@vzn/vx 0.0.652 → 0.0.653

package/src/orchestrator/local-floor.ts

@@ -2,8 +2,8 @@
 // workers, which run tasks another machine placed. A run arms the sandbox
 // runtime before it builds a sandboxed request; a worker is no run, so it
 // arms here. It starts a request's servers (`ExecuteRequest.servers`) once
-// each, before the task, each inside its own sandbox, and stops them when
-// it closes.
+// each, before the task, each inside its own sandbox, and stops each when
+// the run says no task needs it, or when it closes.
 
 import type { ExecConfig } from '../config.js'
 import {
@@ -18,6 +18,7 @@ import {
   type ServerSpec,
   wrapSandboxedCommand,
 } from '../exec/index.js'
+import { stopServer } from './persistent.js'
 import { placeholderSweeper, prepareSandbox, sandboxRequestFor } from './sandbox-request.js'
 import { forwardedSignal, terminateChildren } from './signals.js'
 
@@ -28,6 +29,8 @@ export interface LocalFloor {
   execute(req: ExecuteRequest): Promise<ExecuteResult>
   /** Arms the sandbox runtime for `sandboxes` from the next sandboxed task on; its servers keep running. */
   rearm(sandboxes: readonly NonNullable<ExecConfig['sandbox']>[]): Promise<void>
+  /** Stops server `taskId` if this started it: no task left needs it. A later task that needs it starts it again. */
+  stop(taskId: string): Promise<void>
   /** Stops the servers this started and the sandbox runtime this armed. */
   close(): Promise<void>
 }
@@ -38,10 +41,13 @@ export interface LocalFloor {
  * unix-socket filter are one per process, set from their union before the
  * first sandboxed task (`prepareSandbox`). A request that carries a
  * `signal` but no `liveChildren` has its children stopped here when it
- * aborts, the way a run's stop ends its own.
+ * aborts, the way a run's stop ends its own. `onServer` hears each
+ * server's pid as it spawns, and `undefined` as `stop` ends it: a worker
+ * meters what its servers use.
  */
 export function localFloor(
   sandboxes: readonly NonNullable<ExecConfig['sandbox']>[] = [],
+  onServer?: (taskId: string, pid: number | undefined) => void,
 ): LocalFloor {
   const local = localExecutor()
   const prepare = (list: typeof sandboxes) =>
@@ -103,6 +109,7 @@ export function localFloor(
     if (spawn.child === undefined) void gone()
     else {
       children.push(spawn.child)
+      onServer?.(spec.taskId, spawn.child.pid)
       void spawn.child.exited.then(gone, gone)
     }
     try {
@@ -190,6 +197,17 @@ export function localFloor(
       if (armer?.armed === true) await resetSandbox()
       armer = prepare(list)
     },
+    async stop(taskId) {
+      const up = servers.get(taskId)
+      if (up === undefined) return
+      servers.delete(taskId)
+      const child = await up.catch(() => undefined)
+      if (child === undefined) return
+      const i = children.indexOf(child)
+      if (i >= 0) children.splice(i, 1)
+      onServer?.(taskId, undefined)
+      await stopServer(child)
+    },
     async close() {
       if (children.length > 0) await terminateChildren(() => children)
       if (armer?.armed === true) await resetSandbox()

package/src/orchestrator/lockfile-claim.ts

@@ -21,7 +21,7 @@
 // `vx lock` adds them to the memo.
 
 import path from 'node:path'
-import { stat } from 'node:fs/promises'
+import { readdir, realpath, stat } from 'node:fs/promises'
 import { type LockfileMemo, readLockfileMemo, writeLockfileMemo } from '../cache/index.js'
 import { relPosix, UserError, xxh3, xxh3hex } from '../util/index.js'
 import type { TaskNode } from '../graph/index.js'
@@ -88,6 +88,11 @@ export interface LockfileImporter {
   readonly deps: Readonly<Record<string, string>>
   /** Its peers that resolve to an importer, each with no installed entry of the same name. */
   readonly peers: Readonly<Record<string, string>>
+  /**
+   * The importers it reaches only through installed packages, sorted: a
+   * registry package's dependency the install resolved to a workspace.
+   */
+  readonly transitive?: readonly string[]
 }
 
