@vzn/vx 0.0.651 → 0.0.653

package/src/cli/lock.ts

@@ -3,21 +3,29 @@
 // `vx lock --check` — audit the lock against a fresh evaluation in the
 // current environment. Design: docs/design/config-lock-2026-06.md.
 
+import { readdirSync } from 'node:fs'
 import { open } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
 import { flagHint, formatValue, refuse, refusedWord, seeHelp } from './help.js'
-import { buildTaskGraph, expandRequested, isDefaultBuild } from '../graph/index.js'
+import {
+  buildTaskGraph,
+  expandRequested,
+  isDefaultBuild,
+  refuseFiltersThroughGroups,
+} from '../graph/index.js'
 import {
   applyGraphStage,
   claimedDigests,
   discoverProjects,
   fingerprintClaims,
   hasHook,
+  ignoredConfigRefusal,
   loadProjects,
 } from '../orchestrator/index.js'
 import { resolveSetting, runRules } from '../settings.js'
 import {
+  configErrorFrame,
   DOT_VX_GITATTRIBUTES,
   fsRefusalHint,
   isFsRefusal,
@@ -26,10 +34,12 @@ import {
   maskedLine,
   relPosix,
   type RefusalParts,
-  type UserError,
+  UserError,
   secretMask,
+  secretNamed,
   type SecretMask,
   refuseSymlink,
+  writeAllOrNone,
   writeNoFollow,
 } from '../util/index.js'
 import * as ui from '../ui/index.js'
@@ -39,6 +49,7 @@ import {
   findProjectConfigs,
   findWorkspaceRoot,
   REVIEW_FILE,
+  PROJECT_CONFIG_FILENAMES,
   loadProjectConfigs,
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
@@ -48,11 +59,11 @@ import {
   checkBracketLiterals,
   checkDependencyRules,
   computeNestedProjectDirs,
-  writeLockfile,
+  lockfileWrite,
   DEPENDENCIES_LOCK_NAME,
   dependenciesLock,
   parseDependenciesLock,
-  writeDependenciesLock,
+  dependenciesLockWrite,
   type DependenciesLock,
   type Lockfile,
   type ProjectMeta,
@@ -86,6 +97,29 @@ export function parseLockArgs(args: readonly string[]): LockArgs {
 
