@vzn/vx 0.0.646 → 0.0.649

package/src/workspace/affected.ts

@@ -6,7 +6,8 @@
 // index + unstaged — so it captures everything you touched and nothing
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
-import { realpath, stat } from 'node:fs/promises'
+import { lstatSync } from 'node:fs'
+import { lstat, readlink, realpath, stat } from 'node:fs/promises'
 import path from 'node:path'
 import {
   executablePath,
@@ -18,11 +19,11 @@ import {
   relPosix,
   UserError,
 } from '../util/index.js'
-import { LOCKFILE_NAME } from './lockfile.js'
+import { LOCKFILE_NAME, lockKey } from './lockfile.js'
 import { configImportOwners, realpathOr } from './config-imports.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { bunPatchFiles } from './fingerprint.js'
-import { PROJECT_CONFIG_FILENAMES, type ProjectMeta } from './workspace.js'
+import { PROJECT_CONFIG_FILENAMES, REVIEW_FILE, type ProjectMeta } from './workspace.js'
 
 /**
  * Every git call here goes through these two: a git that is not on PATH
@@ -38,7 +39,9 @@ function spawnGitSync(
   try {
     return Bun.spawnSync({
       cmd: [executablePath('git'), ...args],
-      env: gitEnv(),
+      // A probe never fetches: in a partial clone, `rev-parse` of a commit
+      // it lacks fetched that commit and all its history (50k objects).
+      env: { ...gitEnv(), GIT_NO_LAZY_FETCH: '1' },
       cwd,
       stdout: 'pipe',
       stderr,
@@ -99,6 +102,7 @@ export interface AffectedArgs {
   workspaceGlobOwners?: (
     changedPaths: readonly string[],
     nested: readonly string[],
+    dirLinks: ReadonlySet<string>,
   ) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
@@ -120,6 +124,12 @@ export interface AffectedArgs {
    * -s` here. A changed or untracked link is a changed path already.
    */
   links?: () => Promise<readonly string[] | null>
+  /**
+   * The tracked paths git does not look at on disk (assume-unchanged,
+   * skip-worktree), workspace-relative, from the run's enumeration; null or
+   * absent asks `git ls-files -v` here.
+   */
+  flagged?: () => Promise<readonly string[] | null>
 }
 
 export interface FingerprintClaims {
@@ -132,7 +142,29 @@ export interface FingerprintClaims {
     extras?: ReadonlyMap<string, { before: Uint8Array | null; after: Uint8Array | null }>
   }): Promise<ReadonlySet<string> | undefined>
   /** The files a claimed file names that its claimant keys too; absent = it reads none. */
-  extraFiles?(file: string, bytes: Uint8Array): readonly string[] | undefined
+  extraFiles?(file: string, bytes: Uint8Array): Promise<readonly string[] | undefined>
+}
+
+/**
+ * `extraFiles` on one side of a claimed file. Which side failed to parse is
+ * the whole fix: a broken lockfile at the base ref is not the working
+ * tree's to regenerate, and the bare refusal named neither.
+ */
+async function extraFilesOn(
+  claims: FingerprintClaims,
+  file: string,
+  bytes: Uint8Array,
+  side: string,
+): Promise<readonly string[] | undefined> {
+  try {
+    return await claims.extraFiles?.(file, bytes)
+  } catch (err) {
+    if (!(err instanceof Error)) throw err
+    throw new UserError(
+      `${err.message} (${side})`,
+      err instanceof UserError ? err.code : 'VX_E_REFUSED',
+    )
+  }
 }
 
 /**
@@ -145,7 +177,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
 }
 
 /**
- * What `--affected` seeds its tasks from (owner, 2026-10-04): the changed
+ * What `--affected` seeds its tasks from (2026-10-04): the changed
  * projects, each one's changed paths relative to it, and the projects a
  * change reaches as a whole — every task in one is affected whatever its
  * inputs say, because the reason was no path of its own (a lockfile claim,
@@ -167,8 +199,18 @@ export interface AffectedChanges {
    * in it, so a `workspaceFiles` glob that reaches under one is reached.
    */
   nested?: readonly string[]
+  /**
+   * The changed paths a glob matches as a directory (a link to one),
+   * workspace-relative: `declaresInput`'s `dirLink`.
+   */
+  dirLinks?: ReadonlySet<string>
+  /** Project → its `dirLinks`, relative to the project's directory. */
+  dirLinksIn?: ReadonlyMap<string, ReadonlySet<string>>
 }
 
+/** `<base>...HEAD` / `<base>..HEAD`: the base alone, read as `affectedChanges` reads it. */
+const HEAD_RANGE = /^(.+?)(\.{2,3})HEAD$/s
+
 export async function affectedChanges(
   args: AffectedArgs,
   perTask = true,
@@ -177,7 +219,7 @@ export async function affectedChanges(
   // vx already diffs from the merge base (three dots' meaning), and the
   // working tree it diffs to holds HEAD (D-117). Its two-dot `[A..HEAD]`
   // diffs from A itself (G-145). Any other range is refused.
-  const headRange = /^(.+?)(\.{2,3})HEAD$/s.exec(args.since)
+  const headRange = HEAD_RANGE.exec(args.since)
   const since = headRange?.[1] ?? args.since
   const fromMergeBase = headRange?.[2] !== '..'
   // The base reaches git as an argument, never through a shell, so `$(…)`
@@ -220,9 +262,11 @@ export async function affectedChanges(
   // when there is none (unrelated histories, a detached probe) the ref
   // itself is the base, as before. Turbo's two-dot range `A..HEAD` is the
   // one form that diffs from A itself.
+  // Asked beside the base, not after it: the diff's shape waits on it.
+  const partial = isPartialClone(args.workspaceRoot).catch(() => false)
   const base = fromMergeBase
     ? await mergeBase(args.workspaceRoot, since)
-    : (await verifyRef(args.workspaceRoot, since), since)
+    : await rangeBase(args.workspaceRoot, since)
 
   const [diffed, untracked] = await Promise.all([
     // `--no-renames` is crucial for project-affected detection: with
@@ -252,7 +296,7 @@ export async function affectedChanges(
     //
     // `--raw` for each path's mode: a gitlink (160000) is a nested
     // repository, one path standing for every file in it (`nested` below).
-    gitDiffPaths(args.workspaceRoot, base),
+    gitDiffPaths(args.workspaceRoot, base, partial),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
@@ -264,22 +308,54 @@ export async function affectedChanges(
 
