@vzn/vx 0.0.131 → 0.0.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.131",
+  "version": "0.0.132",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.131",
-    "@vzn/vx-linux-arm64": "0.0.131",
-    "@vzn/vx-darwin-x64": "0.0.131",
-    "@vzn/vx-darwin-arm64": "0.0.131"
+    "@vzn/vx-linux-x64": "0.0.132",
+    "@vzn/vx-linux-arm64": "0.0.132",
+    "@vzn/vx-darwin-x64": "0.0.132",
+    "@vzn/vx-darwin-arm64": "0.0.132"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/archive.ts

@@ -224,14 +224,14 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
       const st = await stat(abs).catch((err: NodeJS.ErrnoException) => {
         if (err.code === 'ENOENT') {
           throw new UserError(
-            `output ${shown} is a dangling symlink: vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces (output globs take no '!')`,
+            `output ${shown} is a dangling symlink: vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
           )
         }
         throw err
       })
       if (!st.isFile()) {
         throw new UserError(
-          `output ${shown} is not a regular file (a symlink to a directory?): vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces (output globs take no '!')`,
+          `output ${shown} is not a regular file (a symlink to a directory?): vx stores regular files only — emit a file there, or narrow cache.outputs.files to the files the task produces, or take it back with a '!' entry`,
         )
       }
       // Windows reports 0o666 (0o444 read-only) and never an exec bit: a

package/src/cache/cache.ts

@@ -32,16 +32,15 @@ import path from 'node:path'
 import { createTables } from './schema.js'
 import {
   UserError,
-  asTrees,
   formatBytes,
   isDiskFull,
   isFsRefusal,
   isOutOfFds,
   OUT_OF_FDS_HINT,
+  outputMatcher,
   relPosix,
   span,
   splitTaskId,
-  taskGlob,
   xxh3hex,
 } from '../util/index.js'
 import {
@@ -1952,13 +1951,14 @@ function assertArtifactNames(
     }
   }
   if (declared === undefined) return
-  const files = asTrees(declared.files).map(taskGlob)
-  const wsFiles = asTrees(declared.workspaceFiles).map(taskGlob)
+  // A path a `!` entry takes back is no declared output either (A-44).
+  const isFile = outputMatcher(declared.files)
+  const isWsFile = outputMatcher(declared.workspaceFiles)
   for (const name of names) {
     const ok = name.startsWith('outputs/')
-      ? files.some((g) => g.match(name.slice('outputs/'.length)))
+      ? isFile(name.slice('outputs/'.length))
       : name.startsWith(WORKSPACE_OUTPUT_PREFIX)
-        ? wsFiles.some((g) => g.match(name.slice(WORKSPACE_OUTPUT_PREFIX.length)))
+        ? isWsFile(name.slice(WORKSPACE_OUTPUT_PREFIX.length))
         : true
     if (!ok) {
       throw new CorruptArtifactError(

package/src/cache/inputs.ts

@@ -25,7 +25,9 @@ import {
   isExecutableMissing,
   isLiteralPattern,
   normalizeGlob,
+  outputMatcher,
   shellArgv,
+  splitNegations,
   slashBraceExpansions,
   taskGlob,
   UserError,
@@ -242,11 +244,10 @@ async function resolveWorkspaceFiles(args: {
   }
   if (positive.length === 0) return []
 
