@vzn/vx 0.0.652 → 0.0.653

package/src/workspace/affected.ts

@@ -11,8 +11,10 @@ import { lstat, readlink, realpath, stat } from 'node:fs/promises'
 import path from 'node:path'
 import {
   executablePath,
+  gitCaseArgs,
   gitEnv,
   gitSpawnRefusal,
+  ignoreCaseLies,
   isExecutableMissing,
   isInstalledPath,
   notAWorkTree,
@@ -31,7 +33,7 @@ import {
 import { configImportOwners, realpathOr } from './config-imports.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { bunPatchFiles } from './fingerprint.js'
-import { PROJECT_CONFIG_FILENAMES, REVIEW_FILE, type ProjectMeta } from './workspace.js'
+import { inVxDir, PROJECT_CONFIG_FILENAMES, REVIEW_FILE, type ProjectMeta } from './workspace.js'
 
 /**
  * Every git call here goes through these two: a git that is not on PATH
@@ -111,6 +113,8 @@ export interface AffectedArgs {
     changedPaths: readonly string[],
     nested: readonly string[],
     dirLinks: ReadonlySet<string>,
+    /** `AffectedChanges.untracked`. */
+    untracked: ReadonlySet<string>,
   ) => Promise<Iterable<string>>
   /**
    * The fingerprint files a plugin claims (`VxPlugin.fingerprint`) and its
@@ -205,6 +209,8 @@ export interface AffectedChanges {
   whole: ReadonlySet<string>
   /** A whole project → the workspace-wide file that made it so (a workspace config, a claimed root file). */
   wholeBy?: ReadonlyMap<string, string>
+  /** `wholeBy`'s file reached every project (the workspace config), not only those a claim named. */
+  wide?: boolean
   /**
    * The changed paths that are nested repositories (a submodule, an
    * embedded repository), workspace-relative: each stands for every file
@@ -218,6 +224,14 @@ export interface AffectedChanges {
   dirLinks?: ReadonlySet<string>
   /** Project → its `dirLinks`, relative to the project's directory. */
   dirLinksIn?: ReadonlyMap<string, ReadonlySet<string>>
+  /**
+   * Project → its changed paths git tracks neither now nor at the base,
+   * relative to the project's directory: one under a task's own outputs
+   * is no input of it.
+   */
+  untrackedIn?: ReadonlyMap<string, ReadonlySet<string>>
+  /** Those changed paths, workspace-relative: `declaresInput`'s `untracked`. */
+  untracked?: ReadonlySet<string>
 }
 
 /** `<base>...HEAD` / `<base>..HEAD`: the base alone, read as `affectedChanges` reads it. */
@@ -275,7 +289,19 @@ export async function affectedChanges(
   // itself is the base, as before. Turbo's two-dot range `A..HEAD` is the
   // one form that diffs from A itself.
   // Asked beside the base, not after it: the diff's shape waits on it.
-  const partial = isPartialClone(args.workspaceRoot).catch(() => false)
+  const config = gitConfigFacts(args.workspaceRoot).catch(() => ({
+    partial: false,
+    ignoreCase: false,
+    autocrlf: false,
+  }))
+  const partial = config.then((c) => c.partial)
+  const autocrlf = config.then((c) => c.autocrlf)
+  // `core.ignorecase=true` on a disk that tells case apart hid a new
+  // `a.txt` beside the tracked `A.txt` from the untracked listings.
+  const caseArgs = config.then((c) => {
+    if (c.ignoreCase) ignoreCaseLies(args.workspaceRoot, args.workspaceRoot)
+    return gitCaseArgs(args.workspaceRoot)
+  })
   const base = fromMergeBase
     ? await mergeBase(args.workspaceRoot, since)
     : await rangeBase(args.workspaceRoot, since)
@@ -308,14 +334,20 @@ export async function affectedChanges(
     //
     // `--raw` for each path's mode: a gitlink (160000) is a nested
     // repository, one path standing for every file in it (`nested` below).
-    gitDiffPaths(args.workspaceRoot, base, partial),
+    gitDiffPaths(args.workspaceRoot, base, partial, autocrlf),
     // `git diff` never reports untracked-but-not-ignored files, but input
     // enumeration does (`git ls-files --cached --others --exclude-standard`),
     // so a brand-new source file changes a task's cache key. Union it in or
     // `--affected` skips a package that genuinely has new work.
     (async () =>
       (await args.untracked?.().catch(() => null)) ??
-      gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']))(),
+      gitPaths(args.workspaceRoot, [
+        ...(await caseArgs),
+        'ls-files',
+        '--others',
+        '--exclude-standard',
+        '-z',
+      ]))(),
   ])
 