 type ConfiguredMeta = ProjectMeta & { configPath: string }
 
+/**
+ * A `dependsOn` the graph refused (`a#dep: dependsOn a#nope …`), said as
+ * a schema refusal of that field, so it prints at the config's line with
+ * its frame as every other config error does. Undefined when the task's
+ * `dependsOn` is not in its file (a plugin's task, the default build).
+ */
+function placedDependsOn(
+  err: UserError,
+  all: readonly ProjectMeta[],
+  root: string,
+): string | undefined {
+  if (err.code !== 'VX_E_DEPENDS_ON') return undefined
+  const m = /^(.+)#([^#\s]+): dependsOn (.+)$/s.exec(err.message)
+  if (m === null) return undefined
+  const configPath = all.find((p) => p.name === m[1])?.configPath
+  if (configPath === undefined || configPath === null) return undefined
+  // `does not accept …` reads on from the field; a named dep takes `names`.
+  // The frame turns a trailing ` — did you mean X?` into its fix line.
+  const said = /^(?:does not|patterns are)\b/.test(m[3]!) ? m[3] : `names ${m[3]}`
+  const placed = `${configPath}: tasks.${m[2]}.dependsOn ${said!.replace(/\. Did you mean (.+)\?$/s, ' — did you mean $1?')}`
+  return configErrorFrame(placed, root) === undefined ? undefined : placed
+}
+
 export async function lockCmd(args: readonly string[]): Promise<number> {
   const parsed = parseLockArgs(args)
   if (parsed.error) return refuse('lock', args, parsed.error, 'VX_E_USAGE')
@@ -156,11 +190,19 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
   try {
     const { workspaceConfig, plugins, cacheDir } = await loadCliWorkspace(root)
     out.reviewFiles = resolveSetting('lock.reviewFiles', workspaceConfig).value !== false
-    const { configs: found, strayReviews, shadowed } = await findProjectConfigs(root)
+    const {
+      configs: found,
+      strayReviews,
+      shadowed,
+      nestedWorkspaces,
+    } = await findProjectConfigs(root)
     out.strayReviews = strayReviews
     out.shadowed = shadowed
     // The one load that evaluates: every reader reads the lock this writes.
-    const configs = await loadProjectConfigs(found.map((f) => f.configPath))
+    const configs = await loadProjectConfigs(
+      found.map((f) => f.configPath),
+      root,
+    )
     // In the lock's form: a field left `undefined` is a key the stored JSON
     // never has. Entries, not assignment: a directory named `__proto__` is
     // a key of its own (D-152).
@@ -173,10 +215,16 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
         },
       ]),
     )
+    if (nestedWorkspaces.length > 0)
+      out.fresh.nestedWorkspaces = nestedWorkspaces.map((dir) => lockKey(root, dir))
     // The stages edit what they are handed; the lock keeps what the configs say.
     const view = structuredClone(out.fresh)
     const lock = async (): Promise<Lockfile> => view
     out.all = await discoverProjects(root, lock, plugins, cacheDir, warn)
+    for (const m of out.all) {
+      const why = m.configPath === null ? ignoredConfigRefusal(root, m) : undefined
+      if (why !== undefined) throw new UserError(why, 'VX_E_LOCK')
+    }
     const { projects } = await loadProjects({
       workspaceRoot: root,
       cacheDir,
@@ -216,11 +264,19 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
       workspaceRoot: root,
       rules,
       nestedProjects: new Map(
-        [...computeNestedProjectDirs(out.all)].map(([name, dirs]) => [
+        [...computeNestedProjectDirs(out.all, nestedWorkspaces)].map(([name, dirs]) => [
           name,
-          dirs.map((dir) => ({ name: nameOf.get(dir)!, dir })),
+          dirs.map((dir) => {
+            const project = nameOf.get(dir)
+            return project === undefined
+              ? { name: relPosix(root, dir), dir, workspace: true }
+              : { name: project, dir }
+          }),
         ]),
       ),
+      projectConfigs: out.all.flatMap((m) =>
+        m.configPath === null ? [] : [{ name: m.name, configPath: m.configPath }],
+      ),
     })
     if (hasHook(plugins, 'graph'))
       await applyGraphStage(plugins, nodes, {
@@ -230,11 +286,14 @@ async function audit(root: string, warn: (message: string) => void): Promise<Gra
         warn,
         rules,
       })
+    // A run refuses it after its `graph` stage; the lock, which holds the
+    // graph every run trusts, refuses it too.
+    refuseFiltersThroughGroups(nodes)
   } catch (err) {
     if (isUserError(err))
       return {
         ...out,
-        broken: err.message,
+        broken: placedDependsOn(err, out.all, root) ?? err.message,
         ...(err.parts ? { brokenParts: err.parts } : {}),
         ...(err instanceof ConfigsRefused ? { alsoBroken: err.all.slice(1) } : {}),
       }
@@ -424,11 +483,11 @@ async function writeLock(
   }
   // The copies first: one that cannot be written leaves the lock as it was,
   // not a new lock beside stale copies and a stack.
-  for (const r of reviews) refuseSymlink(r.file)
+  for (const r of reviews) refuseSymlink(r.file, root)
   const blocked = (
     await Promise.all(
       reviews.map((r) =>
-        writeNoFollow(r.file, r.text).then(
+        writeNoFollow(r.file, r.text, root).then(
           () => null,
           (err: unknown): { file: string; err: NodeJS.ErrnoException } => {
             if (typeof (err as NodeJS.ErrnoException).code !== 'string' || isOutOfFds(err))
@@ -451,8 +510,13 @@ async function writeLock(
     })
     return 1
   }
-  await writeLockfile(root, check.fresh)
-  if (check.dependencies !== null) await writeDependenciesLock(root, check.dependencies)
+  await writeAllOrNone(
+    [
+      lockfileWrite(root, check.fresh),
+      ...(check.dependencies === null ? [] : [dependenciesLockWrite(root, check.dependencies)]),
+    ],
+    root,
+  )
   await writeIfMissing(path.join(root, '.vx', '.gitattributes'), DOT_VX_GITATTRIBUTES)
   const n = metas.length
   say(`${n} project config${n === 1 ? '' : 's'} → ${LOCKFILE_NAME}${bareNote(bare)}`)
@@ -464,6 +528,27 @@ async function writeLock(
   return 0
 }
 
