@vzn/vx-migrate 0.0.652 → 0.0.653

package/src/shared-outputs.ts

@@ -294,10 +294,11 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
       }
       dropped.add(c.index)
       const shared = c.files.find((gb) => clash.files.some((ga) => hits(clash, ga, gb)))!
+      const theirs = clash.files.find((ga) => hits(clash, ga, shared))!
       uncache(t.task!)
       t.todos.push(
-        `declares the output ${JSON.stringify(shared)} that ${JSON.stringify(clash.name)} also ` +
-          "declares — vx cleans a task's outputs before it runs and before a restore, so two " +
+        `declares the output ${sharing(shared, theirs, JSON.stringify(clash.name))} — ` +
+          "vx cleans a task's outputs before it runs and before a restore, so two " +
           "cached tasks on one path would delete each other's work; this one runs uncached. " +
           'Give it its own output path to cache it.',
       )
@@ -306,6 +307,13 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
   return tasks
 }
 
+/** `"<mine>" that <owner> also declares`, or both globs when they only overlap. */
+function sharing(mine: string, theirs: string, owner: string): string {
+  return mine === theirs
+    ? `${JSON.stringify(mine)} that ${owner} also declares`
+    : `${JSON.stringify(mine)}, which overlaps the output ${JSON.stringify(theirs)} that ${owner} declares`
+}
+
 /**
  * Two globs can match one path only when one's literal prefix is a
  * directory of the other's (`packages/*\/dist/**` and `packages/a/dist/**`),
@@ -397,10 +405,17 @@ function inputsOf(t: GeneratedTask): { files: string[]; workspaceFiles?: unknown
  * files git tracks, and a build's outputs are not, so the adopted tool
  * never keyed them either. A literal input another task writes cannot be
  * taken back (core refuses a `!` over a literal input), so that task runs
- * uncached with a todo. A reader whose `!` hides a committed file is the
- * tracked pass's (`spareTrackedOutputs`).
+ * uncached with a todo. Under `walksGlobs` (Turbo) so does a glob that
+ * names the output's place (`gen/**` beside a `gen` writing `gen/**`)
+ * when no `dependsOn` path reaches the writer: Turbo walks an explicit
+ * glob on disk, and with no edge the writer's key does not reach the
+ * reader's either, so taken back it replayed the old output. A glob led
+ * by `**` walks the whole package, as the default does, and keeps the
+ * `!`. Nx hashes no gitignored file, and its mapper drops an input under
+ * an untracked output before this pass. A reader whose `!` hides a
+ * committed file is the tracked pass's (`spareTrackedOutputs`).
  */
-export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
+export function excludeSiblingOutputs(tasks: GeneratedTask[], walksGlobs = false): GeneratedTask[] {
   const writers = tasks.flatMap((t, index) => {
     const c = cachedOutputs(t, index)
     return c === null ? [] : [c]
@@ -427,6 +442,18 @@ export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
           )
           return
         }
+        const named = walksGlobs
+          ? read.find((g) => !g.replace(/^(\.\/)+/, '').startsWith('**'))
+          : undefined
+        if (named !== undefined && !isKeyedGroup(t) && !reaches(tasks, index, w.index)) {
+          unkey(t.task!)
+          t.todos.push(
+            `reads ${JSON.stringify(named)}, which ${JSON.stringify(w.name)} writes and no ` +
+              'dependsOn reaches — vx keys a task only on files no other task writes, so it runs ' +
+              'uncached; add the edge or read the source instead in a vx.config to cache it',
+          )
+          return
+        }
         inputs.files.push(`!${out}`)
       }
     }
@@ -434,6 +461,26 @@ export function excludeSiblingOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
   return tasks
 }
 