   const projects = await args.projects
 
-  // .vx/projects.lock.json (workspace-root metadata) is excluded like a gitignored
-  // file: re-running `vx lock` must not mark every project affected.
+  // What vx writes under `.vx` (the lock, its git files, the cache) is
+  // excluded like a gitignored file: re-running `vx lock` must not mark
+  // every project affected, nor the root project whole. The lock's
+  // entries are read below.
   // An untracked file under `node_modules` is an install, which the input
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
+  // So is each project's `vx.lock.json`, the review copy `vx lock` writes
+  // beside its config and nothing reads: a re-lock rewriting them all
+  // selected every project while no key moved.
+  const reviewCopies = new Set(projects.map((p) => path.join(p.dir, REVIEW_FILE)))
+  const rootDir = path.resolve(args.workspaceRoot)
   const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
-    (s) => s !== LOCKFILE_NAME,
+    (s) =>
+      !VX_OWN.has(s) &&
+      !s.startsWith('.vx/cache/') &&
+      !s.startsWith('.vx/tmp/') &&
+      (path.posix.basename(s) !== REVIEW_FILE || !reviewCopies.has(path.join(rootDir, s))),
   )
   // A symlinked input keys the content behind it (cache/linked-inputs.ts),
   // and the diff names that content's path, never the link's: a link whose
   // target changed is a changed path itself.
-  changed.push(
-    ...(await linkedChanges(
-      args.workspaceRoot,
-      (await args.links?.().catch(() => null)) ?? (await trackedLinks(args.workspaceRoot)),
-      changed,
-    )),
+  // One index listing serves both when the run's enumeration did not.
+  let index: Promise<IndexEntry[]> | undefined
+  const listIndex = () => (index ??= indexEntries(args.workspaceRoot))
+  const [links, flagged] = await Promise.all([
+    (async () =>
+      (await args.links?.().catch(() => null)) ??
+      (await listIndex()).filter((e) => e.mode === '120000').map((e) => e.path))(),
+    (async () =>
+      (await args.flagged?.().catch(() => null)) ??
+      (await listIndex()).filter((e) => e.flagged).map((e) => e.path))(),
+  ])
+  const dirLinkSet = new Set<string>()
+  changed.push(...(await linkedChanges(args.workspaceRoot, links, changed, dirLinkSet)))
+  // A path git was told not to look at (`update-index --assume-unchanged`,
+  // `--skip-worktree`): `git diff` reports no edit to it, and the key
+  // hashes it from disk, so the task missed and selection left it out.
+  if (flagged.length > 0) {
+    changed.push(...(await flaggedChanges(args.workspaceRoot, flagged, await listIndex(), changed)))
+  }
+  // A changed path that is a link to a directory, or was a link and is
+  // no link to a file now: a glob reaching below it keys what is behind
+  // it (cache/inputs.ts `mayHoldMatch`), so it is matched as a directory.
+  const dirLinks = await changedDirLinks(
+    args.workspaceRoot,
+    changed,
+    dirLinkSet,
+    new Set([...diffed.links, ...untracked]),
   )
   // The nested repositories git reports as one path: a gitlink, or an
   // untracked embedded repository (`dir/`, the only path git prints so).
@@ -310,8 +386,8 @@ export async function affectedChanges(
   // changes no key.
   const wsConfig = WORKSPACE_CONFIG_FILENAMES.find((n) => changed.includes(n))
   if (wsConfig !== undefined) return everything(wsConfig)
-  // Loading the workspace file costs an evaluation; only a changed ROOT
-  // name can be claimed, so a diff inside the projects never loads it.
+  // The workspace file is loaded once, for the extra files below and the
+  // changed root names after them.
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
@@ -320,30 +396,33 @@ export async function affectedChanges(
   // patches, a `file:`, `link:` or `portal:` directory
   // a manager copies or links) is part of
   // that lockfile: a change to one, or under one, is a lockfile change the
-  // claimant answers with it. Only a path no project below the root owns
-  // can be one, so a diff inside the projects never loads the claims.
+  // claimant answers with it. It may sit inside another project's
+  // directory, so every changed path is asked: asking only the paths no
+  // project owned selected the owner and never the project the lockfile
+  // says reaches it.
   const extrasBy = new Map<
     string,
     Map<string, { before: Uint8Array | null; after: Uint8Array | null }>
   >()
-  const rootDir = path.resolve(args.workspaceRoot)
-  const loose = changed.filter((rel) => {
-    const abs = path.join(rootDir, rel)
-    return !projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
-  })
-  const extraClaims = loose.length > 0 ? await loadClaims() : undefined
+  const extraClaims = changed.length > 0 ? await loadClaims() : undefined
   for (const file of extraClaims?.files ?? []) {
     const after = await bytesOrNull(path.join(args.workspaceRoot, file))
-    const before = await gitBytesAt(args.workspaceRoot, base, file)
-    const namedAfter = after === null ? [] : extraClaims!.extraFiles?.(file, after)
+    // An unchanged claimed file is the same bytes at the base: one read,
+    // one parse, no git.
+    const same = !changed.includes(file)
+    const before = same ? after : await gitBytesAt(args.workspaceRoot, base, file)
+    const namedAfter =
+      after === null ? [] : await extraFilesOn(extraClaims!, file, after, 'in the working tree')
     const named = new Set([
-      ...(before === null ? [] : (extraClaims!.extraFiles?.(file, before) ?? [])),
+      ...(before === null || same
+        ? []
+        : ((await extraFilesOn(extraClaims!, file, before, 'as of the base ref')) ?? [])),
       ...(namedAfter ?? []),
     ])
     const extras = new Map<string, { before: Uint8Array | null; after: Uint8Array | null }>()
     for (const rel of named) {
       const at = path.posix.normalize(rel).replace(/\/+$/, '')
-      if (loose.includes(at)) {
+      if (changed.includes(at)) {
         extras.set(rel, {
           before: await gitBytesAt(args.workspaceRoot, base, at),
           after: await bytesOrNull(path.join(args.workspaceRoot, at)),
@@ -352,7 +431,7 @@ export async function affectedChanges(
       }
       // A directory's sides are not its bytes: a file under it changed,
       // so they differ, and only the projects reaching it move.
-      const under = loose.filter((p) => p.startsWith(`${at}/`))
+      const under = changed.filter((p) => p.startsWith(`${at}/`))
       if (under.length > 0) {
         extras.set(rel, { before: null, after: new TextEncoder().encode(under.join('\0')) })
       }
@@ -363,7 +442,7 @@ export async function affectedChanges(
       // bun.lock names (the lockfile records no hash of them): it cannot
       // say which projects one reaches, so its edit widens.
       const patches = new Set(bunPatchFiles(after))
-      const patch = loose.find((p) => patches.has(p))
+      const patch = changed.find((p) => patches.has(p))
       if (patch !== undefined) return everything(patch)
     }
   }
@@ -396,6 +475,7 @@ export async function affectedChanges(
     ),
   )
   const paths = new Map<string, string[]>()
+  const dirLinksIn = new Map<string, Set<string>>()
   const whole = new Set<string>(claimedOwned.keys())
   const owned = projectsContaining(
     args.workspaceRoot,
@@ -405,22 +485,62 @@ export async function affectedChanges(
     realDirs,
     perTask
       ? {
-          path: (name, rel) => {
+          path: (name, rel, wsRel) => {
             const list = paths.get(name)
             if (list) list.push(rel)
             else paths.set(name, [rel])
+            if (!dirLinks.has(wsRel)) return
+            const links = dirLinksIn.get(name)
+            if (links) links.add(rel)
+            else dirLinksIn.set(name, new Set([rel]))
           },
           repo: (name) => whole.add(name),
         }
       : undefined,
   )
   for (const name of claimedOwned.keys()) owned.add(name)
+  // A run reads each config from the lock, so an entry that moved moved
+  // its project's keys, though no config or import did (one evaluated
+  // under another env, a preset imported by package name).
+  if (diffed.paths.includes(LOCKFILE_NAME) || untracked.includes(LOCKFILE_NAME)) {
+    // A side with no lock (or one that will not parse) ran nothing from
+    // it: the paths of the configs say what changed, as before the lock.
+    const entries = (bytes: Uint8Array | null): Record<string, unknown> | null => {
+      if (bytes === null) return null
+      try {
+        const locked = (JSON.parse(new TextDecoder().decode(bytes)) as { projects?: unknown })
+          .projects
+        return typeof locked === 'object' && locked !== null
+          ? (locked as Record<string, unknown>)
+          : null
+      } catch {
+        return null
+      }
+    }
+    const before = entries(await gitBytesAt(args.workspaceRoot, base, LOCKFILE_NAME))
+    const after = entries(await bytesOrNull(path.join(args.workspaceRoot, LOCKFILE_NAME)))
+    const same = (dir: string): boolean =>
+      before === null ||
+      after === null ||
+      (Object.hasOwn(before, dir) === Object.hasOwn(after, dir) &&
+        JSON.stringify(before[dir]) === JSON.stringify(after[dir]))
+    for (const p of projects) {
+      if (same(lockKey(rootDir, p.dir))) continue
+      owned.add(p.name)
+      whole.add(p.name)
+    }
+  }
 
