@vzn/vx-migrate 0.0.651 → 0.0.653

package/src/turbo/turbo-map.ts

@@ -11,7 +11,7 @@
 // The consumer decides what a global becomes through `splice`.
 
 import path from 'node:path'
-import { isLiteralPattern, pruneOrphanPersistentNotes, UserError } from '@vzn/vx'
+import { isLiteralPattern, outputsOverlap, pruneOrphanPersistentNotes, UserError } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
 import { refuseTaskNames } from '../plugin-gaps.js'
 import { apartTakeBacks, literalGlob, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
@@ -24,6 +24,7 @@ import {
   resolveSharedOutputs,
   resolveSharedWorkspaceOutputs,
   takingBack,
+  uncache,
   unkey,
   wildcardCleanTodo,
   wildcardOutput,
@@ -279,6 +280,12 @@ export interface MapTurboOptions {
    * path among them is keyed by a probe. Absent, none is.
    */
   ignored?: (rels: readonly string[]) => Promise<ReadonlySet<string>>
+  /**
+   * What git ignores under the root-relative globs' fixed prefixes
+   * (`gitIgnoredUnder`): files, and `dir/` for a directory ignored whole.
+   * Absent, an explicit glob keys none of them.
+   */
+  ignoredUnder?: (globs: readonly string[]) => Promise<readonly string[]>
   /**
    * The `.tsbuildinfo` files a root-relative package's command writes,
    * relative to the package (`tscBuildInfo`). Absent, none.
@@ -294,6 +301,12 @@ export interface MapTurboOptions {
 interface Literals {
   readonly inputs: Record<string, unknown>
   readonly rels: ReadonlyMap<string, Named>
+  /** The explicit globs, root-relative, with the list that holds them. */
+  readonly globs: ReadonlyMap<string, 'files' | 'workspaceFiles'>
+  /** The global `!` entries, which a preset spread may hide from the lists. */
+  readonly taken: readonly string[]
+  /** The package, root-relative (`files` entries are relative to it). */
+  readonly pkgDir: string
 }
 type Named = readonly ['files' | 'workspaceFiles' | null, string]
 
@@ -312,6 +325,18 @@ function zeroSegments(glob: string): string | null {
   return head === '' || isLiteralPattern(head.replace(/\\./g, '_')) ? null : head
 }
 
+/**
+ * A glob with its `.` and `..` segments collapsed, as Turbo cleans the path
+ * before it walks (turborepo-globwalk's `collapse_path`): `src/../../shared/**`
+ * is `../shared/**`, `./src/**` is `src/**`. A `$TURBO_ROOT$/` prefix is
+ * the root, not a segment.
+ */
+function collapseDots(glob: string): string {
+  if (glob.startsWith('$TURBO_ROOT$/'))
+    return '$TURBO_ROOT$/' + collapseDots(glob.slice('$TURBO_ROOT$/'.length))
+  return path.posix.normalize(glob)
+}
+
 /** A glob, `!` or not, and the X its `X/**` also matches in Turbo (`zeroSegments`). */
 function withZeroSegments(glob: string): string[] {
   const neg = glob.startsWith('!') ? '!' : ''
@@ -362,6 +387,70 @@ function keyIgnored(
   inputs.workspaceRuntime = [...probes, ignoredFilesProbe(hits.map(([rel]) => rel))]
 }
 
