@vzn/vx 0.0.646 → 0.0.649

package/src/cli/lock.ts

@@ -7,35 +7,41 @@ import { open } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
 import { flagHint, formatValue, refuse, refusedWord, seeHelp } from './help.js'
-import { buildTaskGraph, expandRequested } from '../graph/index.js'
-import {
-  applyGraphStage,
-  discoverProjects,
-  hasHook,
-  isDefaultBuild,
-  loadProjects,
-} from '../orchestrator/index.js'
+import { buildTaskGraph, expandRequested, isDefaultBuild } from '../graph/index.js'
+import { applyGraphStage, discoverProjects, hasHook, loadProjects } from '../orchestrator/index.js'
 import { resolveSetting, runRules } from '../settings.js'
 import {
   refusalNotice,
   DOT_VX_GITATTRIBUTES,
+  fsRefusalHint,
+  isFsRefusal,
+  isOutOfFds,
   isUserError,
+  maskedLine,
   relPosix,
   type RefusalParts,
+  type UserError,
   secretMask,
+  type SecretMask,
   ui,
   sayNotice,
+  refuseSymlink,
+  writeNoFollow,
 } from '../util/index.js'
 import {
+  ConfigsRefused,
   findProjectConfigs,
   findWorkspaceRoot,
+  REVIEW_FILE,
   loadProjectConfigs,
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
   lockKey,
   readLockfile,
   buildPackageGraph,
+  checkBracketLiterals,
   checkDependencyRules,
+  computeNestedProjectDirs,
   writeLockfile,
   type Lockfile,
   type ProjectMeta,
@@ -107,7 +113,7 @@ export async function lockWorkspace(
 ): Promise<number> {
   const check = await audit(root, warn)
   if (check.broken !== null) {
-    notWritten(check.broken, check.brokenParts)
+    notWritten(check.broken, check.brokenParts, check.alsoBroken)
     return 1
   }
   return await writeLock(root, check, say)
@@ -116,7 +122,7 @@ export async function lockWorkspace(
 /**
  * The lock as `vx lock` would write it, and the graph rules (`run.rules`)
  * checked over every project and task the workspace declares: a run trusts
- * the lock and does not check them (owner, 2026-10-13). Every config is
+ * the lock and does not check them (2026-10-13). Every config is
  * found (`findProjectConfigs`) and evaluated once; the projects, names and
  * graph are the ones a run builds from that lock, the `discover` and
  * `graph` stages included.
@@ -126,16 +132,21 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
   const resolved = new Map<string, ProjectConfig>()
   const out: GraphCheck = {
     broken: null,
+    loaded: false,
     fresh: { version: LOCKFILE_VERSION, projects: {} },
     all: [],
     tasked,
     resolved,
     reviewFiles: true,
+    strayReviews: [],
+    shadowed: [],
   }
   try {
     const { workspaceConfig, plugins, cacheDir } = await loadCliWorkspace(root)
     out.reviewFiles = resolveSetting('lock.reviewFiles', workspaceConfig).value !== false
-    const found = await findProjectConfigs(root)
+    const { configs: found, strayReviews, shadowed } = await findProjectConfigs(root)
+    out.strayReviews = strayReviews
+    out.shadowed = shadowed
     // The one load that evaluates: every reader reads the lock this writes.