-  const excludeGlobs = [
-    ...ALWAYS_IGNORE,
-    ...asTrees(args.ownWorkspaceOutputs),
-    ...asTrees(negative),
-  ].map(globFor)
+  const excludeGlobs = [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor)
+  // A path the task's own outputs take back with `!` is no output, so it
+  // stays an input (A-44).
+  const ownOutput = outputMatcher(args.ownWorkspaceOutputs, globFor)
   const positiveGlobs = asTrees(positive).map(globFor)
   // Workspace-wide partition, keyed by the workspace root. Populated
   // up-front by `populateGitFilesCache(..., workspaceWide: true)` when
@@ -276,7 +277,7 @@ async function resolveWorkspaceFiles(args: {
     gitFiles,
     positive,
     positiveGlobs,
-    excludeGlobs,
+    (rel) => excludeGlobs.some((g) => g.match(rel)) || ownOutput(rel),
     undecodable,
   )
   if (memoKey !== undefined) args.memo!.set(memoKey, { snapshot: gitFiles, result })
@@ -288,7 +289,7 @@ async function resolveWorkspaceFilesOver(
   gitFiles: readonly string[],
   positive: readonly string[],
   positiveGlobs: readonly Bun.Glob[],
-  excludeGlobs: readonly Bun.Glob[],
+  excluded: (rel: string) => boolean,
   undecodable: ReadonlySet<string> | undefined,
 ): Promise<string[]> {
   // Second call site of the literal-input guard. `resolveWorkspaceFiles`
@@ -302,7 +303,7 @@ async function resolveWorkspaceFilesOver(
   for (const rel of gitFiles) {
     if (unmatchedLiterals.size > 0) settleLiterals(unmatchedLiterals, rel)
     if (!positiveGlobs.some((g) => g.match(rel))) continue
-    if (excludeGlobs.some((g) => g.match(rel))) continue
+    if (excluded(rel)) continue
     candidates.push(path.resolve(args.workspaceRoot, rel))
   }
   if (unmatchedLiterals.size > 0) {
@@ -510,11 +511,12 @@ export async function resolveOutputs(args: {
   outputs: string[]
   nestedProjectDirs: string[]
 }): Promise<string[]> {
-  if (args.outputs.length === 0) return []
-  const excludeGlobs = outputExcludes(args.outputs)
+  const { positive, negative } = splitNegations(args.outputs)
+  if (positive.length === 0) return []
+  const excludeGlobs = [...outputExcludes(positive), ...asTrees(negative).map(globFor)]
   const scanned = [
     ...(await scanUnion(
-      asTrees(args.outputs),
+      asTrees(positive),
       excludeGlobs,
       args.projectDir,
       inNestedProject(args.projectDir, args.nestedProjectDirs),
@@ -781,10 +783,10 @@ export async function resolveWorkspaceOutputs(args: {
   workspaceRoot: string
   outputs: string[]
 }): Promise<string[]> {
-  if (args.outputs.length === 0) return []
-  const scanned = [
-    ...(await scanUnion(asTrees(args.outputs), outputExcludes(args.outputs), args.workspaceRoot)),
-  ]
+  const { positive, negative } = splitNegations(args.outputs)
+  if (positive.length === 0) return []
+  const excludeGlobs = [...outputExcludes(positive), ...asTrees(negative).map(globFor)]
+  const scanned = [...(await scanUnion(asTrees(positive), excludeGlobs, args.workspaceRoot))]
   // Same containment as the project twin, anchored one level out. These globs
   // deliberately ignore PROJECT boundaries — that is the escape hatch — but
   // escaping the WORKSPACE was never part of it, and `cleanWorkspaceOutputs`
@@ -964,9 +966,10 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   if (positive.length === 0) return []
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
-  const excludeGlobs = [...ALWAYS_IGNORE, ...asTrees(args.ownOutputs), ...asTrees(negative)].map(
-    globFor,
-  )
+  const excludeGlobs = [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor)
+  // A path the task's own outputs take back with `!` is no output, so it
+  // stays an input: a tracked file under `dist` the build reads (A-44).
+  const ownOutput = outputMatcher(args.ownOutputs, globFor)
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
   // files, .git/info/exclude, and global excludes all participate
@@ -1031,7 +1034,7 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
       }
     }
     if (!matched) continue
-    if (nested(rel) || excludeGlobs.some((g) => g.match(rel))) continue
+    if (nested(rel) || excludeGlobs.some((g) => g.match(rel)) || ownOutput(rel)) continue
     candidates.push(path.resolve(args.projectDir, rel))
   }
   if (unmatchedLiterals.size > 0) {