+/**
+ * Turbo walks an explicit input glob on disk, gitignored files and all
+ * (`$TURBO_DEFAULT$` alone skips them); core's globs filter what git
+ * lists, so `src/**` over an ignored `src/gen.ts` keyed nothing and an
+ * edit replayed the old output. Each ignored path a glob matches is named
+ * outright, which core reads from disk: a file as itself, a directory
+ * ignored whole as the glob's rest under it (`src/out/**`). A file a `!`
+ * takes back stays out (core refuses a literal one covers).
+ */
+function keyIgnoredGlobbed(
+  l: Literals,
+  under: readonly string[],
+  projectDirs: readonly string[],
+): void {
+  // The lists as they stand: a sibling's output taken back since counts.
+  const current = (['files', 'workspaceFiles'] as const).flatMap((kind) =>
+    ((l.inputs[kind] as unknown[] | undefined) ?? []).flatMap((e) =>
+      typeof e === 'string' && e.startsWith('!')
+        ? [kind === 'files' && l.pkgDir !== '' ? `${l.pkgDir}/${e.slice(1)}` : e.slice(1)]
+        : [],
+    ),
+  )
+  const taken = [...l.taken, ...current].map((t) => new Bun.Glob(t))
+  for (const [glob, kind] of l.globs) {
+    const matcher = new Bun.Glob(glob)
+    const at = kind === 'files' && l.pkgDir !== '' ? `${l.pkgDir}/` : ''
+    for (const e of under) {
+      if (!e.startsWith(at)) continue
+      // A package nested in this one is another project, which core's
+      // globs stop at: its path is named from the workspace root.
+      const nested = at !== '' && projectDirs.some((d) => d.startsWith(at) && e.startsWith(`${d}/`))
+      const base = nested ? '' : at
+      const entry = e.endsWith('/')
+        ? globUnder(glob.slice(at.length), e.slice(at.length, -1))
+        : matcher.match(e) && !taken.some((t) => t.match(e))
+          ? literalGlob(e.slice(base.length))
+          : null
+      if (entry === null) continue
+      const into = nested ? 'workspaceFiles' : kind
+      const named = nested && e.endsWith('/') ? `${l.pkgDir}/${entry}` : entry
+      const list = (l.inputs[into] as unknown[] | undefined) ?? []
+      if (!list.includes(named)) l.inputs[into] = [...list, named]
+    }
+  }
+}
+
+/**
+ * `glob`'s rest below `dir`, which it reaches into (`a/**\/*.ts` under
+ * `a/gen`: `a/gen/**\/*.ts`), else null: the paths of the glob under it.
+ */
+function globUnder(glob: string, dir: string): string | null {
+  // A brace holding a `/` spans segments; such a glob is not split here.
+  if (/\{[^}]*\//.test(glob)) return null
+  const gs = glob.split('/')
+  const ds = dir.split('/')
+  for (let i = 0; i < ds.length; i++) {
+    const g = gs[i]
+    if (g === undefined) return null
+    if (g === '**') return [...ds.map(literalGlob), ...gs.slice(i)].join('/')
+    if (!new Bun.Glob(g).match(ds[i]!)) return null
+  }
+  return gs.length > ds.length ? [...ds.map(literalGlob), ...gs.slice(ds.length)].join('/') : null
+}
+
 async function readTurboJson(file: string, root: string): Promise<TurboJson> {
   const text = await Bun.file(file).text()
   let parsed: unknown
@@ -1173,6 +1262,8 @@ export async function mapTurboWorkspace(
   // whose own edges lack `^name` (opencode's `build: { dependsOn: [] }`)
   // is key-only too: Turbo's `^build` stops at it, and core's walked past
   // it to the builds below, running and keying ones Turbo never waits on.
+  // `cache: false` does not stop it: a key-only node stores nothing, and
+  // Turbo's no-op hashes the package's files cached or not.
   const keyOnly = new Map<string, Set<string>>()