     const configs = await loadProjectConfigs(found.map((f) => f.configPath))
     // In the lock's form: a field left `undefined` is a key the stored JSON
@@ -166,6 +177,8 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
       lock: true,
     })
     for (const entry of projects.values()) resolved.set(entry.name, entry.config)
+    out.loaded = true
+    checkBracketLiterals(root, projects.values())
     const names = new Set<string>()
     for (const entry of projects.values()) {
       const tasks = Object.entries(entry.config.tasks ?? {})
@@ -182,12 +195,19 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
         buildPackageGraph(out.all, taskEdgesFrom(projects)),
       )
     const rules = runRules(workspaceConfig)
+    const nameOf = new Map(out.all.map((m) => [m.dir, m.name]))
     const nodes = buildTaskGraph({
       projects,
       packageGraph: buildPackageGraph(out.all),
       requested: expandRequested([...names], [...projects.keys()], projects, isDefaultBuild),
       workspaceRoot: root,
       rules,
+      nestedProjects: new Map(
+        [...computeNestedProjectDirs(out.all)].map(([name, dirs]) => [
+          name,
+          dirs.map((dir) => ({ name: nameOf.get(dir)!, dir })),
+        ]),
+      ),
     })
     if (hasHook(plugins, 'graph'))
       await applyGraphStage(plugins, nodes, {
@@ -199,7 +219,12 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
       })
   } catch (err) {
     if (isUserError(err))
-      return { ...out, broken: err.message, ...(err.parts ? { brokenParts: err.parts } : {}) }
+      return {
+        ...out,
+        broken: err.message,
+        ...(err.parts ? { brokenParts: err.parts } : {}),
+        ...(err instanceof ConfigsRefused ? { alsoBroken: err.all.slice(1) } : {}),
+      }
     throw err
   }
   return out
@@ -209,6 +234,10 @@ interface GraphCheck {
   /** A graph rule's refusal, or a config that does not load; null when sound. */
   broken: string | null
   brokenParts?: RefusalParts
+  /** Every config loaded and resolved: `broken`, if set, is a graph rule's refusal. */
+  loaded: boolean
+  /** The other configs that do not load, past `broken`. */
+  alsoBroken?: readonly UserError[]
   /** The lock the configs evaluate to here. */
   fresh: Lockfile
   /** Every project, as a run discovers them from `fresh`. */
@@ -219,6 +248,10 @@ interface GraphCheck {
   resolved: Map<string, ProjectConfig>
   /** `lock.reviewFiles`. */
   reviewFiles: boolean
+  /** Review copies in a directory no config is in (`findProjectConfigs`). */
+  strayReviews: string[]
+  /** Config files a higher-precedence one beside them hides (`findProjectConfigs`). */
+  shadowed: { file: string; read: string }[]
 }
 
 function configured(all: readonly ProjectMeta[]): ConfiguredMeta[] {
@@ -237,14 +270,38 @@ export async function lockAfterMigration(root: string): Promise<{ code: number;
     return { code, said }
   } catch (err) {
     if (!isUserError(err)) throw err
-    notWritten(err.message, err.parts)
+    notWritten(err.message, err.parts, err instanceof ConfigsRefused ? err.all.slice(1) : [])
     return { code: 1, said }
   }
 }
 
-/** The lock refused: the refusal's own parts, or its config line and frame, or its message. */
-function notWritten(message: string, parts: RefusalParts | undefined): void {
-  ui.print('err', refusalNotice('vx lock', message, parts, { headline: 'lock not written' }))
+/** Refusals shown in full past the first; the rest are counted. */
+const ALSO_SHOWN = 4
+
+/**
+ * The lock refused: the refusal's own parts, or its config line and frame,
+ * or its message; then each other config that does not load, so one run
+ * names what a repo must fix.
+ */
+function notWritten(
+  message: string,
+  parts: RefusalParts | undefined,
+  also: readonly UserError[] = [],
+): void {
+  // Masked: a config's own throw is its author's text, and quotes what
+  // it read (L-11). bin.ts masks what reaches it; this is printed here.