+/** The first places (three at most) two evaluated configs differ: `path: locked → now`. */
+function configDiff(locked: unknown, now: unknown, at = '', out: string[] = []): string[] {
+  if (out.length >= 3 || Bun.deepEquals(locked, now, true)) return out
+  const isObj = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object'
+  if (isObj(locked) && isObj(now) && Array.isArray(locked) === Array.isArray(now)) {
+    for (const k of new Set([...Object.keys(locked), ...Object.keys(now)])) {
+      const next = Array.isArray(now) ? `${at}[${k}]` : at === '' ? k : `${at}.${k}`
+      configDiff(locked[k], now[k], next, out)
+    }
+    return out
+  }
+  out.push(`${at}: ${diffValue(locked)} → ${diffValue(now)}`)
+  return out
+}
+
+function diffValue(v: unknown): string {
+  if (v === undefined) return '(none)'
+  const s = JSON.stringify(v)
+  return s.length > 60 ? `${s.slice(0, 59)}…` : s
+}
+
 /**
  * Review copies with no config beside them, sorted. One left beside a
  * config since deleted shows reviewers tasks nothing runs, and keys the
@@ -483,21 +568,45 @@ async function strayCopies(check: GraphCheck): Promise<string[]> {
   return [...new Set([...kept.filter((f) => f !== null), ...check.strayReviews])].sort()
 }
 
-const strayLine = (root: string, file: string): string =>
-  `${relPosix(root, file)} has no vx.config beside it — delete it`
+/**
+ * A copy's config renamed to a name vx does not read (`.json`, `.tsx`)
+ * is still there: "delete it" was the wrong advice. Looked for only here,
+ * once a copy is already stray.
+ */
+function strayLine(root: string, file: string): string {
+  const copy = `${relPosix(root, file)} has no vx.config beside it`
+  let names: string[] = []
+  try {
+    names = readdirSync(path.dirname(file))
+  } catch {
+    // gone or unreadable: nothing beside it to name
+  }
+  const unread = names
+    .filter((n) => n.startsWith('vx.config.') && !PROJECT_CONFIG_FILENAMES.includes(n))
+    .sort()[0]
+  if (unread === undefined) return `${copy} — delete it`
+  const exts = PROJECT_CONFIG_FILENAMES.map((n) => n.slice('vx.config.'.length)).join(', ')
+  return `${copy}: ${unread} is not a config vx reads (${exts})`
+}
 
 /**
  * Each place an evaluated config holds the value of a secret in this
  * environment, by the rule output masking uses (a secret-named variable,
- * or one a task lists in `exec.env.secret`). The lock is committed, so
- * such a value would be published, and masking it would freeze a `***`
- * that every run runs (L-42).
+ * one a task lists in `exec.env.secret`, or a define of such a name whose
+ * value this environment holds). The lock is committed, so such a value
+ * would be published, and masking it would freeze a `***` that every run
+ * runs (L-42).
  */
 function secretsIn(projects: Record<string, ProjectConfig>): Array<{ at: string; name: string }> {
   const named = new Set<string>()
+  const defines: Array<[name: string, value: string]> = []
   for (const config of Object.values(projects)) {
-    for (const task of Object.values(config.tasks ?? {}))
-      for (const n of task?.exec?.env?.secret ?? []) named.add(n)
+    for (const task of Object.values(config.tasks ?? {})) {
+      const secret = task?.exec?.env?.secret ?? []
+      for (const n of secret) named.add(n)
+      for (const [n, v] of Object.entries(task?.exec?.env?.define ?? {}))
+        if (secretNamed(n) || secret.includes(n)) defines.push([n, v])
+    }
   }
   // Each variable's own mask: what the output masks of it, a URL's
   // password and a key's lines too, not only the whole value.
@@ -507,12 +616,26 @@ function secretsIn(projects: Record<string, ProjectConfig>): Array<{ at: string;
       value === undefined ? null : secretMask([{ [name]: value }], named.has(name) ? [name] : [])
     if (mask !== null) secrets.push([mask, name])
   }
+  // The output masks a secret define's value by the define's name, so
+  // `API_TOKEN: process.env.MY_CREDS` printed masked and locked in clear.
+  // Only a value this environment holds counts: a literal define is the
+  // config's own committed text, and npm's `'${NPM_TOKEN}'` is no secret.
+  for (const [n, v] of defines) {
+    const mask = secretMask([{ [n]: v }], [n])
+    if (mask === null) continue
+    for (const [name, value] of Object.entries(process.env))
+      if (value !== undefined && mask.spans(value).length > 0) secrets.push([mask, name])
+  }
   if (secrets.length === 0) return []
   const found: Array<{ at: string; name: string }> = []
   const walk = (project: string, at: string, v: unknown): void => {
     if (typeof v === 'string') {
-      for (const [mask, name] of secrets)
-        if (mask.spans(v).length > 0) found.push({ at: `${project}: ${at} holds $${name}`, name })
+      for (const [mask, name] of secrets) {
+        const place = `${project}: ${at} holds $${name}`
+        // A define's mask and its variable's own both find one value.
+        if (mask.spans(v).length > 0 && !found.some((f) => f.at === place))
+          found.push({ at: place, name })
+      }
     } else if (Array.isArray(v)) {
       v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
     } else if (v !== null && typeof v === 'object') {
@@ -533,6 +656,29 @@ function warnShadowed(root: string, check: GraphCheck, verb: string): void {
     )
 }
 
