@vzn/vx 0.0.650 → 0.0.652

package/src/ui/version-line.ts

@@ -0,0 +1,28 @@
+// `vx --version`'s one line, imported alone: the answer that loads nothing
+// else (the ui barrel costs ~20 ms, `node:tty` 17 ms). Painted as the
+// `status` component's verb and the info hue; piped, the same words a
+// script reads.
+
+import { fstatSync } from 'node:fs'
+
+function versionLine(version: string, where: string, on: boolean): string {
+  const sgr = (code: string, text: string): string => (on ? `\x1b[${code}m${text}\x1b[0m` : text)
+  return `${sgr('1', 'vx')} ${sgr('38;2;6;182;212', version)}${where === '' ? '' : sgr('2', where)}\n`
+}
+
+/**
+ * Write the line to stdout. Colour is decided here, not by `detectColors`:
+ * fd 1 as a character device is the TTY answer, and a CI's log is not
+ * painted for this one line. `Bun.stdout`, not `process.stdout`: the Node
+ * stream's first touch is ~7 ms, half of this verb (2026-10-02). A reader
+ * gone (EPIPE) is no failure of the line.
+ */
+export async function printVersion(version: string, where: string): Promise<void> {
+  const env = process.env
+  const on = env['NO_COLOR']
+    ? false
+    : env['FORCE_COLOR'] !== undefined
+      ? env['FORCE_COLOR'] !== '0' && env['FORCE_COLOR'] !== 'false'
+      : env['TERM'] !== 'dumb' && fstatSync(1).isCharacterDevice()
+  await Bun.write(Bun.stdout, versionLine(version, where, on)).catch(() => {})
+}

package/src/util/config-frame.ts

@@ -7,9 +7,11 @@
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
 
-// `<file>: tasks.<path>[:] …`, or a top-level `<file> has unknown field …`,
-// from a project's vx.config or the workspace's .vx/workspace.ts.
-const HEAD = /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (tasks\.[^\s:]+)(:?))? /
+// `<file>: tasks.<path>[:] …`, `<file>: \`<setting>\` …`, `<file>: task name "<name>" …`,
+// or a top-level `<file> has unknown field …`, from a project's vx.config
+// or the workspace's .vx/workspace.ts.
+const HEAD =
+  /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (?:(tasks\.[^\s:]+)(:?)|`([^`\n]+)`|task name ("(?:[^"\\\n]|\\.)*")))? /
 
 /**
  * The message with its file named at `line:col`, relative to `cwd`, and a
@@ -19,13 +21,36 @@ const HEAD = /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (task
 export function configErrorFrame(message: string, cwd: string): string | undefined {
   const head = HEAD.exec(message)
   if (head === null) return positionFrame(message, cwd)
-  const [, file, fieldPath, colon] = head as unknown as [string, string, string?, string?]
+  const [, file, tasksPath, colon, setting, taskName] = head as unknown as [
+    string,
+    string,
+    string?,
+    string?,
+    string?,
+    string?,
+  ]
   const rest = message.slice(head[0].length)
   // The field the refusal is about, past the path that leads to it:
   // `has unknown field "comand"`, or `tasks.build: \`cache\` is not allowed`.
-  const named =
-    colon === ':' ? /^`([^`]+)`/.exec(rest) : /^has (?:unknown )?field "([^"]+)"/.exec(rest)
-  const segments = [...(fieldPath?.split('.') ?? []), ...(named === null ? [] : [named[1]!])]
+  // A refused key is quoted: `tasks.b.exec.env.define: "A=B" is not …`.
+  const said =
+    colon === ':'
+      ? /^(?:`([^`]+)`|("(?:[^"\\\n]|\\.)*"))/.exec(rest)
+      : /^has (?:unknown )?field "([^"]+)"/.exec(rest)
+  const named = said === null ? null : [said[0], said[1] ?? JSON.parse(said[2]!)]
+  // `plugins[2].name`: an element of an array, framed at the element (a
+  // plugin is a call, so no key inside it is searched).
+  const element = setting === undefined ? null : /^([^[]+)\[(\d+)\]/.exec(setting)
+  const fieldPath =
+    taskName !== undefined
+      ? ['tasks', JSON.parse(taskName)]
+      : element !== null
+        ? element[1]!.split('.')
+        : (tasksPath ?? setting)?.split('.')
+  const segments = [
+    ...(fieldPath ?? []),
+    ...(named === null || element !== null ? [] : [named[1]!]),
+  ]
   if (segments.length === 0) return undefined
   let source: string
   try {
@@ -33,7 +58,7 @@ export function configErrorFrame(message: string, cwd: string): string | undefin
   } catch {
     return undefined
   }
-  const at = locate(source, segments)
+  const at = locate(source, segments, element === null ? undefined : Number(element[2]))
   if (at === undefined) return undefined
   return framed(file, source, at, message.slice(file.length), cwd)
 }
@@ -43,8 +68,70 @@ export function configErrorFrame(message: string, cwd: string): string | undefin
 const POSITION =
   /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s):(\d+):(\d+)(: [^]*)$/
 