 /** What a lockfile plugin spreads into `definePlugin` (`fingerprint`, `key`), and `importers` for its own stages. */
@@ -152,13 +157,34 @@ function unreadable(rel: string, err: unknown): UserError {
  * Every file under `dir` but its `node_modules` and `.git`, as `rel\0hash`
  * lines in sorted order. Links are followed: a linked file is what a task
  * reads, and the scan skipped it, so an edit to its target moved no key.
+ * The walk never enters `node_modules` or `.git`: a glob of `**` that
+ * dropped them after listed every file under them (30k files there: a warm
+ * run 307 → 183 ms, min of 10). A linked directory that is one of its own
+ * ancestors is not entered again.
  */
 async function hashDir(dir: string): Promise<string> {
   const rels: string[] = []
-  const scan = { cwd: dir, dot: true, onlyFiles: true, followSymlinks: true }
-  for await (const rel of new Bun.Glob('**').scan(scan)) {
-    if (!rel.split('/').some((s) => s === 'node_modules' || s === '.git')) rels.push(rel)
+  const walk = async (rel: string, real: string, ancestors: readonly string[]): Promise<void> => {
+    const entries = await readdir(path.join(dir, rel), { withFileTypes: true })
+    await Promise.all(
+      entries.map(async (e) => {
+        if (e.name === 'node_modules' || e.name === '.git') return
+        const child = rel === '' ? e.name : `${rel}/${e.name}`
+        if (e.isFile()) return void rels.push(child)
+        if (e.isDirectory()) return walk(child, path.join(real, e.name), [...ancestors, real])
+        // A link, or an entry the filesystem gave no type: what it names decides.
+        const abs = path.join(dir, child)
+        const st = await stat(abs).catch(() => undefined)
+        if (st?.isFile()) rels.push(child)
+        else if (st?.isDirectory()) {
+          const target = await realpath(abs)
+          if (target !== real && !ancestors.includes(target))
+            await walk(child, target, [...ancestors, real])
+        }
+      }),
+    )
   }
+  await walk('', await realpath(dir), [])
   rels.sort()
   const lines = await Promise.all(
     rels.map(async (rel) => `${rel}\0${xxh3hex(await Bun.file(path.join(dir, rel)).bytes())}`),

package/src/orchestrator/miss-save.ts

@@ -7,7 +7,7 @@
 // a later run replays. Moved out of execute-task.ts 2026-09-09 as pure
 // code motion.
 