+/** Does a same-project `dependsOn` path lead from task `from` to task `to`? */
+function reaches(tasks: readonly GeneratedTask[], from: number, to: number): boolean {
+  const byName = new Map(tasks.map((t, i) => [t.name, i]))
+  const seen = new Set([from])
+  const queue = [from]
+  for (let i = queue.shift(); i !== undefined; i = queue.shift()) {
+    const deps = tasks[i]!.task?.['dependsOn']
+    if (!Array.isArray(deps)) continue
+    for (const d of deps) {
+      const next = typeof d === 'string' ? byName.get(d) : undefined
+      if (next === to) return true
+      if (next !== undefined && !seen.has(next)) {
+        seen.add(next)
+        queue.push(next)
+      }
+    }
+  }
+  return false
+}
+
 /**
  * The same across projects, for workspace outputs: cal.com's shared
  * `post-install` writes `../../node_modules/@prisma/client/**` from every
@@ -476,11 +523,19 @@ export function resolveSharedWorkspaceOutputs(
         a.find((g) => b.some((h) => outputsOverlap(h, g)))
       let clash: (typeof kept)[number] | undefined
       let shared: string | undefined
+      let theirs: string | undefined
       for (const i of candidates([...ws, ...own])) {
         const k = kept[i]!
-        shared =
-          overlap(ws, [...k.ws, ...k.own]) ??
-          overlap(own, k.project === p.name ? k.ws : [...k.ws, ...k.own])
+        const pools: [string[], string[]][] = [
+          [ws, [...k.ws, ...k.own]],
+          [own, k.project === p.name ? k.ws : [...k.ws, ...k.own]],
+        ]
+        for (const [mine, other] of pools) {
+          shared = overlap(mine, other)
+          if (shared === undefined) continue
+          theirs = other.find((h) => outputsOverlap(h, shared!))
+          break
+        }
         if (shared !== undefined) {
           clash = k
           break
@@ -493,7 +548,7 @@ export function resolveSharedWorkspaceOutputs(
       }
       uncache(t.task!)
       t.todos.push(
-        `declares the workspace output ${JSON.stringify(shared)} that ${clash.id} also declares — ` +
+        `declares the workspace output ${sharing(shared!, theirs!, clash.id)} — ` +
           "vx cleans a task's outputs before it runs and before a restore, so two cached tasks " +
           "on one path would delete each other's work; this one runs uncached. Give it its own " +
           'output path to cache it.',

package/src/tracked-outputs.ts

@@ -72,6 +72,47 @@ export async function gitIgnored(root: string, rels: readonly string[]): Promise
   }
 }
 
+/**
+ * What git ignores under the fixed prefixes of the root-relative `globs`:
+ * each ignored file, and a directory ignored whole (or holding only
+ * ignored files) as one `dir/` entry (`--directory`: `dist/` is never
+ * walked). Entries under `node_modules` (the lockfile keys an install) or
+ * vx's own `.vx/` are left out. One spawn; empty outside a repo or
+ * without git.
+ */
+export async function gitIgnoredUnder(root: string, globs: readonly string[]): Promise<string[]> {
+  if (globs.length === 0) return []
+  const prefixes = [...new Set(globs.map((g) => literalPrefix(g) || '.'))].sort()
+  // A prefix under another adds nothing; `ls-files` takes no pathspec file.
+  const kept = prefixes.includes('.')
+    ? ['.']
+    : prefixes.filter((p, i) => !prefixes.slice(0, i).some((q) => p.startsWith(`${q}/`)))
+  try {
+    const p = Bun.spawn(
+      [
+        'git',
+        'ls-files',
+        '-z',
+        '--others',
+        '--ignored',
+        '--exclude-standard',
+        '--directory',
+        '--no-empty-directory',
+        '--',
+        ...kept,
+      ],
+      { cwd: root, stdout: 'pipe', stderr: 'ignore' },
+    )
+    const out = await new Response(p.stdout).text()
+    if ((await p.exited) !== 0) return []
+    return out
+      .split('\0')
+      .filter((f) => f !== '' && !f.startsWith('.vx/') && !f.split('/').includes('node_modules'))
+  } catch {
+    return []
+  }
+}
+
 /**
  * What a project's tracked files are: their extensions (lower case, no
  * dot), directory names at any depth, and top-level entry names.
@@ -165,18 +206,20 @@ function literalPrefix(glob: string): string {
   return out.join('/')
 }
 
