@vzn/vx 0.0.15 → 0.0.18

package/src/cache/inputs.ts

@@ -19,7 +19,8 @@
 // supported.
 
 import path from 'node:path'
-import { rm } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { realpath, rm } from 'node:fs/promises'
 import type { CacheInputs } from '../config.js'
 import { UserError } from '../util/index.js'
 
@@ -154,10 +155,8 @@ async function resolveWorkspaceFiles(args: {
   }
   if (positive.length === 0) return []
 
-  const excludeGlobs = [...ALWAYS_IGNORE, ...args.ownWorkspaceOutputs, ...negative].map(
-    (p) => new Bun.Glob(p),
-  )
-  const positiveGlobs = positive.map((p) => new Bun.Glob(p))
+  const excludeGlobs = [...ALWAYS_IGNORE, ...args.ownWorkspaceOutputs, ...negative].map(globFor)
+  const positiveGlobs = positive.map(globFor)
   // Workspace-wide partition, keyed by the workspace root. Populated
   // up-front by `populateGitFilesCache(..., workspaceWide: true)` when
   // any loaded task declares workspaceFiles; a missing/invalidated
@@ -167,12 +166,21 @@ async function resolveWorkspaceFiles(args: {
     gitFiles = runGitLsFiles(args.workspaceRoot).files
     args.gitFilesCache?.set(args.workspaceRoot, gitFiles)
   }
+  // Second call site of the literal-input guard. `resolveWorkspaceFiles`
+  // carries its own copy of the filter-over-git-set design, so the same
+  // silently-folds-nothing hazard exists here — and a fix applied only to the
+  // project half would pass that half's tests while leaving this one live.
+  const unmatchedLiterals = new Set(positive.filter(isLiteralPath))
   const candidates: string[] = []
   for (const rel of gitFiles) {
+    if (unmatchedLiterals.size > 0) unmatchedLiterals.delete(rel)
     if (!positiveGlobs.some((g) => g.match(rel))) continue
     if (excludeGlobs.some((g) => g.match(rel))) continue
     candidates.push(path.resolve(args.workspaceRoot, rel))
   }
+  if (unmatchedLiterals.size > 0) {
+    await assertNoInvisibleLiteralInputs(unmatchedLiterals, args.workspaceRoot, 'workspaceFiles')
+  }
   // Same OID-trust shortcut as project files: a clean-per-status
   // tracked file necessarily exists on disk.
   const oids = args.gitFilesCache?.oidsFor(args.workspaceRoot)
@@ -262,10 +270,68 @@ export async function resolveOutputs(args: {
   nestedProjectDirs: string[]
 }): Promise<string[]> {
   if (args.outputs.length === 0) return []
-  const excludeGlobs = boundaryIgnorePatterns(args.projectDir, args.nestedProjectDirs).map(
-    (p) => new Bun.Glob(p),
-  )
-  return [...(await scanUnion(args.outputs, excludeGlobs, args.projectDir))].sort()
+  const excludeGlobs = boundaryIgnorePatterns(args.projectDir, args.nestedProjectDirs).map(globFor)
+  const scanned = [...(await scanUnion(args.outputs, excludeGlobs, args.projectDir))]
+  // Containment, enforced HERE and not only at the loader. `cleanOutputs`
+  // DELETES whatever this returns, and `Bun.Glob.scan` happily walks `..` out
+  // of its cwd — so the loader's `..`/absolute rejection alone was a single
+  // point of failure. The resolver that feeds the delete refuses to name a path
+  // outside the project, so any future caller reaching it by another route (a
+  // programmatic embedder, a config source that skips the loader) is contained
+  // by construction.
+  return (await containedIn(args.projectDir, scanned)).sort()
+}
+
+/**
+ * Keep only the paths that are REALLY inside `root` — lexically, and after
+ * resolving symlinks.