-import { existsSync, lstatSync, realpathSync, statSync } from 'node:fs'
+import { existsSync, statSync } from 'node:fs'
 import path from 'node:path'
 import {
   type CacheLayer,
@@ -26,7 +26,6 @@ import {
   relPosix,
   span,
   splitNegations,
-  staticPrefix,
   taskGlob,
 } from '../util/index.js'
 import { type Logger, warnOf } from '../report/index.js'
@@ -137,7 +136,7 @@ export interface SaveMissArgs {
    * (a same-project downstream task reads both), and the pack + write +
    * index go to the run's save lane (save-lane.ts).
    */
-  deferSave?: ((save: () => Promise<void>) => Promise<boolean>) | undefined
+  deferSave?: ((save: () => Promise<void>, taskId: string) => Promise<boolean>) | undefined
   /** Time the save and size its artifact, for a telemetry sink: one stat. */
   measure?: boolean | undefined
 }
@@ -167,6 +166,11 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
           projectDir: node.projectDir,
           outputs: a.outputs,
           nestedProjectDirs: a.nestedProjectDirs,
+          inputs: {
+            projectDir: node.projectDir,
+            workspaceRoot: a.workspaceRoot,
+            declared: node.config.inputs,
+          },
           special: true,
         })
   const outputFiles = tree.files
@@ -176,6 +180,11 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
       : await resolveWorkspaceOutputTree({
           workspaceRoot: a.workspaceRoot,
           outputs: a.wsOutputs,
+          inputs: {
+            projectDir: node.projectDir,
+            workspaceRoot: a.workspaceRoot,
+            declared: node.config.inputs,
+          },
           special: true,
         })
   const wsOutputFiles = wsTree.files
@@ -213,17 +222,12 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     // `outputs` is not a write grant; `exec.sandbox.allow.write` is.
     const sandboxed = node.config.exec?.sandbox !== undefined
     const grantsWrite = (node.config.exec?.sandbox?.allow?.write?.length ?? 0) > 0
-    // A `workspaceFiles` directory linked out of the workspace drops every
-    // file (M-65); a project one is refused by the resolver (X-88).
-    const linkedOut = outputDirLinkedOut(a.workspaceRoot, a.wsOutputs)
     warnOf(log)(
       `[vx] ${node.id}: outputs matched no files (${[...a.outputs, ...a.wsOutputs].join(', ')}) — ` +
         `an empty artifact is saved; a later hit restores nothing` +
-        (linkedOut !== undefined
-          ? ` — ${linkedOut.dir} is a symlink to ${linkedOut.target}, outside ${linkedOut.base}, and vx keeps only outputs inside it: make ${linkedOut.dir} a directory`
-          : sandboxed && !grantsWrite
-            ? ` — the task is sandboxed and declares no exec.sandbox.allow.write, so its writes never reached disk`
-            : '') +
+        (sandboxed && !grantsWrite
+          ? ` — the task is sandboxed and declares no exec.sandbox.allow.write, so its writes never reached disk`
+          : '') +
         bracketLiteralHint([
           ...a.outputs.map((g) => [node.projectDir, g] as const),
           ...a.wsOutputs.map((g) => [a.workspaceRoot, g] as const),
@@ -231,6 +235,7 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     )
   }
   const facts: SaveFacts = {}
+  let kept = false
   const save = async (): Promise<void> => {
     const saveStart = a.measure === true ? performance.now() : 0
     const endSave = span('miss: save')
@@ -262,6 +267,9 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     endSave()
     const bytes = cache.outputBytes?.(a.hash)
     if (bytes !== undefined) facts.outputBytes = bytes
+    // A `--force` run that found the key stored kept that entry: the
+    // footer's `↑` counts saves, and this was none.
+    if (cache.kept?.(a.hash) === true) kept = true
     if (a.measure === true) {
       facts.saveMs = Math.round(performance.now() - saveStart)
       // No local artifact (local writes off): no size to say.
@@ -300,11 +308,13 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
   // the entry before the outcome.
   if (a.deferSave !== undefined) {
     return {
-      landed: a.deferSave(save).then((stored) => (stored ? { ...facts, saved: true } : facts)),
+      landed: a
+        .deferSave(save, node.id)
+        .then((stored) => (stored && !kept ? { ...facts, saved: true } : facts)),
     }
   }
   await save()
-  return { landed: Promise.resolve({ ...facts, saved: true }) }
+  return { landed: Promise.resolve(kept ? facts : { ...facts, saved: true }) }
 }
 
 /** What `markUnsaved` reads of a miss: where its declared outputs are. */
@@ -342,10 +352,20 @@ async function resolveUnsaved(
     projectDir: a.node.projectDir,
     outputs: a.outputs,
     nestedProjectDirs: a.nestedProjectDirs,
+    inputs: {
+      projectDir: a.node.projectDir,
+      workspaceRoot: a.workspaceRoot,
+      declared: a.node.config.inputs,
+    },
   })
   const wsOutputFiles = await resolveWorkspaceOutputs({
     workspaceRoot: a.workspaceRoot,
     outputs: a.wsOutputs,
+    inputs: {
+      projectDir: a.node.projectDir,
+      workspaceRoot: a.workspaceRoot,
+      declared: a.node.config.inputs,
+    },
   })
   endResolve()
   return { outputFiles, wsOutputFiles }
@@ -399,46 +419,6 @@ function markWritten(
   }
 }
 