-/** The tracked `files` (relative to the same base as `globs`) the positive globs cover and no `!` takes back. */
+/**
+ * The tracked `files` (relative to the same base as `globs`) the positive
+ * globs cover, even one the globs' own `!` takes back: a reader's take-back
+ * is of the positives alone (`excludeSiblingOutputs`), so its `!*\/**`
+ * beside a `*\/**` minus `!src/**` output still hid src.
+ */
 function coveredTracked(globs: readonly string[], files: readonly string[]): string[] {
-  const positive = globs.filter((g) => !g.startsWith('!'))
-  const taken = globs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
   const hit = new Set<string>()
-  for (const g of positive) {
+  for (const g of globs) {
+    if (g.startsWith('!')) continue
     const prefix = literalPrefix(g)
     for (const f of files) {
       if (prefix !== '' && f !== prefix && !f.startsWith(`${prefix}/`)) continue
-      if (!outputsOverlap(g, f)) continue
-      if (taken.some((t) => outputsOverlap(t, f))) continue
-      hit.add(f)
+      if (outputsOverlap(g, f)) hit.add(f)
     }
   }
   return [...hit].sort()
@@ -275,20 +318,16 @@ export function spareTrackedOutputs(
       ] as const) {
         const globs = outputs[key]
         if (!Array.isArray(globs) || globs.length === 0) continue
-        let strings = globs.filter((g): g is string => typeof g === 'string')
+        const strings = globs.filter((g): g is string => typeof g === 'string')
         // An output naming one committed file (eslint's
-        // `eslint-suppressions.json`) is a source: the entry goes, and so
-        // does the `!` a reader's inputs got for it, or every reader ran
-        // uncached (hono).
+        // `eslint-suppressions.json`, a codegen's `gen.ts`) is also a
+        // source: the `!` a reader's inputs got for it goes, or every
+        // reader ran uncached (hono). The entry stays: dropped, a task
+        // that rewrites the file never saved.
         const rootedOf = (g: string) => (key === 'files' && rel !== '' ? `${rel}/${g}` : g)
-        const sources = new Set(
-          strings.filter((g) => isLiteralPattern(g) && trackedSet.has(rootedOf(g))),
-        )
-        if (sources.size > 0) {
-          strings = strings.filter((g) => !sources.has(g.startsWith('!') ? g.slice(1) : g))
-          outputs[key] = strings
-          for (const g of sources) unhide(key === 'files' ? p : null, rootedOf(g))
-        }
+        for (const g of strings)
+          if (isLiteralPattern(g) && trackedSet.has(rootedOf(g)))
+            unhide(key === 'files' ? p : null, rootedOf(g))
         const hit = coveredTracked(strings, base)
         if (hit.length > 0) hits.push([key, hit])
       }

package/src/turbo/index.ts

@@ -18,7 +18,7 @@ import { refuseUnknownOptions, UserError, type PluginOptionKinds } from '@vzn/vx
 import { type AdoptionRun, adoptionPlugin } from '../adoption-plugin.js'
 import type { AdoptionMapping } from '../mapping-cache.js'
 import { collectGaps } from '../plugin-gaps.js'
-import { gitIgnored, trackedKinds } from '../tracked-outputs.js'
+import { gitIgnored, gitIgnoredUnder, trackedKinds } from '../tracked-outputs.js'
 import { packageScripts, relPosix } from '../paths.js'
 import { onceReader, type ReadText, tscBuildInfo } from '../tsc-buildinfo.js'
 import type * as TurboMap from './turbo-map.js'
@@ -317,6 +317,7 @@ async function mapAll(
     ...(tracked === null ? {} : { tracked: trackedKinds(tracked) }),
     ownConfig: (rel) => configs.get(rel === '.' ? '' : rel) ?? null,
     ignored: (rels) => gitIgnored(root, rels),
+    ignoredUnder: (globs) => gitIgnoredUnder(root, globs),
     buildInfo: (rel, command) => tscBuildInfo(read, path.join(root, rel), command),
   })
   const byName = new Map<string, TurboMappedProject>()

package/src/turbo/turbo-map.ts

@@ -11,7 +11,7 @@
 // The consumer decides what a global becomes through `splice`.
 
