@vzn/vx 0.0.652 → 0.0.653

package/src/workspace/project-loader.ts

@@ -3,18 +3,22 @@ import path from 'node:path'
 import type { ProjectConfig, WorkspaceConfig } from '../config.js'
 import { isUserError, UserError, xxh3hex } from '../util/index.js'
 import { isSkippedPlugin, validateProjectConfig, validateWorkspace } from './config-schema.js'
+import { nonJsonMessage, nonJsonPaths } from './json-data.js'
 import {
   beginEvalRound,
   builtinsChangedBy,
   CONFIG_EXIT,
   evalBudgetMs,
+  evalDeadline,
   evaluateConfigFresh,
+  modulesChangedBy,
   thrownValueMessage,
   WATCHED_BUILTIN_NAMES,
 } from './config-eval.js'
 import { configImports, hasEsmExport, unprovidedBareImports } from './config-imports.js'
 import { readOnce, unreadable } from './load-reads.js'
 import { buildCompiled, loadCompiled, loadedModules } from './config-bytecode.js'
+import { changedExports, exportState, type ExportState } from './module-state.js'
 
 // The validator lives in config-schema.ts; re-exported so a reader that
 // reaches the loader for it (the tests do) keeps working.
@@ -37,7 +41,11 @@ function assertDefaultObject(mod: unknown, kind: string, configPath: string): vo
     // the bare refusal did not say what was there instead (D-110).
     throw new UserError(
       `${kind} config at ${configPath} did not export a default object` +
-        (typeof mod === 'function' ? `: ${EXPORTED_A_FUNCTION}` : ''),
+        (typeof mod === 'function'
+          ? `: ${EXPORTED_A_FUNCTION}`
+          : mod === undefined
+            ? ': it has no `export default` — write `export default { … }`'
+            : ''),
     )
   }
 }
@@ -200,9 +208,11 @@ async function loadDefaultExport(
   compiledRoot?: string,
   /** File texts read for the refusal, kept across one load's configs. */
   reads = new Map<string, Promise<string>>(),
+  /** The round refused unprovided imports in the config and its closure already. */
+  checked = false,
 ): Promise<unknown> {
   const text = new TextDecoder().decode(bytes)
-  refuseUnprovided(text, configPath, configPath, kind)
+  if (!checked) refuseUnprovided(text, configPath, configPath, kind)
   // No random bust for `vx lock`: a project config reaches this import
   // only on its FIRST load in the process, so nothing is cached under the
   // URL yet, and a repeat load (the one that could replay an evaluation
@@ -230,7 +240,6 @@ async function loadDefaultExport(
   let compiled: { default?: unknown } | null | undefined
   let loaded: Set<string> | undefined
   const unguard = guardExit()
-  let deadline: ReturnType<typeof setTimeout> | undefined
   try {
     // A bundle that throws is evaluated from source below, so the error
     // the user sees is the source's.
@@ -239,14 +248,13 @@ async function loadDefaultExport(
     // Awaited here: a default that is a rejected Promise is the config's
     // throw too, and passed out unawaited it reached bin.ts as a vx
     // defect (2026-10-28).
-    if (compiled) return await defaultOf(compiled, kind, configPath)
+    if (compiled) return await withinBudget(defaultOf(compiled, kind, configPath), kind, configPath)
     if (compiled === undefined) loaded = loadedModules(compiledRoot!)
     // The worker's budget, here too: a top-level await that never settled
     // while a timer kept the loop alive hung `vx run` for good, silently
     // (D-66).
-    await refuseUnprovidedClosure(text, configPath, kind, reads)
-    const budget = evalBudgetMs()
-    ns = (await Promise.race([
+    if (!checked) await refuseUnprovidedClosure(text, configPath, kind, reads)
+    ns = (await withinBudget(
       plain === null
         ? import(specifier)
         : import(configPath).then(
@@ -256,18 +264,9 @@ async function loadDefaultExport(
               return import(specifier)
             },
           ),
-      new Promise<never>((_, reject) => {
-        deadline = setTimeout(
-          () =>
-            reject(
-              new UserError(
-                `${kind} config ${configPath} did not finish evaluating within ${budget}ms (VX_CONFIG_WORKER_TIMEOUT)`,
-              ),
-            ),
-          budget,
-        )
-      }),
-    ])) as { default?: unknown }
+      kind,
+      configPath,
+    )) as { default?: unknown }
   } catch (err) {
     // A served module's frames name its specifier; the user wrote the path.
     const seen = new Set<unknown>()
@@ -278,7 +277,6 @@ async function loadDefaultExport(
     }
     throw loadFailure(err, configPath, kind)
   } finally {
-    clearTimeout(deadline)
     unguard()
     if (source !== null) releaseSource(hash, plain, configPath)
   }
@@ -287,12 +285,42 @@ async function loadDefaultExport(
     await buildCompiled(compiledRoot, configPath, bytes, loaded, ns)
   }
   try {
-    return await mod
+    // The budget again: a default that is a Promise which never settles
+    // hung every verb once the import's deadline was cleared.
+    return await withinBudget(mod, kind, configPath)
   } catch (err) {
     throw loadFailure(err, configPath, kind)
   }
 }
 