+/**
+ * `read` with each file's record taken from `fresh` where only the files
+ * its digests read moved (same bytes, same extra files, an extra's hash
+ * changed): a run digests anew on such an edit (`lockfileClaim`'s
+ * `lockedOnce`), and cli.md says it needs no `vx lock`, yet `--check`
+ * failed every edit in a `file:` directory or a patch. With every hash
+ * unchanged a run keys from the record, so its digests are compared.
+ */
+function liveExtras(read: DependenciesLock, fresh: DependenciesLock): DependenciesLock {
+  const files = { ...read.files }
+  for (const [name, now] of Object.entries(fresh.files)) {
+    const was = files[name]
+    if (
+      was !== undefined &&
+      was.hash === now.hash &&
+      Bun.deepEquals(Object.keys(was.extras ?? {}), Object.keys(now.extras ?? {})) &&
+      !Bun.deepEquals(was.extras ?? {}, now.extras ?? {})
+    )
+      files[name] = now
+  }
+  return { ...read, files }
+}
+
 /**
  * Audit the lock: find and re-evaluate every config in the CURRENT
  * environment and deep-compare it with the locked object. That sees an
@@ -586,12 +732,26 @@ async function checkLock(root: string, json: boolean): Promise<number> {
           ? `${rel} is not the ${locked.file} the lock holds for ${dir === '.' ? 'the workspace root project' : dir} — run 'vx lock'`
           : !Bun.deepEquals(fresh.config, locked.config, true)
             ? `${rel} evaluates differently from the lock here — its config, a file ` +
-              `it imports, or the environment it reads changed; run 'vx lock'`
+              `it imports, or the environment it reads changed; run 'vx lock'` +
+              // What changed: a config that reads the environment shows no file diff.
+              configDiff(locked.config, fresh.config)
+                .map((d) => `\n  ${maskedLine(d)}`)
+                .join('')
             : null
     if (problem === null) continue
     failures.push(problem)
     drifted.add(dir)
   }
+  const lockedWalls = lock.nestedWorkspaces ?? []
+  const walls = check.fresh.nestedWorkspaces ?? []
+  for (const dir of walls)
+    if (!lockedWalls.includes(dir))
+      failures.push(`${dir} is a nested workspace the lock does not hold — run 'vx lock'`)
+  for (const dir of lockedWalls)
+    if (!walls.includes(dir))
+      failures.push(
+        `the lock holds ${dir} as a nested workspace, which it is not now — run 'vx lock'`,
+      )
   if (broken !== null && check.loaded) failures.push(broken)
   // Each config that does not load, as `vx lock` names them: a CI fixing
   // one at a time re-ran the gate once per broken config.
@@ -645,7 +805,10 @@ async function checkLock(root: string, json: boolean): Promise<number> {
       .catch(() => null)
     // Compared as JSON: a formatter may lay the file out its own way.
     const read = parseDependenciesLock(text)
-    if (read === null || !Bun.deepEquals(read, check.dependencies, true))
+    if (
+      read === null ||
+      !Bun.deepEquals(liveExtras(read, check.dependencies), check.dependencies, true)
+    )
       failures.push(
         `${DEPENDENCIES_LOCK_NAME} ${text === null ? 'is missing' : 'is not what the dependencies resolve to here'} — run 'vx lock'`,
       )

