@vzn/vx 0.0.651 → 0.0.652

package/src/workspace/config-schema.ts

@@ -115,7 +115,7 @@ const oneOf = (values: readonly string[]): string =>
 
 function validateInputStability(stability: unknown, at: string): void {
   if (typeof stability !== 'object' || stability === null || Array.isArray(stability)) {
-    throw new UserError(`${at} must be an object — \`inputStability: { strategy: 'mutable' }\``)
+    throw new UserError(`${at} must be an object — \`stability: { strategy: 'mutable' }\``)
   }
   assertKnownFields(stability, INPUT_STABILITY_FIELDS, at)
   const { strategy, severity } = stability as Record<string, unknown>
@@ -128,13 +128,13 @@ function validateInputStability(stability: unknown, at: string): void {
 }
 
 /**
- * `VX_CACHE_INPUT_STABILITY_STRATEGY` and `_SEVERITY`, which override every
- * task's `cache.inputStability` for the run: each undefined when unset or
+ * `VX_INPUTS_STABILITY_STRATEGY` and `_SEVERITY`, which override every
+ * task's `inputs.stability` for the run: each undefined when unset or
  * empty, refused when it names no value.
  */
 export function inputStabilityEnv(): InputStability {
-  const strategy = settingEnv('cache.inputStability.strategy') as InputStability['strategy']
-  const severity = settingEnv('cache.inputStability.severity') as InputStability['severity']
+  const strategy = settingEnv('inputs.stability.strategy') as InputStability['strategy']
+  const severity = settingEnv('inputs.stability.severity') as InputStability['severity']
   return {
     ...(strategy !== undefined ? { strategy } : {}),
     ...(severity !== undefined ? { severity } : {}),
@@ -231,6 +231,8 @@ function ruleSelectorProblem(s: string): string | null {
   // The root's own name, which the filter reads as the root's directory.
   if (s === ROOT_NAME) return null
   if (s.startsWith('!')) return "starts with '!', which a filter reads as an exclusion"
+  // The filter parser refuses one, which the catch below would read as a walk.
+  if (hasControl(s)) return 'holds a control character'
   const walk = "starts or ends with '...', which a filter reads as a dependency walk"
   let f: ReturnType<typeof parseFilter>
   try {
@@ -590,6 +592,9 @@ export function validateProjectConfig(
     const exec = (task as { exec?: unknown }).exec
     const dependsOn = (task as { dependsOn?: unknown }).dependsOn
     const cache = (task as { cache?: unknown }).cache
+    if (cache !== undefined && typeof cache !== 'boolean') {
+      throw new UserError(`${where}.cache must be true or false`)
+    }
     if (exec !== undefined) {
       if (typeof exec !== 'object' || exec === null) {
         throw new UserError(`${where}.exec must be an object with a \`command\` string`)
@@ -623,9 +628,9 @@ export function validateProjectConfig(
       // Documented and never held: an uncached 'only' task loaded, and the
       // REAPI executor refused it at run time for want of described inputs
       // (item 1001).
-      if (remote === 'only' && cache === undefined) {
+      if (remote === 'only' && cache !== true) {
         throw new UserError(
-          `${where}.exec.remote 'only' needs \`cache\`: its inputs are what a worker reproduces ` +
+          `${where}.exec.remote 'only' needs \`cache: true\`: its inputs are what a worker reproduces ` +
             `and its key is the address of its remote record`,
         )
       }
@@ -712,7 +717,7 @@ export function validateProjectConfig(
         throw new UserError(`${where}.exec.interactive must be a boolean (or omitted)`)
       }
       if (interactive === true) {
-        if (cache !== undefined) {
+        if (cache === true) {
           throw new UserError(
             `${where}: \`cache\` is not allowed on an interactive task — what it does ` +
               `depends on what is typed, which no key holds`,
@@ -765,7 +770,7 @@ export function validateProjectConfig(
             )
           }
         }
-        if (cache !== undefined) {
+        if (cache === true) {
           throw new UserError(