+ *
+ * Lexical alone was sufficient only while `Bun.Glob.scan` refused to descend
+ * into symlinked directories, which this repo pinned as a deliberate tripwire
+ * on a DEPENDENCY's behaviour. **Bun 1.4.0 tripped it**: with `dist ->
+ * ../victim` the scan now yields `dist/precious.txt`, a path that is lexically
+ * inside the project while the file it names is not — and the caller rm()s
+ * whatever this returns. Measured on 1.4.0 before this guard: a plain
+ * `outputs.files: ['dist/**']` deleted a file outside the project.
+ *
+ * DIRECTORIES are what matter, not files: `rm` on a symlinked FILE unlinks the
+ * link and never its target, so a link sitting inside a real output directory
+ * is harmless. Resolving per directory also keeps this cheap — one syscall per
+ * distinct output directory rather than per output file, concurrently, and a
+ * `dist/**` of ten thousand files in one directory costs exactly one.
+ *
+ * A path whose directory will not resolve (a broken link, or a race with the
+ * task that produced it) is REFUSED. When the caller deletes, unresolvable
+ * means leave it alone.
+ */
+async function containedIn(root: string, paths: readonly string[]): Promise<string[]> {
+  // One `path.dirname` per path, kept alongside — computing it again in the
+  // final filter measured as the DOMINANT added cost on a wide output tree
+  // (string work, not syscalls: 10k files in 20 dirs cost more than 5k files
+  // in 200, which is the wrong shape for a per-directory probe).
+  const lexical: string[] = []
+  const lexDirs: string[] = []
+  for (const p of paths) {
+    if (!isInside(root, p)) continue
+    lexical.push(p)
+    lexDirs.push(path.dirname(p))
+  }
+  if (lexical.length === 0) return []
+  const realRoot = await realpath(root).catch(() => root)
+  const uniqueDirs = [...new Set(lexDirs)]
+  const resolved = await Promise.all(uniqueDirs.map((d) => realpath(d).catch(() => null)))
+  const contained = new Set<string>()
+  for (const [i, dir] of uniqueDirs.entries()) {
+    const real = resolved[i]
+    if (real !== null && real !== undefined && isInside(realRoot, real)) contained.add(dir)
+  }
+  return lexical.filter((_p, i) => contained.has(lexDirs[i]!))
+}
+
+/** Is `abs` the directory `dir` itself or something beneath it? */
+function isInside(dir: string, abs: string): boolean {
+  if (abs === dir) return true
+  return abs.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)
 }
 
 /**
@@ -307,7 +373,12 @@ export async function resolveWorkspaceOutputs(args: {
   outputs: string[]
 }): Promise<string[]> {
   if (args.outputs.length === 0) return []
-  return [...(await scanUnion(args.outputs, [], args.workspaceRoot))].sort()
+  const scanned = [...(await scanUnion(args.outputs, [], args.workspaceRoot))]
+  // Same containment as the project twin, anchored one level out. These globs
+  // deliberately ignore PROJECT boundaries — that is the escape hatch — but
+  // escaping the WORKSPACE was never part of it, and `cleanWorkspaceOutputs`
+  // deletes what this returns.
+  return (await containedIn(args.workspaceRoot, scanned)).sort()
 }
 
 /**
@@ -496,6 +567,51 @@ interface ResolveFilesArgs {
   gitFilesCache?: GitFilesCache
 }
 
+/** No glob metacharacter — the entry names one exact path. */
+function isLiteralPath(glob: string): boolean {
+  return !/[*?[\]{}]/.test(glob)
+}
+
+/**
+ * Refuse a literal `cache.inputs.files` entry that EXISTS ON DISK but is
+ * invisible to git — gitignored, or otherwise absent from
+ * `git ls-files --cached --others --exclude-standard`.
+ *
+ * Such an entry contributes nothing to the cache key, so the task stops
+ * tracking a file its own config names as an input. That is a stale hit, and a
+ * quiet one: the run replays cached stdout, so it even LOOKS like it executed.
