@vzn/vx 0.0.652 → 0.0.653

package/src/util/errors.ts

@@ -86,16 +86,22 @@ export function errorCode(err: unknown): string {
  * Does this argv ask for JSON (`--format json`, `--format=json`,
  * `--dry=json`)? Then a refusal is a JSON document on stdout too, so a
  * reader of stdout gets an answer, not nothing. Args after `--` are the
- * task's, not vx's.
+ * task's, not vx's. Each flag's LAST value counts, as every verb's parser
+ * keeps it: `--format json --format pretty` prints pretty. `--dry` alone is
+ * run's pretty plan, and a switch beside `--format` elsewhere.
  */
 export function wantsJson(argv: readonly string[]): boolean {
+  let format: string | undefined
+  let dry: string | undefined
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!
-    if (a === '--') return false
-    if (a === '--format=json' || a === '--dry=json') return true
-    if (a === '--format' && argv[i + 1] === 'json') return true
+    if (a === '--') break
+    if (a === '--format') format = argv[++i]
+    else if (a.startsWith('--format=')) format = a.slice('--format='.length)
+    else if (a === '--dry') dry = 'pretty'
+    else if (a.startsWith('--dry=')) dry = a.slice('--dry='.length)
   }
-  return false
+  return format === 'json' || dry === 'json'
 }
 
 /**
@@ -185,9 +191,18 @@ export function isOutOfFds(err: unknown): err is NodeJS.ErrnoException {
 export const OUT_OF_FDS_HINT =
   'the process is out of file descriptors; raise the limit (ulimit -n 4096) and re-run'
 
-/** A file system refusing a write for a reason no code path caused: permission or space. */
+/**
+ * `ENAMETOOLONG`: a path past what the file system takes (PATH_MAX, 4096
+ * bytes on Linux; NAME_MAX for one name). The path is the user's: an
+ * output that deep failed its save as an internal error.
+ */
+function isNameTooLong(err: unknown): err is NodeJS.ErrnoException {
+  return err instanceof Error && (err as NodeJS.ErrnoException).code === 'ENAMETOOLONG'
+}
+
+/** A file system refusing a path for a reason no code path caused: permission, space or length. */
 export function isFsRefusal(err: unknown): err is NodeJS.ErrnoException {
-  return isPermissionError(err) || isDiskFull(err)
+  return isPermissionError(err) || isDiskFull(err) || isNameTooLong(err)
 }
 
 export const DISK_FULL_HINT = 'the disk that path is on is full'
@@ -205,6 +220,7 @@ const READ_SYSCALLS = new Set(['scandir', 'stat', 'lstat', 'readlink', 'read', '
 export function fsRefusalHint(err: NodeJS.ErrnoException): string {
   const { syscall } = err
   if (isDiskFull(err)) return DISK_FULL_HINT
+  if (isNameTooLong(err)) return 'that path is longer than the file system allows; shorten it'
   // A listing told to be a write sent the user to chmod the wrong thing.
   return READ_SYSCALLS.has(syscall ?? '') ? READ_PERMISSION_HINT : PERMISSION_HINT
 }