   for (const meta of metas) {
     const scripts = packageScripts(meta)
@@ -1184,7 +1275,7 @@ export async function mapTurboWorkspace(
       if (!(caretSelf.has(name) || stops) || !withScript.has(name) || transit.has(name)) continue
       if (scripts[name] !== undefined || commandOverride(def) !== undefined) continue
       if (sidecarGroups.has(`${meta.name}#${name}`)) continue
-      if (def?.cache === false || def?.persistent === true) continue
+      if (def?.persistent === true) continue
       emitted.get(meta.name)!.add(name)
       runnable.get(meta.name)!.add(name)
       let set = keyOnly.get(meta.name)
@@ -1314,8 +1405,12 @@ export async function mapTurboWorkspace(
       // Core gives a project with no `build` this very node (a group behind
       // `^build`, keyed on the project's files), so writing it is noise:
       // solid's three script-less packages each got a key-only `build`.
+      // Written configs only: a bare `build` skips core's node (X-102), so
+      // under turbo(), which writes nothing, `vx run build` scoped to such a
+      // package was refused where Turbo runs its dependencies' builds.
       const noopEdges = defFor(name)!.dependsOn ?? []
       if (
+        opts.envNames === undefined &&
         noop &&
         name === 'build' &&
         noopEdges.includes('^build') &&
@@ -1444,7 +1539,7 @@ export async function mapTurboWorkspace(
         npmScriptEnv(mapped.task, name, command === script, meta, opts)
       tasks.push(mapped)
     }
-    excludeSiblingOutputs(resolveSharedOutputs(tasks))
+    excludeSiblingOutputs(resolveSharedOutputs(tasks), true)
     const tags = packageTags(meta === rootMeta ? rootCfg : files.get(meta.name))
     projects.push({ name: meta.name, dir: meta.dir, ...(tags.length > 0 ? { tags } : {}), tasks })
   }
@@ -1511,7 +1606,7 @@ export async function mapTurboWorkspace(
           if (pm === undefined) continue
           const pdef = definitions(pm).defFor(task)
           if (pdef?.cache !== false) continue
-          if (!sel.startsWith('^')) unfold.add(`${pm.name}#${task}`)
+          unfold.add(`${pm.name}#${task}`)
           const at = relPosix(root, pm.dir)
           for (const g of dep.globs.length > 0 ? dep.globs : (pdef.outputs ?? []))
             if (!g.startsWith('!')) rels.push(at === '' ? g : `${at}/${g}`)
@@ -1531,11 +1626,15 @@ export async function mapTurboWorkspace(
       inputs['workspaceRuntime'] = [...probes, probe]
       // Folded, the producer's key "covers" what it writes, and core answers
       // the probe before it runs: the previous run's bytes. Left out of the
-      // fold, the probe waits for it (core's late probes, X-34).
+      // fold, the probe waits for it (core's late probes, X-34). A `^gen`
+      // edge reaches it too, beside its cached siblings: those stay folded.
       const deps = (t.task!['dependsOn'] as string[] | undefined) ?? []
-      const id = (d: string) => (d.startsWith('^') || d.includes('#') ? d : `${meta.name}#${d}`)
-      if (deps.some((d) => unfold.has(id(d))))
-        inputs['tasks'] = deps.filter((d) => !unfold.has(id(d)))
+      const ids = (d: string): string[] =>
+        d.startsWith('^')
+          ? metas.filter((m) => declares(meta, m.name)).map((m) => `${m.name}#${d.slice(1)}`)
+          : [d.includes('#') ? d : `${meta.name}#${d}`]
+      if (deps.some((d) => ids(d).some((i) => unfold.has(i))))
+        inputs['tasks'] = [...deps, ...[...unfold].map((i) => `!${i}`)]
     }
   }
 