+// The loader's `Project config <file> threw: <message> (at <file>:<line>:<col>)`:
+// the config's own throw, placed by its stack in the config itself.
+const THREW =
+  /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s) threw: ([^\n]*?) \(at (\/[^\n]*?):(\d+):(\d+)\)([^]*)$/
+
+// The loader's `<kind> config <file>: cannot find '<pkg>' …`: placed at the
+// specifier. And `<kind> config at <file> did not export a default object`:
+// at the `export default` that exported something else, when there is one.
+const UNPROVIDED =
+  /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s): (cannot find '([^'\n]+)'[^]*)$/
+const NOT_OBJECT =
+  /^(?:Project|Workspace) config at (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s) (did not export a default object[^]*)$/
+
+/** The file, the source offset `find` places in it, and what follows `<file>:<line>:<col>`. */
+function sourceFrame(
+  file: string,
+  find: (source: string) => number,
+  rest: string,
+  cwd: string,
+): string | undefined {
+  let source: string
+  try {
+    source = readFileSync(file, 'utf8')
+  } catch {
+    return undefined
+  }
+  const at = find(source)
+  if (at < 0) return undefined
+  const before = source.slice(0, at)
+  const line = before.split('\n').length
+  return framed(file, source, { line, col: at - before.lastIndexOf('\n') }, rest, cwd)
+}
+
 function positionFrame(message: string, cwd: string): string | undefined {
-  const pos = POSITION.exec(message)
+  const unprovided = UNPROVIDED.exec(message)
+  if (unprovided !== null) {
+    const [, file, said, pkg] = unprovided as unknown as [string, string, string, string]
+    const spec = new RegExp(
+      `(?<=\\b(?:from|import|import\\(|require\\()\\s*)(['"])${escapeRe(pkg)}\\1`,
+    )
+    return sourceFrame(file, (src) => spec.exec(src)?.index ?? -1, `: ${said}`, cwd)
+  }
+  const notObject = NOT_OBJECT.exec(message)
+  if (notObject !== null) {
+    const [, file, said] = notObject as unknown as [string, string, string]
+    return sourceFrame(
+      file,
+      (src) => /^export\s+default\b/m.exec(src)?.index ?? -1,
+      `: ${said}`,
+      cwd,
+    )
+  }
+  const threw = THREW.exec(message)
+  const pos =
+    threw !== null && threw[3] === threw[1]
+      ? [
+          threw[0],
+          threw[1],
+          threw[4],
+          threw[5],
+          // A cause's own `(at …)` names the same file: relative there too.
+          `: threw: ${threw[2]}${threw[6]!.replaceAll(threw[1]!, path.relative(cwd, threw[1]!))}`,
+        ]
+      : POSITION.exec(message)
   if (pos === null) return undefined
   const [, file, line, col, rest] = pos as unknown as [string, string, string, string, string]
   let source: string
@@ -86,37 +173,127 @@ function framed(
 