 import path from 'node:path'
-import { isLiteralPattern, pruneOrphanPersistentNotes, UserError } from '@vzn/vx'
+import { isLiteralPattern, outputsOverlap, pruneOrphanPersistentNotes, UserError } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
 import { refuseTaskNames } from '../plugin-gaps.js'
 import { apartTakeBacks, literalGlob, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
@@ -280,6 +280,12 @@ export interface MapTurboOptions {
    * path among them is keyed by a probe. Absent, none is.
    */
   ignored?: (rels: readonly string[]) => Promise<ReadonlySet<string>>
+  /**
+   * What git ignores under the root-relative globs' fixed prefixes
+   * (`gitIgnoredUnder`): files, and `dir/` for a directory ignored whole.
+   * Absent, an explicit glob keys none of them.
+   */
+  ignoredUnder?: (globs: readonly string[]) => Promise<readonly string[]>
   /**
    * The `.tsbuildinfo` files a root-relative package's command writes,
    * relative to the package (`tscBuildInfo`). Absent, none.
@@ -295,6 +301,12 @@ export interface MapTurboOptions {
 interface Literals {
   readonly inputs: Record<string, unknown>
   readonly rels: ReadonlyMap<string, Named>
+  /** The explicit globs, root-relative, with the list that holds them. */
+  readonly globs: ReadonlyMap<string, 'files' | 'workspaceFiles'>
+  /** The global `!` entries, which a preset spread may hide from the lists. */
+  readonly taken: readonly string[]
+  /** The package, root-relative (`files` entries are relative to it). */
+  readonly pkgDir: string
 }
 type Named = readonly ['files' | 'workspaceFiles' | null, string]
 
@@ -313,6 +325,18 @@ function zeroSegments(glob: string): string | null {
   return head === '' || isLiteralPattern(head.replace(/\\./g, '_')) ? null : head
 }
 
+/**
+ * A glob with its `.` and `..` segments collapsed, as Turbo cleans the path
+ * before it walks (turborepo-globwalk's `collapse_path`): `src/../../shared/**`
+ * is `../shared/**`, `./src/**` is `src/**`. A `$TURBO_ROOT$/` prefix is
+ * the root, not a segment.
+ */
+function collapseDots(glob: string): string {
+  if (glob.startsWith('$TURBO_ROOT$/'))
+    return '$TURBO_ROOT$/' + collapseDots(glob.slice('$TURBO_ROOT$/'.length))
+  return path.posix.normalize(glob)
+}
+
 /** A glob, `!` or not, and the X its `X/**` also matches in Turbo (`zeroSegments`). */
 function withZeroSegments(glob: string): string[] {
   const neg = glob.startsWith('!') ? '!' : ''
@@ -363,6 +387,70 @@ function keyIgnored(
   inputs.workspaceRuntime = [...probes, ignoredFilesProbe(hits.map(([rel]) => rel))]
 }
 