             `${where}: \`cache\` is not allowed on a persistent task — persistent tasks ` +
               `don't terminate, so there's no exit to cache`,
@@ -943,16 +948,8 @@ export function validateProjectConfig(
         validateWorkspaceGlobs(wsInputs, `${where}.inputs.workspaceFiles`, true)
       }
     }
-    if (cache !== undefined) {
-      if (typeof cache !== 'object' || cache === null) {
-        throw new UserError(
-          `${where}.cache must be an object when present — \`inputs: { files: [...] }, cache: { outputs: { files: [...] } }\`, or no \`cache\` for a task that never caches`,
-        )
-      }
-      assertKnownFields(cache, CACHE_FIELDS, `${where}.cache`)
-      const stability = (cache as { inputStability?: unknown }).inputStability
-      if (stability !== undefined)
-        validateInputStability(stability, `${where}.cache.inputStability`)
+    const outputs = (task as { outputs?: unknown }).outputs
+    if (cache === true) {
       // The key is the task's inputs, and a group runs nothing to cache.
       if (exec === undefined) {
         throw new UserError(
@@ -964,23 +961,38 @@ export function validateProjectConfig(
           `${where}: \`cache\` needs \`inputs\` — the key is the task's inputs, \`inputs: { files: [...] }\``,
         )
       }
-      const outputs = (cache as { outputs?: unknown }).outputs
-      if (outputs === undefined || outputs === null) {
-        throw new UserError(`${where}.cache.outputs is required when \`cache\` is set`)
+      if (outputs === undefined) {
+        throw new UserError(
+          `${where}: \`cache\` needs \`outputs\` — what the task produces, \`outputs: { files: [...] }\` (\`[]\` for none)`,
+        )
+      }
+    }
+    const stability = (inputs as { stability?: unknown } | undefined)?.stability
+    if (stability !== undefined) {
+      validateInputStability(stability, `${where}.inputs.stability`)
+      if (exec === undefined) {
+        throw new UserError(
+          `${where}.inputs.stability needs \`exec\` — a task with no command runs nothing that could write its inputs`,
+        )
+      }
+    }
+    if (outputs !== undefined) {
+      if (outputs === null || typeof outputs !== 'object') {
+        throw new UserError(`${where}.outputs must be an object — \`outputs: { files: [...] }\``)
       }
-      if (typeof outputs !== 'object') {
+      assertKnownFields(outputs, OUTPUT_FIELDS, `${where}.outputs`)
+      if (exec === undefined) {
         throw new UserError(
-          `${where}.cache.outputs must be an object — \`outputs: { files: [...] }\``,
+          `${where}.outputs needs \`exec\` — a task with no command writes nothing`,
         )
       }
-      assertKnownFields(outputs, CACHE_OUTPUT_FIELDS, `${where}.cache.outputs`)
       const clean = (outputs as { clean?: unknown }).clean
       if (clean !== undefined && typeof clean !== 'boolean') {
-        throw new UserError(`${where}.cache.outputs.clean must be true or false`)
+        throw new UserError(`${where}.outputs.clean must be true or false`)
       }
       const outFiles = (outputs as { files?: unknown }).files
       if (!Array.isArray(outFiles)) {
-        throw new UserError(`${where}.cache.outputs.files must be an array of glob strings`)
+        throw new UserError(`${where}.outputs.files must be an array of glob strings`)
       }
       // Reject zero-length strings and absolute paths up front.
       // Both reach `resolveOutputs` as undefined behavior; the error
@@ -988,26 +1000,26 @@ export function validateProjectConfig(
       // at the user's config. Fail loud at load time.
       for (const g of outFiles as unknown[]) {
         if (typeof g !== 'string' || g.length === 0) {
-          throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
+          throw new UserError(`${where}.outputs.files must be an array of non-empty strings`)
         }
         if (isAbsoluteGlob(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
+            `${where}.outputs.files: absolute paths are not allowed (got "${g}") — ` +