+/** `work` settled, or a UserError once the eval budget (VX_CONFIG_WORKER_TIMEOUT) passes. */
+async function withinBudget<T>(work: T | Promise<T>, kind: string, configPath: string): Promise<T> {
+  if (!(work instanceof Promise)) return work
+  const budget = evalBudgetMs()
+  let clearDeadline: (() => void) | undefined
+  try {
+    return await Promise.race([
+      work,
+      new Promise<never>((_, reject) => {
+        clearDeadline = evalDeadline(
+          kind,
+          configPath,
+          budget,
+          () =>
+            reject(
+              new UserError(
+                `${kind} config ${configPath} did not finish evaluating within ${budget}ms (VX_CONFIG_WORKER_TIMEOUT)`,
+              ),
+            ),
+          true,
+        )
+      }),
+    ])
+  } finally {
+    clearDeadline?.()
+  }
+}
+
 function defaultOf(ns: { default?: unknown }, kind: string, configPath: string): unknown {
   const mod = ns?.default
   assertDefaultObject(mod, kind, configPath)
@@ -308,7 +336,10 @@ function tryCompiled(
   try {
     return loadCompiled(root, configPath, bytes)
   } catch {
-    return null
+    // A bundle that throws (a truncated one too) is built again after the
+    // source load; null left every later run loading the source. The
+    // config's own throw throws from source too and builds nothing.
+    return undefined
   }
 }
 
@@ -380,13 +411,15 @@ const SCRIPT = /\.[cm]?[jt]sx?$/
  * refused (L-22; `--no-install` holds only the shebang, not `bun src/bin.ts`
  * or an embedder). Only a source evaluation pays: a fresh bundle resolved
  * every import it holds. `reads` keeps each file's text for the load's other
- * configs: a preset a thousand configs share is read once.
+ * configs: a preset a thousand configs share is read once. `statics` gets
+ * the scripts reached by static import (`configImports`).
  */
 async function refuseUnprovidedClosure(
   source: string,
   configPath: string,
   kind: string,
   reads: Map<string, Promise<string>>,
+  statics?: Set<string>,
 ): Promise<void> {
   if (!RELATIVE_IMPORT.test(source)) return
   const read = (file: string): Promise<string> => {
@@ -394,7 +427,7 @@ async function refuseUnprovidedClosure(
     if (text === undefined) reads.set(file, (text = Bun.file(file).text()))
     return text
   }
-  for (const file of await configImports(configPath, source, read)) {
+  for (const file of await configImports(configPath, source, read, statics)) {
     if (!SCRIPT.test(file)) continue
     const text = await read(file).catch(() => null)
     if (text !== null) refuseUnprovided(text, file, configPath, kind)
@@ -452,7 +485,12 @@ export function configLoadError(err: unknown, configPath: string, kind: string):
   // printed `vx: JSON Parse error: Expected '}'` and named nothing. A
   // config's own `JSON.parse` has its line in the stack and passes through.
   if (name === 'SyntaxError' && !NAMED_FRAME.test(String((err as { stack?: unknown }).stack))) {
-    return new UserError(`${kind} config ${configPath}: an import does not parse: ${message}`)
+    // A missing named export is a SyntaxError too, though nothing failed to
+    // parse: "does not parse" sent the user looking for a typo.
+    const what = message.startsWith('Export named ')
+      ? 'an import names an export its module lacks'
+      : 'an import does not parse'
+    return new UserError(`${kind} config ${configPath}: ${what}: ${message}`)
   }
   if (name === 'ResolveMessage') {
     const spec = /Cannot find (?:package|module) ['"]([^'"]+)['"]/.exec(message)?.[1]
@@ -551,6 +589,108 @@ function throwSite(stack: string, configPath: string): string | undefined {
   return `${sites[0]}, from ${own}`
 }
 