-  // A config that makes an existing directory a project took files from
-  // the project above it.
-  const configs = changed.filter((rel) => CONFIG_NAMES.has(path.posix.basename(rel)))
-  if (configs.length > 0) {
-    const atBase = await gitBlobsAt(args.workspaceRoot, base, configs)
+  // A config or manifest that makes an existing directory a project took
+  // files from the project above it.
+  const markers = changed.filter((rel) => PROJECT_MARKERS.has(path.posix.basename(rel)))
+  if (markers.length > 0) {
+    const atBase = await gitBlobsAt(args.workspaceRoot, base, markers)
+    // A config the base had in a directory that is no project now: the
+    // project is gone, and with it the edge naming who depended on it,
+    // while their keys lost an upstream. Today's graph cannot say who.
+    const gone = await removedProjectConfig(args.workspaceRoot, atBase, projects)
+    if (gone !== undefined) return everything(gone)
     for (const name of parentsOfNewNested(args.workspaceRoot, atBase, projects)) {
       owned.add(name)
       whole.add(name)
@@ -435,16 +555,20 @@ export async function affectedChanges(
   // (`../../src/index.ts`), whose target is owned.
   // Per task, a project that owns the changed file still needs to know its
   // config imported it: that re-keys every task, whatever their inputs.
-  for (const name of args.configImports === false
-    ? []
-    : await configImportOwners({
-        workspaceRoot: args.workspaceRoot,
-        projects: projects,
-        changed,
-        skip: perTask ? new Set() : owned,
-      })) {
-    owned.add(name)
-    whole.add(name)
+  // A file the workspace config imports widens as the config itself does.
+  if (args.configImports !== false) {
+    const imports = await configImportOwners({
+      workspaceRoot: args.workspaceRoot,
+      projects: projects,
+      changed,
+      skip: perTask ? new Set() : owned,
+      workspaceConfigs: WORKSPACE_CONFIG_FILENAMES.map((n) => path.join(rootDir, n)),
+    })
+    if (imports.workspace !== undefined) return everything(imports.workspace)
+    for (const name of imports.owners) {
+      owned.add(name)
+      whole.add(name)
+    }
   }
 
   const nestedDirs = [...nested].map((rel) => rel.replace(/\/$/, ''))
@@ -455,22 +579,32 @@ export async function affectedChanges(
     whole,
     ...(claimedOwned.size > 0 ? { wholeBy: claimedOwned } : {}),
     ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
+    ...(dirLinks.size > 0 ? { dirLinks, dirLinksIn } : {}),
   })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
-  for (const name of await args.workspaceGlobOwners(changed, nestedDirs)) owned.add(name)
+  for (const name of await args.workspaceGlobOwners(changed, nestedDirs, dirLinks)) owned.add(name)
   return done()
 }
 
+/** What vx writes under `.vx`, which no key reads (cache/inputs.ts `ALWAYS_IGNORE`). */
+const VX_OWN: ReadonlySet<string> = new Set([LOCKFILE_NAME, '.vx/.gitattributes', '.vx/.gitignore'])
+
 const CONFIG_NAMES: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
+/**
+ * The files that make a directory a project: core's configs, and the
+ * `package.json` a `discover` plugin reads (core keys every project's own).
+ * Discovery names no file it read, so these stand for the base's project set.
+ */
+const PROJECT_MARKERS: ReadonlySet<string> = new Set([...PROJECT_CONFIG_FILENAMES, 'package.json'])
 
 /**
  * The projects a NEW nested project took files from. A project's inputs
- * stop at every project below it, so a config that makes an existing
+ * stop at every project below it, so a marker that makes an existing
  * directory a project re-keys the project above it — its `**` lost the
  * directory's files — while containment maps the change to the new
  * project alone, and `--affected` left the re-keyed parent out. "New" is
- * judged at the base: none of the changed configs in its directory was
- * there. `atBase` holds each changed config there.
+ * judged at the base: none of the changed markers in its directory was
+ * there. `atBase` holds each changed marker there.
  */
 function parentsOfNewNested(
   workspaceRoot: string,
@@ -498,6 +632,24 @@ function parentsOfNewNested(
   return out
 }
 