               `outputs must be project-relative globs`,
           )
         }
         if (hasParentSegment(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
+            `${where}.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
               `outputs must stay within the project (vx clears a task's outputs before it runs, ` +
               `so a glob that escapes the project would delete files outside it)`,
           )
         }
-        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
-        assertNoForeignToken(g, `${where}.cache.outputs.files`)
+        assertPosixGlob(g, `${where}.outputs.files`, 'project')
+        assertNoForeignToken(g, `${where}.outputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
+            `${where}.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
               `name the directory the task writes, such as "dist/**"`,
           )
         }
@@ -1016,31 +1028,31 @@ export function validateProjectConfig(
         // a "corrupt artifact", dropped and run again.
         if (!g.startsWith('!') && normalizeGlob(g).split('/')[0] === 'workspace-outputs') {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
+            `${where}.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
               `artifacts reserve for outputs.workspaceFiles — write the task's files to another directory`,
           )
         }
         // A `!` entry takes a path back from the outputs (A-44): it is not
         // cleaned, saved or restored, and it stays an input.
-        assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
+        assertNotDoubleNegated(g, `${where}.outputs.files`)
         // Taken back by a `!`, the file is never cleaned or restored.
         const own = g.startsWith('!')
           ? undefined
           : ownFilesCovered(g, ownConfig).find((f) => !takenBack(outFiles as unknown[], f))
         if (own !== undefined) {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
+            `${where}.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
               `task's outputs before it runs and restores them on a hit, so the project would lose ` +
               `its config. Name the directory the task writes, such as "dist/**", ` +
               `or take the file back with "!${own}".`,
           )
         }
       }
-      assertOutputsNotNegationOnly(outFiles as string[], `${where}.cache.outputs.files`)
-      assertNoLiteralTakenBack(outFiles as string[], `${where}.cache.outputs.files`, OUTPUT_LOST)
+      assertOutputsNotNegationOnly(outFiles as string[], `${where}.outputs.files`)
+      assertNoLiteralTakenBack(outFiles as string[], `${where}.outputs.files`, OUTPUT_LOST)
       const wsOutputs = (outputs as { workspaceFiles?: unknown }).workspaceFiles
       if (wsOutputs !== undefined) {
-        validateWorkspaceGlobs(wsOutputs, `${where}.cache.outputs.workspaceFiles`, false)
+        validateWorkspaceGlobs(wsOutputs, `${where}.outputs.workspaceFiles`, false)
       }
     }
   }
@@ -1055,7 +1067,7 @@ export function validateProjectConfig(
 // `tasks` first: `nearest` breaks a tie by order, and `taks` is one edit
 // from both.
 const PROJECT_FIELDS = new Set(['name', 'tasks', 'tags'])
-const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'inputs', 'cache'])
+const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'inputs', 'outputs', 'cache'])
 const EXEC_FIELDS = new Set([
   'command',
   'env',
@@ -1069,7 +1081,6 @@ const EXEC_FIELDS = new Set([
 ])
 const PERSISTENT_FIELDS = new Set(['readyWhen'])
 const ENV_FIELDS = new Set(['passThrough', 'define', 'secret'])
-const CACHE_FIELDS = new Set(['outputs', 'inputStability'])
 const INPUT_FIELDS = new Set([
   'files',
   'workspaceFiles',
@@ -1077,8 +1088,9 @@ const INPUT_FIELDS = new Set([
   'tasks',
   'runtime',
   'workspaceRuntime',
+  'stability',
 ])
-const CACHE_OUTPUT_FIELDS = new Set(['files', 'workspaceFiles', 'clean'])
+const OUTPUT_FIELDS = new Set(['files', 'workspaceFiles', 'clean'])
 