+// A module several configs import is evaluated once in the process, so a
+// config that changed it handed the change to every config evaluated after
+// it: b locked `echo a,b` beside a, and `echo b` alone or when a loaded
+// later. So before any config evaluates, the round imports each local
+// module that more than one first load reaches by static import, in the
+// order the configs reach them, notes what each one's exports hold, and
+// refuses a change to them once every config has loaded. Importing them
+// first evaluates nothing a config would not: whatever could make a shared
+// module evaluate differently by order is a global or another shared
+// module, both refused when changed.
+interface ModuleWatch {
+  /** Each shared module, its namespace, its state before any config ran, and its importers. */
+  modules: Array<{ file: string; ns: object; state: ExportState; owners: string[] }>
+  /** First loads whose unprovided imports, closure included, were refused here already. */
+  checked: Set<string>
+}
+
+async function watchSharedModules(
+  prepared: ReadonlyArray<{ configPath: string; bytes: Uint8Array }>,
+  reads: Map<string, Promise<string>>,
+): Promise<ModuleWatch> {
+  const statics = await Promise.all(
+    prepared.map(async ({ configPath, bytes }) => {
+      if (loadedConfigs.has(configPath)) return undefined
+      const text = new TextDecoder().decode(bytes)
+      // No relative import, no module to share: its own load checks it, as before.
+      if (!RELATIVE_IMPORT.test(text)) return undefined
+      const own = new Set<string>()
+      try {
+        refuseUnprovided(text, configPath, configPath, 'Project')
+        await refuseUnprovidedClosure(text, configPath, 'Project', reads, own)
+      } catch {
+        // Its own load throws the same refusal, in order.
+        return undefined
+      }
+      return own
+    }),
+  )
+  const checked = new Set<string>()
+  const owners = new Map<string, string[]>()
+  prepared.forEach(({ configPath }, i) => {
+    const own = statics[i]
+    if (own === undefined) return
+    checked.add(configPath)
+    for (const file of own) {
+      if (!SCRIPT.test(file)) continue
+      const list = owners.get(file)
+      if (list === undefined) owners.set(file, [configPath])
+      else list.push(configPath)
+    }
+  })
+  const modules: ModuleWatch['modules'] = []
+  const shared = [...owners].filter(([file, list]) => list.length > 1 && !/[\\?]/.test(file))
+  if (shared.length === 0) return { modules, checked }
+  const loaded: Array<[string, object, string[]]> = []
+  const unguard = guardExit()
+  const budget = evalBudgetMs()
+  try {
+    for (const [file, list] of shared) {
+      let timer: ReturnType<typeof setTimeout> | undefined
+      // A module that throws or never settles is left to the configs that
+      // import it, which report it as their own load does.
+      const ns = await Promise.race([
+        import(file).catch(() => null) as Promise<object | null>,
+        new Promise<undefined>((resolve) => {
+          timer = setTimeout(() => resolve(undefined), budget)
+        }),
+      ])
+      clearTimeout(timer)
+      if (ns === undefined) break
+      if (ns !== null) loaded.push([file, ns, list])
+    }
+  } finally {
+    unguard()
+  }
+  // Noted once all are imported: a shared module that changes another as
+  // it evaluates does so in every round alike.
+  for (const [file, ns, list] of loaded)
+    modules.push({ file, ns, state: exportState(ns), owners: list })
+  return { modules, checked }
+}
+
+function sharedModuleChanged(
+  watch: ModuleWatch,
+): { file: string; exports: string[]; owners: string[] } | undefined {
+  for (const { file, ns, state, owners } of watch.modules) {
+    const exports = changedExports(state, exportState(ns))
+    if (exports.length > 0) return { file, exports, owners }
+  }
+  return undefined
+}
+
+function sharedModuleRefused(
+  shared: { file: string; exports: readonly string[] },
+  configPath?: string,
+): UserError {
+  const what = shared.exports.map((e) => `export ${e}`).join(', ')
+  return new UserError(
+    `${configPath ?? 'a project config'} changed ${what} of ${shared.file} while it was evaluated, and another project config imports that module: configs share one evaluation of it, so what they read from it depended on which loaded first; build a config's own value (\`[...list, x]\`, \`{ ...preset }\`) instead of changing a shared one`,
+  )
+}
+
 /**
  * More than one config refused in one load: the first is the error, and
  * `all` names each. A rename after an upgrade refuses every config at once,
@@ -568,10 +708,19 @@ export class ConfigsRefused extends UserError {
  * one evaluated (in the order given, so a failure names the first broken
  * file the way a one-by-one load did). A single-path load is the
  * one-element case. Only `vx lock` evaluates; every run reads the lock.
+ *
+ * Each evaluates with the workspace root, `root`, as `process.cwd()`: the
+ * invoking directory made the lock depend on where `vx lock` ran, and
+ * `--check` from a subdirectory failed a lock written at the root. Not the
+ * project's own directory: the cwd is the process's, the worker's too, and
+ * the loads overlap. Without `root`, the cwd is left as it is.
  */
 const LOAD_WIDTH = 128
 