package/src/cli/cache.ts

@@ -59,6 +59,7 @@ interface PruneArgs {
   olderThanMs?: number
   maxBytes?: number
   dryRun?: boolean
+  format?: 'pretty' | 'json'
   /** `--cache-dir`: prune the cache a run with the same flag uses. */
   cacheDir?: string
   error?: string
@@ -110,6 +111,12 @@ export function parsePruneArgs(args: readonly string[]): PruneArgs {
       out.maxBytes = bytes
     } else if (a === '--dry-run') {
       out.dryRun = true
+    } else if (a === '--format' || a?.startsWith('--format=')) {
+      const v = a === '--format' ? args[++i] : a.slice('--format='.length)
+      if (v !== 'pretty' && v !== 'json') {
+        return { error: `--format must be pretty or json${seeHelp('cache')}` }
+      }
+      out.format = v
     } else {
       const cd = parseCacheDirFlag(args, i)
       if (cd === null)
@@ -151,10 +158,10 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
   // to find that out made it: `.vx/cache` with a database and a
   // `.gitignore`, where item 900 had held the dry run to making nothing
   // (and a read-only checkout was refused as unwritable instead).
+  const dry = parsed.dryRun === true
+  const json = parsed.format === 'json'
   if (!existsSync(dir)) {
-    process.stdout.write(
-      parsed.dryRun === true ? 'Would prune 0 entries (0 B)\n' : 'Pruned 0 entries (0 B freed)\n',
-    )
+    printPruned({ evicted: 0, bytesFreed: 0, orphans: 0, orphanBytes: 0 }, dry, json)
     return 0
   }
   if (parsed.dryRun === true) {
@@ -163,7 +170,7 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
       warnToStderr(
         `[vx] the cache index is schema ${earlier.found} from an earlier vx: the prune resets it first, and every artifact past the hour's grace is then an orphan`,
       )
-      printPruned({ evicted: 0, bytesFreed: 0, ...earlier }, true)
+      printPruned({ evicted: 0, bytesFreed: 0, ...earlier }, true, json)
       return 0
     }
   }
@@ -187,7 +194,7 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
     if (parsed.olderThanMs !== undefined) opts.olderThanMs = parsed.olderThanMs
     if (parsed.maxBytes !== undefined) opts.maxBytes = parsed.maxBytes
     if (parsed.dryRun) opts.dryRun = true
-    printPruned(await cache.prune(opts), parsed.dryRun === true)
+    printPruned(await cache.prune(opts), dry, json)
   } finally {
     cache.close()
     await releaseRunLock()
@@ -198,7 +205,15 @@ async function pruneCmd(args: readonly string[]): Promise<number> {
 function printPruned(
   result: { evicted: number; bytesFreed: number; orphans: number; orphanBytes: number },
   dry: boolean,
+  json: boolean,
 ): void {
+  if (json) {
+    const { evicted, bytesFreed, orphans, orphanBytes } = result
+    process.stdout.write(
+      `${JSON.stringify({ dryRun: dry, evicted, bytesFreed, orphans, orphanBytes })}\n`,
+    )
+    return
+  }
   const orphans =
     result.orphans > 0
       ? `, ${dry ? 'would reap' : 'reaped'} ${result.orphans} orphaned artifact${result.orphans === 1 ? '' : 's'} (${formatBytes(result.orphanBytes)})`

package/src/cli/help.ts

@@ -42,7 +42,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     'Usage:',
     '  vx run [OPTIONS] [TASK | PKG#TASK] [-- forwarded-args...]',
     '  vx watch [OPTIONS] TASK [-- forwarded-args...]',
-    '  vx cache prune [--older-than <duration>] [--max-size <size>] [--dry-run] [--cache-dir <path>]',
+    '  vx cache prune [--older-than <duration>] [--max-size <size>] [--dry-run] [--format pretty|json] [--cache-dir <path>]',
     '  vx lock [--check]',
     '  vx init [--dry] [--force] [--mjs] [--plugin <seam>]',
     '  vx upgrade [tag]',
@@ -125,6 +125,7 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '  vx cache prune --older-than 30d     Evict entries last accessed > 30 days ago.',
     '  vx cache prune --max-size 1G        Keep total cache under 1 GB (LRU eviction).',
     '      --dry-run                       Say what the policy would reap; delete nothing.',
+    '      --format <fmt>                  pretty (default) | json.',
     '      --cache-dir <path>              The cache a run with the same flag uses (why, last, info too).',
     '',
     '  Duration units: s, m, h, d. Size units: K, M, G, T (powers of 1024).',