 /**
  * Where the last of `segments` is declared as a key, each one searched
- * after the one before. A task name holds dots (`lint.oxfmt`), so the
- * longest run of segments that names a key wins.
+ * inside the object literal the one before holds. A task name holds dots
+ * (`lint.oxfmt`), so the longest run of segments that names a key wins.
+ * A last segment the object leaves out (`outputs is required`) is placed
+ * at its parent: searched past it, the next task's `outputs` was framed.
  */
 function locate(
   source: string,
   segments: readonly string[],
+  /** The element of the array the last segment holds; past its end, the key. */
+  index?: number,
 ): { line: number; col: number } | undefined {
   let pos = 0
+  let end = source.length
   let found = -1
   let i = 0
   while (i < segments.length) {
     let next = -1
     for (let j = segments.length; j > i && next < 0; j--) {
       const name = segments.slice(i, j).join('.')
-      const re = new RegExp(`(?<![\\w$.])(['"\`]?)${escapeRe(name)}\\1\\s*:`, 'g')
+      // An empty key is quoted, or every `:` matched; a control character
+      // is in the source as its escape (`'\u001b'`).
+      const spelled = JSON.stringify(name).slice(1, -1)
+      const names = spelled === name ? escapeRe(name) : `${escapeRe(name)}|${escapeRe(spelled)}`
+      const re = new RegExp(
+        `(?<![\\w$.])(['"\`]${name === '' ? '' : '?'})(?:${names})\\1\\s*:`,
+        'g',
+      )
       re.lastIndex = pos
       const m = re.exec(source)
-      if (m === null) continue
+      if (m === null || m.index >= end) continue
       found = m.index + m[1]!.length
       pos = m.index + m[0].length
+      end = literalEnd(source, pos)
       next = j
     }
-    if (next < 0) return undefined
+    if (next < 0) {
+      if (found < 0 || i !== segments.length - 1) return undefined
+      break
+    }
     i = next
   }
   if (found < 0) return undefined
+  if (index !== undefined && i === segments.length) {
+    const el = elementStart(source, pos, index)
+    if (el !== undefined) found = el
+  }
   const before = source.slice(0, found)
   const line = before.split('\n').length
   return { line, col: found - before.lastIndexOf('\n') }
 }
 
+/**
+ * Where the object or array literal starting at `from` (past blanks) ends;
+ * `from` itself when the value is no literal (`exec: 'x'`, `cache: shared`),
+ * so no key is searched inside it.
+ */
+function literalEnd(source: string, from: number): number {
+  let i = from
+  while (i < source.length && /\s/.test(source[i]!)) i++
+  if (source[i] !== '{' && source[i] !== '[') return from
+  let depth = 0
+  for (; i < source.length; i++) {
+    const c = source[i]!
+    if (c === '"' || c === "'" || c === '`') {
+      for (i++; i < source.length && source[i] !== c; i++) if (source[i] === '\\') i++
+    } else if (c === '/' && source[i + 1] === '/') {
+      i = source.indexOf('\n', i)
+      if (i < 0) return source.length
+    } else if (c === '/' && source[i + 1] === '*') {
+      i = source.indexOf('*/', i + 2)
+      if (i < 0) return source.length
+      i++
+    } else if (c === '{' || c === '[') depth++
+    else if (c === '}' || c === ']') {
+      depth--
+      if (depth === 0) return i
+    }
+  }
+  return source.length
+}
+
+/** Where element `index` of the array literal at `from` (past blanks) starts, if it has one. */
+function elementStart(source: string, from: number, index: number): number | undefined {
+  let i = from
+  while (i < source.length && /\s/.test(source[i]!)) i++
+  if (source[i] !== '[') return undefined
+  let depth = 0
+  let n = 0
+  // Each element starts at the first code past `[` or a top-level `,`.
+  let pending = true
+  for (i++; i < source.length; i++) {
+    const c = source[i]!
+    if (c === '/' && source[i + 1] === '/') {
+      i = source.indexOf('\n', i)
+      if (i < 0) return undefined
+      continue
+    }
+    if (c === '/' && source[i + 1] === '*') {
+      i = source.indexOf('*/', i + 2)
+      if (i < 0) return undefined
+      i++
+      continue
+    }
+    if (/\s/.test(c)) continue
+    if (depth === 0 && (c === ']' || c === ')' || c === '}')) return undefined
+    if (pending) {
+      if (n === index) return i
+      pending = false
+    }
+    if (c === '"' || c === "'" || c === '`') {
+      for (i++; i < source.length && source[i] !== c; i++) if (source[i] === '\\') i++
+    } else if (c === '{' || c === '[' || c === '(') depth++
+    else if (c === '}' || c === ']' || c === ')') depth--
+    else if (c === ',' && depth === 0) {
+      n++
+      pending = true
+    }
+  }
+  return undefined
+}
+
 function escapeRe(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }

package/src/util/edit-distance.ts

@@ -37,9 +37,14 @@ export function nearest(
   // Two edits rewrite half of a word of four letters or fewer (`--poll`
   // read as `--all`, `vx test` as `last`), unless they swap two letters.
   const short = maxEdits === 2 && name.replace(/^-+/, '').length <= 4
+  // The same word in another case is the nearest whatever its length:
+  // `--ALL` is three edits from `--all`, `BUILD` five from `build`.
+  const lower = name.toLowerCase()
+  const list = [...candidates]
+  for (const c of list) if (c !== name && c.toLowerCase() === lower) return c
   let best: string | undefined
   let bestD = maxEdits + 1
-  for (const c of candidates) {
+  for (const c of list) {
     // Capped one past the budget, so "past it" never reads as within it:
     // `--continue-on-error` was nine edits from `--concurrency`, capped to
     // the three `vx run`'s same-prefix hint allows, and offered.

package/src/util/index.ts

@@ -27,25 +27,11 @@ export {
 } from './errors.js'
 export { configErrorFrame, configRefusal } from './config-frame.js'
 export { envFlagOn } from './env-flag.js'
-export {
-  detectColors,
-  dumbTerminal,
-  ERROR,
-  identityColor,
-  paint,
-  SUCCESS,
-  WARN,
-  type ColorSupport,
-} from './colors.js'
-export { barWidth, gradientRule, ruleWidth } from './report.js'
-import * as ui from './ui.js'
-export { refusalNotice, sayLine, sayNotice } from './refusal-notice.js'
-export { ui }
 export { keysSorted, xxh3, xxh3hex } from './hash.js'
 export {
   beginRun,
   mark,
-  printTimings,
+  timingLines,
   restartTimings,
   span,
   stageTimes,
@@ -86,6 +72,7 @@ export {
 } from './paths.js'
 export {
   claimExitForSignal,
+  dieOf,
   exitClaimedBySignal,
   killGraceMs,
   settleWithin,

package/src/util/paths.ts

@@ -202,7 +202,7 @@ export function isLiteralPattern(glob: string): boolean {
 }
 
 /**
- * The alphabet of a TASK glob (`inputs.files`, `cache.outputs.files`,
+ * The alphabet of a TASK glob (`inputs.files`, `outputs.files`,
  * `workspaceFiles`), behind {@link isLiteralPattern}, for the callers that
  * need the POSITION of the first wildcard rather than a verdict. Every site
  * that asks "must this declaration be matched?" reads this one regex: item
@@ -523,15 +523,33 @@ export function braceAlternatives(pattern: string): string[] {
   return expandBraces(pattern, false)
 }
 