@@ -1574,6 +1673,14 @@ export async function mapTurboWorkspace(
   for (const e of opts.splice('inputs', globals.inputs))
     if (typeof e !== 'string') opaque.set(JSON.stringify(e), globals.inputs)
   excludeWorkspaceOutputs(root, projects, (e) => opaque.get(JSON.stringify(e)) ?? [])
+  // After every take-back: a path one takes back is not named back.
+  if (opts.ignoredUnder !== undefined) {
+    const under = await opts.ignoredUnder([
+      ...new Set(literals.tasks.flatMap((l) => [...l.globs.keys()])),
+    ])
+    const dirs = projects.map((p) => relPosix(root, p.dir)).filter((d) => d !== '')
+    if (under.length > 0) for (const l of literals.tasks) keyIgnoredGlobbed(l, under, dirs)
+  }
   pruneUnreachedPersistentNotes(projects, metas, opts.persistentTodo)
   pruneOrphanPersistentNotes(projects, opts.persistentTodo)
   refuseTaskNames(projects, 'task')
@@ -1606,7 +1713,7 @@ function sortOrderFree(projects: readonly TurboMappedProject[]): void {
       const task = t.task
       if (task === null) continue
       if (Array.isArray(task['dependsOn'])) task['dependsOn'] = [...task['dependsOn']].sort(byText)
-      const outputs = (task['cache'] as { outputs?: Record<string, unknown> } | undefined)?.outputs
+      const outputs = task['outputs'] as Record<string, unknown> | undefined
       if (outputs === undefined) continue
       for (const k of ['files', 'workspaceFiles'])
         if (Array.isArray(outputs[k])) outputs[k] = [...outputs[k]].sort(negationsLast)
@@ -1822,16 +1929,12 @@ function keyOnlyGroup(t: TurboMappedTask): TurboMappedTask {
   if (task === null) return t
   const exec = task['exec'] as Record<string, unknown>
   if (exec['persistent'] !== undefined || exec['interactive'] !== undefined) return t
-  const cache = task['cache'] as
-    | { outputs: { files: unknown[]; workspaceFiles?: unknown[] } }
-    | undefined
+  const outputs = task['outputs'] as { files: unknown[]; workspaceFiles?: unknown[] } | undefined
   if (task['inputs'] === undefined && task['dependsOn'] === undefined) return t
-  if (
-    cache !== undefined &&
-    (cache.outputs.files.length > 0 || cache.outputs.workspaceFiles !== undefined)
-  )
+  if (outputs !== undefined && (outputs.files.length > 0 || outputs.workspaceFiles !== undefined))
     return t
-  const { exec: _exec, cache: _cache, ...group } = task
+  const { exec: _exec, ...group } = task
+  uncache(group)
   return { ...t, task: group }
 }
 