+/**
+ * Turbo walks an explicit input glob on disk, gitignored files and all
+ * (`$TURBO_DEFAULT$` alone skips them); core's globs filter what git
+ * lists, so `src/**` over an ignored `src/gen.ts` keyed nothing and an
+ * edit replayed the old output. Each ignored path a glob matches is named
+ * outright, which core reads from disk: a file as itself, a directory
+ * ignored whole as the glob's rest under it (`src/out/**`). A file a `!`
+ * takes back stays out (core refuses a literal one covers).
+ */
+function keyIgnoredGlobbed(
+  l: Literals,
+  under: readonly string[],
+  projectDirs: readonly string[],
+): void {
+  // The lists as they stand: a sibling's output taken back since counts.
+  const current = (['files', 'workspaceFiles'] as const).flatMap((kind) =>
+    ((l.inputs[kind] as unknown[] | undefined) ?? []).flatMap((e) =>
+      typeof e === 'string' && e.startsWith('!')
+        ? [kind === 'files' && l.pkgDir !== '' ? `${l.pkgDir}/${e.slice(1)}` : e.slice(1)]
+        : [],
+    ),
+  )
+  const taken = [...l.taken, ...current].map((t) => new Bun.Glob(t))
+  for (const [glob, kind] of l.globs) {
+    const matcher = new Bun.Glob(glob)
+    const at = kind === 'files' && l.pkgDir !== '' ? `${l.pkgDir}/` : ''
+    for (const e of under) {
+      if (!e.startsWith(at)) continue
+      // A package nested in this one is another project, which core's
+      // globs stop at: its path is named from the workspace root.
+      const nested = at !== '' && projectDirs.some((d) => d.startsWith(at) && e.startsWith(`${d}/`))
+      const base = nested ? '' : at
+      const entry = e.endsWith('/')
+        ? globUnder(glob.slice(at.length), e.slice(at.length, -1))
+        : matcher.match(e) && !taken.some((t) => t.match(e))
+          ? literalGlob(e.slice(base.length))
+          : null
+      if (entry === null) continue
+      const into = nested ? 'workspaceFiles' : kind
+      const named = nested && e.endsWith('/') ? `${l.pkgDir}/${entry}` : entry
+      const list = (l.inputs[into] as unknown[] | undefined) ?? []
+      if (!list.includes(named)) l.inputs[into] = [...list, named]
+    }
+  }
+}
+
+/**
+ * `glob`'s rest below `dir`, which it reaches into (`a/**\/*.ts` under
+ * `a/gen`: `a/gen/**\/*.ts`), else null: the paths of the glob under it.
+ */
+function globUnder(glob: string, dir: string): string | null {
+  // A brace holding a `/` spans segments; such a glob is not split here.
+  if (/\{[^}]*\//.test(glob)) return null
+  const gs = glob.split('/')
+  const ds = dir.split('/')
+  for (let i = 0; i < ds.length; i++) {
+    const g = gs[i]
+    if (g === undefined) return null
+    if (g === '**') return [...ds.map(literalGlob), ...gs.slice(i)].join('/')
+    if (!new Bun.Glob(g).match(ds[i]!)) return null
+  }
+  return gs.length > ds.length ? [...ds.map(literalGlob), ...gs.slice(ds.length)].join('/') : null
+}
+
 async function readTurboJson(file: string, root: string): Promise<TurboJson> {
   const text = await Bun.file(file).text()
   let parsed: unknown
@@ -1174,6 +1262,8 @@ export async function mapTurboWorkspace(
   // whose own edges lack `^name` (opencode's `build: { dependsOn: [] }`)
   // is key-only too: Turbo's `^build` stops at it, and core's walked past
   // it to the builds below, running and keying ones Turbo never waits on.
+  // `cache: false` does not stop it: a key-only node stores nothing, and
+  // Turbo's no-op hashes the package's files cached or not.
   const keyOnly = new Map<string, Set<string>>()