+/** The first config in `atBase` the base had whose file and project are both gone now. */
+async function removedProjectConfig(
+  workspaceRoot: string,
+  atBase: ReadonlyMap<string, Uint8Array | null>,
+  projects: readonly ProjectMeta[],
+): Promise<string | undefined> {
+  const dirs = new Set(projects.map((p) => p.dir.normalize('NFC')))
+  for (const [rel, bytes] of atBase) {
+    // A manifest's directory may never have been a project; a config's was.
+    if (bytes === null || !CONFIG_NAMES.has(path.posix.basename(rel))) continue
+    const dir = path.resolve(workspaceRoot, path.posix.dirname(rel)).normalize('NFC')
+    if (dirs.has(dir)) continue
+    if (await Bun.file(path.join(workspaceRoot, rel)).exists()) continue
+    return rel
+  }
+  return undefined
+}
+
 /**
  * Each of `files` (workspace-root-relative) as `ref` has it, in one `git
  * cat-file --batch`: null for a file the ref does not have. `./` anchors
@@ -580,12 +732,82 @@ async function bytesOrNull(file: string): Promise<Uint8Array | null> {
   return (await f.exists()) ? await f.bytes() : null
 }
 
-/** The symlinks the index lists, workspace-relative. */
-async function trackedLinks(workspaceRoot: string): Promise<string[]> {
+interface IndexEntry {
+  path: string
+  mode: string
+  oid: string
+  /** Assume-unchanged or skip-worktree: git does not look at it on disk. */
+  flagged: boolean
+  skipWorktree: boolean
+}
+
+/**
+ * The index's stage-0 entries, workspace-relative. `ls-files -v` prefixes
+ * a tag: `S` skip-worktree, a lowercase letter assume-unchanged (`s` both).
+ */
+async function indexEntries(workspaceRoot: string): Promise<IndexEntry[]> {
+  const out: IndexEntry[] = []
+  for (const record of await gitPaths(workspaceRoot, ['ls-files', '-s', '-v', '-z'])) {
+    const m = /^(\S) (\d+) ([0-9a-f]+) 0\t(.*)$/s.exec(record)
+    if (m === null) continue
+    const tag = m[1]!
+    out.push({
+      path: m[4]!,
+      mode: m[2]!,
+      oid: m[3]!,
+      flagged: tag === 'S' || (tag >= 'a' && tag <= 'z'),
+      skipWorktree: tag === 'S' || tag === 's',
+    })
+  }
+  return out
+}
+
+/**
+ * The flagged paths whose disk side moved from the index (`git diff` covers
+ * the index against the base): a file whose bytes hash to another blob, a
+ * link, or an assume-unchanged file deleted. An absent skip-worktree file
+ * is a sparse checkout's: the key leaves it out, and so does this.
+ */
+async function flaggedChanges(
+  workspaceRoot: string,
+  flagged: readonly string[],
+  index: readonly IndexEntry[],
+  changed: readonly string[],
+): Promise<string[]> {
+  const byPath = new Map(index.map((e) => [e.path, e]))
+  const seen = new Set(changed)
   const out: string[] = []
-  for (const record of await gitPaths(workspaceRoot, ['ls-files', '-s', '-z'])) {
-    if (record.startsWith('120000 ')) out.push(record.slice(record.indexOf('\t') + 1))
+  const hash: IndexEntry[] = []
+  for (const rel of flagged) {
+    const entry = byPath.get(rel)
+    if (entry === undefined || seen.has(rel)) continue
+    // Synchronous: a sparse checkout flags its every absent file, and one
+    // awaited stat each was 7 s per 100,000 (a loop of these, 0.15 s).
+    if (lstatSync(path.join(workspaceRoot, rel), { throwIfNoEntry: false }) === undefined) {
+      if (!entry.skipWorktree) out.push(rel)
+    } else if (entry.mode === '120000' || rel.includes('\n')) out.push(rel)
+    else hash.push(entry)
   }
+  if (hash.length === 0) return out
+  // `--stdin-paths` hashes each file as `git add` would (its clean
+  // filters), so an unchanged one names the index's blob.
+  const proc = spawnGit(
+    ['hash-object', '--stdin-paths'],
+    workspaceRoot,
+    new TextEncoder().encode(hash.map((e) => `${e.path}\n`).join('')),
+  )
+  const [stdout, stderr, exit] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  if (exit !== 0) {
+    throw new UserError(`git hash-object failed (exit ${exit}): ${stderr.trim()}`, 'VX_E_GIT')
+  }
+  const oids = stdout.split('\n')
+  hash.forEach((e, i) => {
+    if (oids[i] !== e.oid) out.push(e.path)
+  })
   return out
 }
 
@@ -600,6 +822,8 @@ async function linkedChanges(
   workspaceRoot: string,
   links: readonly string[],
   changed: readonly string[],
+  /** Given each link to a directory. */
+  dirs: Set<string>,
 ): Promise<string[]> {
   if (links.length === 0) return []
   const realRoot = await realpath(workspaceRoot).catch(() => workspaceRoot)
@@ -614,6 +838,7 @@ async function linkedChanges(
     } catch {
       continue
     }
+    if (dir) dirs.add(link)
     const rel = path.relative(realRoot, real)
     if (rel.startsWith('..') || path.isAbsolute(rel)) out.push(link)
     else inside.push({ link, target: rel.split(path.sep).join('/'), dir })
@@ -628,7 +853,8 @@ async function linkedChanges(
     '--directory',
     '-z',
     '--',
-    ...(named.length === inside.length ? named : ['.']),
+    // A name is a path, never pathspec magic (`:x`, `*`).
+    ...(named.length === inside.length ? named.map((n) => `:(literal)${n}`) : ['.']),
   ])
   const changedSet = new Set(changed)
   const under = (p: string, dir: string): boolean => dir === '' || p.startsWith(`${dir}/`)
@@ -643,6 +869,45 @@ async function linkedChanges(
   return out
 }
 