@@ -2085,12 +2188,13 @@ function buildTask(
       // build (item 1031). A positive glob with no safe
       // form widens to every package file; a negation with none is dropped
       // (it would exclude fewer files, never more).
-      const wax = minimatchToVx(neg ? i.slice(1) : i, neg)
-      if (wax === null) {
+      const vx = minimatchToVx(neg ? i.slice(1) : i, neg)
+      if (vx === null) {
         todos.push(`input ${JSON.stringify(i)}: glob syntax vx cannot take — map manually`)
         if (!neg) files.push('**/*')
         continue
       }
+      const wax = collapseDots(vx)
       const translated = (neg ? '!' : '') + wax
       const body = wax
       const up = climbed(translated)
@@ -2175,8 +2279,17 @@ function buildTask(
   if (keyEnv.length > 0) inputs.env = keyEnv
   if (pkgDotenv) inputs.runtime = [pkgDotenvDeep ? DOTENV_PROBE : DOTENV_PROBE_TOP]
   if (wsDotenv.length > 0) inputs.workspaceRuntime = [dotenvGlobsProbe(wsDotenv) ?? DOTENV_PROBE]
-  for (const rel of rels.keys()) if (!isLiteral(rel)) rels.delete(rel)
-  literals.tasks.push({ inputs, rels })
+  const globs = new Map<string, 'files' | 'workspaceFiles'>()
+  for (const [rel, [kind]] of rels)
+    if (!isLiteral(rel)) {
+      rels.delete(rel)
+      if (kind !== null) globs.set(rel, kind)
+    }
+  const taken: string[] = []
+  for (const g of globalKept)
+    if (g.startsWith('!')) taken.push(g.slice(1))
+    else if (!isLiteral(g) && !globs.has(g)) globs.set(g, 'workspaceFiles')
+  literals.tasks.push({ inputs, rels, globs, taken, pkgDir: atRoot ? '' : pkgDir })
   // Turbo keys every task on its inputs, cached or not, and a dependant
   // folds that key: an uncached task's inputs still move its dependants.
   task.inputs = inputs
@@ -2185,6 +2298,8 @@ function buildTask(
   const outFiles: string[] = []
   const zeroed = new Set<string>()
   const wsOutFiles: string[] = []
+  // The user's `!` outputs, not the take-backs added below.
+  const ownNegated = new Set<string>()
   for (const raw of def.outputs ?? []) {
     // Turbo's grammar: an extglob in `dist/**/*.@(js|mjs)` matched
     // nothing, so a hit restored nothing (item 1031).
@@ -2200,12 +2315,13 @@ function buildTask(
     // `.next/**` minus `!.next/cache/**` saved the cache and cleaned it
     // before every run while vx outputs could not exclude.
     const neg = mapped.startsWith('!') ? '!' : ''
-    const o = mapped.slice(neg.length)
+    const o = collapseDots(mapped.slice(neg.length))
     const signed = (g: string) => {
       const head = zeroSegments(g)
-      if (head === null) return [neg + g]
-      zeroed.add(neg + head)
-      return [neg + g, neg + head]
+      const out = head === null ? [neg + g] : [neg + g, neg + head]
+      if (head !== null) zeroed.add(neg + head)
+      if (neg) for (const e of out) ownNegated.add(e)
+      return out
     }
     if (o.startsWith('$TURBO_ROOT$/')) {
       wsOutFiles.push(...signed(o.slice('$TURBO_ROOT$/'.length)))
@@ -2216,7 +2332,7 @@ function buildTask(
     } else if (o.includes('$TURBO_ROOT$')) {
       todos.push(
         `output ${JSON.stringify(o)}: $TURBO_ROOT$ only maps as a '$TURBO_ROOT$/<path>' ` +
-          'prefix (→ cache.outputs.workspaceFiles) — map manually',
+          'prefix (→ outputs.workspaceFiles) — map manually',
       )
     } else outFiles.push(...signed(o))
   }
@@ -2255,10 +2371,30 @@ function buildTask(
   const outputs: Record<string, unknown> = { files: takingBack(outFiles).sort(negationsLast) }
   const ws = takingBack(wsOutFiles).sort(negationsLast)
   if (ws.length > 0) outputs.workspaceFiles = ws
-  task.cache = {
-    outputs,
-    ...(rewritesManifest ? { inputStability: { strategy: 'mutable' } } : {}),
+  task.outputs = outputs
+  // A path a `!` output takes back is still written by the task, often
+  // not gitignored (`dist/skip`): as its own input it changed after the
+  // key was taken, so no run was saved, and no dependant's either. One
+  // over a committed file is source (`*/**` minus `!src/**`, medusa's):
+  // Turbo keys it, and taken back an edit there replayed the old build.
+  // Without git's list, no `!` is known to hold only what the task writes.
+  const subtract = (field: 'files' | 'workspaceFiles', from: readonly string[]) => {
+    const list = inputs[field] as unknown[] | undefined
+    const tracked = opts.tracked?.(field === 'files' ? pkgDir : '').files
+    if (tracked === undefined) return
+    const negs = from.filter(
+      (g) =>
+        ownNegated.has(g) &&
+        !list?.includes(g) &&
+        !tracked.some((f) => outputsOverlap(g.slice(1), f)),
+    )
+    if (list !== undefined && negs.length > 0) inputs[field] = withoutTakenBack([...list, ...negs])
   }
+  subtract('files', outputs.files as string[])
+  subtract('workspaceFiles', ws)
+  task.cache = true
+  // In place: the ignored-path passes hold this object.
+  if (rewritesManifest) inputs.stability = { strategy: 'mutable' }
 