+  ui.print(
+    'err',
+    refusalNotice('vx lock', maskedLine(message), parts, { headline: 'lock not written' }),
+  )
+  for (const e of also.slice(0, ALSO_SHOWN))
+    ui.print(
+      'err',
+      refusalNotice('vx lock', maskedLine(e.message), e.parts, { headline: 'also refused' }),
+    )
+  const more = also.length - ALSO_SHOWN
+  if (more > 0)
+    sayNotice('error', 'vx lock', `${more} more configs refused; fix these, then run vx lock again`)
 }
 
 /** Names shown per note: a turbo() repo can have hundreds of bare projects. */
@@ -259,9 +316,6 @@ function bareNote(bare: readonly string[]): string {
   return bare.length === 0 ? '' : ` (no vx.config, so not locked: ${bareNames(bare)})`
 }
 
-/** The name `vx lock` writes each project's review copy under. */
-const REVIEW_FILE = 'vx.lock.json'
-
 interface Review {
   name: string
   file: string
@@ -331,16 +385,69 @@ async function writeLock(
     })
     return 1
   }
+  // The copies first: one that cannot be written leaves the lock as it was,
+  // not a new lock beside stale copies and a stack.
+  for (const r of reviews) refuseSymlink(r.file)
+  const blocked = (
+    await Promise.all(
+      reviews.map((r) =>
+        writeNoFollow(r.file, r.text).then(
+          () => null,
+          (err: unknown): { file: string; err: NodeJS.ErrnoException } => {
+            if (typeof (err as NodeJS.ErrnoException).code !== 'string' || isOutOfFds(err))
+              throw err
+            return { file: r.file, err: err as NodeJS.ErrnoException }
+          },
+        ),
+      ),
+    )
+  ).filter((b) => b !== null)
+  if (blocked.length > 0) {
+    const first = blocked[0]!
+    notWritten('', {
+      headline: `${blocked.length === 1 ? 'a review copy' : 'review copies'} could not be written`,
+      // The code and the copy's path: the message names the temp the write renames.
+      what: blocked.map((b) => `${b.err.code}: ${relPosix(root, b.file)}`),
+      fix: isFsRefusal(first.err)
+        ? fsRefusalHint(first.err)
+        : `remove what stands at ${relPosix(root, first.file)}, then run vx lock again`,
+    })
+    return 1
+  }
   await writeLockfile(root, check.fresh)
-  await Promise.all([
-    ...reviews.map((r) => Bun.write(r.file, r.text)),
-    writeIfMissing(path.join(root, '.vx', '.gitattributes'), DOT_VX_GITATTRIBUTES),
-  ])
+  await writeIfMissing(path.join(root, '.vx', '.gitattributes'), DOT_VX_GITATTRIBUTES)
   const n = metas.length
   say(`${n} project config${n === 1 ? '' : 's'} → ${LOCKFILE_NAME}${bareNote(bare)}`)
+  // A second config beside the one read was edited and nothing changed.
+  warnShadowed(root, check, 'vx lock')
+  // Named here too: a lock that wrote clean failed the `--check` after it.
+  if (check.reviewFiles)
+    for (const file of await strayCopies(check)) sayNotice('warn', 'vx lock', strayLine(root, file))
   return 0
 }
 
+/**
+ * Review copies with no config beside them, sorted. One left beside a
+ * config since deleted shows reviewers tasks nothing runs, and keys the
+ * `**` of a project around it. vx never deletes a committed file; it
+ * names it. A project kept without a config (a plugin's) is checked on
+ * disk; any other directory is what discovery listed.
+ */
+async function strayCopies(check: GraphCheck): Promise<string[]> {
+  const kept = await Promise.all(
+    check.all
+      .filter((m) => m.configPath === null)
+      .map(async (m) => {
+        const file = path.join(m.dir, REVIEW_FILE)
+        return (await Bun.file(file).exists()) ? file : null
+      }),
+  )
+  return [...new Set([...kept.filter((f) => f !== null), ...check.strayReviews])].sort()
+}
+
+const strayLine = (root: string, file: string): string =>
+  `${relPosix(root, file)} has no vx.config beside it — delete it`
+
 /**
  * Each place an evaluated config holds the value of a secret in this
  * environment, by the rule output masking uses (a secret-named variable,
@@ -354,17 +461,20 @@ function secretsIn(projects: Record<string, ProjectConfig>): Array<{ at: string;
     for (const task of Object.values(config.tasks ?? {}))
       for (const n of task?.exec?.env?.secret ?? []) named.add(n)
   }
-  const secrets: [value: string, name: string][] = []
+  // Each variable's own mask: what the output masks of it, a URL's
+  // password and a key's lines too, not only the whole value.