package/src/util/foreign-cache-dir.ts

@@ -0,0 +1,60 @@
+import { existsSync, realpathSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import path from 'node:path'
+import { UserError } from './errors.js'
+
+export const OWN_DIR_HINT =
+  'Point `cache.dir` in .vx/workspace.ts (or --cache-dir) at a directory of its own, such as .vx/cache.'
+
+/** Cache directories this process already found to be vx's own, with the workspace root asked for. */
+const passed = new Set<string>()
+
+/**
+ * Refuses a cache directory that resolves to the home directory, the file
+ * system root, or a directory holding the workspace or a repository:
+ * compared unresolved, a `.vx/cache` linked to `~` or `..` passed, the run
+ * wrote its index and config bundle there, and `vx cache clean` deleted
+ * every entry (the home directory; the workspace's `.git` and config). The
+ * config bundle asks first and the cache's open again: one realpath, as a
+ * pass is kept for the process; a refusal is decided afresh each time. A
+ * directory not there yet is made as named, by its caller.
+ */
+export function refuseForeignCacheDir(cacheDir: string, workspaceRoot: string | undefined): void {
+  const memo = `${path.resolve(cacheDir)}\0${workspaceRoot ?? ''}`
+  if (passed.has(memo)) return
+  let real: string
+  try {
+    real = realpathSync(cacheDir)
+  } catch {
+    return
+  }
+  const home = process.env['HOME'] || homedir()
+  let what: string | undefined
+  if (real === path.parse(real).root) what = 'the file system root'
+  else if (sameDir(real, home)) what = 'the home directory'
+  else if (
+    (workspaceRoot !== undefined && !path.relative(real, workspaceRoot).startsWith('..')) ||
+    existsSync(path.join(real, '.git'))
+  )
+    what = 'a directory holding the workspace or a repository'
+  if (what === undefined) {
+    passed.add(memo)
+    return
+  }
+  throw new UserError(
+    `cache directory ${cacheDir} resolves to ${real}, ${what}: vx would keep its index there and \`vx cache clean\` would delete from it. ${OWN_DIR_HINT}`,
+    'VX_E_CONFIG',
+  )
+}
+
+function sameDir(a: string, b: string): boolean {
+  if (a === path.resolve(b)) return true
+  // A home named through a link: stats only when the names could agree.
+  if (path.basename(a) !== path.basename(b)) return false
+  try {
+    const [x, y] = [statSync(a), statSync(b)]
+    return x.ino === y.ino && x.dev === y.dev
+  } catch {
+    return false
+  }
+}

package/src/util/git-ignored.ts

@@ -4,6 +4,8 @@
 // knows every rule source (nested files, `info/exclude`, `core.excludesFile`)
 // and that a directory holding a tracked file is not ignored.
 
+import { existsSync } from 'node:fs'
+import path from 'node:path'
 import { gitEnv } from './hide-env.js'
 import { isLiteralPattern, normalizeGlob } from './paths.js'
 import { executablePath } from './which.js'
@@ -37,6 +39,56 @@ export function ignoreProbes(glob: string): { paths: string[]; deep: boolean; di
 
 const CHECK_IGNORE = ['check-ignore', '--stdin', '-z']
 
+/**
+ * Per directory git runs in, whether its `core.ignorecase=true` is false on
+ * disk: a `.git` copied from macOS to Linux keeps the setting, and git then
+ * takes a new `a.txt` beside the tracked `A.txt` for the tracked file and
+ * lists it nowhere. Asked only where git's config was read anyway.
+ */
+const caseLies = new Map<string, boolean>()
+
+/**
+ * Whether `core.ignorecase=true`, which git in `dir` reported, is false on
+ * disk: one stat of `probe` (an existing path) with its name's case
+ * swapped, once per `dir`. A name with no cased letter cannot tell, so git
+ * is trusted.
+ */
+export function ignoreCaseLies(dir: string, probe: string): boolean {
+  const at = path.resolve(dir)
+  let lies = caseLies.get(at)
+  if (lies === undefined) {
+    const name = path.basename(probe)
+    const lower = name.toLowerCase()
+    const twin = lower === name ? name.toUpperCase() : lower
+    lies = twin !== name && !existsSync(path.join(path.dirname(probe), twin))
+    caseLies.set(at, lies)
+  }
+  return lies
+}
+
+/**
+ * What a git spawn in `cwd` prepends so a wrong `core.ignorecase` hides no
+ * file: `-c core.ignorecase=false` at or under a directory `ignoreCaseLies`
+ * found lying (the disk there tells case apart, so the override is git's
+ * own answer for any repository on it), else nothing.
+ */
+export function gitCaseArgs(cwd: string): readonly string[] {
+  if (caseLies.size === 0) return []
+  const at = path.resolve(cwd)
+  for (const [dir, lies] of caseLies)
+    if (lies && (at === dir || at.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)))
+      return CASE_SENSITIVE
+  return []
+}
+
+const CASE_SENSITIVE = ['-c', 'core.ignorecase=false']
+
+// git reads each line as a pathspec, so `:top/dist/` was asked as
+// `top/dist/`. `./` keeps it the path it is (this command refuses
+// `:(literal)`), and git echoes each path back as given.
+const stdinOf = (paths: readonly string[]): Buffer =>
+  Buffer.from(paths.map((p) => `./${p}\0`).join(''))
+
 function ignoredOf(exitCode: number, stdout: Uint8Array): Set<string> | null {
   // 0: some ignored; 1: none; anything else (no work tree): undecided.
   if (exitCode === 1) return new Set()
@@ -45,7 +97,8 @@ function ignoredOf(exitCode: number, stdout: Uint8Array): Set<string> | null {
     new TextDecoder()
       .decode(stdout)
       .split('\0')
-      .filter((p) => p !== ''),
+      .filter((p) => p !== '')
+      .map((p) => p.slice(2)),
   )
 }
 