+/**
+ * Where the `[`…`]` class opening at `i` ends, as `bracket-literal.ts`
+ * reads one (a `]` right after the `[` is a member); `i` for a `[` with no
+ * `]`, which `Bun.Glob` takes literally. A `,` `{` or `}` inside a class
+ * is a member: split there, `src/{a[,]b,x}.ts` became `src/a[.ts` and
+ * `src/]b.ts`, so an edit to `src/a,b.ts` kept the key (turborepo#13763).
+ */
+function classEnd(pattern: string, i: number): number {
+  const end = pattern.indexOf(']', i + 2)
+  return end === -1 ? i : end
+}
+
 function expandBraces(pattern: string, slashOnly: boolean): string[] {
   if (pattern.includes('\\')) return [pattern]
-  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+  for (let open = 0; open < pattern.length; open++) {
+    if (pattern[open] === '[') {
+      open = classEnd(pattern, open)
+      continue
+    }
+    if (pattern[open] !== '{') continue
     let depth = 0
     const cuts: number[] = []
     let close = -1
     for (let i = open; i < pattern.length && close === -1; i++) {
       const c = pattern[i]
-      if (c === '{') depth++
+      if (c === '[') i = classEnd(pattern, i)
+      else if (c === '{') depth++
       else if (c === '}' && --depth === 0) close = i
       else if (c === ',' && depth === 1) cuts.push(i)
     }

package/src/util/secret-mask.ts

@@ -115,15 +115,51 @@ export function secretMask(
     for (const name in source) {
       const value = source[name]
       if (secretNamed(name)) add(value)
-      if (value?.includes('://') === true && value.includes('@')) {
-        for (const m of value.matchAll(URL_PASSWORD)) add(m[1])
-      }
+      if (value?.includes('://') === true && value.includes('@'))
+        for (const pw of urlPasswords(value)) add(pw)
     }
     for (const name of named) add(source[name])
   }
   // This process's secrets: the environment's and the held ones.
   if (sources.includes(process.env)) for (const value of held) add(value)
   if (values.size === 0) return null
+  const found = [...values]
+  for (const m of masks) if (sameValues(m.values, found)) return m.mask
+  if (masks.length >= MASKS_KEPT) masks.shift()
+  const mask = maskOf(values)
+  masks.push({ values: found, mask })
+  return mask
+}
+
+/**
+ * Masks built, with the values each masks: every task of a run asks for
+ * the same one, and building it (a sort, a RegExp the engine compiles
+ * again) took 30 ms of a cold run's main thread at 500 tasks. The values
+ * are read fresh on every call; only the same values reuse a mask.
+ */
+const masks: Array<{ values: readonly string[]; mask: SecretMask }> = []
+const MASKS_KEPT = 8
+
+function sameValues(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false
+  return true
+}
+
+/** Each URL value's passwords, found once: the value decides them. */
+const urlPasswordsOf = new Map<string, string[]>()
+
+function urlPasswords(value: string): string[] {
+  let found = urlPasswordsOf.get(value)
+  if (found === undefined) {
+    found = []
+    for (const m of value.matchAll(URL_PASSWORD)) if (m[1] !== undefined) found.push(m[1])
+    urlPasswordsOf.set(value, found)
+  }
+  return found
+}
+
+function maskOf(values: ReadonlySet<string>): SecretMask {
   // Longest first, so a value holding another is replaced whole.
   const sorted = [...values].sort((a, b) => b.length - a.length)
   const pattern = new RegExp(

package/src/util/settle.ts

@@ -51,7 +51,8 @@ export function killGraceMs(defaultMs: number): number {
 export async function settleWithin(p: Promise<unknown>, ms: number): Promise<boolean> {
   let timer: ReturnType<typeof setTimeout> | undefined
   const deadline = new Promise<false>((resolve) => {
-    timer = setTimeout(() => resolve(false), ms)
+    // A delay past a 32-bit int fires at 1 ms: the longest the timer holds instead.
+    timer = setTimeout(() => resolve(false), Math.min(ms, MAX_TIMEOUT_MS))
   })
   try {
     return (await Promise.race([p.then(() => true), deadline])) !== false
@@ -69,6 +70,37 @@ export async function settleWithin(p: Promise<unknown>, ms: number): Promise<boo
 // with the run's verdict (1), so bin.ts asks before it exits.
 let signalOwnsExit = false
 