-/**
- * The first `workspaceFiles` directory that is a symlink resolving outside
- * the workspace root: every file under it is dropped as outside, and the
- * empty-artifact warning blamed the glob (M-65).
- */
-function outputDirLinkedOut(
-  baseDir: string,
-  outputs: readonly string[],
-): { dir: string; target: string; base: string } | undefined {
-  const realProject = realpathOrNull(baseDir) ?? baseDir
-  // `dist` names the tree `dist/**`: the same reading the resolver gives.
-  for (const pattern of asTrees(outputs.filter((o) => !o.startsWith('!')))) {
-    const literal = staticPrefix(pattern)
-      .split('/')
-      .filter((p) => p !== '' && p !== '.')
-    for (let i = 1; i <= literal.length; i++) {
-      const dir = literal.slice(0, i).join('/')
-      const abs = path.join(baseDir, dir)
-      try {
-        if (!lstatSync(abs).isSymbolicLink()) continue
-      } catch {
-        break
-      }
-      const target = realpathOrNull(abs)
-      if (target !== null && target !== realProject && !target.startsWith(realProject + path.sep)) {
-        return { dir, target, base: 'the workspace' }
-      }
-    }
-  }
-  return undefined
-}
-
-function realpathOrNull(p: string): string | null {
-  try {
-    return realpathSync(p)
-  } catch {
-    return null
-  }
-}
-
 /**
  * The clause a "matched no files" warning gains when a glob holds an
  * unescaped `[` and, read as a literal path, names something on disk:

package/src/orchestrator/options.ts

@@ -8,6 +8,7 @@ import type { TaskOutcome } from '../graph/index.js'
 import type { AffectedReason } from './affected-tasks.js'
 import type { EventBus, Logger } from '../report/index.js'
 import type { TelemetrySink } from './telemetry.js'
+import type { CommandWindows } from './command-windows.js'
 import type { AffectedChanges, ProjectEntry, ProjectMeta } from '../workspace/index.js'
 import type { RunSettings } from '../config.js'
 
@@ -220,6 +221,11 @@ export interface RunOptions {
    * is replaced only when the next cycle starts.
    */
   holdPersistent?: boolean
+  /**
+   * The run is a `vx watch` cycle: an input edited while a task ran starts
+   * the next cycle, and the line withholding the task's save says so.
+   */
+  watch?: boolean
   /**
    * The servers an earlier `holdPersistent` run handed back. Each one still
    * up whose task this run would start again, with the same resolved
@@ -232,6 +238,13 @@ export interface RunOptions {
    * not take.
    */
   keep?: HeldPersistent
+  /**
+   * Where the run records when each command ran (and each restore or deferred fetch)
+   * and where it may write (command-windows.ts). The watch loop passes its
+   * own, so a write that lands during the cycle and no command of it may
+   * have made is the user's edit, whatever the file settles to.
+   */
+  commandWindows?: CommandWindows
   /**
    * Print the per-task table (`--verbosity 1`) just above the footer: the
    * footer is the run's last word, so the caller cannot print it after.

package/src/orchestrator/output-host.ts

@@ -3,9 +3,10 @@
 // and core's renderer is the run's, byte for byte.
 
 import { terminalSubscriber, type RunEventSubscriber } from '../report/index.js'
-import type { Logger } from '../report/index.js'
+import type { Logger, RunEvent } from '../report/index.js'
 import { settleWithin, teardownTimeoutMs, thrownMessage } from '../util/index.js'
 import type { OutputContext, VxPlugin } from './plugin.js'
+import { readOnlyEvents } from './read-only.js'
 
