@vzn/vx 0.0.646 → 0.0.649

package/src/workspace/project-loader.ts

@@ -1,7 +1,7 @@
-import { existsSync, realpathSync, statSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import type { ProjectConfig, WorkspaceConfig } from '../config.js'
-import { UserError, xxh3hex } from '../util/index.js'
+import { isUserError, UserError, xxh3hex } from '../util/index.js'
 import { isSkippedPlugin, validateProjectConfig, validateWorkspace } from './config-schema.js'
 import {
   beginEvalRound,
@@ -24,7 +24,7 @@ export { validateProjectConfig }
 import { WORKSPACE_CONFIG_FILENAMES, workspaceFile, workspaceRootOf } from '../handoff.js'
 export { WORKSPACE_CONFIG_FILENAMES }
 
-/** What a function default export is told; the playground says the same. */
+/** What a function default export is told. */
 const EXPORTED_A_FUNCTION =
   'it exports a function, and vx reads the object itself — export what the function returns'
 
@@ -92,19 +92,72 @@ function serveHeldSources(): void {
         contents: heldSources.get(HELD_QUERY.exec(args.path)![1]!)!.source,
         loader: /\.[cm]?ts\?/.test(args.path) ? 'ts' : 'js',
       }))
+      build.onLoad({ filter: PLAIN_CONFIG }, (args) => {
+        const loader = /\.[cm]?ts$/.test(args.path) ? 'ts' : 'js'
+        const held = heldPaths.get(args.path) ?? heldByRealPath(args.path)
+        if (held !== undefined) {
+          held.served = true
+          return { contents: heldSources.get(held.hash)!.source, loader }
+        }
+        // A config no load holds now, imported by another module. `onLoad`
+        // cannot decline it, so it is served as Bun reads it, and what
+        // `onLoad` cannot carry (CommonJS, not UTF-8) is Bun's own load.
+        const bytes = readFileSync(args.path)
+        const source = servableSource(bytes, loader)
+        if (source !== null) return { contents: source, loader }
+        const native = JSON.stringify(`${args.path}?vx-bust=${xxh3hex(bytes)}`)
+        return {
+          contents: `import * as m from ${native}\nexport * from ${native}\nexport default m.default\n`,
+          loader: 'js',
+        }
+      })
     },
   })
 }
 
-function holdSource(hash: string, source: string): void {
+function holdSource(hash: string, source: string, plain: Held | null, configPath: string): void {
   const held = heldSources.get(hash)
   if (held === undefined) heldSources.set(hash, { source, uses: 1 })
   else held.uses++
+  if (plain !== null) heldPaths.set(configPath, plain)
 }
 
-function releaseSource(hash: string): void {
+function releaseSource(hash: string, plain: Held | null, configPath: string): void {
   const held = heldSources.get(hash)!
   if (--held.uses === 0) heldSources.delete(hash)
+  if (plain !== null) heldPaths.delete(configPath)
+}
+
+// Served under `?vx-held=`, a config was a second module beside the plain
+// path an import cycle reaches back to, and its `import.meta.url` carried
+// the query, unlike the worker's. So it is imported under its own path,
+// and `served` says whether this load's bytes were what Bun evaluated:
+// unset, the registry held the path already (a config another imported,
+// maybe older bytes), and only a query evaluates afresh.
+interface Held {
+  hash: string
+  served: boolean
+  /** Learned only when `onLoad` misses: Bun hands it the real path. */
+  real?: string | null
+}
+const heldPaths = new Map<string, Held>()
+
+const PLAIN_CONFIG = /[\\/]vx\.config\.[cm]?[jt]s$/
+
+// A realpath for every config was 7–10 ms on 1,000 (2026-10-28); only a
+// path reached through a link misses, so only a miss pays it.
+function heldByRealPath(real: string): Held | undefined {
+  for (const [configPath, held] of heldPaths) {
+    if (held.real === undefined) {
+      try {
+        held.real = realpathSync(configPath)
+      } catch {
+        held.real = null
+      }
+    }
+    if (held.real === real) return held
+  }
+  return undefined
 }
 