+ *
+ * Turbo honours the declaration instead (an explicit `inputs` entry overrides
+ * gitignore). vx cannot afford to, and the reason is not cost: honouring it
+ * would make the cache key depend on a change that `git diff` and
+ * `git ls-files --others` CANNOT SEE, so editing that input would re-key the
+ * task while `--affected` selected nothing. `docs/cli.md` states the invariant
+ * those two surfaces owe each other as a principle — "input hashing sees it, so
+ * `--affected` must too" — and it was closed for lockfiles only recently.
+ * Honouring a gitignored input would reopen it from the other side.
+ *
+ * An entry that does NOT exist on disk stays silent: that is an ordinary stale
+ * declaration, and refusing it would break every config that lists an
+ * optional file.
+ */
+async function assertNoInvisibleLiteralInputs(
+  literals: ReadonlySet<string>,
+  base: string,
+  field: 'files' | 'workspaceFiles' = 'files',
+): Promise<void> {
+  for (const rel of literals) {
+    if (!(await Bun.file(path.resolve(base, rel)).exists())) continue
+    throw new UserError(
+      `cache.inputs.${field}: "${rel}" exists in ${base} but git does not report it, ` +
+        `so it contributes NOTHING to the cache key — input globs filter the files git ` +
+        `lists, and a filter cannot add one back. The task would keep reporting ` +
+        `up-to-date after that file changed. If it is generated, depend on the task ` +
+        `that produces it via cache.inputs.tasks; if it should be tracked, remove it ` +
+        `from .gitignore.`,
+    )
+  }
+}
+
 async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   const positive: string[] = []
   const negative: string[] = []
@@ -513,7 +629,7 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
 
   const boundaryIgnores = boundaryIgnorePatterns(args.projectDir, args.nestedProjectDirs)
   const excludeGlobs = [...ALWAYS_IGNORE, ...boundaryIgnores, ...args.ownOutputs, ...negative].map(
-    (p) => new Bun.Glob(p),
+    globFor,
   )
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
@@ -524,7 +640,7 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // per task (build + test + lint + …). Spawning git N times for the
   // same project per run is wasteful; we cache the result for the
   // duration of one orchestrator run.
-  const positiveGlobs = positive.map((p) => new Bun.Glob(p))
+  const positiveGlobs = positive.map(globFor)
   let gitFiles = args.gitFilesCache?.snapshotFor(args.projectDir, positiveGlobs)
   if (gitFiles === undefined) {
     // Mid-run re-enumeration. The OIDs this spawn could yield are NOT
@@ -536,9 +652,22 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
     // set() also clears the project's pending-changed bookkeeping.
     args.gitFilesCache?.set(args.projectDir, gitFiles)
   }
+  // A LITERAL entry — one with no glob metacharacter — names exactly one file,
+  // so "this matched nothing" is unambiguous. For a glob it is not: matching
+  // nothing is perfectly legitimate (`src/**/*.gen.ts` in a package with no
+  // generated code), which is why only literals are tracked here.
+  //
+  // The reason it has to be tracked at all: the user's globs FILTER the set git
+  // reports, and a filter can only remove. So naming a gitignored file by hand
+  // folds NOTHING — silently. The task then reports `up-to-date` while replaying
+  // an artifact built from an older version of a file the config explicitly
+  // claims as an input. See the refusal below for why this is not simply
+  // honoured instead.