 /**
  * Another runner's spelling of a field vx has under another name, by the
@@ -1090,8 +1102,10 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
   [
     TASK_FIELDS,
     {
-      outputs: '`cache.outputs.files`',
       env: '`inputs.env` (to key the task on a variable) or `exec.env` (to pass one)',
+      // wireit's script keys.
+      output: '`outputs.files`',
+      dependencies: "`dependsOn` (an upstream's key goes into this one)",
       passThroughEnv: '`exec.env.passThrough`',
       command: '`exec.command`',
       cmd: '`exec.command`',
@@ -1128,18 +1142,6 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       shell: 'no field: `command` always runs in a shell',
     },
   ],
-  // wireit's `files` / `output` and include-style spellings written into
-  // a cache block, refused with no word on where they go (D-118).
-  [
-    CACHE_FIELDS,
-    {
-      files: "the task's `inputs.files`",
-      output: '`outputs.files`',
-      env: "the task's `inputs.env`",
-      dependencies: "the task's `dependsOn` (an upstream's key goes into this one)",
-      enabled: 'no field: a task with a `cache` block caches, one without runs every time',
-    },
-  ],
   [
     INPUT_FIELDS,
     {
@@ -1151,7 +1153,7 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
     },
   ],
   [
-    CACHE_OUTPUT_FIELDS,
+    OUTPUT_FIELDS,
     {
       globs: '`files`',
       include: '`files`',
@@ -1176,12 +1178,11 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       sourceRoot: "a task's `inputs.files`",
       projectType: 'no field: vx runs every project alike',
       ...Object.fromEntries(
-        ['dependsOn', 'inputs', 'cache', 'exec', 'description'].map((k) => [
+        ['dependsOn', 'inputs', 'outputs', 'cache', 'exec', 'description'].map((k) => [
           k,
           `\`tasks.<name>.${k}\`: a project holds tasks, and each task its own \`${k}\``,
         ]),
       ),
-      outputs: '`tasks.<name>.cache.outputs.files`',
       env: '`tasks.<name>.inputs.env` (to key a task on it) or `tasks.<name>.exec.env`',
     },
   ],
@@ -1252,7 +1253,7 @@ function nestedHome(allowed: ReadonlySet<string>, key: string): string | undefin
   for (const [field, own] of [
     ['exec', EXEC_FIELDS],
     ['inputs', INPUT_FIELDS],
-    ['cache', CACHE_FIELDS],
+    ['outputs', OUTPUT_FIELDS],
   ] as const) {
     if (own.has(key)) return `\`${field}.${key}\``
   }
@@ -1538,7 +1539,7 @@ function assertInputGlob(glob: string, where: string): void {
   if (glob.replace(/^!/, '').split('/').includes('.git')) {
     throw new UserError(
       `${where}: "${glob}" names a path under .git, which git never lists, so it keys nothing — ` +
-        `inputs are the repository's files`,
+        `inputs are the workspace's files`,
     )
   }
 }
@@ -1699,6 +1700,9 @@ export function taskNameProblem(name: string): string | null {
 function tagProblem(tag: string): string | null {
   if (tag.trim() !== tag) return 'has surrounding whitespace'
   if (tag.includes('*')) return "holds '*', which makes it a pattern"
+  // Refused by the caller in its own words; the filter parser refuses one
+  // too, which the catch below would read as a walk.
+  if (hasControl(tag)) return null
   const walk = "ends in '...', which a filter reads as a dependency walk"
   let f: ReturnType<typeof parseFilter>
   try {
@@ -1828,6 +1832,7 @@ const SANDBOX_FIELDS = new Set([
   'ignore',
   'weakerWhenNested',
   'weakerNetworkIsolation',
+  'hermetic',
 ])
 const GRANT_PATH_FIELDS = ['read', 'write'] as const
 const GRANT_NAME_FIELDS = ['systemInfo', 'machLookup'] as const
@@ -1871,7 +1876,7 @@ function validateSandbox(sandbox: unknown, where: string): void {
   assertKnownFields(sandbox, SANDBOX_FIELDS, `${where}.sandbox`)
   const obj = sandbox as Record<string, unknown>
 