package/src/cli/watch-filter.ts

@@ -7,6 +7,7 @@ import {
   executablePath,
   isLiteralPattern,
   normalizeGlob,
+  outputMatcher,
   staticPrefix,
   taskGlob,
 } from '../util/index.js'
@@ -67,11 +68,14 @@ export function makeWatchIgnore(
   // every ancestor of it under the dir are output containers.
   // A literal entry means the file or its whole tree — the resolver's own
   // rule (`asTrees`), so the tree's files never count as edits.
+  // A `!` entry takes its paths back, so an edit there is an edit (A-44);
+  // compiled as a glob it would be `Bun.Glob`'s own negation and hide every
+  // other path.
   const declared = [...outputs].map(
     ([dir, globs]) =>
       [
         path.resolve(dir),
-        asTrees(globs).map((g) => taskGlob(g)),
+        outputMatcher(globs),
         globs.map(outputContainer).filter((c) => c !== ''),
       ] as const,
   )
@@ -101,13 +105,13 @@ export function makeWatchIgnore(
     const abs = path.resolve(base, filename)
     if (abs === cacheAbs || abs.startsWith(cacheAbs + path.sep)) return true
     if (isInput(abs)) return false
-    for (const [dir, globs, containers] of declared) {
+    for (const [dir, isOutput, containers] of declared) {
       if (!abs.startsWith(dir + path.sep)) continue
       const rel = abs
         .slice(dir.length + 1)
         .split(path.sep)
         .join('/')
-      if (globs.some((g) => g.match(rel))) return true
+      if (isOutput(rel)) return true
       if (containers.some((c) => c === rel || c.startsWith(`${rel}/`))) return true
     }
     return false

package/src/graph/task-graph.ts

@@ -3,6 +3,7 @@ import type { ProjectConfig, TaskConfig } from '../config.js'
 import {
   asTrees,
   isLiteralPattern,
+  splitNegations,
   staticPrefix,
   taskGlob,
   UserError,
@@ -773,9 +774,16 @@ function detectOutputCollisions(nodes: Map<string, TaskNode>, workspaceRoot?: st
     if ((outs?.workspaceFiles?.length ?? 0) > 0) wsDeclarers.push(n)
   }
 
-  const filesOf = (n: TaskNode): readonly string[] | undefined => n.config.cache?.outputs.files
+  // Where each task's outputs MIGHT land: its positive globs. A `!` entry
+  // only narrows, so leaving it out can refuse a pair it separates, never
+  // pass one it does not (A-44); read as a glob it is `Bun.Glob`'s own
+  // negation, which overlaps nearly everything.
+  const positiveOf = (globs: readonly string[] | undefined): readonly string[] | undefined =>
+    globs === undefined ? undefined : splitNegations(globs).positive
+  const filesOf = (n: TaskNode): readonly string[] | undefined =>
+    positiveOf(n.config.cache?.outputs.files)
   const wsFilesOf = (n: TaskNode): readonly string[] | undefined =>
-    n.config.cache?.outputs.workspaceFiles
+    positiveOf(n.config.cache?.outputs.workspaceFiles)
   for (const bucket of byProject.values()) {
     // Most projects hold one task with outputs, and a call per project
     // cost the cold build a measured 0.4 ms at 1,000 projects.
@@ -994,10 +1002,11 @@ function collide(
       // edge the two run in either order, and the refusal below stands.
       const [up, down] = reaches(b.id, a.id) ? [a, b] : reaches(a.id, b.id) ? [b, a] : []
       if (up !== undefined && down !== undefined) {
-        const downGlobs =
-          field === 'files'
+        const downGlobs = splitNegations(
+          (field === 'files'
             ? down.config.cache?.outputs.files
-            : down.config.cache?.outputs.workspaceFiles
+            : down.config.cache?.outputs.workspaceFiles) ?? [],
+        ).positive
         ;(down.addsToOutputsOf ??= []).push(up.id)
         ;(up.outputsAddedToBy ??= []).push(...(downGlobs ?? []))
         return

package/src/orchestrator/deferred-outputs.ts

@@ -58,10 +58,6 @@ export class DeferredOutputs {
     return [...this.entries.keys()].sort()
   }
 