 const utf8 = new TextDecoder('utf-8', { fatal: true })
@@ -145,8 +198,11 @@ async function loadDefaultExport(
   bytes: Uint8Array,
   /** The workspace root, where the load may run the config's bytecode bundle (config-bytecode.ts). */
   compiledRoot?: string,
+  /** File texts read for the refusal, kept across one load's configs. */
+  reads = new Map<string, Promise<string>>(),
 ): Promise<unknown> {
-  refuseUnprovidedImports(bytes, configPath, kind)
+  const text = new TextDecoder().decode(bytes)
+  refuseUnprovided(text, configPath, configPath, kind)
   // No random bust for `vx lock`: a project config reaches this import
   // only on its FIRST load in the process, so nothing is cached under the
   // URL yet, and a repeat load (the one that could replay an evaluation
@@ -163,10 +219,12 @@ async function loadDefaultExport(
     )
   }
   const hash = xxh3hex(bytes)
+  const plain: Held | null =
+    source !== null && !literal && PLAIN_CONFIG.test(configPath) ? { hash, served: false } : null
   const specifier = `${configPath}?vx-${literal ? 'literal' : source !== null ? 'held' : 'bust'}=${hash}`
   if (source !== null) {
     serveHeldSources()
-    holdSource(hash, source)
+    holdSource(hash, source, plain, configPath)
   }
   let ns: { default?: unknown }
   let compiled: { default?: unknown } | null | undefined
@@ -178,14 +236,26 @@ async function loadDefaultExport(
     // the user sees is the source's.
     compiled =
       literal || compiledRoot === undefined ? null : tryCompiled(compiledRoot, configPath, bytes)
-    if (compiled) return defaultOf(compiled, kind, configPath)
+    // Awaited here: a default that is a rejected Promise is the config's
+    // throw too, and passed out unawaited it reached bin.ts as a vx
+    // defect (2026-10-28).
+    if (compiled) return await defaultOf(compiled, kind, configPath)
     if (compiled === undefined) loaded = loadedModules(compiledRoot!)
     // The worker's budget, here too: a top-level await that never settled
     // while a timer kept the loop alive hung `vx run` for good, silently
     // (D-66).
+    await refuseUnprovidedClosure(text, configPath, kind, reads)
     const budget = evalBudgetMs()
     ns = (await Promise.race([
-      import(specifier),
+      plain === null
+        ? import(specifier)
+        : import(configPath).then(
+            (ns: unknown) => (plain.served ? ns : import(specifier)),
+            (err: unknown) => {
+              if (plain.served) throw err
+              return import(specifier)
+            },
+          ),
       new Promise<never>((_, reject) => {
         deadline = setTimeout(
           () =>
@@ -200,20 +270,27 @@ async function loadDefaultExport(
     ])) as { default?: unknown }
   } catch (err) {
     // A served module's frames name its specifier; the user wrote the path.
-    if (err instanceof Error && err.stack !== undefined) {
-      err.stack = err.stack.replaceAll(specifier, configPath).replace(BUST_QUERY, '')
+    const seen = new Set<unknown>()
+    for (let e: unknown = err; e instanceof Error && !seen.has(e); e = e.cause) {
+      seen.add(e)
+      if (e.stack !== undefined)
+        e.stack = e.stack.replaceAll(specifier, configPath).replace(BUST_QUERY, '')
     }
     throw loadFailure(err, configPath, kind)
   } finally {
     clearTimeout(deadline)
     unguard()
-    if (source !== null) releaseSource(hash)
+    if (source !== null) releaseSource(hash, plain, configPath)
   }
   const mod = defaultOf(ns, kind, configPath)
   if (compiledRoot !== undefined && loaded !== undefined) {
     await buildCompiled(compiledRoot, configPath, bytes, loaded, ns)
   }
-  return mod
+  try {
+    return await mod
+  } catch (err) {
+    throw loadFailure(err, configPath, kind)
+  }
 }
 