-  for (const flag of ['weakerWhenNested', 'weakerNetworkIsolation']) {
+  for (const flag of ['weakerWhenNested', 'weakerNetworkIsolation', 'hermetic']) {
     if (obj[flag] !== undefined && typeof obj[flag] !== 'boolean') {
       throw new UserError(`${where}.sandbox.${flag} must be a boolean`)
     }

package/src/workspace/filter.ts

@@ -22,7 +22,7 @@
 // given, the base set is "all projects" and excluded packages are removed.
 
 import path from 'node:path'
-import { BUN_GLOB_WILDCARDS, relPosix, UserError } from '../util/index.js'
+import { BUN_GLOB_WILDCARDS, hasControl, printable, relPosix, UserError } from '../util/index.js'
 import type { PackageGraph } from './package-graph.js'
 import { canonicalDir } from './canonical-dir.js'
 import type { ProjectMeta } from './workspace.js'
@@ -76,6 +76,13 @@ export function parseFilter(
   /** The filter as typed, when `raw` is the `./` reading of a name (`dirFallback`). */
   typed = raw,
 ): ParsedFilter {
+  // No project name, path or git ref holds one; echoed raw, a newline split
+  // the refusal in two and an escape painted the terminal.
+  if (hasControl(raw)) {
+    throw new UserError(
+      `filter "${printable(raw)}" holds a control character: no project name, path or git ref does`,
+    )
+  }
   let s = raw
   const negate = s.startsWith('!')
   if (negate) s = s.slice(1)

package/src/workspace/migration.ts

@@ -42,6 +42,10 @@ export function isStarterConfig(file: string): boolean {
   }
 }
 
+/** A C0 or C1 control, or DEL. */
+// oxlint-disable-next-line no-control-regex
+const CONTROL = /[\x00-\x1f\x7f-\x9f]/g
+
 /**
  * Escape an arbitrary string into a single-quoted TS literal. Escapes
  * backslash + quote AND raw newlines/CR — a value with an embedded newline
@@ -55,7 +59,10 @@ export function quoteTsLiteral(s: string): string {
     .replaceAll('\\', '\\\\')
     .replaceAll("'", "\\'")
     .replaceAll('\n', '\\n')
-    .replaceAll('\r', '\\r')}'`
+    .replaceAll('\r', '\\r')
+    // Any other control as its escape: a script's raw ESC landed in the
+    // file as the byte, and `cat vx.config.ts` retitled the terminal.
+    .replace(CONTROL, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, '0')}`)}'`
 }
 
 /**
@@ -658,7 +665,7 @@ const EXAMPLE_BODY = `export default {
     build: {
       exec: { command: 'tsc -b' },
       dependsOn: ['^build'],
-      inputs: { files: ['src/**'] }, cache: { outputs: { files: ['dist/**'] } },
+      inputs: { files: ['src/**'] }, outputs: { files: ['dist/**'] }, cache: true,
     },
   },
 }`
@@ -747,7 +754,7 @@ function renderConfigFile(p: GeneratedProject, format: MigrationFormat): string
     // The suggested block sits in the task, commented: deleting `// `
     // after setting the real globs caches it, no copying from the TODO.
     const block =
-      t.task['cache'] === undefined
+      t.task['cache'] !== true
         ? t.todos.find(isCacheTodo)?.match(/^cache: add `(.+?)`/)?.[1]
         : undefined
     lines.push(
@@ -790,11 +797,10 @@ function ownConfigNamed(
   return {
     ...p,
     tasks: p.tasks.map((t) => {
-      const outputs = (t.task?.['cache'] as { outputs?: { files?: unknown } } | undefined)?.outputs
+      const outputs = t.task?.['outputs'] as { files?: unknown } | undefined
       if (!Array.isArray(outputs?.files) || !outputs.files.includes(planned)) return t
-      const cache = t.task!['cache'] as Record<string, unknown>
       const files = outputs.files.map((f: unknown) => (f === planned ? `!${name}` : f))
-      return { ...t, task: { ...t.task, cache: { ...cache, outputs: { ...outputs, files } } } }
+      return { ...t, task: { ...t.task, outputs: { ...outputs, files } } }
     }),
   }
 }