+/**
+ * The changed paths a glob must match as a directory: a tracked link to
+ * one (`dirs`), and each of `maybe` (a link on either side of the diff,
+ * an untracked path) that is a link now to no file.
+ */
+async function changedDirLinks(
+  workspaceRoot: string,
+  changed: readonly string[],
+  dirs: ReadonlySet<string>,
+  maybe: ReadonlySet<string>,
+): Promise<Set<string>> {
+  const out = new Set<string>()
+  await Promise.all(
+    changed.map(async (rel) => {
+      if (dirs.has(rel)) out.add(rel)
+      else if (
+        maybe.has(rel) &&
+        !rel.endsWith('/') &&
+        (await noFileLink(path.join(workspaceRoot, rel)))
+      ) {
+        out.add(rel)
+      }
+    }),
+  )
+  return out
+}
+
+/** A link now to anything but a file, or a path that is gone (a deleted link). */
+async function noFileLink(abs: string): Promise<boolean> {
+  try {
+    if (!(await lstat(abs)).isSymbolicLink()) return false
+  } catch {
+    return true
+  }
+  return !(await stat(abs)
+    .then((s) => s.isFile())
+    .catch(() => false))
+}
+
 /** Run a NUL-separated path-listing git command from the workspace root. */
 async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
   const proc = spawnGit([...cmd], workspaceRoot)
@@ -653,68 +918,168 @@ async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]>
   const stderr = await new Response(proc.stderr).text()
   const exit = await proc.exited
   if (exit !== 0) {
-    throw new UserError(`git ${cmd[0]} failed (exit ${exit}): ${stderr.trim()}`, 'VX_E_GIT')
+    throw new UserError(
+      `git ${cmd[cmd[0] === '-c' ? 2 : 0]} failed (exit ${exit}): ${stderr.trim()}`,
+      'VX_E_GIT',
+    )
   }
   return stdout.split('\0').filter((s) => s.length > 0)
 }
 
 /**
- * `git diff --raw -z <base>`'s paths, and those that are a gitlink on
- * either side: one the change removed took its files with it. Each record
+ * `git diff --raw -z <base>`'s paths, those that are a symlink on either
+ * side, and those that are a gitlink on either side: one the change
+ * removed took its files with it. Each record
  * is `:<mode> <mode> <oid> <oid> <status>` then its path (one path:
  * `--no-renames`).
+ *
+ * `diff.autoRefreshIndex=false`: a porcelain `diff` that meets a
+ * stat-dirty file rewrites the index under `index.lock`, and ignores
+ * `--no-optional-locks`, so a user's `git commit` beside a run failed on
+ * that lock. Without the refresh a stat-only change is listed as a
+ * modification (`statOnly` drops it).
  */
 async function gitDiffPaths(
   workspaceRoot: string,
   base: string,
-): Promise<{ paths: string[]; gitlinks: string[] }> {
-  const fields = await gitPaths(workspaceRoot, [
-    'diff',
-    '--no-renames',
-    '--ignore-submodules=none',
-    '--relative',
-    '--raw',
-    '-z',
-    '--end-of-options',
-    base,
-  ])
+  partial: Promise<boolean>,
+): Promise<{ paths: string[]; gitlinks: string[]; links: string[] }> {
+  const diff = (...revs: string[]) =>
+    gitPaths(workspaceRoot, [
+      '-c',
+      'diff.autoRefreshIndex=false',
+      'diff',
+      '--no-renames',
+      '--ignore-submodules=none',
+      '--relative',
+      '--raw',
+      '--no-abbrev',
+      '-z',
+      '--end-of-options',
+      ...revs,
+    ])
+  // A partial clone lacks the base's blobs, and a stat-dirty file made
+  // `git diff <base>` read them to drop it: one fetch per file, and git
+  // 2.43 crashed (exit 139) on the batch. The base's tree against HEAD's
+  // reads no blob, HEAD's against the working tree reads only blobs a
+  // checkout has; their union over-selects only a file the working tree
+  // put back as the base had it.
+  const lists =
+    (await partial) || fetchedInto.has(workspaceRoot)
+      ? await Promise.all([diff(base, 'HEAD'), diff('HEAD')])
+      : [await diff(base)]
   const paths: string[] = []
   const gitlinks: string[] = []
-  for (let i = 0; i + 1 < fields.length; i += 2) {
-    const rel = fields[i + 1]!
-    paths.push(rel)
-    const head = fields[i]!
-    if (head.startsWith('160000 ', 1) || head.startsWith('160000 ', 8)) gitlinks.push(rel)
+  const links: string[] = []
+  const seen = new Set<string>()
+  const unread: { rel: string; oid: string; link: boolean }[] = []
+  for (const fields of lists) {
+    for (let i = 0; i + 1 < fields.length; i += 2) {
+      const rel = fields[i + 1]!
+      if (seen.has(rel)) continue
+      seen.add(rel)
+      paths.push(rel)
+      const head = fields[i]!
+      if (head.startsWith('160000 ', 1) || head.startsWith('160000 ', 8)) gitlinks.push(rel)
+      if (head.startsWith('120000 ', 1) || head.startsWith('120000 ', 8)) links.push(rel)
+      const [src, dst, oid, worktree, status] = head.slice(1).split(' ')
+      if (status === 'M' && src === dst && /^0+$/.test(worktree!) && src !== '160000')
+        unread.push({ rel, oid: oid!, link: src === '120000' })
+    }
+  }
+  if (unread.length === 0) return { paths, gitlinks, links }
+  const same = await statOnly(workspaceRoot, unread)
+  return { paths: paths.filter((p) => !same.has(p)), gitlinks, links }
+}
+
+/**
+ * Of the paths the diff listed as modified in the working tree, those
+ * whose content is still the base's blob: the working-tree side is hashed
+ * as `git add` would (filters, a link's target), so only a stat changed.
+ */
+async function statOnly(
+  workspaceRoot: string,
+  unread: readonly { rel: string; oid: string; link: boolean }[],
+): Promise<Set<string>> {
+  const same = new Set<string>()
+  const files: { rel: string; oid: string }[] = []
+  for (const u of unread) {
+    if (!u.link) {
+      // `--stdin-paths` reads a line and unquotes a leading `"`; the
+      // decoder replaced a byte that was not UTF-8. Such a path stays listed.
+      if (!/[\n\uFFFD]/.test(u.rel) && !u.rel.startsWith('"')) files.push(u)
+      continue
+    }
+    try {
+      const target = await readlink(path.join(workspaceRoot, u.rel), 'buffer')
+      const hasher = new Bun.CryptoHasher(u.oid.length === 64 ? 'sha256' : 'sha1')
+      hasher.update(`blob ${target.length}\0`)
+      hasher.update(target)
+      if (hasher.digest('hex') === u.oid) same.add(u.rel)
+    } catch {
+      // not a link any more: a change
+    }
   }
-  return { paths, gitlinks }
+  if (files.length === 0) return same
+  const proc = spawnGit(
+    ['hash-object', '--stdin-paths'],
+    workspaceRoot,
+    new TextEncoder().encode(files.map((f) => `${f.rel}\n`).join('')),
+  )
+  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  if (exit !== 0) return same
+  const oids = out.split('\n')
+  files.forEach((f, i) => {
+    if (oids[i] === f.oid) same.add(f.rel)
+  })
+  return same
+}
+
+/** A remote that serves missing objects on demand: `--filter` on a clone or a fetch. */
+async function isPartialClone(workspaceRoot: string): Promise<boolean> {
+  const proc = spawnGit(
+    ['config', '--get-regexp', String.raw`^(remote\..*\.promisor|extensions\.partialclone)$`],
+    workspaceRoot,
+  )
+  const [out] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  return out.split('\n').some((l) => l.startsWith('extensions.') || l.endsWith(' true'))
 }
 
