@vzn/vx 0.0.652 → 0.0.653

package/src/orchestrator/projects.ts

@@ -4,6 +4,7 @@
 // plugin `project` stage, which can give tasks to a package that never
 // wrote a `vx.config.ts`.
 
+import { existsSync } from 'node:fs'
 import { stat } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
@@ -14,6 +15,7 @@ import {
   lockedProjects,
   NO_LOCK,
   pathName,
+  PROJECT_CONFIG_FILENAMES,
   readLockfile,
   validateProjectConfig,
   type Lockfile,
@@ -22,8 +24,9 @@ import {
   type ProjectMeta,
 } from '../workspace/index.js'
 import type { WorkspaceConfig } from '../config.js'
-import { lazyGitEnumeration, type LazyGitEnumeration } from '../cache/index.js'
-import { relPosix, UserError } from '../util/index.js'
+import { atPath, SETTINGS } from '../settings.js'
+import { lazyGitEnumeration, type LazyGitEnumeration, parseCachePolicy } from '../cache/index.js'
+import { checkIgnoreSync, isUserError, relPosix, UserError } from '../util/index.js'
 import {
   cacheScopeError,
   isCacheScope,
@@ -34,8 +37,10 @@ import {
   validateWorkspace,
 } from '../workspace/index.js'
 import { DEFAULT_BUILD, parseDependencySpec } from '../graph/index.js'
+import { workspaceFile } from '../handoff.js'
 import { applyConfigHooks, applyDiscoverHooks, applyProjectHooks, hasHook } from './plugin-host.js'
 import type { BranchFacts, VxPlugin } from './plugin.js'
+import { freezeDeep, readOnly } from './read-only.js'
 
 /**
  * The workspace config with the plugin `config` stage applied — the first
@@ -49,12 +54,27 @@ export async function loadWorkspacePlugins(
   workspaceConfig: WorkspaceConfig | null
   plugins: readonly VxPlugin[]
   branch: BranchFacts
+  /** Setting path → the last plugin whose `config` hook changed it (`vx info`). */
+  settingPlugins: ReadonlyMap<string, string>
 }> {
   const loaded = await loadWorkspaceConfig(workspaceRoot)
+  const policy = loaded?.cache?.policy
+  if (policy !== undefined) {
+    // The grammar is the cache module's, which the schema may not import:
+    // checked here, where the file is known, so the refusal is framed.
+    try {
+      parseCachePolicy(policy)
+    } catch (err) {
+      const file = await workspaceFile(workspaceRoot)
+      if (!isUserError(err) || file === null) throw err
+      throw new UserError(`${file}: \`cache.policy\` ${err.message}`, 'VX_E_CONFIG')
+    }
+  }
   const plugins = (loaded?.plugins ?? []) as readonly VxPlugin[]
   const branch: BranchFacts = {}
+  const settingPlugins = new Map<string, string>()
   if (loaded === null || !hasHook(plugins, 'config'))
-    return { workspaceConfig: loaded, plugins, branch }
+    return { workspaceConfig: loaded, plugins, branch, settingPlugins }
   // Bun keeps one module per specifier, so the file's export is one object
   // per process: the CLI's selection pass, the run and each `vx watch`
   // cycle handed the hooks what the last load's hooks had edited
@@ -91,9 +111,17 @@ export async function loadWorkspacePlugins(
       branch.refs = [...new Set(facts.refs)]
     }
   }
+  const settingPaths = SETTINGS.filter((s) => s.config !== false).map((s) => s.path)
+  const settingValues = new Map(settingPaths.map((p) => [p, atPath(workspaceConfig, p)]))
   await applyConfigHooks(plugins, workspaceConfig, { workspaceRoot, warn, setBranch }, (plugin) => {
     const at = `.vx/workspace (after plugin '${plugin.name}')`
     validateWorkspace(workspaceConfig, at)
+    for (const p of settingPaths) {
+      const v = atPath(workspaceConfig, p)
+      if (v === settingValues.get(p)) continue
+      settingValues.set(p, v)
+      settingPlugins.set(p, plugin.name)
+    }
     // The run takes `plugins` from the file: an edited list validated and was dropped.
     const now = workspaceConfig.plugins
     if (now?.length !== list?.length || now?.some((p, i) => p !== list![i])) {
@@ -102,7 +130,7 @@ export async function loadWorkspacePlugins(
       )
     }
   })
-  return { workspaceConfig, plugins, branch }
+  return { workspaceConfig, plugins, branch, settingPlugins }
 }
 