 function defaultOf(ns: { default?: unknown }, kind: string, configPath: string): unknown {
@@ -270,29 +347,60 @@ function pnpAbove(dir: string): boolean {
  * evaluation: left to Bun, a workspace with no `node_modules` would have
  * the package auto-installed from the registry first (config-imports.ts),
  * and a config must never download. The message keeps the shape Bun's own
- * refusal has, with the remedy.
+ * refusal has, with the remedy. `source` is `file`'s: the config's own,
+ * or one it reaches.
  */
-function refuseUnprovidedImports(bytes: Uint8Array, configPath: string, kind: string): void {
-  const loader = /\.[cm]?ts$/.test(configPath) ? 'ts' : 'js'
-  const missing = unprovidedBareImports(
-    new TextDecoder().decode(bytes),
-    path.dirname(configPath),
-    loader,
-  )
+function refuseUnprovided(source: string, file: string, configPath: string, kind: string): void {
+  const loader = /\.[cm]?tsx?$/.test(file) ? 'ts' : 'js'
+  const missing = unprovidedBareImports(source, path.dirname(file), loader)
   if (missing.length === 0) return
+  const own = file === configPath
+  const what = own
+    ? `cannot find '${missing[0]}'`
+    : `${file} imports '${missing[0]}', which no node_modules above it provides`
   // Under Yarn Plug'n'Play the dependencies ARE installed, into a
   // `.pnp.cjs` Bun does not read: "install them first" sent the user to a
   // `yarn install` that changed nothing (D-109).
-  if (pnpAbove(path.dirname(configPath))) {
+  if (pnpAbove(path.dirname(file))) {
     throw new UserError(
-      `${kind} config ${configPath}: cannot find '${missing[0]}' — Yarn Plug'n'Play installed the workspace's dependencies into .pnp.cjs, which Bun does not read; set \`nodeLinker: node-modules\` in .yarnrc.yml and run \`yarn install\``,
+      `${kind} config ${configPath}: ${what} — Yarn Plug'n'Play installed the workspace's dependencies into .pnp.cjs, which Bun does not read; set \`nodeLinker: node-modules\` in .yarnrc.yml and run \`yarn install\``,
     )
   }
   throw new UserError(
-    `${kind} config ${configPath}: cannot find '${missing[0]}' — no node_modules above the config provides it; install the workspace's dependencies first`,
+    `${kind} config ${configPath}: ${what}${own ? ' — no node_modules above the config provides it' : ''}; install the workspace's dependencies first`,
   )
 }
 
+const RELATIVE_IMPORT = /["']\.\.?\//
+const SCRIPT = /\.[cm]?[jt]sx?$/
+
+/**
+ * The same refusal for each script the config reaches by relative import:
+ * a preset's bare import was installed and run where the config's own was
+ * refused (L-22; `--no-install` holds only the shebang, not `bun src/bin.ts`
+ * or an embedder). Only a source evaluation pays: a fresh bundle resolved
+ * every import it holds. `reads` keeps each file's text for the load's other
+ * configs: a preset a thousand configs share is read once.
+ */
+async function refuseUnprovidedClosure(
+  source: string,
+  configPath: string,
+  kind: string,
+  reads: Map<string, Promise<string>>,
+): Promise<void> {
+  if (!RELATIVE_IMPORT.test(source)) return
+  const read = (file: string): Promise<string> => {
+    let text = reads.get(file)
+    if (text === undefined) reads.set(file, (text = Bun.file(file).text()))
+    return text
+  }
+  for (const file of await configImports(configPath, source, read)) {
+    if (!SCRIPT.test(file)) continue
+    const text = await read(file).catch(() => null)
+    if (text !== null) refuseUnprovided(text, file, configPath, kind)
+  }
+}
+
 /**
  * Where a transpile error was found. Bun's `BuildMessage` carries it as
  * `position`; the config worker forwards the same three fields (see
@@ -374,16 +482,87 @@ export function configLoadError(err: unknown, configPath: string, kind: string):
   return null
 }
 
-/** What a failed load throws: Bun's own errors and non-Error throws as user errors, the rest as thrown. */
+/**
+ * What a failed load throws: always a user error. A config's own throw, or
+ * a plugin factory's it called, is the config's to fix, not a vx defect:
+ * passed through, it printed a stack under VX_E_INTERNAL, whose fix is to
+ * report a vx bug (2026-10-28). Its line stands in for the stack.
+ */
 function loadFailure(err: unknown, configPath: string, kind: string): unknown {
   const user = configLoadError(err, configPath, kind)
   if (user !== null) return user
+  if (isUserError(err)) return err
   if (err !== null && typeof err === 'object' && typeof (err as Error).message === 'string') {
-    return err
+    const user = new UserError(
+      `${kind} config ${configPath} threw: ${thrownLine(err as Error, configPath)}${causeLines(err as Error, configPath)}`,
+      'VX_E_CONFIG',
+    )
+    // The thrown error, stack and all, for an embedder of the loader.
+    user.cause = err
+    return user
   }
   return new UserError(thrownValueMessage(kind, configPath, Bun.inspect(err, { compact: true })))
 }
 