-export async function loadProjectConfigs(configPaths: readonly string[]): Promise<ProjectConfig[]> {
+export async function loadProjectConfigs(
+  configPaths: readonly string[],
+  root?: string,
+): Promise<ProjectConfig[]> {
   const prepared = await Promise.all(
     configPaths.map(async (configPath) => ({
       configPath,
@@ -581,10 +730,13 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
     })),
   )
   let builtins: BuiltinSnapshot | undefined
+  let watch: ModuleWatch | undefined
   let env: Readonly<Record<string, string | undefined>> = {}
   let cwd = ''
+  let invokedIn = ''
   let umask = -1
   let unredirect: (() => void) | undefined
+  let unredirectFd: (() => void) | undefined
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
@@ -605,7 +757,14 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
       ? await evaluateConfigFresh(configPath).catch((err: unknown) => {
           throw loadFailure(err, configPath, 'Project')
         })
-      : await loadDefaultExport(configPath, 'Project', bytes, undefined, reads)
+      : await loadDefaultExport(
+          configPath,
+          'Project',
+          bytes,
+          undefined,
+          reads,
+          watch?.checked.has(configPath),
+        )
     // Before anything reads through them: a replaced `Array.prototype.includes`
     // turned the JSON-data walk's own check into "a cyclic reference".
     const changed = repeat
@@ -629,16 +788,23 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
       throw overlapping ? new ChangedInRound(changed) : builtinsChanged(changed, configPath)
     }
     assertDefaultObject(mod, 'Project', configPath)
-    // Validation runs HERE, on whichever object we ended up with, so a
-    // malformed config reports the identical UserError whether it was
-    // evaluated in-process or in a worker.
-    validateProjectConfig(mod as ProjectConfig, configPath)
+    // What JSON cannot carry is refused on the live object: the copy below
+    // would drop it unseen.
+    const [nonJson] = nonJsonPaths(mod)
+    if (nonJson !== undefined) throw new UserError(nonJsonMessage(configPath, nonJson))
     // A tree of its own, as the lock hands out. The module object shares
     // what the config shares: one preset's task in two configs, one `exec`
     // in two tasks. A `project` hook that edits in place then edited them
     // all (item 967). A config is JSON data (config-schema.ts), so the copy
     // loses nothing.
-    return JSON.parse(JSON.stringify(mod)) as ProjectConfig
+    const copy = JSON.parse(JSON.stringify(mod)) as ProjectConfig
+    // Validation runs on the copy, the object every reader gets, so a
+    // malformed config reports the identical UserError whether it was
+    // evaluated in-process or in a worker. On the live object, a getter in
+    // an array or a Proxy answered the check with one value and the copy
+    // with another: `outputs.files: ['../victim/**']` reached the lock.
+    validateProjectConfig(copy, configPath, configPath, true)
+    return copy
   }
   // One worker for every repeat load in this round, however many there are.
   const endRound = beginEvalRound()
@@ -652,11 +818,15 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
     const results: Array<ProjectConfig | { failed: unknown }> = []
     if (prepared.length > 0) {
       unredirect = stdoutToStderr()
+      unredirectFd = fdOneToStderr()
       builtins = builtinSnapshot()
       env = { ...process.env }
+      invokedIn = process.cwd()
+      if (root !== undefined && root !== invokedIn) process.chdir(root)
       cwd = process.cwd()
       umask = currentUmask()
     }
+    if (prepared.length > 1) watch = await watchSharedModules(prepared, reads)
     overlapping = prepared.length > 1
     let next = 0
     const lane = async (): Promise<void> => {
@@ -709,8 +879,20 @@ export async function loadProjectConfigs(configPaths: readonly string[]): Promis
     // that moved it: the worker no longer reads the umask to say so.
     if (changed.length > 0)
       throw builtinsChanged(changed, prepared.length === 1 ? prepared[0]!.configPath : undefined)
+    const shared = watch === undefined ? undefined : sharedModuleChanged(watch)
+    if (shared !== undefined) {
+      for (const { configPath } of prepared) {
+        if (!shared.owners.includes(configPath)) continue
+        const own = await modulesChangedBy(configPath, [shared.file])
+        restoreUmask(umask)
+        if (own.length > 0) throw sharedModuleRefused(shared, configPath)
+      }
+      throw sharedModuleRefused(shared)
+    }
     return results as ProjectConfig[]
   } finally {
+    if (invokedIn !== '' && process.cwd() !== invokedIn) process.chdir(invokedIn)
+    unredirectFd?.()
     unredirect?.()
     endRound()
   }
@@ -786,6 +968,67 @@ function stdoutToStderr(): () => void {
   }
 }
 