   const projects = await args.projects
@@ -328,16 +360,19 @@ export async function affectedChanges(
   // enumeration drops too (`isInstalledPath`); a tracked one is a source.
   // So is each project's `vx.lock.json`, the review copy `vx lock` writes
   // beside its config and nothing reads: a re-lock rewriting them all
-  // selected every project while no key moved.
+  // selected every project while no key moved. The temp a killed write of
+  // any of these left beside it is vx's too.
   const reviewCopies = new Set(projects.map((p) => path.join(p.dir, REVIEW_FILE)))
   const rootDir = path.resolve(args.workspaceRoot)
-  const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
-    (s) =>
-      !VX_OWN.has(s) &&
+  const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter((s) => {
+    const own = s.replace(WRITE_TEMP, '')
+    return (
+      !VX_OWN.has(own) &&
       !s.startsWith('.vx/cache/') &&
       !s.startsWith('.vx/tmp/') &&
-      (path.posix.basename(s) !== REVIEW_FILE || !reviewCopies.has(path.join(rootDir, s))),
-  )
+      (path.posix.basename(own) !== REVIEW_FILE || !reviewCopies.has(path.join(rootDir, own)))
+    )
+  })
   // A symlinked input keys the content behind it (cache/linked-inputs.ts),
   // and the diff names that content's path, never the link's: a link whose
   // target changed is a changed path itself.
@@ -353,12 +388,22 @@ export async function affectedChanges(
       (await listIndex()).filter((e) => e.flagged).map((e) => e.path))(),
   ])
   const dirLinkSet = new Set<string>()
-  changed.push(...(await linkedChanges(args.workspaceRoot, links, changed, dirLinkSet)))
+  changed.push(
+    ...(await linkedChanges(args.workspaceRoot, links, changed, dirLinkSet, await caseArgs)),
+  )
   // A path git was told not to look at (`update-index --assume-unchanged`,
   // `--skip-worktree`): `git diff` reports no edit to it, and the key
   // hashes it from disk, so the task missed and selection left it out.
   if (flagged.length > 0) {
-    changed.push(...(await flaggedChanges(args.workspaceRoot, flagged, await listIndex(), changed)))
+    changed.push(
+      ...(await flaggedChanges(
+        args.workspaceRoot,
+        flagged,
+        await listIndex(),
+        changed,
+        await autocrlf,
+      )),
+    )
   }
   // A changed path that is a link to a directory, or was a link and is
   // no link to a file now: a glob reaching below it keys what is behind
@@ -390,7 +435,7 @@ export async function affectedChanges(
   const everything = (file: string): AffectedChanges => {
     const all = new Set(projects.map((p) => p.name))
     const wholeBy = new Map([...all].map((n) => [n, file]))
-    return { projects: all, changed, paths: new Map(), whole: all, wholeBy }
+    return { projects: all, changed, paths: new Map(), whole: all, wholeBy, wide: true }
   }
   // The workspace config's plugins shape every project's resolved config,
   // so its edit can re-key any task and selection cannot tell which (item
@@ -519,6 +564,11 @@ export async function affectedChanges(
   )
   const paths = new Map<string, string[]>()
   const dirLinksIn = new Map<string, Set<string>>()
+  // A path git tracked at the base and no longer does is in both lists: the
+  // base key folded it, so it moved a key and stays an input.
+  const tracked = new Set(diffed.paths)
+  const untrackedSet = new Set(untracked.filter((rel) => !tracked.has(rel)))
+  const untrackedIn = new Map<string, Set<string>>()
   const whole = new Set<string>(claimedOwned.keys())
   const owned = projectsContaining(
     args.workspaceRoot,
@@ -532,6 +582,11 @@ export async function affectedChanges(
             const list = paths.get(name)
             if (list) list.push(rel)
             else paths.set(name, [rel])
+            if (untrackedSet.has(wsRel)) {
+              const loose = untrackedIn.get(name)
+              if (loose) loose.add(rel)
+              else untrackedIn.set(name, new Set([rel]))
+            }
             if (!dirLinks.has(wsRel)) return
             const links = dirLinksIn.get(name)
             if (links) links.add(rel)
@@ -610,6 +665,10 @@ export async function affectedChanges(
       workspaceConfigs: WORKSPACE_CONFIG_FILENAMES.map((n) => path.join(rootDir, n)),
     })
     if (imports.workspace !== undefined) return everything(imports.workspace)
+    if (imports.outside !== undefined) {
+      const moved = await outsideChanged(args.workspaceRoot, base, imports.outside)
+      if (moved !== undefined) return everything(moved)
+    }
     for (const name of imports.owners) {
       owned.add(name)
       whole.add(name)
@@ -625,9 +684,12 @@ export async function affectedChanges(
     ...(claimedOwned.size > 0 ? { wholeBy: claimedOwned } : {}),
     ...(nestedDirs.length > 0 ? { nested: nestedDirs } : {}),
     ...(dirLinks.size > 0 ? { dirLinks, dirLinksIn } : {}),
+    ...(untrackedIn.size > 0 ? { untrackedIn } : {}),
+    ...(untrackedSet.size > 0 ? { untracked: untrackedSet } : {}),
   })
   if (changed.length === 0 || args.workspaceGlobOwners === undefined) return done()
-  for (const name of await args.workspaceGlobOwners(changed, nestedDirs, dirLinks)) owned.add(name)
+  const owners = await args.workspaceGlobOwners(changed, nestedDirs, dirLinks, untrackedSet)
+  for (const name of owners) owned.add(name)
   return done()
 }
 
