(install.cwd, 'package.json'))?.['workspaces'] !== undefined &&
+    !lockText(path.join(install.cwd, 'yarn.lock')).includes('__metadata:')
+  )
+    argv.push('-W')
   return argv
 }
 
@@ -717,7 +786,7 @@ export async function upgradeGlobal(
 
 /**
  * `vx upgrade -g`: bring this vx, the global one, to `version` and nothing
- * else (owner, 2026-10-16) — no project's package.json, no plugin. The
+ * else (2026-10-16) — no project's package.json, no plugin. The
  * project's own vx refuses: no global ran.
  */
 export async function upgradeOnlyGlobal(
@@ -733,7 +802,7 @@ export async function upgradeOnlyGlobal(
   const install = managedInstall(self, path.dirname(self))
   if (install?.scope === 'project') {
     throw new UserError(
-      `vx upgrade -g: no global vx ran — ${self} is the project's own. Install one (npm install -g ${PACKAGE}), or run \`vx upgrade\` to move the project's`,
+      `vx upgrade -g: no global vx ran — ${self} is the project's own. Install one (bun add -g ${PACKAGE}), or run \`vx upgrade\` to move the project's`,
     )
   }
   if (install === null) await upgradeBinary(self, version, current, 'global ')
@@ -750,33 +819,50 @@ async function named<T>(what: string, run: () => Promise<T>): Promise<T> {
   }
 }
 
-export async function upgradeCmd(argv: readonly string[]): Promise<number> {
+interface UpgradeArgs {
+  global: boolean
+  tag?: string
+  error?: string
+  /** The error names an unknown flag: `--format json` reads it as JSON. */
+  flag?: true
+}
+
+export function parseUpgradeArgs(argv: readonly string[]): UpgradeArgs {
   const global = argv.some((a) => a === '-g' || a === '--global')
   const args = argv.filter((a) => a !== '-g' && a !== '--global')
   const unknown = args.find((a) => a.startsWith('-'))
   if (unknown !== undefined) {
-    sayNotice(
-      'error',
-      'vx upgrade',
-      `unknown flag: ${unknown}${flagHint('upgrade', unknown)}${seeHelp('upgrade')}`,
-    )
-    return 1
+    return {
+      global,
+      flag: true,
+      error: `unknown flag: ${unknown}${flagHint('upgrade', unknown)}${seeHelp('upgrade')}`,
+    }
   }
   // One release is installed; a second tag was dropped without a word and
   // the first one went in (`vx upgrade v0.0.22 v0.0.23`).
   const [tag, extra] = args
   if (extra !== undefined) {
-    sayNotice('error', 'vx upgrade', `unexpected argument: ${extra}${seeHelp('upgrade')}`)
+    return { global, error: `unexpected argument: ${extra}${seeHelp('upgrade')}` }
+  }
+  return tag === undefined ? { global } : { global, tag }
+}
+
+export async function upgradeCmd(argv: readonly string[]): Promise<number> {
+  const { global, tag, error, flag } = parseUpgradeArgs(argv)
+  if (error !== undefined && flag === true) return refuse('upgrade', argv, error, 'VX_E_USAGE')
+  if (error !== undefined) {
+    sayNotice('error', 'vx upgrade', error)
     return 1
   }
+  // A mistyped tag is the mistake to name, before any guard about this install.
+  versionSpec(tag)
   if (!isCompiledBinary()) {
     throw new UserError(
-      'vx upgrade: only the compiled binary upgrades itself; this vx runs from source — use git pull ' +
-        '(npm installs update with: npm install -g @vzn/vx@latest)',
+      'vx upgrade: only the compiled binary upgrades itself; this vx runs from source — use git pull',
     )
   }
   const dest = process.execPath
-  const handedOffFrom = process.env['VX_HANDED_OFF']
+  const handedOffFrom = process.env['VX_HANDED_OFF'] || undefined
   if (global) {
     // A launcher from before -g handed the call over: the global is the one that did.
     const version = await targetVersion(tag)
@@ -786,7 +872,7 @@ export async function upgradeCmd(argv: readonly string[]): Promise<number> {
   }
   const install = managedInstall(dest, process.cwd())
   // A global vx handed this run to the project's own: both move, to one
-  // version, the project first (owner, 2026-10-15).
+  // version, the project first (2026-10-15).
   const from = handedOffFrom
   if (from !== undefined) {
     const version = await targetVersion(tag)
@@ -808,26 +894,35 @@ export async function upgradeCmd(argv: readonly string[]): Promise<number> {
 }
 