 /**
  * The base a bare `--affected` compares with: the merge base of HEAD and
  * the base branch (`origin/<baseBranch>`, or the local branch in a clone
  * with no remote; its tip when they share no history). On the base branch
- * itself there is none (owner, 2026-10-17): what a push to main changed
+ * itself there is none (2026-10-17): what a push to main changed
  * is the last good commit's to say (`--affected=<sha>`), and `HEAD~1`
  * guessed it wrong after any multi-commit push.
  */
 export async function defaultAffectedBase(
   workspaceRoot: string,
   baseBranch: string | undefined,
+  /** The verb's way to take every project instead: `vx show` has no `--all`. */
+  instead = 'run --all (the cache skips what did not change)',
 ): Promise<string> {
-  const found = await baseBranchRef(workspaceRoot, baseBranch)
+  const found =
+    (await baseBranchRef(workspaceRoot, baseBranch)) ??
+    (await fetchBaseBranch(workspaceRoot, baseBranch))
   if (found === undefined) {
     const noHistory = noHistoryRefusal(workspaceRoot)
     if (noHistory !== undefined) throw noHistory
     throw new UserError(
       `--affected has no base here: ${baseBranch === undefined ? 'no origin/HEAD, main or master' : `no ${baseBranch} or origin/${baseBranch}`} ` +
-        'to compare with — a shallow clone? Fetch history (actions/checkout: fetch-depth: 0), ' +
-        'set `baseBranch`, or name the base: --affected=origin/main',
+        'to compare with: set `baseBranch`, or name the base: --affected=origin/main',
       'VX_E_AFFECTED_BASE',
     )
   }
+  // A detached HEAD (a CI checkout of a pushed commit) is on the base
+  // branch when the branch holds it: the base was HEAD, or a commit after
+  // it, and nothing ran, green.
+  if (!found.onIt && found.detached && (await isAncestor(workspaceRoot, 'HEAD', found.ref))) {
+    found.onIt = true
+  }
   if (found.onIt) {
     throw new UserError(
-      `--affected has no default on the base branch (${found.branch}): name the last good commit, --affected=<sha>`,
+      `--affected has no default on the base branch (${found.branch}): ${instead}, or name the last good commit, --affected=<sha>`,
       'VX_E_AFFECTED_BASE',
     )
   }
@@ -749,7 +1114,7 @@ function noHistoryRefusal(workspaceRoot: string): UserError | undefined {
 async function baseBranchRef(
   workspaceRoot: string,
   configured: string | undefined,
-): Promise<{ ref: string; branch: string; onIt: boolean } | undefined> {
+): Promise<{ ref: string; branch: string; onIt: boolean; detached: boolean } | undefined> {
   const text = async (args: string[]): Promise<string> => {
     const proc = spawnGit(args, workspaceRoot)
     const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
@@ -772,7 +1137,12 @@ async function baseBranchRef(
     text(['symbolic-ref', '--short', '-q', 'HEAD']),
   ])
   const have = new Set(refs.split('\n'))
-  const at = (branch: string, ref: string) => ({ ref, branch, onIt: head === branch })
+  const at = (branch: string, ref: string) => ({
+    ref,
+    branch,
+    onIt: head === branch,
+    detached: head === '',
+  })
   if (remoteHead.startsWith('origin/') && have.has(remoteHead)) {
     return at(remoteHead.slice('origin/'.length), remoteHead)
   }
@@ -782,13 +1152,15 @@ async function baseBranchRef(
 }
 
 /**
- * Does `ref` name the commit HEAD is on? A base that IS HEAD can never
- * mark anything affected — the shape of a single-branch clone whose
- * `origin/HEAD` is the branch under test.
+ * The base `ref` names (`<base>...HEAD` reads as `<base>`, as
+ * `affectedChanges` reads it) when it is the commit HEAD is on, else
+ * undefined. A base that IS HEAD can never mark anything affected — the
+ * shape of a single-branch clone whose `origin/HEAD` is the branch under test.
  */
-export function refIsHead(workspaceRoot: string, ref: string): boolean {
+export function headBase(workspaceRoot: string, ref: string): string | undefined {
   const head = revParse(workspaceRoot, 'HEAD')
-  return head !== undefined && head === revParse(workspaceRoot, ref)
+  const base = HEAD_RANGE.exec(ref)?.[1] ?? ref
+  return head !== undefined && head === revParse(workspaceRoot, base) ? base : undefined
 }
 