package/src/cli/plan-format.ts

@@ -3,7 +3,7 @@
 import type { AffectedReason, CacheStatus, RunPlan } from '../orchestrator/index.js'
 import { computeReverseDepCount } from '../graph/index.js'
 import { planList, type PlannedRow, skippedReason } from '../report/index.js'
-import { formatBytes, formatElapsed, maskedCommand } from '../util/index.js'
+import { formatBytes, formatElapsed, maskedCommand, printable } from '../util/index.js'
 import * as ui from '../ui/index.js'
 import type { ColorSupport } from '../ui/index.js'
 
@@ -12,11 +12,10 @@ import type { ColorSupport } from '../ui/index.js'
  * list's grid (what the run would do with it, its usual time, where it
  * would run), then the counts and the predicted time.
  *
- *   ─ Plan 3 ─────────────────────────────────────────────────────
- *         time   usual status  cache      cpu    mem outputs  blocks worker       task
- *    ⇢                 cached  local                                 local        @vzn/vx#lint
- *    ⇣                 cached  remote                     12MB       local        @vzn/vx#test
- *    ⏺︎               ~1.2s run     miss                                  local        @vzn/vx#build
+ *     Plan 3    status  cache     usual    time   cpu    mem outputs  blocks worker       task
+ *              cached  local          —       —     —      —       —       — local        @vzn/vx#lint
+ *              cached  remote         —       —     —      —    12MB       — local        @vzn/vx#test
+ *              run     miss       ~1.2s       —     —      —       —       — local        @vzn/vx#build
  *
  *     tasks      3 planned · 2 cache hits (1 local, 1 remote, 12MB) · 1 would run
  *     predicted  ~1.20s wall · ~1.20s total execution
@@ -46,12 +45,12 @@ export function planReport(plan: RunPlan): ui.Block {
     if (t.cacheStatus === 'skipped') notes.push(skippedReason(t))
     const desc = shownDescription(t)
     if (desc !== undefined && desc !== '') notes.push(desc)
-    if (t.affected !== undefined) notes.push(`affected: ${describeReason(t.affected)}`)
+    if (t.affected !== undefined) notes.push(`affected: ${printable(describeReason(t.affected))}`)
     const executes = !skipped && (t.cacheStatus === 'miss' || t.cacheStatus === 'no-cache')
     rows.push({
       node: t.node,
       ...(skipped ? NOOP : LOOK[t.cacheStatus]),
-      ...(executes && t.p50Ms !== undefined ? { usualMs: t.p50Ms } : {}),
+      ...(executes ? { usualMs: t.p50Ms ?? null } : {}),
       ...(t.cacheStatus === 'hit-remote' && t.remoteBytes !== undefined
         ? { outputBytes: t.remoteBytes }
         : {}),
@@ -114,7 +113,7 @@ export function planReport(plan: RunPlan): ui.Block {
     const parts = [`~${formatElapsed(p.wallMs)} wall`]
     parts.push(`~${formatElapsed(p.workMs)} total execution`)
     if (p.unknownCount > 0) {
-      parts.push(`${p.unknownCount} task${p.unknownCount === 1 ? '' : 's'} without history (+?)`)
+      parts.push(`${p.unknownCount} task${p.unknownCount === 1 ? '' : 's'} never timed (+?)`)
     }
     facts.push(['predicted', parts.join(' · ')])
   }
@@ -137,37 +136,34 @@ export function formatPlanText(plan: RunPlan, c: ColorSupport = { enabled: false
   return ui.render([planReport(plan)], c)
 }
 
-type Look = Pick<PlannedRow, 'glyph' | 'status' | 'tone' | 'cache' | 'cacheTone'>
+type Look = Pick<PlannedRow, 'status' | 'tone' | 'cache' | 'cacheTone'>
 