 /**
- * The vx an upgrade just installed: the replaced binary, or the project's
+ * The vx an upgrade just installed: the replaced binary, or the tree's
  * `node_modules/.bin/vx` (a manager's store path names the old version).
+ * npm's global tree has no `.bin` there; its platform binary keeps its path.
  */
-const newVx = (install: ManagedInstall | null, dest: string): string =>
-  install === null ? dest : path.join(install.cwd, 'node_modules', '.bin', 'vx')
+function newVx(install: ManagedInstall | null, dest: string): string {
+  if (install === null) return dest
+  const bin = path.join(install.cwd, 'node_modules', '.bin', 'vx')
+  return existsSync(bin) ? bin : dest
+}
 
 /**
- * Lock the workspace with the vx just installed at `bin` (M, 2026-10-18):
+ * Lock the workspace with the vx just installed at `bin` (2026-10-18):
  * a release may record the lock differently. `-g` never re-locks. A lock
  * that fails leaves the upgrade done and says what to run.
  */
 export async function relock(bin: string, cwd = process.cwd()): Promise<void> {
   const root = await findWorkspaceRoot(cwd).catch(() => null)
   if (root === null) return
-  const proc = Bun.spawnSync({
-    cmd: [bin, 'lock'],
-    cwd: root,
-    stdio: ['inherit', 'inherit', 'inherit'],
-  })
-  if (proc.exitCode !== 0) sayNotice('warn', 'vx upgrade', 'vx lock failed: run vx lock')
+  let code: number | null
+  try {
+    code = Bun.spawnSync({
+      cmd: [bin, 'lock'],
+      cwd: root,
+      stdio: ['inherit', 'inherit', 'inherit'],
+    }).exitCode
+  } catch {
+    code = null
+  }
+  if (code !== 0) sayNotice('warn', 'vx upgrade', 'vx lock failed: run vx lock')
 }
 
 /**
@@ -837,13 +932,19 @@ export async function relock(bin: string, cwd = process.cwd()): Promise<void> {
  * binary in place, old one never restored.
  */
 export function startedVersion(bin: string, timeoutMs = 10_000): string | null {
-  const proc = Bun.spawnSync({
-    cmd: [bin, '--version'],
-    stdin: 'ignore',
-    stdout: 'pipe',
-    stderr: 'pipe',
-    timeout: timeoutMs,
-  })
+  let proc: ReturnType<typeof Bun.spawnSync>
+  try {
+    proc = Bun.spawnSync({
+      cmd: [bin, '--version'],
+      stdin: 'ignore',
+      stdout: 'pipe',
+      stderr: 'pipe',
+      timeout: timeoutMs,
+    })
+  } catch {
+    // The OS refused the spawn (EACCES on a noexec mount, ENOENT): it did not start.
+    return null
+  }
   const out = new TextDecoder().decode(proc.stdout).trim()
   return proc.exitCode === 0 && out.startsWith('vx ') ? out : null
 }

package/src/cli/watch-cycle.ts

@@ -5,7 +5,7 @@
 // as Ctrl-C would and the loop starts the next one; a cycle running any
 // other work is never stopped.
 
-import { type RunOptions } from '../orchestrator/index.js'
+import { CYCLE_INTERRUPT, type RunOptions } from '../orchestrator/index.js'
 import { createEventBus } from '../report/index.js'
 
 export interface WatchCycle {
@@ -13,7 +13,9 @@ export interface WatchCycle {
   readonly opts: RunOptions
   /** Every task in flight is a persistent one not yet ready. */
   waitsOnReadiness(): boolean
-  /** Stop the run as a SIGTERM would; watch keeps going. */
+  /** The project directories of the servers in flight. */
+  serverDirs(): string[]
+  /** Stop the run's own work as a SIGTERM would, sparing the servers it was handed; watch keeps going. */
   interrupt(): void
   readonly interrupted: boolean
   /** The run's task count, once it has started. */
@@ -26,21 +28,24 @@ export function watchCycle(opts: RunOptions, stop: AbortSignal, onWaiting: () =>
   const bus = createEventBus()
   // id → persistent; a group task has no process and holds nothing up.
   const active = new Map<string, boolean>()
+  const dirs = new Map<string, string>()
   let tasks: number | undefined
   const waitsOnReadiness = (): boolean =>
     active.size > 0 && [...active.values()].every((persistent) => persistent)
   bus.subscribe((e) => {
     if (e.kind === 'run:start') tasks = e.info.total
-    else if (e.kind === 'task:start' && e.node.config.exec !== undefined)
+    else if (e.kind === 'task:start' && e.node.config.exec !== undefined) {
       active.set(e.node.id, e.node.config.exec.persistent !== undefined)
-    else if (e.kind === 'task:complete') active.delete(e.node.id)
+      dirs.set(e.node.id, e.node.projectDir)
+    } else if (e.kind === 'task:complete') active.delete(e.node.id)
     else return
     if (waitsOnReadiness()) onWaiting()
   })
   return {
     opts: { ...opts, bus, footer: false, signal: AbortSignal.any([stop, own.signal]) },
     waitsOnReadiness,
-    interrupt: () => own.abort('SIGTERM'),
+    serverDirs: () => [...active].filter(([, server]) => server).map(([id]) => dirs.get(id)!),
+    interrupt: () => own.abort(CYCLE_INTERRUPT),
     get interrupted() {
       return own.signal.aborted
     },