 const isRef = (r: unknown): boolean =>
@@ -128,6 +156,17 @@ export function lockOfDiscovery(
   return discoveredLock.get(projects)
 }
 
+/** The nested workspace roots (absolute) the lock a discovery read records, by the array it returned. */
+const discoveredWalls = new WeakMap<readonly ProjectMeta[], readonly string[]>()
+
+/**
+ * Where every project's outputs stop besides its nested projects: the
+ * nested workspaces `vx lock` found. None for an array no discovery made.
+ */
+export function nestedWorkspacesOf(projects: readonly ProjectMeta[]): readonly string[] {
+  return discoveredWalls.get(projects) ?? []
+}
+
 /**
  * The package graph a selection pass built over a discovery, by that
  * discovery's array, when it folded no task edge in: the graph a run that
@@ -143,6 +182,31 @@ export function keepDiscoveryGraph(projects: readonly ProjectMeta[], graph: Pack
   discoveredGraph.set(projects, graph)
 }
 
+/** The plugin whose `discover` entry made each project the lock does not hold. */
+const addedBy = new WeakMap<object, string>()
+
+/**
+ * Why a project a `discover` plugin added holds no config while its
+ * directory has one git ignores, or undefined: `vx lock` reads only the
+ * configs git lists, so "run `vx lock`" could never fix it. `config` is
+ * the file on disk, looked for when not given. One git spawn, asked only
+ * of a directory holding a config.
+ */
+export function ignoredConfigRefusal(
+  root: string,
+  meta: { readonly name: string; readonly dir: string },
+  config?: string,
+): string | undefined {
+  const by = addedBy.get(meta)
+  if (by === undefined) return undefined
+  const file =
+    config ?? PROJECT_CONFIG_FILENAMES.map((n) => path.join(meta.dir, n)).find((f) => existsSync(f))
+  if (file === undefined) return undefined
+  const rel = relPosix(root, file)
+  if (checkIgnoreSync(root, [rel])?.has(rel) !== true) return undefined
+  return `plugin '${by}' adds project ${meta.name}, but git ignores ${rel}, so \`vx lock\` cannot read it — unignore it or delete it`
+}
+
 /**
  * The workspace's projects: the directories the lock records (a run never
  * walks for configs), then the plugin `discover` stage, which may add
@@ -158,7 +222,13 @@ export async function discoverProjects(
   /** The run's enumeration, which `DiscoverContext.worktreeChanges` reads (and starts). */
   git: LazyGitEnumeration = lazyGitEnumeration(workspaceRoot),
 ): Promise<ProjectMeta[]> {
-  const projects = lockedProjects(workspaceRoot, (await lock()).projects)
+  const read = await lock()
+  const projects = lockedProjects(workspaceRoot, read.projects)
+  if (read.nestedWorkspaces !== undefined)
+    discoveredWalls.set(
+      projects,
+      read.nestedWorkspaces.map((rel) => path.join(workspaceRoot, rel)),
+    )
   // Registered whatever the hooks: an `--affected` selection reads its
   // untracked files from this walk, and the run reuses it (I-26).
   discoveredGit.set(projects, git)
@@ -176,7 +246,10 @@ export async function discoverProjects(
     { workspaceRoot, cacheDir, warn, worktreeChanges },
     async (entry, plugin) => {
       const found = await discoveredProject(workspaceRoot, byDir, entry, plugin.name)
-      if (found.added) byDir.set(found.meta.dir, found.meta)
+      if (found.added) {
+        byDir.set(found.meta.dir, found.meta)
+        addedBy.set(found.meta, plugin.name)
+      }
       return found
     },
   )
@@ -259,6 +332,10 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
   // behind `^build`. Left out, its edit replayed the dependant's stale
   // output as a hit (X-9).
   const projectStage = hasHook(plugins, 'project')
+  // A hook that set one project's `dir` to another's moved it there: the
+  // graph's directory guard read the moved entry, and its outputs clean
+  // emptied the other project's.
+  if (projectStage) freezeDeep(args.projectMetas)
   const configured = args.projectMetas.filter(
     (m) => projectStage || (typeof m.configPath === 'string' && m.configPath.length > 0),
   )
@@ -372,9 +449,10 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
       }
       const frozen: ProjectConfig =
         meta.configPath === null ? { tasks: {} } : (loaded[next++] as ProjectConfig)
-      // The lock shares a task two projects declare alike: an edit in place
-      // works on this project's own copy.
-      const config = projectStage ? structuredClone(frozen) : frozen
+      // The lock shares a task, or a part of one, every place declares alike,
+      // in this project too: an edit in place works on a copy that shares
+      // nothing. `structuredClone` keeps the sharing; the lock is JSON.
+      const config: ProjectConfig = projectStage ? JSON.parse(JSON.stringify(frozen)) : frozen
       if (projectStage) {
         // The `project` stage edits the validated object in place; core
         // re-validates after EACH plugin so a plugin can only produce what
@@ -391,7 +469,8 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
             warn: args.warn,
             name: meta.name,
             dir: meta.dir,
-            projects: args.projectMetas,
+            // The view `discover` was handed: nx() keys its graph on its identity.
+            projects: readOnly(args.projectMetas),
             lock: args.lock === true,
           },
           (plugin) => {