   for (const meta of metas) {
     const scripts = packageScripts(meta)
@@ -1185,7 +1275,7 @@ export async function mapTurboWorkspace(
       if (!(caretSelf.has(name) || stops) || !withScript.has(name) || transit.has(name)) continue
       if (scripts[name] !== undefined || commandOverride(def) !== undefined) continue
       if (sidecarGroups.has(`${meta.name}#${name}`)) continue
-      if (def?.cache === false || def?.persistent === true) continue
+      if (def?.persistent === true) continue
       emitted.get(meta.name)!.add(name)
       runnable.get(meta.name)!.add(name)
       let set = keyOnly.get(meta.name)
@@ -1315,8 +1405,12 @@ export async function mapTurboWorkspace(
       // Core gives a project with no `build` this very node (a group behind
       // `^build`, keyed on the project's files), so writing it is noise:
       // solid's three script-less packages each got a key-only `build`.
+      // Written configs only: a bare `build` skips core's node (X-102), so
+      // under turbo(), which writes nothing, `vx run build` scoped to such a
+      // package was refused where Turbo runs its dependencies' builds.
       const noopEdges = defFor(name)!.dependsOn ?? []
       if (
+        opts.envNames === undefined &&
         noop &&
         name === 'build' &&
         noopEdges.includes('^build') &&
@@ -1445,7 +1539,7 @@ export async function mapTurboWorkspace(
         npmScriptEnv(mapped.task, name, command === script, meta, opts)
       tasks.push(mapped)
     }
-    excludeSiblingOutputs(resolveSharedOutputs(tasks))
+    excludeSiblingOutputs(resolveSharedOutputs(tasks), true)
     const tags = packageTags(meta === rootMeta ? rootCfg : files.get(meta.name))
     projects.push({ name: meta.name, dir: meta.dir, ...(tags.length > 0 ? { tags } : {}), tasks })
   }
@@ -1512,7 +1606,7 @@ export async function mapTurboWorkspace(
           if (pm === undefined) continue
           const pdef = definitions(pm).defFor(task)
           if (pdef?.cache !== false) continue
-          if (!sel.startsWith('^')) unfold.add(`${pm.name}#${task}`)
+          unfold.add(`${pm.name}#${task}`)
           const at = relPosix(root, pm.dir)
           for (const g of dep.globs.length > 0 ? dep.globs : (pdef.outputs ?? []))
             if (!g.startsWith('!')) rels.push(at === '' ? g : `${at}/${g}`)
@@ -1532,11 +1626,15 @@ export async function mapTurboWorkspace(
       inputs['workspaceRuntime'] = [...probes, probe]
       // Folded, the producer's key "covers" what it writes, and core answers
       // the probe before it runs: the previous run's bytes. Left out of the
-      // fold, the probe waits for it (core's late probes, X-34).
+      // fold, the probe waits for it (core's late probes, X-34). A `^gen`
+      // edge reaches it too, beside its cached siblings: those stay folded.
       const deps = (t.task!['dependsOn'] as string[] | undefined) ?? []
-      const id = (d: string) => (d.startsWith('^') || d.includes('#') ? d : `${meta.name}#${d}`)
-      if (deps.some((d) => unfold.has(id(d))))
-        inputs['tasks'] = deps.filter((d) => !unfold.has(id(d)))
+      const ids = (d: string): string[] =>
+        d.startsWith('^')
+          ? metas.filter((m) => declares(meta, m.name)).map((m) => `${m.name}#${d.slice(1)}`)
+          : [d.includes('#') ? d : `${meta.name}#${d}`]
+      if (deps.some((d) => ids(d).some((i) => unfold.has(i))))
+        inputs['tasks'] = [...deps, ...[...unfold].map((i) => `!${i}`)]
     }
   }
 