package/src/cli/watch-filter.ts

@@ -33,8 +33,13 @@ export function isIgnoredWatchPath(rel: string): boolean {
   const segments = rel.split(path.sep)
   for (let i = 1; i <= segments.length; i++) if (isIgnoredDir(segments.slice(0, i))) return true
   if (IGNORED_SUFFIXES.some((suf) => rel.endsWith(suf))) return true
+  const last = segments.length - 1
+  // The cache's first save writes `.vx/.gitignore`, which ignores only the
+  // `.vx/cache` and `.vx/tmp` already skipped: a watched root project ran
+  // one more cycle for it.
+  if (segments[last] === '.gitignore' && segments[last - 1] === '.vx') return true
   // `vx lock`'s review copy: no input, so a re-lock is no cycle.
-  return segments[segments.length - 1] === 'vx.lock.json'
+  return segments[last] === 'vx.lock.json'
 }
 
 /**
@@ -55,7 +60,7 @@ export function makeWatchIgnore(
   inputs: ReadonlyMap<string, ReadonlyArray<readonly string[]>> = new Map(),
   /** What git tracked at the arm (`gitFiles`): never an output, so an edit there is one. */
   tracked?: ReadonlySet<string>,
-): (base: string, filename: string) => boolean {
+): (base: string, filename: string, dir?: boolean) => boolean {
   // Watchers report under the real root; a cache dir named through a link
   // (`VX_CACHE_DIR`, macOS `/var` -> `/private/var`) is matched as its target.
   const cacheAbs = realThrough(path.resolve(cacheDir))
@@ -104,9 +109,49 @@ export function makeWatchIgnore(
             .filter((g) => g.startsWith('!'))
             .map((g) => outputContainer(g.slice(1)))
             .filter((c) => c !== ''),
+          asTrees(globs.filter((g) => !g.startsWith('!'))).map(reach),
+          ownTrees(globs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))),
         ] as const,
     ),
   )
+  // A directory the poller skips is one whose files it never samples: an
+  // output container that also holds inputs (tsc's `.js` beside `.ts`,
+  // `src/**/*.js` out of `src/**/*.ts`) is walked, or `--poll` never saw
+  // the edit the native watcher ran.
+  const mayHoldInput = (abs: string): boolean =>
+    read.some(([dir, , , , reaches, trees]) => {
+      if (abs !== dir && !abs.startsWith(dir + path.sep)) return false
+      const rel = abs
+        .slice(dir.length + 1)
+        .split(path.sep)
+        .join('/')
+      if (trees.some((t) => rel === t || rel.startsWith(`${t}/`))) return false
+      const depth = rel === '' ? 0 : rel.split('/').length
+      return reaches.some(
+        ([p, max]) =>
+          depth < max &&
+          (p === '' ||
+            rel === '' ||
+            p === rel ||
+            p.startsWith(`${rel}/`) ||
+            rel.startsWith(`${p}/`)),
+      )
+    })
+  let trackedDirs: Set<string> | undefined
+  const holdsTracked = (abs: string): boolean => {
+    if (tracked === undefined) return false
+    if (trackedDirs === undefined) {
+      trackedDirs = new Set()
+      for (const f of tracked)
+        for (
+          let p = path.dirname(f);
+          !trackedDirs.has(p) && p !== path.dirname(p);
+          p = path.dirname(p)
+        )
+          trackedDirs.add(p)
+    }
+    return trackedDirs.has(abs)
+  }
   const isInput = (abs: string): boolean =>
     read.some(([dir, globs, not, containers]) => {
       if (!abs.startsWith(dir + path.sep)) return false
@@ -118,11 +163,12 @@ export function makeWatchIgnore(
       if (not.some((g) => g.match(rel))) return false
       return !containers.some((c) => c === rel || c.startsWith(`${rel}/`))
     })
-  return (base, filename) => {
+  return (base, filename, dir = false) => {
     if (isIgnoredWatchPath(filename)) return true
     const abs = path.resolve(base, filename)
     if (abs === cacheAbs || abs.startsWith(cacheAbs + path.sep)) return true
     if (isInput(abs)) return false
+    if (dir && (mayHoldInput(abs) || holdsTracked(abs))) return false
     // Core never cleans or saves a file git tracks and keys it under the
     // task's own output glob (2026-10-14); a submodule is listed as its
     // gitlink alone, so a path under a tracked one counts.
@@ -144,6 +190,23 @@ export function makeWatchIgnore(
   }
 }
 