package/src/orchestrator/read-only.ts

@@ -0,0 +1,115 @@
+// What a plugin is handed to observe is read-only. A setup handler that set
+// a failed outcome's status to `success` made the run pass and its
+// dependants run; a sink that cleared a record's `failedAttempts` cleared
+// the outcome's own, and the run's failure log crashed on it. A write
+// throws, inside the plugin's own call, where core already reports a throw
+// naming the plugin.
+
+import type { RunEvent } from '../report/index.js'
+
+/**
+ * Freezes `value` and everything it holds, in place: for an object core
+ * built for plugins and no longer writes (a telemetry record, the run
+ * report, the project list). An object already frozen is taken as done, so
+ * each is walked once.
+ */
+export function freezeDeep<T>(value: T): T {
+  if (typeof value !== 'object' || value === null || Object.isFrozen(value)) return value
+  // A typed array with elements cannot be frozen; none is in a record.
+  if (ArrayBuffer.isView(value)) return value
+  Object.freeze(value)
+  for (const key of Object.keys(value)) freezeDeep((value as Record<string, unknown>)[key])
+  return value
+}
+
+/** The write a read-only view refuses: a TypeError, as a frozen object's is, saying why. */
+function refused(key: string | symbol): TypeError {
+  return new TypeError(
+    `'${String(key)}' is read-only: vx hands a plugin what it observes, not what the run decides`,
+  )
+}
+
+/**
+ * The run's events as a plugin sees them: a read-only view of each, made at
+ * the first read of each object and kept for the run, so every plugin reads
+ * the same view and a node keeps one identity from its start to its end.
+ * A view, not a copy: core still writes an outcome after its task ends
+ * (`serverExit`), and a frozen deep copy of each node and outcome was ~5 us
+ * of every task a hook heard (10,000 tasks: 45 ms).
+ */
+export function readOnlyEvents(): (event: RunEvent) => RunEvent {
+  return readOnlyViews()
+}
+
+/**
+ * What a stage hands a plugin that core goes on using live: a task node in
+ * `key`, `schedule` and `admit` (core writes its key parts, platform and
+ * deps after, so it is not frozen), the project list in `discover` (core
+ * names and grows it after each plugin). A key hook that moved a node's
+ * `projectDir` ran it in another project; an admit hook that rewrote its
+ * command ran it under the declared one's key. One view per object for the
+ * process, so a plugin that keys on identity (nx() on the project list,
+ * from `discover` to `project`) sees one object across stages.
+ */
+export const readOnly: <T>(value: T) => T = readOnlyViews()
+
+/** `nodes` as a `schedule` hook reads it: each node a read-only view, the map itself unwritable. */
+export function readOnlyNodes<V>(nodes: ReadonlyMap<string, V>): ReadonlyMap<string, V> {
+  const out = new Map<string, V>()
+  for (const [id, node] of nodes) out.set(id, readOnly(node))
+  for (const key of ['set', 'delete', 'clear'] as const)
+    Object.defineProperty(out, key, {
+      value: () => {
+        throw refused(key)
+      },
+    })
+  return out
+}
+
+/**