+const VX_SRC = `${path.resolve(import.meta.dir, '..')}${path.sep}`
+
+/** A thrown error's message and where it was thrown. */
+function thrownLine(err: Error, configPath: string): string {
+  const stack = String(err.stack ?? '')
+  // A cause rebuilt from the config worker carries its stack alone.
+  const message =
+    err.message !== ''
+      ? err.message
+      : (/^[\w$.]+: (.*)$/.exec(stack.split('\n')[0] ?? '')?.[1] ?? stack.split('\n')[0] ?? '')
+  const at = throwSite(stack, configPath)
+  return `${message}${at === undefined ? '' : ` (at ${at})`}`
+}
+
+/**
+ * Each `cause` under a wrapped throw (`new Error(msg, { cause })`), which
+ * holds the reason the wrapper names only in its own words. Bounded, and a
+ * cause seen before ends the chain.
+ */
+function causeLines(err: Error, configPath: string): string {
+  let out = ''
+  const seen = new Set<unknown>([err])
+  for (
+    let c = err.cause, depth = 0;
+    c !== undefined && c !== null && !seen.has(c) && depth < 8;
+    c = c instanceof Error ? c.cause : undefined, depth++
+  ) {
+    seen.add(c)
+    out += `; caused by: ${c instanceof Error ? thrownLine(c, configPath) : Bun.inspect(c, { compact: true })}`
+  }
+  return out
+}
+
+/**
+ * Where a throw came from: its first frame that names a file, and the
+ * config's own line that led there when that is another.
+ */
+function throwSite(stack: string, configPath: string): string | undefined {
+  // vx's own frames (the process.exit guard) are not where the config went wrong.
+  const sites = [...stack.matchAll(/^\s+at (?:.*\()?(\/[^()\n]+:\d+:\d+)\)?$/gm)]
+    .map((m) => m[1]!.replace(BUST_QUERY, ''))
+    .filter((s) => !s.startsWith(VX_SRC))
+  const own = sites.find((s) => s.startsWith(`${configPath}:`))
+  if (sites[0] === undefined || own === undefined || own === sites[0]) return sites[0] ?? own
+  return `${sites[0]}, from ${own}`
+}
+
+/**
+ * More than one config refused in one load: the first is the error, and
+ * `all` names each. A rename after an upgrade refuses every config at once,
+ * and naming one a run made a 200-config repo take 200 runs.
+ */
+export class ConfigsRefused extends UserError {
+  constructor(readonly all: readonly UserError[]) {
+    super(all[0]!.message, all[0]!.code)
+    if (all[0]!.parts !== undefined) this.parts = all[0]!.parts
+  }
+}
+
 /**
  * Evaluate many configs at once: every file's bytes in parallel, then each
  * one evaluated (in the order given, so a failure names the first broken
@@ -409,6 +588,7 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
+  const reads = new Map<string, Promise<string>>()
   const loadOne = async (entry: (typeof prepared)[number]): Promise<ProjectConfig> => {
     const { configPath, bytes } = entry
     // A REPEAT load in this process re-evaluates in a worker, because the
@@ -416,12 +596,16 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
     // config-eval.ts. A FIRST load keeps the in-process import.
     const repeat = loadedConfigs.has(configPath)
     loadedConfigs.add(configPath)
-    if (repeat) refuseUnprovidedImports(bytes, configPath, 'Project')
+    if (repeat) {
+      const text = new TextDecoder().decode(bytes)
+      refuseUnprovided(text, configPath, configPath, 'Project')
+      await refuseUnprovidedClosure(text, configPath, 'Project', reads)
+    }
     const mod = repeat
       ? await evaluateConfigFresh(configPath).catch((err: unknown) => {
           throw loadFailure(err, configPath, 'Project')
         })
-      : await loadDefaultExport(configPath, 'Project', bytes)
+      : await loadDefaultExport(configPath, 'Project', bytes, undefined, reads)
     // Before anything reads through them: a replaced `Array.prototype.includes`