+  const unmatchedLiterals = new Set(positive.filter(isLiteralPath))
   // First pass: glob-filter to candidate absolute paths (no I/O).
   const candidates: string[] = []
   for (const rel of gitFiles) {
+    if (unmatchedLiterals.size > 0) unmatchedLiterals.delete(rel)
     let matched = false
     for (const g of positiveGlobs) {
       if (g.match(rel)) {
@@ -550,6 +679,9 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
     if (excludeGlobs.some((g) => g.match(rel))) continue
     candidates.push(path.resolve(args.projectDir, rel))
   }
+  if (unmatchedLiterals.size > 0) {
+    await assertNoInvisibleLiteralInputs(unmatchedLiterals, args.projectDir, 'files')
+  }
   // Second pass: parallel existence check — but ONLY for paths
   // without a trusted index OID. A clean-per-status tracked file
   // necessarily exists on disk, so skipping its probe keeps the warm
@@ -580,13 +712,17 @@ interface GitLsResult {
    * dirtiness — callers intersect with `git status` before trusting.
    */
   oids: Map<string, string>
+  /** Paths flagged skip-worktree / assume-unchanged (only when `-v` was passed). */
+  flagged: Set<string>
 }
 
 // `<mode> <oid> <stage>\t<path>` — the staged-entry form of
 // `ls-files -s`. `--others` paths print bare; with `-z`,
 // core.quotePath quoting is off, so a bare path containing a literal
 // tab still can't match this fixed-form prefix.
-const LS_FILES_STAGE_RE = /^([0-7]{6}) ([0-9a-f]{40,64}) ([0-3])\t/
+// `ls-files -s -v`: an optional cache-state flag (`H`, `S`, `h`, …) then the
+// stage record. Both answers come from ONE spawn.
+const LS_FILES_STAGE_RE = /^(?:([A-Za-z]) )?([0-7]{6}) ([0-9a-f]{40,64}) ([0-3])\t/
 
 /**
  * Run `git ls-files -s --others --exclude-standard -z .` in `cwd`.
@@ -628,7 +764,8 @@ function runGitLsFiles(cwd: string): GitLsResult {
 function parseLsFilesOutput(out: string): GitLsResult {
   const files: string[] = []
   const oids = new Map<string, string>()
-  if (out.length === 0) return { files, oids }
+  const flagged = new Set<string>()
+  if (out.length === 0) return { files, oids, flagged }
   // NUL-separated; trailing NUL produces an empty segment we skip.
   for (const record of out.split('\0')) {
     if (record.length === 0) continue
@@ -639,21 +776,147 @@ function parseLsFilesOutput(out: string): GitLsResult {
     }
     const filePath = record.slice(m[0].length)
     files.push(filePath)
-    const mode = m[1]!
-    const stage = m[3]!
+    const mode = m[2]!
+    const stage = m[4]!
     if ((mode === '100644' || mode === '100755') && stage === '0') {
-      oids.set(filePath, m[2]!)
+      oids.set(filePath, m[3]!)
+    }
+    // A LOWERCASE letter means skip-worktree or assume-unchanged (`S` is the
+    // older spelling of skip-worktree): git has been told to stop looking at
+    // the worktree file, so its index OID says nothing about the disk.
+    const flag = m[1]
+    if (flag !== undefined && (flag === 'S' || (flag >= 'a' && flag <= 'z'))) flagged.add(filePath)
+  }
+  return { files, oids, flagged }
+}
+
+/** One completed `git` invocation. */
+interface GitRun {
+  exitCode: number
+  stdout: string
+  stderr: string
+}
+
+/**
+ * Parse `git check-attr -z text eol ident` output — a flat stream of
+ * `<path>\0<attr>\0<value>\0` triples — into the set of paths where a clean
+ * filter can rewrite bytes. `unspecified` means no rule matched and
+ * `unset` (`-text`) explicitly disables conversion; both leave the index blob
+ * byte-identical to the worktree file, so those OIDs stay trusted.
+ */
+export function parseCheckAttrOutput(out: string): Set<string> {
+  const affected = new Set<string>()
+  const fields = out.split('\0')
+  for (let i = 0; i + 2 < fields.length; i += 3) {
+    const value = fields[i + 2]!
+    if (value !== 'unspecified' && value !== 'unset') affected.add(fields[i]!)
+  }
+  return affected
+}
+
+/**
+ * Remove from `trusted` every path whose index blob may differ from its
+ * worktree bytes because a clean filter applies.