+  const secrets: [mask: SecretMask, name: string][] = []
   for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined && secretMask([{ [name]: value }], named.has(name) ? [name] : []))
-      secrets.push([value, name])
+    const mask =
+      value === undefined ? null : secretMask([{ [name]: value }], named.has(name) ? [name] : [])
+    if (mask !== null) secrets.push([mask, name])
   }
   if (secrets.length === 0) return []
   const found: Array<{ at: string; name: string }> = []
   const walk = (project: string, at: string, v: unknown): void => {
     if (typeof v === 'string') {
-      for (const [value, name] of secrets)
-        if (v.includes(value)) found.push({ at: `${project}: ${at} holds $${name}`, name })
+      for (const [mask, name] of secrets)
+        if (mask.spans(v).length > 0) found.push({ at: `${project}: ${at} holds $${name}`, name })
     } else if (Array.isArray(v)) {
       v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
     } else if (v !== null && typeof v === 'object') {
@@ -375,6 +485,16 @@ function secretsIn(projects: Record<string, ProjectConfig>): Array<{ at: string;
   return found
 }
 
+/** A second config beside the one read: edited, it changes nothing. */
+function warnShadowed(root: string, check: GraphCheck, verb: string): void {
+  for (const { file, read } of check.shadowed)
+    sayNotice(
+      'warn',
+      verb,
+      `${relPosix(root, file)} is not read: ${path.basename(read)} beside it is — delete one`,
+    )
+}
+
 /**
  * Audit the lock: find and re-evaluate every config in the CURRENT
  * environment and deep-compare it with the locked object. That sees an
@@ -383,6 +503,9 @@ function secretsIn(projects: Record<string, ProjectConfig>): Array<{ at: string;
  */
 async function checkLock(root: string, json: boolean): Promise<number> {
   const check = await audit(root, warnToStderr)
+  // A warning, as `vx lock` says it: the CI gate passed beside a hidden
+  // config whose edit changed nothing.
+  warnShadowed(root, check, 'vx lock --check')
   const { broken } = check
   const metas = configured(check.all)
   const bare = bareProjects(check.all, check.tasked)
@@ -398,7 +521,16 @@ async function checkLock(root: string, json: boolean): Promise<number> {
     }
     return problems.length === 0 ? 0 : 1
   }
-  const lock = await readLockfile(root)
+  // A lock that does not read is drift `vx lock` fixes, as a missing one
+  // is: the audit answers it in its own shape, not as a refusal.
+  let lock: Lockfile | null
+  try {
+    lock = await readLockfile(root)
+  } catch (err) {
+    if (!isUserError(err)) throw err
+    if (!json) sayNotice('error', 'vx lock --check', err.message)
+    return answer([err.message])
+  }
   if (!lock) {
     const problem = `no ${LOCKFILE_NAME} at ${root} — run \`vx lock\` first`
     if (!json) sayNotice('error', 'vx lock --check', problem)
@@ -413,7 +545,7 @@ async function checkLock(root: string, json: boolean): Promise<number> {
       locked === undefined
         ? `${rel} is not in the lock — run 'vx lock'`
         : locked.file !== fresh.file
-          ? `${rel} is not the ${locked.file} the lock holds for ${dir} — run 'vx lock'`
+          ? `${rel} is not the ${locked.file} the lock holds for ${dir === '.' ? 'the workspace root project' : dir} — run 'vx lock'`
           : !Bun.deepEquals(fresh.config, locked.config, true)
             ? `${rel} evaluates differently from the lock here — its config, a file ` +
               `it imports, or the environment it reads changed; run 'vx lock'`
@@ -422,47 +554,60 @@ async function checkLock(root: string, json: boolean): Promise<number> {
     failures.push(problem)
     drifted.add(dir)
   }
-  if (broken !== null) failures.push(broken)
-  if (check.reviewFiles && broken === null) {
+  if (broken !== null && check.loaded) failures.push(broken)
+  // Each config that does not load, as `vx lock` names them: a CI fixing
+  // one at a time re-ran the gate once per broken config.