@@ -639,6 +701,9 @@ const VX_OWN: ReadonlySet<string> = new Set([
   '.vx/.gitignore',
 ])
 
+/** The suffix of the temp a write renames into place (util/write-file.ts). */
+const WRITE_TEMP = /\.tmp-\d+-[0-9a-z]*$/
+
 const CONFIG_NAMES: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
 /**
  * The files that make a directory a project: core's configs, and the
@@ -694,6 +759,8 @@ async function removedProjectConfigs(
   for (const [rel, bytes] of atBase) {
     // A manifest's directory may never have been a project; a config's was.
     if (bytes === null || !CONFIG_NAMES.has(path.posix.basename(rel))) continue
+    // Under `.vx` no config made a project, at the base either.
+    if (inVxDir(rel)) continue
     const dir = path.resolve(workspaceRoot, path.posix.dirname(rel)).normalize('NFC')
     if (dirs.has(dir)) continue
     if (await Bun.file(path.join(workspaceRoot, rel)).exists()) continue
@@ -832,11 +899,13 @@ async function flaggedChanges(
   flagged: readonly string[],
   index: readonly IndexEntry[],
   changed: readonly string[],
+  /** `core.autocrlf` converts (`gitConfigFacts`). */
+  autocrlf: boolean,
 ): Promise<string[]> {
   const byPath = new Map(index.map((e) => [e.path, e]))
   const seen = new Set(changed)
   const out: string[] = []
-  const hash: IndexEntry[] = []
+  let hash: IndexEntry[] = []
   for (const rel of flagged) {
     const entry = byPath.get(rel)
     if (entry === undefined || seen.has(rel)) continue
@@ -847,6 +916,13 @@ async function flaggedChanges(
     } else if (entry.mode === '120000' || rel.includes('\n')) out.push(rel)
     else hash.push(entry)
   }
+  const raw = await filtered(
+    workspaceRoot,
+    hash.map((e) => e.path),
+    autocrlf,
+  )
+  for (const e of hash) if (raw.has(e.path)) out.push(e.path)
+  if (raw.size > 0) hash = hash.filter((e) => !raw.has(e.path))
   if (hash.length === 0) return out
   // `--stdin-paths` hashes each file as `git add` would (its clean
   // filters), so an unchanged one names the index's blob.
@@ -883,6 +959,8 @@ async function linkedChanges(
   changed: readonly string[],
   /** Given each link to a directory. */
   dirs: Set<string>,
+  /** `gitCaseArgs`, for the ignored listing. */
+  caseArgs: readonly string[],
 ): Promise<string[]> {
   if (links.length === 0) return []
   const realRoot = await realpath(workspaceRoot).catch(() => workspaceRoot)
@@ -905,6 +983,7 @@ async function linkedChanges(
   if (inside.length === 0) return out
   const named = inside.map((l) => l.target).filter((t) => t !== '')
   const ignored = await gitPaths(workspaceRoot, [
+    ...caseArgs,
     'ls-files',
     '--others',
     '--ignored',
@@ -1002,6 +1081,8 @@ async function gitDiffPaths(
   workspaceRoot: string,
   base: string,
   partial: Promise<boolean>,
+  /** `core.autocrlf` converts (`gitConfigFacts`). */
+  autocrlf: Promise<boolean>,
 ): Promise<{ paths: string[]; gitlinks: string[]; links: string[] }> {
   const diff = (...revs: string[]) =>
     gitPaths(workspaceRoot, [
@@ -1047,7 +1128,7 @@ async function gitDiffPaths(
     }
   }
   if (unread.length === 0) return { paths, gitlinks, links }
-  const same = await statOnly(workspaceRoot, unread)
+  const same = await statOnly(workspaceRoot, unread, await autocrlf)
   return { paths: paths.filter((p) => !same.has(p)), gitlinks, links }
 }
 
