@vzn/vx 0.0.652 → 0.0.653

package/src/workspace/migration.ts

@@ -5,11 +5,12 @@
 // whichever tool wrote it. Core knows no source format here: a mapper returns a
 // `MigrationPlan` and this file does the rest.
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { unlink } from 'node:fs/promises'
 import path from 'node:path'
 import { workspaceFileWritten } from '../handoff.js'
 import {
+  checkIgnoreSync,
   DOT_VX_GITIGNORE,
   executablePath,
   gitEnv,
@@ -22,6 +23,31 @@ import * as ui from '../ui/index.js'
 import { VERSION } from '../version.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 
+/**
+ * The nearest existing directory at or above `dir` (under `root`) and its
+ * real path when that path is outside `realRoot`; none when it is inside.
+ */
+function linkOut(
+  root: string,
+  realRoot: string,
+  dir: string,
+): [link: string | undefined, real: string] {
+  for (let at = dir; ; at = path.dirname(at)) {
+    let real: string
+    try {
+      real = realpathSync(at)
+    } catch {
+      // quiet: not made yet; mkdir makes it a real directory under its parent
+      if (at === root) return [undefined, realRoot]
+      continue
+    }
+    const rel = path.relative(realRoot, real)
+    return rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)
+      ? [at, real]
+      : [undefined, real]
+  }
+}
+
 /** The root config `vx init` writes outside a Turbo or Nx repo: no task yet. */
 export function starterProject(format: MigrationFormat): string {
   return format === 'ts'
@@ -246,8 +272,9 @@ export interface ApplyMigrationArgs {
    * the migrated workspace has its .vx/projects.lock.json and its graph rules checked
    * (2026-10-14). On success `said` is its line, shown as the
    * report's `lock` row; a refusal (a graph rule, a plugin not installed
-   * yet) prints above the report and the migration still succeeds: its
-   * files are written, and `vx lock` is the step to re-run.
+   * yet) prints above the report, the files stay written, `vx lock` is the
+   * step to re-run, and the exit is 1: a run reads only the lock, so the
+   * migration is not done (as `vx init`'s own path exits).
    */
   lock?: (root: string) => Promise<{ code: number; said: string }>
   /** Rows of what the tool did before the write, e.g. `['ran', 'bun add -d …']`. */
@@ -352,11 +379,23 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
 
   // A plan is a mapper's reading of the repo's own files (an Nx node's
   // `root`, a workspace glob): one that names `../x` wrote outside it.
+  // A member directory linked out of the root is spelled inside it, so the
+  // real directory is asked too: core's discovery never loads a config
+  // there. `.vx` is not a project: its files are refused outside the
+  // root at the write (`refuseSymlink`).
+  const realRoot = realpathSync(root)
   for (const f of files) {
     const rel = relPosix(root, f.abs)
     if (rel === '..' || rel.startsWith('../') || path.isAbsolute(rel)) {
       throw new UserError(`${f.relPath}: outside the workspace root`)
     }
+    if (rel.startsWith('.vx/')) continue
+    const [link, real] = linkOut(root, realRoot, path.dirname(f.abs))
+    if (link !== undefined) {
+      throw new UserError(
+        `${f.relPath}: outside the workspace root (${relPosix(root, link)} resolves to ${real}); vx loads no project there`,
+      )
+    }
   }
 
   if (!dry && !force) {
@@ -396,8 +435,8 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
       ui.print('out', ui.excerpt(f.relPath, f.contents))
     }
   } else if (!dry) {
-    for (const f of files) refuseSymlink(f.abs)
-    for (const f of files) await writeNoFollow(f.abs, f.contents)
+    for (const f of files) refuseSymlink(f.abs, root)
+    for (const f of files) await writeNoFollow(f.abs, f.contents, root)
     for (const f of replaced) await unlink(f)
     // The lock that follows loads its plugins from the file just written.
     workspaceFileWritten()
@@ -538,7 +577,7 @@ export async function applyMigration(args: ApplyMigrationArgs): Promise<number>
     lock === undefined || lock.code === 0 ? next : `fix the above, then vx lock and ${next}`
   rows.push(null, ['next', said])
   ui.print('out', ui.report(`${verb} ${VERSION}`, rows))
-  return 0
+  return lock === undefined || lock.code === 0 ? 0 : 1
 }
 
 /**
@@ -590,25 +629,7 @@ function ignoreAdvice(root: string, ignored: readonly string[], dry: boolean): s
 