     // turned the JSON-data walk's own check into "a cyclic reference".
     const changed = repeat
@@ -513,7 +697,14 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
       }
       throw builtinsChanged(changedInRound)
     }
-    if (first !== undefined) throw first.failed
+    if (first !== undefined) {
+      const refused = results.flatMap((r) =>
+        'failed' in r && isUserError(r.failed) ? [r.failed] : [],
+      )
+      throw refused.length > 1 && refused[0] === first.failed
+        ? new ConfigsRefused(refused)
+        : first.failed
+    }
     // One load in the round, in the worker (a repeat load), is the one
     // that moved it: the worker no longer reads the umask to say so.
     if (changed.length > 0)
@@ -543,8 +734,7 @@ let undoRedirect = (): void => {}
 /**
  * Bun's own console, taken at load: the console a round finds may be a
  * constructed one (a plugin's verb may install its own), which has no
- * `Console`. The global's, not `node:console`'s: the playground bundles
- * this module for the browser, where that specifier is a stub.
+ * `Console`.
  */
 const bunConsole = globalThis.console as typeof console & { Console?: typeof console.Console }
 let stderrConsole: typeof console | undefined
@@ -634,9 +824,7 @@ function installRedirect(): () => void {
  */
 // `Bun` and `Bun.hash` are what vx itself runs on: `Bun.hash.xxHash3 = ()
 // => 7n` gave every task the key 00000000, and a changed command replayed
-// the old output (D-75). `Bun` is read by its identifier, not through
-// globalThis: the docs playground bundles this file with the identifier
-// rewritten to its shim, and a browser has no global `Bun`.
+// the old output (D-75).
 const WATCHED_BUILTINS: ReadonlyArray<readonly [string, object]> = WATCHED_BUILTIN_NAMES.map(
   (name) =>
     [
@@ -694,15 +882,18 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'Glob',
   'JSONC',
   'Subprocess',
+  'TOML',
   'Transpiler',
   'build',
   'color',
+  'connect',
   'deepEquals',
   'env',
   'file',
   'gunzipSync',
   'hash',
   'inspect',
+  'listen',
   'main',
   'nanoseconds',
   'pathToFileURL',
@@ -711,6 +902,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'resolveSync',
   'revision',
   'secrets',
+  'semver',
   'serve',
   'sleep',
   'sleepSync',
@@ -902,8 +1094,6 @@ function restoreEnv(before: Readonly<Record<string, string | undefined>>): strin
  * choice (D-120). Put back, and named as the change.
  */
 function restoreCwd(before: string): string[] {
-  // Through globalThis: the playground bundles this module, and its
-  // browser shim carries no free process global.
   const proc = globalThis.process
   if (before === '' || proc.cwd() === before) return []
   proc.chdir(before)
@@ -916,7 +1106,6 @@ function restoreCwd(before: string): string[] {
  * a user other than root could not read back (D-125). Put back, and named.
  */
 function currentUmask(): number {
-  // Through globalThis, as restoreCwd: the playground's shim has no umask.
   const proc = globalThis.process as { umask?: (mask?: number) => number }
   if (typeof proc.umask !== 'function') return -1
   // Bun reads it by setting 0 and putting it back (probed on 1.4.2: four

package/src/workspace/repo-id.ts

@@ -1,7 +1,7 @@
 // Which repository a workspace is, so its checkouts share one store under
 // `~/.vx/<id>` and other repositories keep theirs: Nx 23.2's
 // `~/.nx/<id>` (`utils/workspace-id.js`, `utils/git-utils.js`), ported
-// rule for rule (owner, 2026-10-06: "do exactly like nx"), minus the Nx
+// rule for rule (2026-10-06: "do exactly like nx"), minus the Nx
 // Cloud id. Read from the `.git` files; git is asked only when they cannot
 // settle it (no parseable remote, an `include`, an `insteadOf`).