@@ -1059,9 +1140,11 @@ async function gitDiffPaths(
 async function statOnly(
   workspaceRoot: string,
   unread: readonly { rel: string; oid: string; link: boolean }[],
+  /** `core.autocrlf` converts (`gitConfigFacts`). */
+  autocrlf: boolean,
 ): Promise<Set<string>> {
   const same = new Set<string>()
-  const files: { rel: string; oid: string }[] = []
+  let files: { rel: string; oid: string }[] = []
   for (const u of unread) {
     if (!u.link) {
       // `--stdin-paths` reads a line and unquotes a leading `"`; the
@@ -1079,6 +1162,12 @@ async function statOnly(
       // not a link any more: a change
     }
   }
+  const raw = await filtered(
+    workspaceRoot,
+    files.map((f) => f.rel),
+    autocrlf,
+  )
+  if (raw.size > 0) files = files.filter((f) => !raw.has(f.rel))
   if (files.length === 0) return same
   const proc = spawnGit(
     ['hash-object', '--stdin-paths'],
@@ -1094,14 +1183,103 @@ async function statOnly(
   return same
 }
 
-/** A remote that serves missing objects on demand: `--filter` on a clone or a fetch. */
-async function isPartialClone(workspaceRoot: string): Promise<boolean> {
+/**
+ * The first of `files` (absolute, above the workspace root) that changed
+ * since `base` or is untracked, workspace-relative: `gitDiffPaths` is
+ * `--relative` and never lists one. A file outside the repository is
+ * git's to tell no more than the key's to pin.
+ */
+async function outsideChanged(
+  workspaceRoot: string,
+  base: string,
+  files: readonly string[],
+): Promise<string | undefined> {
+  const realRoot = realpathOr(workspaceRoot)
+  const top = spawnGitSync(['rev-parse', '--show-toplevel'], workspaceRoot)
+  if (top.exitCode !== 0) return undefined
+  const repo = realpathOr(new TextDecoder().decode(top.stdout).replace(/\n$/, ''))
+  const rels = files.filter((f) => f.startsWith(repo + path.sep)).map((f) => relPosix(realRoot, f))
+  if (rels.length === 0) return undefined
+  const specs = rels.map((r) => `:(literal)${r}`)
+  const [diffed, untracked] = await Promise.all([
+    gitPaths(workspaceRoot, [
+      '-c',
+      'diff.autoRefreshIndex=false',
+      'diff',
+      '--no-renames',
+      '--name-only',
+      '-z',
+      '--end-of-options',
+      base,
+      '--',
+      ...specs,
+    ]),
+    gitPaths(workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z', '--', ...specs]),
+  ])
+  if (diffed.length > 0) return relPosix(realRoot, path.join(repo, diffed[0]!))
+  return untracked[0]
+}
+
+/**
+ * Of `rels`, the paths a clean filter can rewrite (`core.autocrlf`, or a
+ * `text`, `eol`, `ident`, `filter` or `working-tree-encoding` attribute),
+ * as the key asks it (cache/git-inputs.ts `dropFilteredOids`). `hash-object`
+ * names such a file's filtered blob, which a CRLF edit to an LF file leaves
+ * the base's, while the key hashes the raw bytes; and raw bytes equal to the
+ * blob prove nothing, since a checkout under `eol=crlf` writes others. So
+ * each is a change. A failed `check-attr` names every path.
+ */
+async function filtered(
+  workspaceRoot: string,
+  rels: readonly string[],
+  autocrlf: boolean,
+): Promise<Set<string>> {
+  if (rels.length === 0 || autocrlf) return new Set(rels)
+  const proc = spawnGit(
+    ['check-attr', '--stdin', '-z', 'text', 'eol', 'ident', 'filter', 'working-tree-encoding'],
+    workspaceRoot,
+    new TextEncoder().encode(rels.map((r) => `${r}\0`).join('')),
+  )
+  const [out, exit] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
+  if (exit !== 0) return new Set(rels)
+  const hit = new Set<string>()
+  const fields = out.split('\0')
+  for (let i = 0; i + 2 < fields.length; i += 3) {
+    if (fields[i + 2] !== 'unspecified' && fields[i + 2] !== 'unset') hit.add(fields[i]!)
+  }
+  return hit
+}
+
+/**
+ * Three config facts in one `git config`: `partial`, a remote that serves
+ * missing objects on demand (`--filter` on a clone or a fetch),
+ * `ignoreCase`, `core.ignorecase` set true, and `autocrlf`,
+ * `core.autocrlf` set `true` or `input`.
+ */
+async function gitConfigFacts(
+  workspaceRoot: string,
+): Promise<{ partial: boolean; ignoreCase: boolean; autocrlf: boolean }> {
   const proc = spawnGit(
-    ['config', '--get-regexp', String.raw`^(remote\..*\.promisor|extensions\.partialclone)$`],
+    [
+      'config',
+      '--get-regexp',
+      String.raw`^(remote\..*\.promisor|extensions\.partialclone|core\.ignorecase|core\.autocrlf)$`,
+    ],
     workspaceRoot,
   )
   const [out] = await Promise.all([new Response(proc.stdout).text(), proc.exited])
-  return out.split('\n').some((l) => l.startsWith('extensions.') || l.endsWith(' true'))
+  let partial = false
+  let ignoreCase = false
+  let autocrlf = false
+  for (const l of out.split('\n')) {
+    // A bare key (`[core] ignorecase`) is true, as git reads it.
+    if (l.startsWith('core.ignorecase'))
+      ignoreCase = /^core\.ignorecase( (true|yes|on|[-+]?0*[1-9]\d*[kmg]?))?$/i.test(l)
+    else if (l.startsWith('core.autocrlf'))
+      autocrlf = /^core\.autocrlf( (input|true|yes|on|[-+]?0*[1-9]\d*[kmg]?))?$/i.test(l)
+    else if (l.startsWith('extensions.') || l.endsWith(' true')) partial = true
+  }
+  return { partial, ignoreCase, autocrlf }
 }
 