-  get size(): number {
-    return this.entries.size
-  }
-
   /**
    * Materialise every deferred producer in `node`'s TRANSITIVE dependency
    * closure. Which upstream bytes a command reads is unknowable — that is

package/src/orchestrator/local-shortcircuit.ts

@@ -182,9 +182,9 @@ function restoreTierExclusions(nodes: Map<string, TaskNode>, workspaceRoot: stri
   let everything = false
   for (const node of nodes.values()) {
     for (const raw of node.config.cache?.outputs.workspaceFiles ?? []) {
-      // No negation to skip: the schema refuses '!' in output globs
-      // (`validateWorkspaceGlobs`), so the `continue` that stood here
-      // guarded a shape no config can carry (item 640).
+      // A `!` entry needs no skip: its prefix (`!gen`) names no directory,
+      // so it excludes nothing (A-44; the `continue` that stood here was
+      // dropped in item 640).
       const glob = normalizeGlob(raw)
       const prefix = staticPrefix(glob)
       if (prefix === '.' || prefix === '' || prefix === '/') everything = true

package/src/util/index.ts

@@ -28,7 +28,9 @@ export {
   GLOB_WILDCARDS,
   normalizeBunGlob,
   normalizeGlob,
+  outputMatcher,
   relPosix,
+  splitNegations,
   staticPrefix,
   taskGlob,
   wholeSubtreePrefixes,

package/src/util/paths.ts

@@ -228,6 +228,42 @@ export function asTrees(patterns: readonly string[]): string[] {
   return out
 }
 
+/**
+ * An output list's positive globs, and what its `!` entries take back
+ * (A-44). A reader that only needs where outputs MIGHT land (an overlap
+ * refusal, a preliminary key) takes `positive` alone; one that decides
+ * whether a path IS an output takes both, through `outputMatcher`.
+ */
+export function splitNegations(globs: readonly string[]): {
+  positive: string[]
+  negative: string[]
+} {
+  const positive: string[] = []
+  const negative: string[] = []
+  for (const g of globs) {
+    if (g.startsWith('!')) negative.push(g.slice(1))
+    else positive.push(g)
+  }
+  return { positive, negative }
+}
+
+/**
+ * Whether a relative path is one of the outputs `globs` declare: a positive
+ * glob selects it and no `!` entry takes it back. A `!` entry fed to a
+ * matcher as-is would be `Bun.Glob`'s own negation, true of every OTHER
+ * path (A-44).
+ */
+export function outputMatcher(
+  globs: readonly string[],
+  compile: (pattern: string) => Bun.Glob = taskGlob,
+): (rel: string) => boolean {
+  const { positive, negative } = splitNegations(globs)
+  if (positive.length === 0) return () => false
+  const pos = asTrees(positive).map(compile)
+  const neg = asTrees(negative).map(compile)
+  return (rel) => pos.some((g) => g.match(rel)) && !neg.some((g) => g.match(rel))
+}
+
 /**
  * `pattern` with its first brace group expanded, recursively, while that
  * group holds a `/`; any other pattern as itself, since `Bun.Glob`

package/src/workspace/config-schema.ts

@@ -511,7 +511,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
         if (typeof g !== 'string' || g.length === 0) {
           throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
         }
-        if (g.startsWith('/')) {
+        if (g.startsWith('/') || g.startsWith('!/')) {
           throw new UserError(
             `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
               `outputs must be project-relative globs`,
@@ -530,14 +530,10 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `name the directory the task writes, such as "dist/**"`,
           )
         }
-        if (g.startsWith('!')) {
-          throw new UserError(
-            `${where}.cache.outputs.files: negation is not supported (got "${g}") — ` +
-              `unlike inputs, output globs are never split on '!', so this is read as a literal ` +
-              `path beginning with '!' and matches nothing. List the outputs you DO produce.`,
-          )
-        }
-        const own = ownFileCovered(g, configPath)
+        // A `!` entry takes a path back from the outputs (A-44): it is not
+        // cleaned, saved or restored, and it stays an input.
+        assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
+        const own = g.startsWith('!') ? null : ownFileCovered(g, configPath)
         if (own !== null) {
           throw new UserError(
             `${where}.cache.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
@@ -546,6 +542,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
           )
         }
       }
+      assertOutputsNotNegationOnly(outFiles as string[], `${where}.cache.outputs.files`)
       // Same for inputs.files.
       for (const g of (inputs as { files: unknown[] }).files) {
         if (typeof g !== 'string' || g.length === 0) {
@@ -861,7 +858,7 @@ function assertNotDoubleNegated(glob: string, where: string): void {
     `${where}: '!!' is not a double negation (got "${glob}") — it INVERTS the set. ` +
       `One '!' is stripped and the remainder is compiled as a glob, which applies its own ` +
       `leading-'!' negation, so this excludes everything EXCEPT ${JSON.stringify(inner)} and ` +
-      `the task folds only that. Use ${JSON.stringify(`!${inner}`)} to subtract it, or ` +
+      `keeps only that. Use ${JSON.stringify(`!${inner}`)} to subtract it, or ` +
       `${JSON.stringify(inner)} to include it.`,
   )
 }
@@ -996,9 +993,8 @@ function assertNotNegationOnly(globs: readonly string[], where: string): void {
 }
 