+ * Read-only views of plain objects and arrays, each made at its first read
+ * and kept. Only plain objects and arrays are wrapped: a Map's methods need
+ * the Map itself, and a frozen object is read-only already.
+ */
+function readOnlyViews(): <T>(value: T) => T {
+  const views = new WeakMap<object, object>()
+  const handler: ProxyHandler<object> = {
+    // A frozen target's own values are its own: a proxy must answer them
+    // unchanged, and they are read-only already.
+    get: (target, key) => {
+      const value: unknown = Reflect.get(target, key)
+      return Object.isFrozen(target) ? value : view(value)
+    },
+    // Each refused whatever the plugin's mode: a frozen object's write is
+    // silent outside strict code.
+    set: (_target, key) => {
+      throw refused(key)
+    },
+    defineProperty: (_target, key) => {
+      throw refused(key)
+    },
+    deleteProperty: (_target, key) => {
+      throw refused(key)
+    },
+    setPrototypeOf: () => {
+      throw refused('prototype')
+    },
+    preventExtensions: () => {
+      throw refused('extensions')
+    },
+  }
+  function view<T>(value: T): T {
+    if (typeof value !== 'object' || value === null) return value
+    // Before the frozen check: the project list is viewed in `discover`
+    // and frozen before `project`, and keeps its one view.
+    const seen = views.get(value)
+    if (seen !== undefined) return seen as T
+    if (Object.isFrozen(value)) return value
+    const proto: unknown = Object.getPrototypeOf(value)
+    if (proto !== Object.prototype && proto !== Array.prototype && proto !== null) return value
+    const made = new Proxy(value, handler)
+    views.set(value, made)
+    return made as T
+  }
+  return view
+}

package/src/orchestrator/run-context.ts

@@ -455,13 +455,17 @@ function workTreePath(root: string): string | undefined {
  * Normalize a git remote URL so every checkout of the same repository
  * derives the SAME workspace id: `git@github.com:o/r.git`,
  * `ssh://git@github.com/o/r`, and `https://github.com/o/r.git` all
- * reduce to `github.com/o/r`.
+ * reduce to `github.com/o/r`. No credential survives: the userinfo ends
+ * at the last `@` before the path, as a URL parser splits it (a password
+ * may hold `@`), and a query or fragment (`?private_token=`) is dropped.
  */
 export function normalizeRemoteUrl(raw: string): string {
   let s = raw.trim().toLowerCase()
   const hadProtocol = /^[a-z+]+:\/\//.test(s)
   s = s.replace(/^[a-z+]+:\/\//, '') // protocol
-  s = s.replace(/^[^@/]+@/, '') // user[:pass]@
+  s = s.replace(/[?#].*$/s, '') // ?query, #fragment
+  // user[:pass]@; scp shorthand has no password, and its path follows a `:`.
+  s = s.replace(hadProtocol ? /^[^/]*@/ : /^[^@/]+@/, '')
   // A `:port` only appears in a protocol-form URL (`ssh://host:2222/path`); the
   // scp shorthand `host:path` has no port. STRIP it (the old code reinserted it
   // as a path segment, so `ssh://host:2222/o/r` and `https://host/o/r` — the

package/src/orchestrator/run-failures.ts

@@ -3,11 +3,11 @@
 // cache.db's `failures` (cache/run-notes.ts), the newest 50 failed runs kept.
 