+/**
+ * Where a glob's matches can lie: under its static prefix (`''` for the
+ * project's top), no deeper than its segment count when it has no `**`.
+ */
+function reach(glob: string): readonly [prefix: string, maxDepth: number] {
+  const p = staticPrefix(glob)
+  return [p === '.' || p === '/' ? '' : p, glob.includes('**') ? Infinity : glob.split('/').length]
+}
+
+/** The directories a task's own outputs cover whole (`dist/**`, `dist`): none of its inputs lie there. */
+function ownTrees(globs: readonly string[]): string[] {
+  return asTrees(globs).flatMap((g) => {
+    const p = staticPrefix(g)
+    return p !== '.' && p !== '/' && g === `${p}/**` ? [p] : []
+  })
+}
+
 /** `p` with its longest existing prefix realpath'd: the cache dir may not exist yet. */
 function realThrough(p: string): string {
   try {
@@ -312,6 +375,11 @@ export function makeFence(fenceDirs: readonly string[]): (ownDir: string, abs: s
  */
 const PROJECT_CONFIGS: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
 
+/** A project's own config file, by name: a run reads it only through the lock. */
+export function isProjectConfigFile(filename: string): boolean {
+  return PROJECT_CONFIGS.has(path.basename(filename))
+}
+
 export function shapesWatchedSet(filename: string): boolean {
   const base = path.basename(filename)
   return PROJECT_CONFIGS.has(base) || isWorkspaceConfigFile(filename.split(path.sep).join('/'))

package/src/cli/watch-fs.ts

@@ -4,6 +4,7 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
+import { ui } from '../util/index.js'
 
 /** Directories whose changes never trigger a re-run, wherever they appear. */
 export const IGNORED_SEGMENTS = ['node_modules', '.git']
@@ -103,7 +104,20 @@ export function pollWatcher(
         if (e.name === WATCH_PROBE) continue
         const childRel = rel === '' ? e.name : `${rel}/${e.name}`
         if (e.isDirectory()) {
-          if (recursive && !skipDir(childRel)) walk(path.join(abs, e.name), childRel)
+          if (recursive) {
+            if (!skipDir(childRel)) walk(path.join(abs, e.name), childRel)
+          } else {
+            // A non-recursive arm is there for a name coming or going (a
+            // project's parent hears the project made again), as the OS
+            // watcher reports it: by the directory's identity, not its
+            // times, which every write inside moves.
+            try {
+              const st = fs.statSync(path.join(abs, e.name))
+              current.set(childRel, `dir:${st.dev}:${st.ino}:${st.birthtimeMs}`)
+            } catch {
+              // raced with a delete; the next scan settles it
+            }
+          }
           continue
         }
         // A link is an input as its target string (watch-judge.ts), so that
@@ -310,7 +324,8 @@ function treeWatcher(root: string, listener: (filename: string) => void): WatchH
       if (rel === '' || (limit && !armed)) throw err
       if (limit && !warned) {
         warned = true
-        process.stderr.write(
+        ui.say(
+          'warn',
           `vx watch: ${abs}: the OS watch limit is reached (${code}); directories made from here on are not watched — raise it (Linux: sysctl fs.inotify.max_user_watches)\n`,
         )
       }
@@ -420,8 +435,7 @@ export class WatcherPool {
     private readonly skip: (dir: string, rel: string) => boolean,
     private readonly forcePoll = false,
   ) {
-    if (forcePoll)
-      process.stderr.write(`vx watch: polling every ${POLL_INTERVAL_MS} ms (watch.poll)\n`)
+    if (forcePoll) ui.say('info', `vx watch: polling every ${POLL_INTERVAL_MS} ms (watch.poll)\n`)
   }
 
   private poll(dir: string, recursive: boolean, onEvent: (filename: string) => void): WatchHandle {
@@ -453,7 +467,8 @@ export class WatcherPool {
       const code = (err as NodeJS.ErrnoException).code
       if (code !== 'ENOSPC' && code !== 'EMFILE') throw err
       watchers.push(this.poll(dir, recursive, onEvent))
-      process.stderr.write(
+      ui.say(
+        'warn',
         `vx watch: ${dir}: the OS watch limit is reached (${code}); polling every ${POLL_INTERVAL_MS} ms instead — raise it (Linux: sysctl fs.inotify.max_user_watches) to watch natively\n`,
       )
       return handle
@@ -469,7 +484,8 @@ export class WatcherPool {
         // stream the OS refused, a filesystem that reports nothing. Swap in
         // the poller rather than run a loop that silently never fires.
         watchers[at] = this.poll(dir, recursive, onEvent)
-        process.stderr.write(
+        ui.say(
+          'warn',
           `vx watch: ${dir}: no OS watch events within ${WATCH_PROBE_TIMEOUT_MS} ms; polling every ${POLL_INTERVAL_MS} ms instead\n`,
         )
       }),