@@ -1575,6 +1673,14 @@ export async function mapTurboWorkspace(
   for (const e of opts.splice('inputs', globals.inputs))
     if (typeof e !== 'string') opaque.set(JSON.stringify(e), globals.inputs)
   excludeWorkspaceOutputs(root, projects, (e) => opaque.get(JSON.stringify(e)) ?? [])
+  // After every take-back: a path one takes back is not named back.
+  if (opts.ignoredUnder !== undefined) {
+    const under = await opts.ignoredUnder([
+      ...new Set(literals.tasks.flatMap((l) => [...l.globs.keys()])),
+    ])
+    const dirs = projects.map((p) => relPosix(root, p.dir)).filter((d) => d !== '')
+    if (under.length > 0) for (const l of literals.tasks) keyIgnoredGlobbed(l, under, dirs)
+  }
   pruneUnreachedPersistentNotes(projects, metas, opts.persistentTodo)
   pruneOrphanPersistentNotes(projects, opts.persistentTodo)
   refuseTaskNames(projects, 'task')
@@ -2082,12 +2188,13 @@ function buildTask(
       // build (item 1031). A positive glob with no safe
       // form widens to every package file; a negation with none is dropped
       // (it would exclude fewer files, never more).
-      const wax = minimatchToVx(neg ? i.slice(1) : i, neg)
-      if (wax === null) {
+      const vx = minimatchToVx(neg ? i.slice(1) : i, neg)
+      if (vx === null) {
         todos.push(`input ${JSON.stringify(i)}: glob syntax vx cannot take — map manually`)
         if (!neg) files.push('**/*')
         continue
       }
+      const wax = collapseDots(vx)
       const translated = (neg ? '!' : '') + wax
       const body = wax
       const up = climbed(translated)
@@ -2172,8 +2279,17 @@ function buildTask(
   if (keyEnv.length > 0) inputs.env = keyEnv
   if (pkgDotenv) inputs.runtime = [pkgDotenvDeep ? DOTENV_PROBE : DOTENV_PROBE_TOP]
   if (wsDotenv.length > 0) inputs.workspaceRuntime = [dotenvGlobsProbe(wsDotenv) ?? DOTENV_PROBE]
-  for (const rel of rels.keys()) if (!isLiteral(rel)) rels.delete(rel)
-  literals.tasks.push({ inputs, rels })
+  const globs = new Map<string, 'files' | 'workspaceFiles'>()
+  for (const [rel, [kind]] of rels)
+    if (!isLiteral(rel)) {
+      rels.delete(rel)
+      if (kind !== null) globs.set(rel, kind)
+    }
+  const taken: string[] = []
+  for (const g of globalKept)
+    if (g.startsWith('!')) taken.push(g.slice(1))
+    else if (!isLiteral(g) && !globs.has(g)) globs.set(g, 'workspaceFiles')
+  literals.tasks.push({ inputs, rels, globs, taken, pkgDir: atRoot ? '' : pkgDir })
   // Turbo keys every task on its inputs, cached or not, and a dependant
   // folds that key: an uncached task's inputs still move its dependants.
   task.inputs = inputs
@@ -2182,6 +2298,8 @@ function buildTask(
   const outFiles: string[] = []
   const zeroed = new Set<string>()
   const wsOutFiles: string[] = []
+  // The user's `!` outputs, not the take-backs added below.
+  const ownNegated = new Set<string>()
   for (const raw of def.outputs ?? []) {
     // Turbo's grammar: an extglob in `dist/**/*.@(js|mjs)` matched
     // nothing, so a hit restored nothing (item 1031).
@@ -2197,12 +2315,13 @@ function buildTask(
     // `.next/**` minus `!.next/cache/**` saved the cache and cleaned it
     // before every run while vx outputs could not exclude.
     const neg = mapped.startsWith('!') ? '!' : ''
-    const o = mapped.slice(neg.length)
+    const o = collapseDots(mapped.slice(neg.length))
     const signed = (g: string) => {
       const head = zeroSegments(g)
-      if (head === null) return [neg + g]
-      zeroed.add(neg + head)
-      return [neg + g, neg + head]
+      const out = head === null ? [neg + g] : [neg + g, neg + head]
+      if (head !== null) zeroed.add(neg + head)
+      if (neg) for (const e of out) ownNegated.add(e)
+      return out
     }
     if (o.startsWith('$TURBO_ROOT$/')) {
       wsOutFiles.push(...signed(o.slice('$TURBO_ROOT$/'.length)))
@@ -2253,13 +2372,29 @@ function buildTask(
   const ws = takingBack(wsOutFiles).sort(negationsLast)
   if (ws.length > 0) outputs.workspaceFiles = ws
   task.outputs = outputs
-  task.cache = true
-  if (rewritesManifest) {
-    task.inputs = {
-      ...(task.inputs as Record<string, unknown>),
-      stability: { strategy: 'mutable' },
-    }
+  // A path a `!` output takes back is still written by the task, often
+  // not gitignored (`dist/skip`): as its own input it changed after the
+  // key was taken, so no run was saved, and no dependant's either. One
+  // over a committed file is source (`*/**` minus `!src/**`, medusa's):
+  // Turbo keys it, and taken back an edit there replayed the old build.
+  // Without git's list, no `!` is known to hold only what the task writes.
+  const subtract = (field: 'files' | 'workspaceFiles', from: readonly string[]) => {
+    const list = inputs[field] as unknown[] | undefined
+    const tracked = opts.tracked?.(field === 'files' ? pkgDir : '').files
+    if (tracked === undefined) return
+    const negs = from.filter(
+      (g) =>
+        ownNegated.has(g) &&
+        !list?.includes(g) &&
+        !tracked.some((f) => outputsOverlap(g.slice(1), f)),
+    )
+    if (list !== undefined && negs.length > 0) inputs[field] = withoutTakenBack([...list, ...negs])
   }
+  subtract('files', outputs.files as string[])
+  subtract('workspaceFiles', ws)
+  task.cache = true
+  // In place: the ignored-path passes hold this object.
+  if (rewritesManifest) inputs.stability = { strategy: 'mutable' }
 
   return { name, todos, task, uses }
 }