   return { name, todos, task, uses }
 }

package/src/turbo-cache/index.ts

@@ -29,7 +29,7 @@ import {
 } from '@vzn/vx'
 import { deadline, MAX_TIMER_MS } from '../remote-deadline.js'
 import { checkRemoteUrl } from '../remote-url.js'
-import { refusal } from '../remote-refusal.js'
+import { hideTokens, hidingErrors, refusal } from '../remote-refusal.js'
 import { keyedByRef, readScopes, remoteScope, type RemoteScope } from './scope.js'
 import { OutageBreaker } from '../remote-breaker.js'
 import { Cooldown, withRetry } from '../remote-retry.js'
@@ -588,8 +588,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     }
   }
 
+  /** Every bearer a request carried: a refusal that quotes one says `***`. */
+  private readonly sent = new Set<string>()
+  private readonly hidden = (text: string): string => hideTokens(text, this.sent)
+
   private bearer(): string | undefined {
-    return this.borrowed?.() ?? this.token
+    const token = this.borrowed?.() ?? this.token
+    if (token !== undefined) this.sent.add(token)
+    return token
   }
 
   private url(pathname: string): string {
@@ -619,7 +625,9 @@ export class TurboRemoteCache implements RemoteCacheLayer {
    * never reaches a third-party store. The answer's status is not read, as
    * in Turbo. A redirect is not followed: its `Location` is the answer, and
    * the token's verdict stays the API's. Following one let the redirected
-   * host's `Access-Control-Allow-Headers` admit the token to itself.
+   * host's `Access-Control-Allow-Headers` admit the token to itself. A
+   * `Location` that is not http(s), or plain http the token would go to
+   * from an https API, is a request error.
    */
   private async preflight(
     url: string,
@@ -641,12 +649,21 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     await res.body?.cancel()
     const location = res.headers.get('location')
     const allowed = res.headers.get('access-control-allow-headers') ?? ''
-    return {
-      url: location === null ? url : new URL(location, this.config.url).toString(),
-      auth:
-        allowed.trim() === '*' ||
-        allowed.split(',').some((h) => h.trim().toLowerCase() === 'authorization'),
-    }
+    const auth =
+      allowed.trim() === '*' ||
+      allowed.split(',').some((h) => h.trim().toLowerCase() === 'authorization')
+    if (location === null) return { url, auth }
+    const to = new URL(location, this.config.url)
+    // `checkRemoteUrl` saw only the configured URL. A `file:` Location read
+    // a local file as the artifact, and a PUT to it "succeeded" storing
+    // nothing.
+    if (to.protocol !== 'http:' && to.protocol !== 'https:')
+      throw new Error(`the preflight pointed at ${to.protocol}, not an http(s) URL`)
+    if (auth && to.protocol === 'http:' && new URL(this.config.url).protocol === 'https:')
+      throw new Error(
+        `the preflight pointed an https API at ${to.origin}, which would send the token in the clear`,
+      )
+    return { url: to.toString(), auth }
   }
 
   /**
@@ -666,27 +683,30 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     const signal = () => (timeoutMs === 0 ? undefined : deadline(timeoutMs))
     // The batch query is never preflighted, as in Turbo.
     const preflight = this.config.preflight && method !== 'POST'
-    const res = await this.breaker.send(
-      () =>
-        withRetry(
-          async () => {
-            const extra = init.headers ?? {}
-            const to = preflight
-              ? await this.preflight(this.url(pathname), method, extra, signal)
-              : { url: this.url(pathname), auth: true }
-            const s = signal()
-            return this.fetchImpl(to.url, {
-              method,
-              headers: this.headers(extra, to.auth),
-              ...(init.body === undefined ? {} : { body: init.body }),
-              ...(s === undefined ? {} : { signal: s }),
-            })
-          },
-          this.config.retries,
-          this.wait,
-          this.cooldown,
-        ),
-      method === 'GET',
+    const res = await hidingErrors(
+      this.breaker.send(
+        () =>
+          withRetry(
+            async () => {
+              const extra = init.headers ?? {}
+              const to = preflight
+                ? await this.preflight(this.url(pathname), method, extra, signal)
+                : { url: this.url(pathname), auth: true }
+              const s = signal()
+              return this.fetchImpl(to.url, {
+                method,
+                headers: this.headers(extra, to.auth),
+                ...(init.body === undefined ? {} : { body: init.body }),
+                ...(s === undefined ? {} : { signal: s }),
+              })
+            },
+            this.config.retries,
+            this.wait,
+            this.cooldown,
+          ),
+        method === 'GET',
+      ),
+      this.hidden,
     )
     if (method === 'PUT' && res.status === 403) {
       const first = !this.writesRefused
@@ -695,14 +715,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
       // The status and the server's own words (`refusal`): a scope it
       // refuses and a token it no longer takes read alike.
       throw new Error(
-        `${(await refusal(res)).message}: the upload was refused (a read-only token or server); uploads off for this run, reads go on`,
+        `${(await refusal(res, this.hidden)).message}: the upload was refused (a read-only token or server); uploads off for this run, reads go on`,
       )
     }
     if (res.status === 401 || res.status === 403) {
       const first = !this.disabled
       this.disabled = true
       if (!first) return undefined
-      const said = (await refusal(res)).message
+      const said = (await refusal(res, this.hidden)).message
       if (this.forget === undefined)
         throw new Error(`${said}: the token was refused; remote cache off for this run`)
       await this.forget()
@@ -764,7 +784,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
         await res.body?.cancel()
         return null
       }
-      throw await refusal(res, 'batch query answered ')
+      throw await refusal(res, this.hidden, 'batch query answered ')
     }
     // An answer per hash is a few hundred bytes of ArtifactInfo; a reply
     // past this bound is no answer, read no further than the bound (L-9).
@@ -802,21 +822,25 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     return held
   }
 