@@ -57,10 +110,10 @@ export async function checkIgnore(
   if (paths.length === 0) return new Set()
   try {
     const proc = Bun.spawn({
-      cmd: [executablePath('git'), ...CHECK_IGNORE],
+      cmd: [executablePath('git'), ...gitCaseArgs(cwd), ...CHECK_IGNORE],
       env: gitEnv(),
       cwd,
-      stdin: Buffer.from(paths.map((p) => `${p}\0`).join('')),
+      stdin: stdinOf(paths),
       stdout: 'pipe',
       stderr: 'ignore',
     })
@@ -76,10 +129,10 @@ export function checkIgnoreSync(cwd: string, paths: readonly string[]): Set<stri
   if (paths.length === 0) return new Set()
   try {
     const r = Bun.spawnSync({
-      cmd: [executablePath('git'), ...CHECK_IGNORE],
+      cmd: [executablePath('git'), ...gitCaseArgs(cwd), ...CHECK_IGNORE],
       env: gitEnv(),
       cwd,
-      stdin: Buffer.from(paths.map((p) => `${p}\0`).join('')),
+      stdin: stdinOf(paths),
       stdout: 'pipe',
       stderr: 'ignore',
     })
@@ -99,6 +152,7 @@ export function listedSync(cwd: string, dirs: readonly string[]): string[] | nul
     const r = Bun.spawnSync({
       cmd: [
         executablePath('git'),
+        ...gitCaseArgs(cwd),
         'ls-files',
         '-z',
         '--cached',

package/src/util/index.ts

@@ -75,6 +75,7 @@ export {
   dieOf,
   exitClaimedBySignal,
   killGraceMs,
+  POST_EXIT_DRAIN_MS,
   settleWithin,
   teardownTimeoutMs,
   testTimerMs,
@@ -101,18 +102,30 @@ export { gitEnv, helperEnv, hideEnvFromTasks } from './hide-env.js'
 export {
   checkIgnore,
   checkIgnoreSync,
+  gitCaseArgs,
+  ignoreCaseLies,
   ignoreProbes,
   listedSync,
   wholeIgnored,
 } from './git-ignored.js'
+export { OWN_DIR_HINT, refuseForeignCacheDir } from './foreign-cache-dir.js'
 export { realPath, realpathOf } from './real-path.js'
-export { IGNORE_ALL, ignoreDir, refuseSymlink, writeNoFollow } from './write-file.js'
+export {
+  IGNORE_ALL,
+  ignoreDir,
+  type PendingWrite,
+  refuseSymlink,
+  writeAllOrNone,
+  writeNoFollow,
+} from './write-file.js'
 export {
   heldSecrets,
+  holdSecret,
   maskedCommand,
   maskedStreams,
   maskedLine,
   MASKED,
+  maskStreams,
   secretMask,
   secretNamed,
   type SecretMask,
@@ -134,3 +147,4 @@ export {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+export { stripEscapes } from './plain-text.js'