+ *
+ * Gated in two steps so the common case pays NOTHING. The precise answer —
+ * `git ls-files --eol`, comparing `i/` to `w/` — was measured at 240 ms on a
+ * 15k-file tree because it must READ every worktree file: 13x the entire
+ * enumeration, on a run whose warm total is ~130 ms, and in the common Linux
+ * case it finds nothing. So instead:
+ *
+ *  1. If `core.autocrlf` is true/input, conversion applies to every
+ *     auto-detected text file with no attribute needed — trust nothing.
+ *  2. Else, if no attributes source exists anywhere (no in-tree
+ *     `.gitattributes`, no `$GIT_DIR/info/attributes`, no
+ *     `core.attributesFile`), no rule can name a filter — return untouched,
+ *     zero extra work. This is the default `git init` repo.
+ *  3. Otherwise ask `git check-attr` (measured 21 ms; it resolves attributes
+ *     from the index WITHOUT reading worktree content) and drop only the
+ *     paths that actually carry `text`/`eol`/`ident`.
+ *
+ * Never throws: a probe that fails leaves the map as-is, which is exactly the
+ * behaviour before this gate existed.
+ */
+async function dropFilteredOids(
+  trusted: Map<string, string>,
+  args: {
+    workspaceRoot: string
+    gitDir: string
+    coreConfig: string
+    spawnGit: (a: string[], stdin?: string) => Promise<GitRun | null>
+  },
+): Promise<void> {
+  if (trusted.size === 0) return
+  if (autocrlfConverts(args.coreConfig)) {
+    trusted.clear()
+    return
+  }
+  // Cheap checks first, and nothing is materialized until one of them fires —
+  // on a 15k-file repo with no attributes this whole function is a size check,
+  // a substring scan of an empty string, one stat, and a key walk that exits
+  // on the first `.gitattributes` it does not find.
+  let attributesPossible =
+    args.coreConfig.toLowerCase().includes('core.attributesfile') ||
+    (args.gitDir !== '' &&
+      existsSync(path.resolve(args.workspaceRoot, args.gitDir, 'info', 'attributes')))
+  if (!attributesPossible) {
+    for (const rel of trusted.keys()) {
+      if (rel === '.gitattributes' || rel.endsWith('/.gitattributes')) {
+        attributesPossible = true
+        break
+      }
     }
   }
-  return { files, oids }
+  if (!attributesPossible) return
+
+  const res = await args.spawnGit(
+    ['check-attr', '--stdin', '-z', 'text', 'eol', 'ident'],
+    [...trusted.keys()].join('\0'),
+  )
+  if (res === null || res.exitCode !== 0) return
+  for (const rel of parseCheckAttrOutput(res.stdout)) trusted.delete(rel)
 }
 
-function parseStatusOutput(out: string): Set<string> {
+/** `true` when git may rewrite bytes for EVERY auto-detected text file. */
+export function autocrlfConverts(coreConfig: string): boolean {
+  for (const line of coreConfig.split('\n')) {
+    const [name, value] = [line.slice(0, line.indexOf(' ')), line.slice(line.indexOf(' ') + 1)]
+    if (name.toLowerCase() === 'core.autocrlf') {
+      const v = value.trim().toLowerCase()
+      return v === 'true' || v === 'input'
+    }
+  }
+  return false
+}
+
+/**
+ * Paths `git ls-files -v -z` marks as not-watched: `S` is skip-worktree, and
+ * ANY lowercase letter is assume-unchanged layered on that entry's state.
+ * Either way git has been told to stop comparing the worktree file, so its
+ * index OID says nothing about what is — or isn't — on disk. Each
+ * NUL-terminated record is `<letter><space><path>`.
+ */
+export function parseFlaggedOutput(out: string): Set<string> {
+  const flagged = new Set<string>()
+  for (const record of out.split('\0')) {
+    if (record.length < 3 || record[1] !== ' ') continue
+    const letter = record[0]!