 import type { Database } from 'bun:sqlite'
-import { indexDb, type Cache, keepRunNotes, keptFailures } from '../cache/index.js'
+import { indexDb, type Cache, keepRunNotes, keptFailures, storedLog } from '../cache/index.js'
 import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 import { decodeOutputLog } from './output-log.js'
 import { PASS_STATUSES } from '../history/index.js'
-import { maskedLine, splitTaskId } from '../util/index.js'
+import { maskedLine, splitTaskId, stripEscapes } from '../util/index.js'
 import { fileLocations, fileMemo, type OutputLocation } from '../ui/index.js'
 
 /** A failed task of a run and what it said. */
@@ -74,7 +74,7 @@ export function writeRunFailures(
 }
 
 const plain = (log: string): string =>
-  Bun.stripANSI(
+  stripEscapes(
     decodeOutputLog(log)
       .map((c) => c.text)
       .join(''),
@@ -166,8 +166,9 @@ export interface TaskLog {
   status: string
   /**
    * Where the output came from: the run's kept failure output, the cache
-   * entry the task saved or hit (masked as it was replayed), or null when
-   * vx kept none (an uncached task that passed, a skip).
+   * entry the task saved or hit while it still holds that output (masked as
+   * it was replayed), or null when vx kept none (an uncached task that
+   * passed, a skip, an entry another run wrote since).
    */
   source: 'failure' | 'cache' | null
   /** Plain text; '' when `source` is null. The files it names: `runFailures`. */
@@ -183,7 +184,7 @@ export function taskLog(db: Database, taskId: string, runId?: string): TaskLog |
   if (project === '' || task === '') return null
   const row = db
     .query(
-      `SELECT run_id AS runId, hash, status FROM runs
+      `SELECT run_id AS runId, hash, status, cache_hit AS hit, started_at AS startedAt FROM runs
        WHERE project = ? AND task = ? AND run_id IS NOT NULL ${runId === undefined ? '' : 'AND run_id = ?'}
        ORDER BY id DESC LIMIT 1`,
     )
@@ -191,6 +192,8 @@ export function taskLog(db: Database, taskId: string, runId?: string): TaskLog |
     runId: string
     hash: string
     status: string
+    hit: number | null
+    startedAt: number
   } | null
   if (row === null) return null
   const base = { runId: row.runId, taskId, status: row.status }
@@ -213,17 +216,32 @@ export function taskLog(db: Database, taskId: string, runId?: string): TaskLog |
       before === undefined || tries === null || tries === undefined
         ? ''
         : `${before}${attemptHeading(tries, tries, 'passed')}`
-    const stored = db.query('SELECT stdout FROM entry_stdout WHERE hash = ?').get(row.hash) as {
-      stdout: string
-    } | null
+    // The entry is the key's, not the run's: a `--force` run kept the one it
+    // found, and a key evicted and saved again, or saved by two checkouts
+    // of one store at once, holds another run's output. The entry names
+    // the run that wrote it and when, so the log is this run's only when
+    // this run wrote it, or this run hit it and nothing wrote it since;
+    // otherwise the log reads as not kept. Keeping every run's log would
+    // hold a copy per run of what the entry already holds once.
+    const entry = db
+      .query('SELECT run_id AS writer, created_at AS writtenAt FROM entries WHERE hash = ?')
+      .get(row.hash) as { writer: string | null; writtenAt: number } | null
+    const own =
+      entry !== null &&
+      (entry.writer === row.runId || (row.hit === 1 && entry.writtenAt < row.startedAt))
+    const stored = own
+      ? (db.query('SELECT stdout FROM entry_stdout WHERE hash = ?').get(row.hash) as {
+          stdout: Uint8Array
+        } | null)
+      : null
     if (stored !== null) {
       // An entry saved before masking, or by another machine, can hold a
       // secret-named variable's value: masked as a hit's replay masks it.
       // This process's env only: `vx last` loads no config, so a task's
       // `env.define` / `env.secret` values are not known here.
       const output = maskedLine(
-        Bun.stripANSI(
-          decodeOutputLog(stored.stdout)
+        stripEscapes(
+          decodeOutputLog(storedLog(stored.stdout))
             .map((c) => c.text)
             .join(''),
         ),
@@ -231,12 +249,23 @@ export function taskLog(db: Database, taskId: string, runId?: string): TaskLog |
       return { ...base, source: 'cache', output: prefix + output }
     }
     // An entry that printed nothing stores no stdout row: kept, and empty.
-    if (db.query('SELECT 1 FROM entries WHERE hash = ?').get(row.hash) !== null) {
+    if (own) {
       return { ...base, source: 'cache', output: prefix }
     }
   }
-  // A pass with no entry that took a retry still kept its failed attempts.
+  // A pass with no entry that took a retry still kept its failed attempts,
+  // then says the last passed: without it the log read as a failure.
   const kept = row.status === 'failed' ? undefined : keptFailures(db, row.runId).get(taskId)
-  if (kept !== undefined) return { ...base, source: 'failure', output: kept.output }
+  if (kept !== undefined) {
+    const tries = (
+      db
+        .query(
+          'SELECT attempts FROM runs WHERE run_id = ? AND project = ? AND task = ? ORDER BY id DESC LIMIT 1',
+        )
+        .get(row.runId, project, task) as { attempts: number | null } | null
+    )?.attempts
+    const passed = typeof tries === 'number' ? attemptHeading(tries, tries, 'passed') : ''
+    return { ...base, source: 'failure', output: kept.output + passed }
+  }
   return { ...base, source: null, output: '' }
 }