package/src/util/paths.ts

@@ -306,13 +306,50 @@ function compileAnyTaskGlob(rawPatterns: readonly string[]): (rel: string) => bo
   if (patterns.length === 0) return () => false
   const sources = patterns.map(regExpSource)
   const globs = patterns.map(taskGlob)
-  if (sources.every((r) => r !== null)) {
-    const re = new RegExp(`^(?:${sources.join('|')})$`, 'u')
+  if (!sources.every((r) => r !== null)) return (rel) => globs.some((g) => g.match(rel))
+  // Each `**/` alternative opened with its own prefix, retried at every
+  // slash of the path: 1000 `**/fileN.ts` globs took 24 s over 200,000
+  // paths. One shared prefix before their alternation takes 50 ms.
+  const deep: string[] = []
+  const rest: string[] = []
+  for (const s of sources as string[]) {
+    if (s.startsWith(LEADING_GLOBSTAR)) deep.push(s.slice(LEADING_GLOBSTAR.length))
+    else rest.push(s)
+  }
+  const res = alternations(rest)
+  for (let i = 0; i < deep.length; i += ALTERNATIVES_PER_REGEXP) {
+    const part = deep.slice(i, i + ALTERNATIVES_PER_REGEXP)
+    res.push(new RegExp(`^${LEADING_GLOBSTAR}(?:${part.join('|')})$`, 'u'))
+  }
+  if (res.length === 1) {
+    const re = res[0]!
     return (rel) => (rel.endsWith('/') ? globs.some((g) => g.match(rel)) : re.test(rel))
   }
-  return (rel) => globs.some((g) => g.match(rel))
+  return (rel) =>
+    rel.endsWith('/') ? globs.some((g) => g.match(rel)) : res.some((re) => re.test(rel))
+}
+
+/**
+ * Alternatives per compiled RegExp. Bun's engine falls off a cliff past a
+ * few thousand: over 200k paths, 2000 literal-file alternatives took 32 ms,
+ * 4000 took 482 ms and 8000 took 15 s, so a project listing 4000 files in
+ * `inputs.files` paid that on every key. Below the cliff, the cost of
+ * splitting is flat.
+ */
+const ALTERNATIVES_PER_REGEXP = 1000
+
+function alternations(sources: readonly string[]): RegExp[] {
+  const out: RegExp[] = []
+  for (let i = 0; i < sources.length; i += ALTERNATIVES_PER_REGEXP) {
+    const part = sources.slice(i, i + ALTERNATIVES_PER_REGEXP)
+    out.push(new RegExp(`^(?:${part.join('|')})$`, 'u'))
+  }
+  return out
 }
 
+/** What {@link regExpSource} writes for a leading `**` segment. */
+const LEADING_GLOBSTAR = '(?:[^]*/)?'
+
 const REGEXP_SYNTAX = /[\\^$.*+?()[\]{}|]/g
 
 /**
@@ -336,7 +373,7 @@ function regExpSource(pattern: string): string | null {
       // more names (`src/**` does not match `src`).
       if (segments.length === 1) out += '[^]*'
       else if (last) out += '/[^]+'
-      else out += i === 0 ? '(?:[^]*/)?' : '/(?:[^]*/)?'
+      else out += i === 0 ? LEADING_GLOBSTAR : `/${LEADING_GLOBSTAR}`
       continue
     }
     if (seg === '' || seg === '.' || seg === '..' || seg.includes('**')) return null
@@ -535,9 +572,15 @@ function classEnd(pattern: string, i: number): number {
   return end === -1 ? i : end
 }
 
+// A `\x` is one character to both scans: it opens, closes and cuts nothing,
+// and stays in its alternative for the glob to read. Expansion turned off
+// at any escape, `{src,app/\[id\]}` named neither tree.
 function expandBraces(pattern: string, slashOnly: boolean): string[] {
-  if (pattern.includes('\\')) return [pattern]
   for (let open = 0; open < pattern.length; open++) {
+    if (pattern[open] === '\\') {
+      open++
+      continue
+    }
     if (pattern[open] === '[') {
       open = classEnd(pattern, open)
       continue
@@ -548,7 +591,8 @@ function expandBraces(pattern: string, slashOnly: boolean): string[] {
     let close = -1
     for (let i = open; i < pattern.length && close === -1; i++) {
       const c = pattern[i]
-      if (c === '[') i = classEnd(pattern, i)
+      if (c === '\\') i++
+      else if (c === '[') i = classEnd(pattern, i)
       else if (c === '{') depth++
       else if (c === '}' && --depth === 0) close = i
       else if (c === ',' && depth === 1) cuts.push(i)