 /** The commit `ref` names, or undefined when it does not resolve here. */
@@ -826,15 +1198,37 @@ async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
   // which the default base's search already resolved (`HEAD~1`).
   const known = HEAD_ANCESTOR.test(ref) ? resolvedRefs.get(`${workspaceRoot}\0${ref}`) : undefined
   if (known !== undefined) return known
-  const proc = spawnGit(['merge-base', '--end-of-options', ref, 'HEAD'], workspaceRoot)
-  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
-  const sha = out.trim()
-  if (exit === 0 && sha.length > 0) return sha
+  const sha = await gitMergeBase(workspaceRoot, ref)
+  if (sha !== undefined) return sha
+  const reached = await reachMergeBase(workspaceRoot, ref)
+  if (reached !== undefined) return reached
+  await verifyTreeRef(workspaceRoot, ref)
+  // The ref itself is the base only for histories that share nothing. A
+  // shallow clone may just lack the commits between them (origin gone, a
+  // fetch failed, past MAX_DEEPEN), and its tip selected what the base
+  // branch changed.
+  if (
+    revParse(workspaceRoot, ref) !== undefined &&
+    revParse(workspaceRoot, 'HEAD') !== undefined &&
+    isShallow(workspaceRoot)
+  ) {
+    throw new UserError(
+      `git ref "${ref}" has no merge base with HEAD in this shallow clone, and origin did not ` +
+        'give the history between them: fetch it (`git fetch --unshallow origin`).',
+      'VX_E_AFFECTED_BASE',
+    )
+  }
+  return ref
+}
+
+/**
+ * `verifyRef`, then refuse `<rev>:<path>`: it names the tree (or blob) at
+ * <path>, and diffed against the working tree its paths miss the <path>/
+ * prefix, so `develop:pkgs` selected projects nothing had changed, green.
+ * A root tree (`develop^{tree}`, the empty tree) diffs right and stays a base.
+ */
+async function verifyTreeRef(workspaceRoot: string, ref: string): Promise<void> {
   await verifyRef(workspaceRoot, ref)
-  // `<rev>:<path>` names the tree (or blob) at <path>: diffed against the
-  // working tree, its paths miss the <path>/ prefix, and `develop:pkgs`
-  // selected projects nothing had changed, green. A root tree
-  // (`develop^{tree}`, the empty tree) diffs right and stays a base.
   const sub = /^([^:]*):(?!\/)(.+)$/s.exec(ref)
   if (sub !== null) {
     throw new UserError(
@@ -843,9 +1237,201 @@ async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
       'VX_E_AFFECTED_BASE',
     )
   }
+}
+
+/**
+ * The merge base of `ref` and HEAD, or undefined when there is none. A
+ * shallow clone fetches what it needs from origin (`reachMergeBase`):
+ * a plugin reading the base branch's history (shared timings) asks this,
+ * not `git merge-base`, so a one-commit checkout serves it too.
+ */
+export async function mergeBaseWith(
+  workspaceRoot: string,
+  ref: string,
+): Promise<string | undefined> {
+  return (await gitMergeBase(workspaceRoot, ref)) ?? (await reachMergeBase(workspaceRoot, ref))
+}
+
+/** Whether `commit` is `ref` or one of its ancestors. */
+async function isAncestor(workspaceRoot: string, commit: string, ref: string): Promise<boolean> {
+  const proc = spawnGit(
+    ['merge-base', '--is-ancestor', '--end-of-options', commit, ref],
+    workspaceRoot,
+  )
+  return (await proc.exited) === 0
+}
+
+async function gitMergeBase(workspaceRoot: string, ref: string): Promise<string | undefined> {
+  const proc = spawnGit(['merge-base', '--end-of-options', ref, 'HEAD'], workspaceRoot)
+  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  const sha = out.trim()
+  return exit === 0 && sha.length > 0 ? sha : undefined
+}
+
+/**
+ * A shallow clone (CI's checkout fetches one commit) lacks the base, or
+ * the history between it and HEAD: this fetches from origin what the
+ * merge base needs and nothing more (2026-10-24: "we only need
+ * current commit and branch out commit"). The base's tip at depth 1, then
+ * both tips deepened 1, 2, 4… commits until git finds the merge base;
+ * commits and trees only, as `--name-only` reads no blob. A pull request's
+ * merge checkout has its base as HEAD's parent, so it needs one fetch.
+ * Undefined when the clone is whole, has no origin, or the fetch failed.
+ */
+async function reachMergeBase(workspaceRoot: string, ref: string): Promise<string | undefined> {
+  if (!isShallow(workspaceRoot)) return undefined
+  const head = revParse(workspaceRoot, 'HEAD')
+  if (head === undefined) return undefined
+  const ancestor = HEAD_ANCESTOR.test(ref)
+  let tip = ancestor ? undefined : revParse(workspaceRoot, ref)
+  if (tip === undefined && !ancestor) {
+    tip = await fetchTip(workspaceRoot, ref)
+    if (tip === undefined) return undefined
+  }
+  if (tip !== undefined && parentsOf(workspaceRoot, head).includes(tip)) return tip
+  for (let depth = 1; depth <= MAX_DEEPEN; depth *= 2) {
+    const tips = tip === undefined ? [head] : [head, tip]
+    if (!(await fetchOrigin(workspaceRoot, [`--deepen=${depth}`, ...tips]))) return undefined
+    // `HEAD~2` is its own merge base with HEAD, once the history has it.
+    if (ancestor) {
+      const at = revParse(workspaceRoot, ref)
+      if (at !== undefined) return at
+    } else {
+      const found = await gitMergeBase(workspaceRoot, tip!)
+      if (found !== undefined) return found
+    }
+    if (!isShallow(workspaceRoot)) return undefined
+  }
+  return undefined
+}
+
+/** `ref`'s commit fetched from origin at depth 1, or undefined when origin cannot name it. */
+async function fetchTip(workspaceRoot: string, ref: string): Promise<string | undefined> {
+  const spec = originSpec(ref)
+  if (spec === undefined || !(await fetchOrigin(workspaceRoot, ['--depth=1', spec]))) {
+    return undefined
+  }
+  return revParse(workspaceRoot, ref)
+}
+
+/**
+ * The base of a two-dot `<ref>..HEAD`: `ref` itself, which a shallow clone
+ * fetches as the three-dot form fetches its tip (CI's depth-1 checkout
+ * refused `origin/main..HEAD` while `origin/main...HEAD` worked). HEAD's
+ * own ancestor is its merge base with HEAD, reached by deepening.
+ */
+async function rangeBase(workspaceRoot: string, ref: string): Promise<string> {
+  if (HEAD_ANCESTOR.test(ref)) return mergeBase(workspaceRoot, ref)
+  if (revParse(workspaceRoot, ref) === undefined && isShallow(workspaceRoot)) {
+    await fetchTip(workspaceRoot, ref)
+  }
+  await verifyTreeRef(workspaceRoot, ref)
   return ref
 }
 