 /**
@@ -1272,8 +1450,10 @@ async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
     isShallow(workspaceRoot)
   ) {
     throw new UserError(
-      `git ref "${ref}" has no merge base with HEAD in this shallow clone, and origin did not ` +
-        'give the history between them: fetch it (`git fetch --unshallow origin`).',
+      `git ref "${ref}" has no merge base with HEAD in this shallow clone, ` +
+        (hasOrigin(workspaceRoot)
+          ? 'and origin did not give the history between them: fetch it (`git fetch --unshallow origin`).'
+          : 'which has no origin remote: fetch the history between them (`git fetch --unshallow <url>`).'),
       'VX_E_AFFECTED_BASE',
     )
   }
@@ -1388,7 +1568,7 @@ async function rangeBase(workspaceRoot: string, ref: string): Promise<string> {
   return ref
 }
 
-/** The clones `fetchOrigin` fetched into, so made partial: `isPartialClone` may have answered first. */
+/** The clones `fetchOrigin` fetched into, so made partial: `gitConfigFacts` may have answered first. */
 const fetchedInto = new Set<string>()
 
 /** Deepening stops here (2,047 commits on each side): past it, the base is the user's to fetch. */
@@ -1399,6 +1579,18 @@ function isShallow(workspaceRoot: string): boolean {
   return new TextDecoder().decode(proc.stdout).trim() === 'true'
 }
 
+/**
+ * Whether origin has a URL. Asked only in a shallow clone, before a fetch
+ * or on a refusal. Not `git remote get-url`: a `[remote "origin"]` of
+ * promisor keys alone (git's filtered fetch from no origin writes one) it
+ * names as a URL.
+ */
+function hasOrigin(workspaceRoot: string): boolean {
+  return (
+    spawnGitSync(['config', '--get', 'remote.origin.url'], workspaceRoot, 'ignore').exitCode === 0
+  )
+}
+
 /** The parents a commit names, even where a shallow clone cut them off. */
 function parentsOf(workspaceRoot: string, sha: string): string[] {
   const proc = spawnGitSync(
@@ -1465,6 +1657,9 @@ async function originDefaultBranch(workspaceRoot: string): Promise<string | unde
  * demand. Never prompts for credentials; false when it failed.
  */
 async function fetchOrigin(workspaceRoot: string, args: string[]): Promise<boolean> {
+  // With no origin the fetch fails, yet first writes a promisor
+  // `[remote "origin"]` into the user's config.
+  if (!hasOrigin(workspaceRoot)) return false
   try {
     const proc = Bun.spawn({
       cmd: [
@@ -1537,9 +1732,12 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
   // no origin, no network, a name only another clone has.
   throw new UserError(
     `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.` +
-      (isShallow(workspaceRoot)
-        ? ' This clone is shallow and origin did not give it: fetch the base (`git fetch --depth=1 origin <base>`).'
-        : ''),
+      (!isShallow(workspaceRoot)
+        ? ''
+        : hasOrigin(workspaceRoot)
+          ? ' This clone is shallow and origin did not give it: fetch the base (`git fetch --depth=1 origin <base>`).'
+          : ' This clone is shallow and has no origin remote: fetch the base from where it lives ' +
+            '(`git fetch --depth=1 <url> <base>`), or add one (`git remote add origin <url>`).'),
     'VX_E_AFFECTED_BASE',
   )
 }