+    if (letter === 'S' || (letter >= 'a' && letter <= 'z')) flagged.add(record.slice(2))
+  }
+  return flagged
+}
+
+function parseStatusOutput(out: string): { dirty: Set<string>; untracked: string[] } {
   const tokens = out.split('\0')
   const dirty = new Set<string>()
+  const untracked: string[] = []
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]!
     if (token.length < 4) continue
+    if (token[0] === '?') {
+      untracked.push(token.slice(3))
+      continue
+    }
     dirty.add(token.slice(3))
     // X = R or C → the next token is the rename/copy source path.
     const x = token[0]
@@ -662,7 +925,20 @@ function parseStatusOutput(out: string): Set<string> {
       dirty.add(tokens[i]!)
     }
   }
-  return dirty
+  return { dirty, untracked }
+}
+
+/**
+ * Strip a repo→workspace `--show-prefix` (e.g. `code/`) from each path, keeping
+ * only paths inside the workspace — so a repo-root-relative set (from `git
+ * status`/`diff`) is re-keyed workspace-relative to match `git ls-files`. Empty
+ * prefix → returns the set unchanged (workspace root IS the git root).
+ */
+function stripPrefixFromSet(paths: Set<string>, prefix: string): Set<string> {
+  if (prefix === '') return paths
+  const out = new Set<string>()
+  for (const p of paths) if (p.startsWith(prefix)) out.add(p.slice(prefix.length))
+  return out
 }
 
 /**
@@ -700,16 +976,64 @@ export async function populateGitFilesCache(
   cache: GitFilesCache,
   workspaceWide = false,
 ): Promise<void> {
-  // The two spawns are independent — run them concurrently so the
+  const enumeration = await startGitEnumeration(
+    workspaceRoot,
+    gitPathspecs(workspaceRoot, projectDirs, workspaceWide),
+  )
+  applyGitEnumeration(enumeration, workspaceRoot, projectDirs, cache, workspaceWide)
+}
+
+/** What one workspace-wide enumeration learned, before it is partitioned per project. */
+export interface GitEnumeration {
+  /** Every enumerated path, workspace-relative, tracked and untracked. */
+  all: string[]
+  /** Workspace-relative path → index OID, for files whose worktree state matched the index. */
+  trusted: Map<string, string>
+  /** Whether the worktree had uncommitted changes; null when `git status` failed. */
+  dirty: boolean | null
+}
+
+/**
+ * Pathspec scoping: when the run only needs a handful of projects
+ * (scoped config loading), let git scan just those dirs — 75 ms →
+ * 11 ms on an 11k-file repo. Above 64 dirs (or when a project IS
+ * the root) the whole-tree scan wins on arg/exec overhead anyway.
+ */
+export function gitPathspecs(
+  workspaceRoot: string,
+  projectDirs: readonly string[],
+  workspaceWide: boolean,
+): string[] {
+  const rels = projectDirs.map((d) => path.relative(workspaceRoot, d).split(path.sep).join('/'))
+  const scoped =
+    !workspaceWide &&
+    rels.length > 0 &&
+    rels.length <= 64 &&
+    rels.every((r) => r !== '' && r !== '.')
+  return scoped ? rels : ['.']
+}
+
+/**
+ * The spawn half of `populateGitFilesCache`, separated so an UNSCOPED run
+ * can start it before the configs are evaluated — the enumeration needs
+ * only the pathspecs, and `['.']` is right for every unscoped run — and
+ * overlap ~60 ms of git with ~80 ms of config evaluation on a
+ * 1000-project tree instead of paying them back to back.
+ */
+export async function startGitEnumeration(
+  workspaceRoot: string,
+  pathspecs: readonly string[],
+): Promise<GitEnumeration> {
+  // The spawns are independent — run them concurrently so the
   // bulk-populate costs max(ls-files, status) wall time, not the sum
   // (status alone is ~74 ms on a 1000-project tree; serial spawning
   // was a measurable warm-path regression vs the pre-OID code).