+/** How long `dieOf` waits for its own signal to land before the caller exits anyway. */
+const SELF_SIGNAL_WAIT_MS = 1000
+
+/**
+ * Die of `signal`: its listeners off, so Bun restores the default action,
+ * the signal sent to this process, and the caller held until it lands. A
+ * kill is not always delivered before it returns: a signal another thread
+ * takes, or one a tracer holds (the sandbox's `strace -f` sees every
+ * signal before the tracee does), lands later, and the `process.exit`
+ * after it won: vx exited with the signal's code (130), not of the
+ * signal, and a script running it
+ * went on (CI, PR #4867). Bounded: the caller's exit code is the fallback
+ * should the signal never land. `testTimerMs('SELF_SIGNAL_DELAY')` sends
+ * it from a helper that late instead, the window a test widens.
+ */
+export function dieOf(signal: 'SIGINT' | 'SIGTERM' | 'SIGHUP'): void {
+  process.removeAllListeners(signal)
+  const lateMs = testTimerMs('SELF_SIGNAL_DELAY', 0)
+  if (lateMs > 0) {
+    Bun.spawn(['sh', '-c', `sleep ${lateMs / 1000}; kill -${signal.slice(3)} ${process.pid}`], {
+      stdio: ['ignore', 'ignore', 'ignore'],
+    })
+  } else {
+    process.kill(process.pid, signal)
+  }
+  // Synchronous: an `exit` listener's loop never turns again. A signal
+  // that lands ends the process here; the wait costs nothing then.
+  const until = performance.now() + lateMs + SELF_SIGNAL_WAIT_MS
+  while (performance.now() < until) Bun.sleepSync(5)
+}
+
 /** A signal's handler will end the process: bin.ts leaves the exit to it. */
 export function claimExitForSignal(): void {
   signalOwnsExit = true

package/src/util/tail.ts

@@ -32,8 +32,11 @@ export function createTail(): Tail {
   return { chunks: [], chars: 0, dropped: 0 }
 }
 
-export function appendTail(t: Tail, chunk: string, limit = PERSISTENT_TAIL_CHARS): void {
+export function appendTail(t: Tail, chunk: string, cap = PERSISTENT_TAIL_CHARS): void {
   if (chunk.length === 0) return
+  // Every bound below is `chars > limit`, which NaN never is: a NaN cap
+  // kept everything, the unbounded heap this exists to prevent.
+  const limit = Number.isNaN(cap) ? 0 : cap
   t.chunks.push(chunk)
   t.chars += chunk.length
   // Evict WHOLE chunks from the head — no concatenation until the flush

package/src/util/timing.ts

@@ -9,7 +9,6 @@
 // prints (a push per stage, ~15 a run): a telemetry sink draws them as
 // spans (`stageTimes`). The per-call `span`s stay off unless enabled.
 
-import { detectColors, paint } from './colors.js'
 const enabled = process.env.VX_DEBUG_TIMING === 'true' || process.env.VX_DEBUG_TIMING === '1'
 let t0 = Bun.nanoseconds()
 // The wall clock at t0, read then: `performance.timeOrigin` plus the
@@ -88,9 +87,9 @@ export function span(label: string): () => void {
   }
 }
 
-/** Print the stage table (once, at the end of a run). No-op unless enabled. */
-export function printTimings(): void {
-  if (!enabled || marks.length === 0) return
+/** The stage table's lines (once, at the end of a run); none unless enabled. */
+export function timingLines(): string[] | undefined {
+  if (!enabled || marks.length === 0) return undefined
   const width = Math.max(...marks.map(([l]) => l.length))
   let prev = 0
   const lines = ['[vx timing]  stage'.padEnd(width + 14) + '    own   cumulative']
@@ -118,16 +117,5 @@ export function printTimings(): void {
       '             (wall per call, summed; concurrent calls overlap — compare spans, not totals)',
     )
   }
-  const c = detectColors(process.stderr)
-  process.stderr.write(
-    `${lines
-      .map((l) =>
-        l.startsWith('[vx timing]')
-          ? `${paint('#06b6d4', '[vx timing]', c, { bold: true })}${paint('', l.slice(11), c, { dim: true })}`
-          : l.startsWith('             (')
-            ? paint('', l, c, { dim: true })
-            : l,
-      )
-      .join('\n')}\n`,
-  )
+  return lines
 }