package/src/orchestrator/run-id.ts

@@ -8,15 +8,26 @@ import { UserError } from '../util/index.js'
  * The recorded run `raw` names: itself when recorded, else the one run
  * whose id starts with it. Null when none does; a prefix several runs share
  * is refused with those runs, since picking one would replay the wrong run.
+ * A run a stop ended keeps task rows but no header (item 854), and `vx why`
+ * and `vx last --log` print its id, so its rows name it too.
  */
 export function resolveRunId(db: Database, raw: string, verb: string): string | null {
   // Run ids are lower-case UUIDs; one typed or pasted in upper case is the same id.
   const id = raw.toLowerCase()
-  const exact = db.query('SELECT 1 FROM invocations WHERE run_id = ?').get(id)
+  const exact = db
+    .query(
+      'SELECT 1 FROM invocations WHERE run_id = ?1 UNION ALL SELECT 1 FROM run_ids WHERE run_id = ?1 LIMIT 1',
+    )
+    .get(id)
   if (exact !== null) return id
+  // A range on `run_ids` (every run with rows), so its index answers:
+  // `substr` read every row.
+  // `~` sorts after every character of an id.
   const rows = db
     .query(
-      'SELECT run_id FROM invocations WHERE substr(run_id, 1, ?) = ? ORDER BY run_id DESC LIMIT 6',
+      `SELECT run_id FROM invocations WHERE substr(run_id, 1, ?1) = ?2
+       UNION SELECT run_id FROM run_ids WHERE run_id >= ?2 AND run_id < ?2 || '~'
+       ORDER BY run_id DESC LIMIT 6`,
     )
     .all(id.length, id) as Array<{ run_id: string }>
   if (rows.length === 0) return null