+/**
+ * fd 1 itself made stderr's while a round of project configs evaluates;
+ * returns the release. The JS routes above cannot reach the rest: Bun's
+ * ESM `import { writeSync } from 'node:fs'` is a copy taken when vx first
+ * imported it, `writeFileSync('/dev/stdout')` opens the descriptor anew,
+ * and a child a config spawns inherits it. `vx lock --check --format json`
+ * printed all three ahead of its JSON. Only `vx lock` evaluates project
+ * configs, so a run never binds libc for this. The worker shares the
+ * descriptor table, so a repeat load is covered too. Counted, as the
+ * redirect is. Where libc will not bind, the JS routes alone.
+ */
+let fdHolders = 0
+let undoFdRedirect = (): void => {}
+
+function fdOneToStderr(): () => void {
+  if (fdHolders++ === 0) undoFdRedirect = swapFdOne()
+  return () => {
+    if (--fdHolders === 0) undoFdRedirect()
+  }
+}
+
+interface FdCalls {
+  dup: (fd: number) => number
+  dup2: (from: number, to: number) => number
+  close: (fd: number) => number
+}
+let fdCalls: FdCalls | null | undefined
+
+/** libc's `dup`, `dup2` and `close`, bound once (~0.7 ms); null where libc will not load. */
+function boundFdCalls(): FdCalls | null {
+  if (fdCalls !== undefined) return fdCalls
+  fdCalls = null
+  try {
+    // Loaded here, not with the module: every run loads this module.
+    const { dlopen, FFIType } = require('bun:ffi') as typeof import('bun:ffi')
+    const fd = { args: [FFIType.i32], returns: FFIType.i32 } as const
+    // glibc's soname; musl's loader answers any `libc.` name with itself.
+    fdCalls = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+      dup: fd,
+      close: fd,
+      dup2: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    }).symbols
+  } catch {}
+  return fdCalls
+}
+
+function swapFdOne(): () => void {
+  const calls = boundFdCalls()
+  if (calls === null) return () => {}
+  const saved = calls.dup(1)
+  if (saved < 0) return () => {}
+  if (calls.dup2(2, 1) < 0) {
+    calls.close(saved)
+    return () => {}
+  }
+  return () => {
+    calls.dup2(saved, 1)
+    calls.close(saved)
+  }
+}
+
 function installRedirect(): () => void {
   const out = process.stdout
   const ownWrite = Object.getOwnPropertyDescriptor(out, 'write')
@@ -886,6 +1129,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'Transpiler',
   'build',
   'color',
+  'concatArrayBuffers',
   'connect',
   'deepEquals',
   'env',