 const REQUIRED = ['status', 'taskStdout', 'taskStderr', 'taskComplete'] as const
 const OPTIONAL = [
@@ -87,24 +88,35 @@ export function guardedOutput(
   }
   // An `async` method's rejection reached no one: an unhandled rejection
   // ended the run with a stack, exit 1, after its tasks had passed. It
-  // fails the Logger as a throw does; the event it was handed stays its.
+  // fails the Logger as a throw does, and core draws the event it was
+  // handed, as after a throw: a rejected `taskComplete` lost its task's row.
+  let current: RunEvent | undefined
   const logger = Object.create(claimed.logger) as Logger
   for (const k of [...REQUIRED, ...OPTIONAL, 'warn'] as const) {
     const method = claimed.logger[k] as ((...args: unknown[]) => unknown) | undefined
     if (typeof method !== 'function') continue
     ;(logger as unknown as Record<string, unknown>)[k] = (...args: unknown[]): void => {
+      const event = current
       const ret = method.apply(claimed.logger, args)
-      if (ret instanceof Promise) ret.catch(fail)
+      if (ret instanceof Promise)
+        ret.catch((err: unknown) => {
+          fail(err)
+          if (event !== undefined) fallback(event)
+        })
     }
   }
   const render = terminalSubscriber(logger)
+  const viewOf = readOnlyEvents()
   return (event) => {
     if (failed) return fallback(event)
+    current = event
     try {
-      render(event)
+      render(viewOf(event))
     } catch (err) {
       fail(err)
       fallback(event)
+    } finally {
+      current = undefined
     }
   }
 }

package/src/orchestrator/output-log.ts

@@ -5,7 +5,7 @@
 // a literal RS doubled. Output that never touched stderr is its own text.
 
 import { type BoundedCapture, type CapturedChunk, isDroppedOutputChunk } from '../exec/index.js'
-import { MASKED, type SecretMask } from '../util/index.js'
+import { maskStreams, type SecretMask } from '../util/index.js'
 
 const RS = '\x1e'
 
@@ -43,59 +43,6 @@ export function maskedOutputLog(chunks: readonly CapturedChunk[], mask: SecretMa
   return h + back + chunks[at]!.text + lead + t
 }
 
-/**
- * Each stream's run of adjacent non-empty chunks joined, with `mask`
- * applied to each stream's text as a whole: a value is masked where it
- * starts and its rest dropped from the runs it reaches. The live stream
- * masks chunk by chunk and lets a held piece go after a pause, so a value
- * written in two pieces reached the capture in two chunks, and a write to
- * the other stream between them made them two runs. A hit replays each
- * stream to its own descriptor, so `vx run > log` joined them again.
- */
-export function maskStreams(
-  chunks: readonly CapturedChunk[],
-  mask: SecretMask | undefined,
-): CapturedChunk[] {
-  if (mask === undefined) return chunks.filter((c) => c.text.length > 0)
-  const runs: CapturedChunk[] = []
-  for (const c of chunks) {
-    if (c.text.length === 0) continue
-    const last = runs.at(-1)
-    if (last !== undefined && last.err === c.err) last.text += c.text
-    else runs.push({ text: c.text, err: c.err })
-  }
-  for (const err of [false, true]) {
-    const own = runs.filter((r) => r.err === err)
-    const spans = mask.spans(own.map((r) => r.text).join(''))
-    if (spans.length === 0) continue
-    let at = 0
-    let i = 0
-    for (const r of own) {
-      const end = at + r.text.length
-      let text = ''
-      let from = at
-      for (; i < spans.length && spans[i]![0] < end; i++) {
-        const [s, e] = spans[i]!
-        if (s >= from) text += r.text.slice(from - at, s - at) + MASKED
-        from = Math.max(from, Math.min(e, end))
-        // A value that runs past this run is cut from the next one too.
-        if (e > end) break
-      }
-      r.text = text + r.text.slice(from - at)
-      at = end
-    }
-  }
-  // A run emptied whole leaves its neighbours, the other stream, adjacent.
-  const kept: CapturedChunk[] = []
-  for (const r of runs) {
-    if (r.text.length === 0) continue
-    const last = kept.at(-1)
-    if (last !== undefined && last.err === r.err) last.text += r.text
-    else kept.push(r)
-  }
-  return kept
-}
-
 /** The chunks `encodeOutputLog` wrote, adjacent same-stream text joined. */
 export function decodeOutputLog(log: string): CapturedChunk[] {
   if (!log.includes(RS)) return log.length === 0 ? [] : [{ text: log, err: false }]