 /** The paths (root-relative) git's ignore rules drop; none outside a work tree. */
 function gitIgnored(root: string, relPaths: readonly string[]): string[] {
-  if (relPaths.length === 0) return []
-  try {
-    const r = Bun.spawnSync({
-      cmd: [executablePath('git'), 'check-ignore', '--stdin', '-z'],
-      env: gitEnv(),
-      cwd: root,
-      stdin: Buffer.from(relPaths.map((p) => `${p}\0`).join('')),
-      stdout: 'pipe',
-      stderr: 'ignore',
-    })
-    // 0: some ignored; 1: none; anything else (no work tree): nothing to say.
-    if (r.exitCode !== 0) return []
-    return r.stdout
-      .toString()
-      .split('\0')
-      .filter((p) => p !== '')
-  } catch {
-    return []
-  }
+  return [...(checkIgnoreSync(root, relPaths) ?? [])]
 }
 
 function inGitWorkTree(root: string): boolean {

package/src/workspace/module-state.ts

@@ -0,0 +1,62 @@
+// What a module's exports hold, to tell whether a config changed a module
+// other configs import. Both functions are self-contained: the config
+// worker embeds them by their source (config-eval.ts), as it does
+// `nonJsonPaths`, and a minified build renames only what each one holds.
+
+/** One entry per export: every value reachable from it, in walk order, compared by identity. */
+export type ExportState = Map<PropertyKey, unknown[]>
+
+/**
+ * Every value each export of `ns` reaches through own properties and Map
+ * and Set entries, without calling a getter. Functions and typed arrays
+ * are compared by identity only. State a module keeps unexported, behind a
+ * function, is not reached.
+ */
+export function exportState(ns: object): ExportState {
+  const ownKeys = Reflect.ownKeys
+  const describe = Object.getOwnPropertyDescriptor
+  const protoOf = Object.getPrototypeOf
+  const state: ExportState = new Map()
+  for (const name of ownKeys(ns)) {
+    const out: unknown[] = []
+    const seen = new Set<object>()
+    const walk = (v: unknown): void => {
+      out.push(v)
+      if (v === null || typeof v !== 'object' || seen.has(v) || ArrayBuffer.isView(v)) return
+      seen.add(v)
+      out.push(protoOf(v))
+      if (v instanceof Map)
+        for (const [k, x] of v) {
+          out.push(k)
+          walk(x)
+        }
+      else if (v instanceof Set) for (const x of v) walk(x)
+      for (const k of ownKeys(v)) {
+        const d = describe(v, k)!
+        out.push(k, d.get, d.set, d.writable)
+        if ('value' in d) walk(d.value)
+      }
+    }
+    try {
+      walk((ns as Record<PropertyKey, unknown>)[name])
+    } catch {
+      // A binding not yet initialized, or a Proxy's trap that throws.
+      out.push('\0threw')
+    }
+    state.set(name, out)
+  }
+  return state
+}
+
+/** The exports whose state differs between `before` and `after`. */
+export function changedExports(before: ExportState, after: ExportState): string[] {
+  const out: string[] = []
+  for (const name of new Set([...before.keys(), ...after.keys()])) {
+    const a = before.get(name)
+    const b = after.get(name)
+    let same = a !== undefined && b !== undefined && a.length === b.length
+    for (let i = 0; same && i < a!.length; i++) same = Object.is(a![i], b![i])
+    if (!same) out.push(String(name))
+  }
+  return out
+}

package/src/workspace/nested-dirs.ts

@@ -19,9 +19,16 @@ import type { ProjectEntry } from './workspace.js'
  * once we leave the `p.dir` block entirely. The inner loop is still bounded by
  * that block (near-O(P log P) on real trees; interlopers are few), not the
  * full tail.
+ *
+ * `workspaces`: the absolute roots of nested workspaces (each holds its own
+ * `.vx/workspace.*`), a boundary for outputs: each joins the dirs of every
+ * project it lies under. An outer output glob that ran into one let the
+ * clean before a run delete its files. Never passed for inputs: a task may
+ * read them, and an input left out of the key is a stale hit.
  */
 export function computeNestedProjectDirs(
   entries: Array<Pick<ProjectEntry, 'name' | 'dir'>>,
+  workspaces: readonly string[] = [],
 ): Map<string, string[]> {
   const result = new Map<string, string[]>()
   if (entries.length === 0) return result
@@ -42,6 +49,7 @@ export function computeNestedProjectDirs(
       // else: an interloping sibling (`foo-utils` for `foo`) that shares the
       // string prefix but isn't nested — skip it, descendants may follow.
     }
+    for (const w of workspaces) if (w.startsWith(prefix)) nested.push(w)
     result.set(p.name, nested)
   }
   return result