package/src/util/plain-text.ts

@@ -0,0 +1,19 @@
+// A string escape (OSC, DCS, SOS, PM, APC) through its terminator, or to the
+// line's end when it has none: Bun.stripANSI drops an unterminated one with
+// everything after it, so a stray title escape ate the failure reason
+// printed below it. An ESC that is not ST ends it too and is left for
+// Bun.stripANSI, as a terminal aborts the string there. C1 openers are not
+// looked for: output is decoded UTF-8, where an 8-bit C1 byte reads as
+// U+FFFD, and scanning for them doubled the cost on non-Latin-1 text.
+// eslint-disable-next-line no-control-regex -- ESC is the point
+const STRING_OPENER = /\x1b[\]P_^X]/
+// eslint-disable-next-line no-control-regex -- ESC is the point
+const STRING_ESCAPE = /\x1b[\]P_^X][^\x07\x1b\x9c\n]*(?:\x07|\x1b\\|\x9c)?/g
+
+/** `text` without terminal escapes, never losing a line to an unterminated one. */
+export function stripEscapes(text: string): string {
+  // Tested first, after the cheaper ESC search: the replace alone cost half
+  // again as much on coloured text, the regex alone 3x on plain text.
+  if (text.indexOf('\x1b') === -1 || !STRING_OPENER.test(text)) return Bun.stripANSI(text)
+  return Bun.stripANSI(text.replace(STRING_ESCAPE, ''))
+}

package/src/util/secret-mask.ts

@@ -36,8 +36,11 @@ export function secretNamed(name: string): boolean {
 /**
  * A URL's password (`postgres://app:<pw>@db/app`): a credential whatever
  * the variable is named, so `DATABASE_URL` and `REDIS_URL` printed it.
+ * Split as WHATWG splits it: the userinfo ends at the LAST `@` before the
+ * path, query or fragment, and the user name at its first `:`, so either
+ * may hold an `@` (`app:p@ss@db` printed `p@ss` whole).
  */
-const URL_PASSWORD = /[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s/@]+)@/gi
+const URL_PASSWORD = /[a-z][a-z0-9+.-]*:\/\/[^\s:/?#]*:([^\s/?#]+)@/gi
 
 /**
  * Values shorter than this are not masked: `KEY=1` would mask every `1`
@@ -260,6 +263,59 @@ export interface TaskEnvSecrets {
   readonly secret?: readonly string[]
 }
 
+/**
+ * Each stream's run of adjacent non-empty chunks joined, with `mask`
+ * applied to each stream's text as a whole: a value is masked where it
+ * starts and its rest dropped from the runs it reaches. The live stream
+ * masks chunk by chunk and lets a held piece go after a pause, so a value
+ * written in two pieces reached the capture in two chunks, and a write to
+ * the other stream between them made them two runs. A hit replays each
+ * stream to its own descriptor, so `vx run > log` joined them again.
+ */
+export function maskStreams(
+  chunks: ReadonlyArray<{ text: string; err: boolean }>,
+  mask: SecretMask | undefined,
+): Array<{ text: string; err: boolean }> {
+  if (mask === undefined) return chunks.filter((c) => c.text.length > 0)
+  const runs: Array<{ text: string; err: boolean }> = []
+  for (const c of chunks) {
+    if (c.text.length === 0) continue
+    const last = runs.at(-1)
+    if (last !== undefined && last.err === c.err) last.text += c.text
+    else runs.push({ text: c.text, err: c.err })
+  }
+  for (const err of [false, true]) {
+    const own = runs.filter((r) => r.err === err)
+    const spans = mask.spans(own.map((r) => r.text).join(''))
+    if (spans.length === 0) continue
+    let at = 0
+    let i = 0
+    for (const r of own) {
+      const end = at + r.text.length
+      let text = ''
+      let from = at
+      for (; i < spans.length && spans[i]![0] < end; i++) {
+        const [s, e] = spans[i]!
+        if (s >= from) text += r.text.slice(from - at, s - at) + MASKED
+        from = Math.max(from, Math.min(e, end))
+        // A value that runs past this run is cut from the next one too.
+        if (e > end) break
+      }
+      r.text = text + r.text.slice(from - at)
+      at = end
+    }
+  }
+  // A run emptied whole leaves its neighbours, the other stream, adjacent.
+  const kept: typeof runs = []
+  for (const r of runs) {
+    if (r.text.length === 0) continue
+    const last = kept.at(-1)
+    if (last !== undefined && last.err === r.err) last.text += r.text
+    else kept.push(r)
+  }
+  return kept
+}
+
 /**
  * `mask.stream()` driving `emit`: what it holds back (a tail that could
  * begin a value) is emitted `idleMs` after the last chunk when none