-/** Each outcome on the run's grid: its glyph and words, as the run would print them. */
+/** Each outcome on the run's grid: its words, as the run would print them. */
 const LOOK: Record<CacheStatus, Look> = {
   'hit-local': {
-    glyph: '\u21e2',
     status: 'cached',
     tone: 'ok',
     cache: 'local',
     cacheTone: 'local',
   },
   'hit-remote': {
-    glyph: '\u21e3',
     status: 'cached',
     tone: 'ok',
     cache: 'remote',
     cacheTone: 'remote',
   },
-  miss: { glyph: '\u23fa\ufe0e', status: 'run', tone: 'info', cache: 'miss', cacheTone: 'muted' },
+  miss: { status: 'run', tone: 'info', cache: 'miss', cacheTone: 'muted' },
   'no-cache': {
-    glyph: '\u23fa\ufe0e',
     status: 'run',
     tone: 'info',
     cache: 'no-cache',
     cacheTone: 'muted',
   },
-  group: { glyph: '\u25cb', status: 'group', tone: 'muted', cache: '', cacheTone: '' },
-  'not-started': { glyph: '\u25cc', status: 'not run', tone: 'muted', cache: '', cacheTone: '' },
-  skipped: { glyph: '\u2298', status: 'skipped', tone: 'warn', cache: '', cacheTone: '' },
+  group: { status: 'group', tone: 'muted', cache: '', cacheTone: '' },
+  'not-started': { status: 'not run', tone: 'muted', cache: '', cacheTone: '' },
+  skipped: { status: 'skipped', tone: 'warn', cache: '', cacheTone: '' },
 }
-const NOOP: Look = { glyph: '\u00b7', status: 'noop', tone: 'muted', cache: '', cacheTone: '' }
+const NOOP: Look = { status: 'noop', tone: 'muted', cache: '', cacheTone: '' }
 
 /** One `--affected --dry` reason line: the cause, then the edge chain that carried it. */
 function describeReason(r: AffectedReason): string {
@@ -181,13 +177,20 @@ function describeReason(r: AffectedReason): string {
           : r.kind === 'input'
             ? `${r.file} changed (an input)`
             : r.kind === 'workspace'
-              ? `${r.file} changed (workspace-wide)`
+              ? `${r.file} changed (${r.wide === true ? 'workspace-wide' : 'every task in its project'})`
               : r.file !== undefined
                 ? `${r.file} changed (in its project)`
                 : 'its project changed as a whole'
   return r.via === undefined ? cause : `${cause}, via ${r.via.join(' ← ')}`
 }
 
+function wireReason(r: AffectedReason): AffectedReason {
+  if (r.wide === undefined) return r
+  const wire = { ...r }
+  delete wire.wide
+  return wire
+}
+
 /** A TS config may build the description from `process.env` (L-11). */
 function shownDescription(t: RunPlan['tasks'][number]): string | undefined {
   const { description, exec } = t.node.config
@@ -232,7 +235,7 @@ export function formatPlanJson(
           ...(t.executor !== undefined ? { executor: t.executor } : {}),
           ...(t.download !== undefined ? { download: t.download } : {}),
           ...(description !== undefined ? { description } : {}),
-          ...(t.affected !== undefined ? { affected: t.affected } : {}),
+          ...(t.affected !== undefined ? { affected: wireReason(t.affected) } : {}),
           ...(t.otherPlatform !== undefined ? { otherPlatform: t.otherPlatform } : {}),
           ...(t.blockedBy !== undefined ? { blockedBy: t.blockedBy } : {}),
         }

package/src/cli/plugin-commands.ts

@@ -337,7 +337,12 @@ export async function pluginCommandHelp(cwd = process.cwd()): Promise<string[]>
       if (seen.has(verb)) continue
       seen.add(verb)
       lines.push(
-        ...helpLines(`  vx ${verb.padEnd(17)} `, `${command.description} (${plugin.name})`),
+        ...helpLines(
+          // Two spaces at least: one ran a long verb into its description,
+          // and the help painter reads a description after two.
+          `  vx ${verb.length < 17 ? `${verb.padEnd(17)} ` : `${verb}  `}`,
+          `${command.description} (${plugin.name})`,
+        ),
       )
     }
   }