-  const spawnGit = async (args: string[]) => {
+  const spawnGit = async (args: string[], stdin?: string): Promise<GitRun | null> => {
     try {
       const proc = Bun.spawn({
         cmd: ['git', ...args],
         cwd: workspaceRoot,
-        stdin: 'ignore',
+        stdin: stdin === undefined ? 'ignore' : new TextEncoder().encode(stdin),
         stdout: 'pipe',
         stderr: 'pipe',
       })
@@ -723,20 +1047,28 @@ export async function populateGitFilesCache(
       return null
     }
   }
-  // Pathspec scoping: when the run only needs a handful of projects
-  // (scoped config loading), let git scan just those dirs — 75 ms →
-  // 11 ms on an 11k-file repo. Above 64 dirs (or when a project IS
-  // the root) the whole-tree scan wins on arg/exec overhead anyway.
-  const rels = projectDirs.map((d) => path.relative(workspaceRoot, d).split(path.sep).join('/'))
-  const scoped =
-    !workspaceWide &&
-    rels.length > 0 &&
-    rels.length <= 64 &&
-    rels.every((r) => r !== '' && r !== '.')
-  const pathspecs = scoped ? rels : ['.']
-  const [ls, status] = await Promise.all([
-    spawnGit(['ls-files', '-s', '--others', '--exclude-standard', '-z', '--', ...pathspecs]),
-    spawnGit(['status', '--porcelain', '-z', '--', ...pathspecs]),
+  // Four spawns, one worktree walk. `ls-files -s -v` reads the INDEX only
+  // (~9 ms on a 1000-project tree) and answers two questions at once: every
+  // tracked path's OID and its cache-state flag. `status -uall` is the one
+  // command that walks the worktree, and it answers two as well: which
+  // tracked paths are dirty AND which files are untracked. Asking
+  // `ls-files --others` for the untracked set walked the same tree a second
+  // time (~50 ms of CPU, concurrent with status but contending with it).
+  const [ls, status, prefixRes, coreCfg] = await Promise.all([
+    spawnGit(['ls-files', '-s', '-v', '-z', '--', ...pathspecs]),
+    spawnGit(['status', '--porcelain', '-z', '-uall', '--', ...pathspecs]),
+    // Two answers from one spawn. `--show-prefix` is the repo→workspace path
+    // (empty when the workspace root IS the git root): `ls-files` prints
+    // cwd(workspace)-relative paths but `status` prints repo-root-relative
+    // ones, so when the workspace root is a SUBDIR of the git repo the two
+    // disagree; this lets us key both the same way below. `--git-dir` locates
+    // `info/attributes` for the filter gate (it is not always `.git/` — a
+    // linked worktree's `.git` is a FILE pointing elsewhere).
+    spawnGit(['rev-parse', '--show-prefix', '--git-dir']),
+    // Reads three config keys, no tree scan — the gate for whether a clean
+    // filter can rewrite bytes between the index and the worktree. Exits 1
+    // when none are set, which is the common case and means "no gate".
+    spawnGit(['config', '--get-regexp', '^core\\.(autocrlf|eol|attributesfile)$']),
   ])
   if (ls === null) {
     throw new UserError(
@@ -750,16 +1082,74 @@ export async function populateGitFilesCache(
         `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
     )
   }
-  const { files: all, oids } = parseLsFilesOutput(ls.stdout)
-  const dirty = status !== null && status.exitCode === 0 ? parseStatusOutput(status.stdout) : null
+  const { files: tracked, oids, flagged } = parseLsFilesOutput(ls.stdout)
+  // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
+  // the `--show-prefix`) so the dirty set is keyed identically to the trusted
+  // OID map. Without this, when the workspace root is a git subdir, a modified
+  // tracked file is never pruned from `trusted` and keeps its committed OID —
+  // a STALE cache hit serving old outputs. Empty prefix (workspace == git root,
+  // the common case) is a zero-cost no-op. Paths above the workspace can't be
+  // inputs, so they drop out of the set.