package/src/workspace/config-bytecode.ts

@@ -34,16 +34,20 @@ import {
 import { writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import path from 'node:path'
-import { xxh3hex } from '../util/index.js'
+import { refuseForeignCacheDir, xxh3hex } from '../util/index.js'
 
 /** Bumped when what a bundle holds, or how it is checked, changes. */
-const COMPILED_VERSION = 2
+const COMPILED_VERSION = 3
 
 /** What `import.meta` becomes in a bundled file: an identifier no source spells. */
 const META = '__vxImportMeta'
 const META_FIELDS = new Set(['dir', 'dirname', 'path', 'filename', 'file', 'url', 'main'])
 const META_USE = new RegExp(`\\b${META}\\b(\\.[\\w$]+)?`, 'g')
 const COMPUTED_LOAD = /\b(?:require|import)\(\s*(?![\s'"])|\brequire\.resolve\b/
+// Bun's build and transpiler inline `process.env.NODE_ENV` by default, and a
+// bundle's name folds no env: it froze the building run's value. Defined as
+// itself, it is read at run time, as the source reads it.
+const LIVE_NODE_ENV = { 'process.env.NODE_ENV': 'process.env.NODE_ENV' }
 
 interface Manifest {
   version: number
@@ -65,7 +69,17 @@ function nameOf(configPath: string, bytes: Uint8Array): string {
   return `workspace-${xxh3hex(`${COMPILED_VERSION}\0${Bun.revision}\0${configPath}\0${xxh3hex(bytes)}`)}`
 }
 
-function fresh(manifest: Manifest): boolean {
+function fresh(manifest: Manifest, configPath: string): boolean {
+  // Built through a link: retargeted at a file of the same bytes, the config's
+  // relative imports are other files. A config reached by its real path pays
+  // no realpath for this.
+  if (manifest.entry !== configPath) {
+    try {
+      if (realpathSync(configPath) !== manifest.entry) return false
+    } catch {
+      return false
+    }
+  }
   for (const [file, hash] of Object.entries(manifest.inputs)) {
     if (file === manifest.entry) continue
     let bytes: Uint8Array
@@ -109,7 +123,7 @@ export function loadCompiled(
   } catch {
     return undefined
   }
-  if (manifest.version !== COMPILED_VERSION || !fresh(manifest)) return undefined
+  if (manifest.version !== COMPILED_VERSION || !fresh(manifest, configPath)) return undefined
   const ns =
     manifest.skip === true
       ? null
@@ -158,6 +172,9 @@ export async function buildCompiled(
   answered.set(configPath, { bytes, ns })
   const dir = compiledDir(root)
   if (!existsSync(path.dirname(dir))) return
+  // Before the first write there: the cache's own open, which refuses a
+  // `.vx/cache` linked to the home directory, comes after this load.
+  refuseForeignCacheDir(path.dirname(dir), root)
   const name = nameOf(configPath, bytes)
   const entryFile = realpathSync(configPath)
   const inputs: Record<string, string> = {}
@@ -178,6 +195,7 @@ export async function buildCompiled(
       format: 'cjs',
       bytecode: true,
       external: ['@vzn/vx'],
+      define: LIVE_NODE_ENV,
       outdir: tmp,
       naming: `${name}.js`,
       metafile: true,
@@ -206,6 +224,7 @@ export async function buildCompiled(
                 t = new Bun.Transpiler({
                   loader,
                   define: {
+                    ...LIVE_NODE_ENV,
                     'import.meta': META,
                     __dirname: JSON.stringify(fileDir),
                     __filename: JSON.stringify(file),