 /**
- * `negation: false` for OUTPUT globs — `resolveOutputs` /
- * `resolveWorkspaceOutputs` never split on `!`, so such an entry is read as a
- * literal path starting with `!` and matches nothing.
+ * `negation: false` for OUTPUT globs: a `!` entry takes a path back (A-44),
+ * and a list of only negations selects nothing and is refused.
  */
 function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): void {
   if (!Array.isArray(v)) {
@@ -1025,16 +1021,23 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
         `${where}: "${g}" names the workspace root itself and selects nothing — use "**" for everything under it`,
       )
     }
-    if (!negation && g.startsWith('!')) {
-      throw new UserError(
-        `${where}: negation is not supported (got "${g}") — ` +
-          `unlike inputs, output globs are never split on '!', so this is read as a literal ` +
-          `path beginning with '!' and matches nothing. List the outputs you DO produce.`,
-      )
-    }
-    if (negation) assertNotDoubleNegated(g, where)
+    assertNotDoubleNegated(g, where)
   }
   if (negation) assertNotNegationOnly(v as string[], where)
+  else assertOutputsNotNegationOnly(v as string[], where)
+}
+
+/**
+ * An output list of only `!` entries selects nothing: the task saves and
+ * restores nothing while it reads as if it declared outputs (A-44).
+ */
+function assertOutputsNotNegationOnly(globs: readonly string[], where: string): void {
+  if (globs.length === 0 || globs.some((g) => !g.startsWith('!'))) return
+  throw new UserError(
+    `${where}: every entry is a negation, which selects NOTHING (got ${JSON.stringify(globs)}) — ` +
+      `a '!' entry only takes back what a positive glob selected. Add the outputs the task ` +
+      `produces, e.g. ['dist/**', ${JSON.stringify(globs[0])}], or declare [] for none.`,
+  )
 }
 
 const SANDBOX_FIELDS = new Set([

package/src/workspace/workspace.ts

@@ -507,9 +507,13 @@ export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]>
   // Run all package globs concurrently. Disk-bound walks parallelize
   // well; serializing them just stretches the discovery phase by N×.
   const { positive, negative } = splitPackageGlobs(workspace.packageGlobs)
-  const perPattern = await Promise.all(
-    positive.map((pattern) => memberDirs(workspace.root, pattern)),
-  )
+  // A root the globs do not list is a project when it holds a vx config
+  // (D-39): the package manager's member list stays the manager's, and
+  // the root's globs stop at every member as any parent project's do.
+  const [perPattern, rootConfig] = await Promise.all([
+    Promise.all(positive.map((pattern) => memberDirs(workspace.root, pattern))),
+    findConfigFile(workspace.root),
+  ])
   const matches = new Set<string>()
   for (const arr of perPattern) {
     for (const m of arr) {
@@ -517,6 +521,7 @@ export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]>
       matches.add(m)
     }
   }
+  if (rootConfig !== null) matches.add(workspace.root)
 
   // Per-project discovery: the manifest read answers "is there a
   // package.json" (an ENOENT is the "not a member" answer, at the cost of
@@ -558,8 +563,15 @@ export async function listProjects(workspace: Workspace): Promise<ProjectMeta[]>
     }
     const previous = seenName.get(pkg.name)
     if (previous) {
+      // pnpm accepts two manifests of one name (sveltejs/kit's test apps,
+      // the first-five-minutes walk, 2026-09-28); vx cannot, since a
+      // project is addressed by it. Say which two, short, and the way on.
       throw new UserError(
-        `Duplicate package name "${pkg.name}" in workspace: ${previous} and ${dir}`,
+        `Duplicate package name "${pkg.name}" in workspace: ${[previous, dir]
+          .map((d) => relPosix(workspace.root, d))
+          .sort()
+          .join(' and ')}; ` +
+          'vx names a project by its package name — rename one, or leave one out with a `!` pattern in the workspace globs',
       )
     }
     seenName.set(pkg.name, dir)