package/src/workspace/repo-id.ts

@@ -27,6 +27,30 @@ import { gitEnv } from '../util/index.js'
  * git: those share nothing.
  */
 export async function repoIdOf(root: string): Promise<string | null> {
+  const repo = locateRepo(root)
+  if (repo === null) return null
+  const identity =
+    (await remoteIdentity(root, repo.commonDir)) ?? (await firstCommit(repo.commonDir, root))
+  return identity === null ? null : idOf(identity, repo.rel)
+}
+
+/**
+ * Every id `repoIdOf` gives `root` now or gave it before a remote was
+ * added: the remote's and the root commit's. `vx cache clean` deletes a
+ * store its index recorded only under one of these; any other is another
+ * workspace's.
+ */
+export async function repoIdsOf(root: string): Promise<string[]> {
+  const repo = locateRepo(root)
+  if (repo === null) return []
+  const identities = await Promise.all([
+    remoteIdentity(root, repo.commonDir),
+    firstCommit(repo.commonDir, root),
+  ])
+  return identities.flatMap((identity) => (identity === null ? [] : [idOf(identity, repo.rel)]))
+}
+
+function locateRepo(root: string): (GitDir & { rel: string }) | null {
   // Git walks the physical path; the logical one found no `.git` through a
   // symlink from outside the repository, and an alias inside it another id.
   let real: string
@@ -37,12 +61,11 @@ export async function repoIdOf(root: string): Promise<string | null> {
   }
   const located = locateGitDir(real)
   if (located === null) return null
-  const identity =
-    (await remoteIdentity(root, located.commonDir)) ?? (await firstCommit(located.commonDir, root))
-  if (identity === null) return null
-  const rel = path.relative(located.gitRoot, real).split(path.sep).join('/')
-  const key = sha256(`${identity}#${rel}`)
-  return sha256(key).slice(0, 16)
+  return { ...located, rel: path.relative(located.gitRoot, real).split(path.sep).join('/') }
+}
+
+function idOf(identity: string, rel: string): string {
+  return sha256(sha256(`${identity}#${rel}`)).slice(0, 16)
 }
 
 const sha256 = (s: string): string => new Bun.CryptoHasher('sha256').update(s).digest('hex')