-  async get(hash: string): Promise<{ body: Response; durationMs: number | undefined } | null> {
-    if (this.disabled) return null
+  async get(
+    hash: string,
+  ): Promise<{ body: Response; durationMs: number | undefined } | null | undefined> {
+    // Off, or refused: no answer, which core keeps apart from a miss (a
+    // null forgot each hit the index kept, the remote never asked).
+    if (this.disabled) return undefined
     // A gateway that keys binary media on Accept base64-encodes a `*/*`
     // response, and every hit read as a corrupt artifact (nx#33092's class).
     const res = await this.request('GET', `/${hash}`, {
       headers: { Accept: 'application/octet-stream', ...this.reads },
     })
-    if (res === undefined) return null
+    if (res === undefined) return undefined
     if (res.status !== 200) {
       if (res.status === 404) {
         await res.body?.cancel()
         this.absent.add(hash)
         return null
       }
-      throw await refusal(res)
+      throw await refusal(res, this.hidden)
     }
     this.served.add(hash)
     const duration = Number(res.headers.get('x-artifact-duration'))
@@ -870,10 +894,17 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     this.absent.add(hash)
   }
 
-  async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void | false> {
+  async put(
+    hash: string,
+    body: Blob,
+    meta: { durationMs: number; replace?: true },
+  ): Promise<void | false> {
     // Nothing sent, so no upload is counted.
     if (this.disabled || this.writesRefused) return false
-    if (!this.absent.has(hash) && !this.served.has(hash)) {
+    // `replace`: the copy there did not read back, maybe on another machine
+    // of the run (a vx-dte worker), so a HEAD's 200 is the bad copy. Turbo's
+    // PUT writes over a held key.
+    if (meta.replace !== true && !this.absent.has(hash) && !this.served.has(hash)) {
       // Part of the upload, so under its deadline. Any answer but 200 or 404
       // uploads: a lost store costs more. A server the HEAD cannot reach
       // fails the put, as the PUT would.
@@ -901,7 +932,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     if (res === undefined) return false
     // Turbo's client takes any 2xx (`error_for_status`); a server's 201 or
     // 204 stored the artifact and was counted a failed upload.
-    if (!res.ok) throw await refusal(res)
+    if (!res.ok) throw await refusal(res, this.hidden)
     this.absent.delete(hash)
     this.served.delete(hash)
   }

package/src/turbo-cache/oidc.ts

@@ -5,6 +5,7 @@
 // 2026-10-17); any other server names its token URL.
 
 import { deadline } from '../remote-deadline.js'
+import { hideTokens } from '../remote-refusal.js'
 