+  const refused: { message: string; parts?: RefusalParts }[] =
+    broken === null || check.loaded
+      ? []
+      : [
+          { message: broken, ...(check.brokenParts ? { parts: check.brokenParts } : {}) },
+          ...(check.alsoBroken ?? []).map((e) => ({
+            message: e.message,
+            ...(e.parts ? { parts: e.parts } : {}),
+          })),
+        ]
+  if (check.reviewFiles && check.loaded) {
     // A project the lock already fails is named once.
     const stale = await Promise.all(
       reviewsOf(
         metas.filter((m) => !drifted.has(lockKey(root, m.dir))),
         check.resolved,
       ).map(async (r) => {
+        // Only a missing copy is "has no": a directory in its place, or one
+        // this user cannot read, read as missing too.
         const text = await Bun.file(r.file)
           .text()
-          .catch(() => null)
+          .catch((err: NodeJS.ErrnoException) => (err.code === 'ENOENT' ? null : err))
         // Compared as JSON: a formatter may lay the copy out its own way.
-        if (text !== null && sameJson(text, r.config)) return null
+        if (typeof text === 'string' && sameJson(text, r.config)) return null
         const rel = relPosix(root, r.file)
         return text === null
           ? `"${r.name}" has no ${rel} — run 'vx lock'`
-          : `"${r.name}" (${rel}) is not what its config resolves to here — run 'vx lock'`
+          : typeof text !== 'string'
+            ? `"${r.name}" (${rel}) could not be read (${text.code ?? text.message}) — remove it and run 'vx lock'`
+            : `"${r.name}" (${rel}) is not what its config resolves to here — run 'vx lock'`
       }),
     )
     for (const f of stale) if (f !== null) failures.push(f)
-    // A copy left beside a config since deleted shows reviewers tasks
-    // nothing runs. vx never deletes a committed file; it names it.
-    const orphans = await Promise.all(
-      check.all
-        .filter((m) => m.configPath === null)
-        .map(async (m) => {
-          const file = path.join(m.dir, REVIEW_FILE)
-          return (await Bun.file(file).exists())
-            ? `${relPosix(root, file)} has no vx.config beside it — delete it`
-            : null
-        }),
-    )
-    for (const f of orphans) if (f !== null) failures.push(f)
+    for (const file of await strayCopies(check)) failures.push(strayLine(root, file))
   }
-  for (const dir of Object.keys(lock.projects)) {
+  // A config that does not load evaluated none: every locked project
+  // read as gone, the healthy ones too.
+  for (const dir of check.loaded ? Object.keys(lock.projects) : []) {
     if (!Object.hasOwn(check.fresh.projects, dir)) {
-      failures.push(`the lock holds ${dir}, which has no vx.config now — run 'vx lock'`)
+      const what = dir === '.' ? 'the workspace root project' : dir
+      failures.push(`the lock holds ${what}, which has no vx.config now — run 'vx lock'`)
     }
   }
-  if (json) return answer(failures)
-  if (failures.length > 0) {
+  if (json)
+    // Root-relative, as every other problem: the loader names the absolute path.
+    return answer([
+      ...refused.map((r) => r.message.split(`${root}${path.sep}`).join('')),
+      ...failures,
+    ])
+  if (failures.length + refused.length > 0) {
+    for (const r of refused) ui.print('err', refusalNotice('vx lock --check', r.message, r.parts))
     for (const f of failures) sayNotice('error', 'vx lock --check', f)
     return 1
   }