+/** The clones `fetchOrigin` fetched into, so made partial: `isPartialClone` may have answered first. */
+const fetchedInto = new Set<string>()
+
+/** Deepening stops here (2,047 commits on each side): past it, the base is the user's to fetch. */
+const MAX_DEEPEN = 1024
+
+function isShallow(workspaceRoot: string): boolean {
+  const proc = spawnGitSync(['rev-parse', '--is-shallow-repository'], workspaceRoot, 'ignore')
+  return new TextDecoder().decode(proc.stdout).trim() === 'true'
+}
+
+/** The parents a commit names, even where a shallow clone cut them off. */
+function parentsOf(workspaceRoot: string, sha: string): string[] {
+  const proc = spawnGitSync(
+    ['cat-file', '--end-of-options', 'commit', sha],
+    workspaceRoot,
+    'ignore',
+  )
+  const out: string[] = []
+  for (const line of new TextDecoder().decode(proc.stdout).split('\n')) {
+    if (line === '') break
+    if (line.startsWith('parent ')) out.push(line.slice('parent '.length))
+  }
+  return out
+}
+
+/**
+ * What to ask origin for a base: a commit id as it is (GitHub serves any
+ * commit a ref reaches), `origin/<branch>` as that branch into its
+ * remote-tracking ref, any other plain name as origin's tag of that name
+ * (a release base, `v1`; `--no-tags` fetched none). An expression (`v1~2`)
+ * is a name only this clone knows.
+ */
+function originSpec(ref: string): string | undefined {
+  if (/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(ref)) return ref
+  const branch = /^(?:refs\/remotes\/)?origin\/(.+)$/s.exec(ref)?.[1]
+  if (branch !== undefined) {
+    return branch === 'HEAD' ? undefined : `+refs/heads/${branch}:refs/remotes/origin/${branch}`
+  }
+  const tag = /^(?:refs\/tags\/)?([^\s~^:?*[\\@{]+)$/.exec(ref)?.[1]
+  if (tag === undefined || tag === 'HEAD' || tag.startsWith('refs/')) return undefined
+  return `+refs/tags/${tag}:refs/tags/${tag}`
+}
+
+/**
+ * A shallow clone with no base branch at all (a CI checkout of one
+ * commit): fetch it from origin at depth 1, the configured one or
+ * origin's default.
+ */
+async function fetchBaseBranch(
+  workspaceRoot: string,
+  configured: string | undefined,
+): Promise<{ ref: string; branch: string; onIt: boolean; detached: boolean } | undefined> {
+  if (!isShallow(workspaceRoot)) return undefined
+  const branch = configured ?? (await originDefaultBranch(workspaceRoot))
+  if (branch === undefined) return undefined
+  const spec = `+refs/heads/${branch}:refs/remotes/origin/${branch}`
+  if (!(await fetchOrigin(workspaceRoot, ['--depth=1', spec]))) return undefined
+  const proc = spawnGitSync(['symbolic-ref', '--short', '-q', 'HEAD'], workspaceRoot, 'ignore')
+  const head = new TextDecoder().decode(proc.stdout).trim()
+  return { ref: `origin/${branch}`, branch, onIt: head === branch, detached: head === '' }
+}
+
+/** The branch origin's HEAD names, asked of origin (a one-commit checkout has no `origin/HEAD`). */
+async function originDefaultBranch(workspaceRoot: string): Promise<string | undefined> {
+  const proc = spawnGit(['ls-remote', '--symref', 'origin', 'HEAD'], workspaceRoot)
+  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  if (exit !== 0) return undefined
+  return /^ref: refs\/heads\/(\S+)\tHEAD$/m.exec(out)?.[1]
+}
+
+/**
+ * `git fetch` from origin into a shallow clone, without blobs: the diff
+ * names paths, and the lockfile a claim reads at the base is fetched on
+ * demand. Never prompts for credentials; false when it failed.
+ */
+async function fetchOrigin(workspaceRoot: string, args: string[]): Promise<boolean> {
+  try {
+    const proc = Bun.spawn({
+      cmd: [
+        executablePath('git'),
+        'fetch',
+        '--quiet',
+        '--no-tags',
+        '--no-recurse-submodules',
+        '--filter=blob:none',
+        'origin',
+        ...args,
+      ],
+      env: { ...gitEnv(), GIT_TERMINAL_PROMPT: '0' },
+      cwd: workspaceRoot,
+      stdin: 'ignore',
+      stdout: 'ignore',
+      stderr: 'ignore',
+    })
+    fetchedInto.add(workspaceRoot)
+    return (await proc.exited) === 0
+  } catch (err) {
+    if (isExecutableMissing(err)) throw gitSpawnRefusal(workspaceRoot)
+    throw err
+  }
+}
+
 async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   if (resolvedRefs.has(`${workspaceRoot}\0${ref}`)) return
   const proc = spawnGitSync(
@@ -863,20 +1449,37 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   if (proc.exitCode !== 1) {
     const noHistory = noHistoryRefusal(workspaceRoot)
     if (noHistory !== undefined) throw noHistory
+    // `--quiet` also silences a ref git refused in its own words (a reflog
+    // entry the log lacks, `main@{9}`: exit 128): ask again to say why.
+    if (stderr.length === 0) {
+      const loud = spawnGitSync(
+        ['rev-parse', '--verify', '--end-of-options', ref],
+        workspaceRoot,
+        'pipe',
+      )
+      const why = new TextDecoder()
+        .decode(loud.stderr)
+        .trim()
+        .replace(/^fatal: /, '')
+      if (loud.exitCode !== 0 && why.length > 0) {
+        throw new UserError(
+          `git ref "${ref}" did not resolve: ${why.replace(/\.?$/, '.')}`,
+          'VX_E_AFFECTED_BASE',
+        )
+      }
+    }
     throw new UserError(
       `git rev-parse failed (exit ${proc.exitCode}) in ${workspaceRoot}` +
         (stderr.length > 0 ? `: ${stderr}` : ''),
       'VX_E_GIT',
     )
   }
-  // A shallow clone (CI's checkout fetches one commit by default) has no
-  // HEAD~1 and no base branch: the ref exists, the history does not.
-  const shallow = spawnGitSync(['rev-parse', '--is-shallow-repository'], workspaceRoot, 'pipe')
-  const isShallow = new TextDecoder().decode(shallow.stdout).trim() === 'true'
+  // A shallow clone whose base origin could not give (`reachMergeBase`):
+  // no origin, no network, a name only another clone has.
   throw new UserError(
     `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.` +
-      (isShallow
-        ? ' This clone is shallow: fetch the history the base needs (`git fetch --unshallow`, or `fetch-depth: 0` on actions/checkout).'
+      (isShallow(workspaceRoot)
+        ? ' This clone is shallow and origin did not give it: fetch the base (`git fetch --depth=1 origin <base>`).'
         : ''),
     'VX_E_AFFECTED_BASE',
   )
@@ -890,7 +1493,7 @@ function projectsContaining(
   projects: readonly ProjectMeta[],
   realDirs: ReadonlyMap<string, string>,
   /** Told each owned path relative to its project, and each nested repository's projects. */
-  on?: { path(name: string, rel: string): void; repo(name: string): void },
+  on?: { path(name: string, rel: string, wsRel: string): void; repo(name: string): void },
 ): Set<string> {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
@@ -924,7 +1527,7 @@ function projectsContaining(
       const name = dirToName.get(dir)
       if (name !== undefined) {
         owned.add(name)
-        on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')))
+        on?.path(name, relPosix(dir, path.resolve(workspaceRoot, rel).normalize('NFC')), rel)
         // Its files are the project's inputs, and none of them is this
         // path: a task's globs cannot say whether they reach inside.
         if (repo) on?.repo(name)