package/src/util/settle.ts

@@ -27,6 +27,22 @@ export function teardownTimeoutMs(): number {
   return testTimerMs('TEARDOWN_TIMEOUT', DEFAULT_TIMEOUT_MS, true)
 }
 
+/**
+ * Grace after the direct child exits before we abort the stdout/stderr readers.
+ * The pipe reaches EOF only when EVERY write-end fd is closed, so a task that
+ * backgrounds a process inheriting fd 1/2 (`server & echo up` — `execWrap`
+ * leaves compound commands as `sh -c`, so `sh` exits while the grandchild holds
+ * the pipe) never EOFs. On a clean exit with no lingering writer the pipe EOFs
+ * at once, so the readers win this race immediately and normal tasks pay
+ * nothing; only a stuck reader waits out the grace. Residual buffered output is
+ * bounded by the OS pipe buffer (streamToString drains continuously DURING the
+ * run), so this is far longer than any real drain needs. What the leftover
+ * process writes after the bound is lost, and `POST_EXIT_CUT_LINE`
+ * (exec/runner.ts) says so.
+ * A runtime probe's drain is bounded the same (cache/inputs.ts).
+ */
+export const POST_EXIT_DRAIN_MS = 250
+
 /**
  * The SIGTERM→SIGKILL grace a run grants a child that ignores SIGTERM:
  * the one-shot timeout escalation (`exec/runner.ts`),

package/src/util/size.ts

@@ -70,10 +70,20 @@ export function formatBytes(n: number): string {
   return `${v.toFixed(0)} PB`
 }
 
-/** Bytes under `p` on disk, links not followed; 0 when it is missing. */
+/** Bytes under `p` on disk, links not followed; 0 when missing, and for a directory this user cannot list. */
 export function treeBytes(p: string): number {
   const st = lstatSync(p, { throwIfNoEntry: false })
   if (st === undefined) return 0
   if (!st.isDirectory()) return st.size
-  return readdirSync(p).reduce((n, e) => n + treeBytes(path.join(p, e)), 0)
+  let names: string[]
+  try {
+    names = readdirSync(p)
+  } catch (err) {
+    // A directory this user cannot list (another user's store, a task's
+    // 0700 output) is a size nobody here can read, not a failed report.
+    const code = (err as NodeJS.ErrnoException).code
+    if (code === 'EACCES' || code === 'EPERM') return 0
+    throw err
+  }
+  return names.reduce((n, e) => n + treeBytes(path.join(p, e)), 0)
 }

package/src/util/write-file.ts

@@ -1,14 +1,43 @@
-import { lstatSync, readlinkSync, writeFileSync } from 'node:fs'
-import { mkdir, open, rename, rm } from 'node:fs/promises'
+import { lstatSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs'
+import { lstat, mkdir, open, rename, rm } from 'node:fs/promises'
 import path from 'node:path'
 import { UserError } from './errors.js'
 