 /** `turboCache({ oidc })`: `true` is Vercel's hosted cache with its defaults. */
 export interface TurboOidcOptions {
@@ -103,14 +104,15 @@ const where = (url: string) => (URL.canParse(url) ? new URL(url).host : 'the end
  * A refusal's own words: RFC 6749's `error` and `error_description`, or
  * GitHub's `message`. Only those fields, which name a fault and never
  * carry a token; any other body is left unread. "answered HTTP 400" alone
- * did not say the audience or the grant was wrong.
+ * did not say the audience or the grant was wrong. A server may still
+ * quote what it was `sent`: each token is written `***` before the cut.
  */
-async function refused(res: Response, what: string): Promise<Error> {
+async function refused(res: Response, what: string, sent: readonly string[]): Promise<Error> {
   // quiet: a body that is not JSON says nothing; the status still names the refusal
   const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
   const text = (v: unknown): string | undefined =>
     typeof v === 'string' && v.trim() !== ''
-      ? v.replace(/\s+/g, ' ').trim().slice(0, 200)
+      ? hideTokens(v, sent).replace(/\s+/g, ' ').trim().slice(0, 200)
       : undefined
   const said = [text(body?.['error']), text(body?.['error_description']) ?? text(body?.['message'])]
     .filter((s) => s !== undefined)
@@ -118,8 +120,13 @@ async function refused(res: Response, what: string): Promise<Error> {
   return new Error(`${what} answered HTTP ${res.status}${said === '' ? '' : `: ${said}`}`)
 }
 
-async function field(res: Response, name: string, what: string): Promise<string> {
-  if (!res.ok) throw await refused(res, what)
+async function field(
+  res: Response,
+  name: string,
+  what: string,
+  sent: readonly string[],
+): Promise<string> {
+  if (!res.ok) throw await refused(res, what, sent)
   const value = ((await res.json().catch(() => null)) as Record<string, unknown> | null)?.[name]
   if (typeof value !== 'string' || value === '') throw new Error(`${what} sent no ${name}`)
   return value
@@ -148,6 +155,7 @@ export async function exchangeOidc(
     ),
     'value',
     `GitHub's OIDC endpoint (${where(cfg.idTokenUrl)})`,
+    [cfg.idTokenBearer],
   )
   const res = await send(
     fetchImpl,
@@ -162,7 +170,7 @@ export async function exchangeOidc(
     wait,
   )
   const what = `the token exchange (${where(cfg.tokenUrl)})`
-  if (!res.ok) throw await refused(res, what)
+  if (!res.ok) throw await refused(res, what, [idToken])
   const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
   const token = body?.['access_token']
   if (typeof token !== 'string' || token === '') throw new Error(`${what} sent no access_token`)
@@ -192,6 +200,6 @@ export async function revokeOidc(
     }),
     wait,
   )
-  if (!res.ok) throw await refused(res, `revoking at ${where(cfg.revokeUrl)}`)
+  if (!res.ok) throw await refused(res, `revoking at ${where(cfg.revokeUrl)}`, [token])
   await res.body?.cancel()
 }

package/src/vite-task/vite-task-map.ts

@@ -396,7 +396,7 @@ function autoTodo(what: string, known?: Record<string, unknown>): string {
   const have = known === undefined ? '' : ` (declared so far: \`${JSON.stringify(known)}\`)`
   return (
     `cache: Vite Task traced this task's ${what} and vx infers none — add ` +
-    `\`inputs: { files: [...] }, cache: { outputs: { files: [...] } }\` with the real ones${have}; ` +
+    `\`inputs: { files: [...] }, outputs: { files: [...] }, cache: true\` with the real ones${have}; ` +
     'without it the task always runs'
   )
 }
@@ -481,7 +481,8 @@ function mapTask(name: string, def: TaskDef, ctx: TaskCtx): GeneratedTask {
     todos.push(ownFileTodo(ownFile))
     return { name, todos, task }
   }
-  task['cache'] = { outputs: outputs.lists }
+  task['outputs'] = outputs.lists
+  task['cache'] = true
   return { name, todos, task }
 }