package/src/orchestrator/persistent-task.ts

@@ -30,7 +30,7 @@ import {
 } from './sandbox-request.js'
 import { shellVerdict } from './shell-verdict.js'
 import { forwardedSignal, terminateChildren } from './signals.js'
-import { computeTaskHash } from './task-hash.js'
+import { computeTaskHash, keyOf } from './task-hash.js'
 import {
   forgetUndeclaredWrites,
   isAborted,
@@ -52,16 +52,18 @@ export function serverKey(args: ExecuteArgs): Promise<string | undefined> | stri
   if (args.noDependants === true) return undefined
   return (
     args.upfrontKey ??
-    computeTaskHash({
-      node: args.node,
-      upstream: args.upstream,
-      workspaceRoot: args.workspaceRoot,
-      cache: args.cache,
-      forwardArgs: args.forwardArgs,
-      nestedProjectDirs: args.nestedProjectDirs,
-      ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
-      ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
-    })
+    keyOf(
+      computeTaskHash({
+        node: args.node,
+        upstream: args.upstream,
+        workspaceRoot: args.workspaceRoot,
+        cache: args.cache,
+        forwardArgs: args.forwardArgs,
+        nestedProjectDirs: args.nestedProjectDirs,
+        ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
+        ...(args.hashCache !== undefined ? { hashCache: args.hashCache } : {}),
+      }),
+    )
   )
 }
 
@@ -129,6 +131,7 @@ export async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutc
     await args.armSandbox?.()
     // A persistent task never declares `cache` (the loader refuses it), so
     // it keeps the whole linked grant: no key of its can be stale.
+    const deps = await dependencyReads(args.readableDeps?.(node) ?? [], args.workspaceRoot)
     const sb = await sandboxRequestFor(
       node,
       step.sandbox,
@@ -136,7 +139,8 @@ export async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutc
       undefined,
       args.nestedProjectDirs,
       args.cacheDir,
-      await dependencyReads(args.readableDeps?.(node) ?? [], args.workspaceRoot),
+      deps.reads,
+      deps.reported,
     )
     placeholders = sb.placeholders
     serverSandbox = sb.sandbox
@@ -181,6 +185,17 @@ export async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutc
       : {}),
     ...(signalChannel ? { signalChannel } : {}),
     ...(args.terminal === true ? { terminal: true } : {}),
+    // What the pre-ready text left held goes out first, so the run can
+    // tell it from what the server writes since ready.
+    ...(args.serverReady !== undefined
+      ? {
+          onReady: () => {
+            serverMasked?.end()
+            ends.end()
+            args.serverReady!(node.id)
+          },
+        }
+      : {}),
   }
   if (step.persistent.readyWhen !== undefined) {
     persistentOpts.readyWhen = step.persistent.readyWhen
@@ -244,7 +259,9 @@ export async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutc
     readyWhen === undefined
       ? undefined
       : setTimeout(() => {
-          if (isAborted(args.stopSignal)) return
+          // A server that traps SIGTERM runs out the kill grace after the
+          // timeout gave up; the wait is over, and its failure says so.
+          if (isAborted(args.stopSignal) || spawn.gaveUp()) return
           const after = noticeMs < 1000 ? `${noticeMs} ms` : `${noticeMs / 1000} s`
           const unbounded = effectiveTimeout === undefined ? ', with no exec.timeout' : ''
           warnOf(log)(
@@ -288,10 +305,7 @@ export async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutc
     // (an embedder) never saw a bare stderr write at all. What waited on
     // an open line goes first.
     ends.end()
-    log.taskStderr(
-      node,
-      ends.own(`[vx] ${node.id}: persistent task failed to become ready: ${message}\n`),
-    )
+    log.taskStderr(node, ends.own(`[vx] ${node.id}: not ready: ${message}\n`))
     // A server's 127, 126 or signal death needs the line a one-shot task's
     // gets (execute-task.ts): a dev server whose tool sits in a sibling's
     // bin said only "exit 127".