 /**
- * Refuses a `file` that is a symlink: a repo can carry `vx.config.ts ->
- * /anywhere`, and a write through it lands outside the workspace. Called
- * before the first of a set of writes, so a refusal leaves none half-made.
+ * Refuses a `file` whose directory resolves outside `root`: a repo can
+ * carry `.vx -> ../anywhere` (or `plugins -> ...`), and checking only the
+ * file's own name wrote through it. The nearest directory that exists is
+ * asked; one not made yet is made under it.
  */
-export function refuseSymlink(file: string): void {
+function refuseOutside(file: string, root: string): void {
+  const top = realpathSync(root)
+  for (let at = path.dirname(file); ; at = path.dirname(at)) {
+    let real: string
+    try {
+      real = realpathSync(at)
+    } catch {
+      // quiet: not made yet (or a dangling link mkdir cannot make through)
+      if (at === path.dirname(at)) return
+      continue
+    }
+    const rel = path.relative(top, real)
+    if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      throw new UserError(
+        `refusing to write ${file}: ${at} resolves to ${real}, outside the workspace; remove the link and run again`,
+      )
+    }
+    return
+  }
+}
+
+/**
+ * Refuses a `file` that is a symlink, or whose directory resolves outside
+ * `root`: a repo can carry `vx.config.ts -> /anywhere`, and a write
+ * through it lands outside the workspace. Called before the first of a
+ * set of writes, so a refusal leaves none half-made.
+ */
+export function refuseSymlink(file: string, root: string): void {
+  refuseOutside(file, root)
   let link: string
   try {
     if (!lstatSync(file).isSymbolicLink()) return
@@ -22,13 +51,61 @@ export function refuseSymlink(file: string): void {
   )
 }
 
+/**
+ * A rename over a directory (EISDIR) as a refusal naming `shown`, not a
+ * stack trace; any other error as it was.
+ */
+function directoryInTheWay(err: unknown, shown: string): unknown {
+  return (err as NodeJS.ErrnoException | null)?.code === 'EISDIR'
+    ? new UserError(`cannot write ${shown}: a directory stands there; remove it and run again`)
+    : err
+}
+
+/** A file to write: its path, its bytes, and the name a refusal shows. */
+export interface PendingWrite {
+  file: string
+  text: string
+  shown: string
+}
+
+/**
+ * Writes each file to a temp beside it, then renames them all over their
+ * names: a reader never sees half a file, and a refusal (one outside
+ * `root`, as `refuseSymlink`'s) leaves every file
+ * as it was, not one new beside one old (`vx lock` said it wrote nothing
+ * while the config lock held the edit). A refusal names the file the user
+ * knows, never its temp.
+ */
+export async function writeAllOrNone(files: readonly PendingWrite[], root: string): Promise<void> {
+  for (const f of files) refuseOutside(f.file, root)
+  const tag = `.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
+  let at = 0
+  try {
+    for (; at < files.length; at++) await Bun.write(files[at]!.file + tag, files[at]!.text)
+    // A rename over a directory fails only after the ones before it landed.
+    for (at = 0; at < files.length; at++)
+      if ((await lstat(files[at]!.file).catch(() => null))?.isDirectory())
+        throw Object.assign(new Error('directory'), { code: 'EISDIR' })
+    for (at = 0; at < files.length; at++) await rename(files[at]!.file + tag, files[at]!.file)
+  } catch (err) {
+    // Best effort: where the write was refused the temp cannot be named
+    // either (ENOTDIR), and that must not replace the refusal itself.
+    await Promise.all(files.map((f) => rm(f.file + tag, { force: true }).catch(() => {})))
+    const f = files[Math.min(at, files.length - 1)]!
+    const e = err as NodeJS.ErrnoException
+    if (typeof e.message === 'string') e.message = e.message.split(f.file + tag).join(f.file)
+    if (e.path === f.file + tag) e.path = f.file
+    throw directoryInTheWay(err, f.shown)
+  }
+}
+
 /**
  * Writes `text` to `file`, never through a link: a temp beside it, made
  * with O_EXCL, renamed over it. A rename replaces a link put there after
- * the check, never its target.
+ * the check, never its target. Refused outside `root` (`refuseSymlink`).
  */
-export async function writeNoFollow(file: string, text: string): Promise<void> {
-  refuseSymlink(file)
+export async function writeNoFollow(file: string, text: string, root: string): Promise<void> {
+  refuseSymlink(file, root)
   await mkdir(path.dirname(file), { recursive: true })
   const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
   try {