+  // One spawn, two lines: `--show-prefix` then `--git-dir`.
+  const revLines =
+    prefixRes !== null && prefixRes.exitCode === 0 ? prefixRes.stdout.split('\n') : []
+  const gitPrefix = (revLines[0] ?? '').trim()
+  const gitDir = (revLines[1] ?? '').trim()
+  const parsedStatus =
+    status !== null && status.exitCode === 0 ? parseStatusOutput(status.stdout) : null
+  const dirty = parsedStatus === null ? null : stripPrefixFromSet(parsedStatus.dirty, gitPrefix)
+  // Untracked files are inputs too (a new file is the commonest edit there
+  // is). They come from the status walk, repo-root-relative like the dirty
+  // set. Without a status answer the enumeration is the index alone.
+  const untracked =
+    parsedStatus === null ? [] : [...stripPrefixFromSet(new Set(parsedStatus.untracked), gitPrefix)]
+  const all = untracked.length === 0 ? tracked : tracked.concat(untracked)
   // Aggregate dirtiness for the Tier-3 invocation record — derived from
   // this same status spawn so `run()` needs no second `git status`.
   // null when the status spawn failed (non-repo / git error).
-  cache.setWorktreeDirty(dirty === null ? null : dirty.size > 0)
+  const worktreeDirty = dirty === null ? null : dirty.size > 0
   const trusted = dirty === null ? new Map<string, string>() : oids
   if (dirty !== null) {
     for (const rel of dirty) trusted.delete(rel)
   }
+  // A skip-worktree / assume-unchanged path sits at stage 0 and `git status`
+  // reports nothing for it, so it would otherwise keep a trusted OID — and
+  // resolveFiles SKIPS its existence probe for OID-carrying paths. A sparse
+  // checkout would then count a file that is not on disk as an input, so
+  // materializing it later changes no key and the old artifact is replayed.
+  // Dropping the OID sends these back through the probe, where they correctly
+  // fall out of the input set while unmaterialized.
+  for (const rel of flagged) trusted.delete(rel)
+  // An index OID is only the file's content hash when git stores the worktree
+  // bytes VERBATIM. Under a clean filter (`text`/`eol`/`ident`) the blob is a
+  // DIFFERENT sequence of bytes — the LF-normalized form — while the task
+  // reads the CRLF worktree file. `git status` compares AFTER filtering, so
+  // such a file reports clean and keeps its OID: the CRLF and LF states then
+  // fold the SAME key and a real content change is invisible.
+  //
+  // Dropping an OID is not over-invalidation. It routes the path to
+  // `hashFile`, which hashes the worktree bytes — the source that was correct
+  // all along. The only cost is the read, so the gate below is about paying it
+  // ONLY where a filter can actually apply.
+  await dropFilteredOids(trusted, {
+    workspaceRoot,
+    gitDir,
+    coreConfig: coreCfg !== null && coreCfg.exitCode === 0 ? coreCfg.stdout : '',
+    spawnGit,
+  })
+  return { all, trusted, dirty: worktreeDirty }
+}
+
+/** The partition half of `populateGitFilesCache`: store per-project slices of one enumeration. */
+export function applyGitEnumeration(
+  enumeration: GitEnumeration,
+  workspaceRoot: string,
+  projectDirs: readonly string[],
+  cache: GitFilesCache,
+  workspaceWide = false,
+): void {
+  const { all, trusted } = enumeration
+  cache.setWorktreeDirty(enumeration.dirty)
   // Sort once, then each project's files are a contiguous range found
   // by binary search on its `dir/` prefix — O((F+P) log F) instead of
   // the O(P·F) per-project startsWith scan (54 ms at 1090 projects ×
@@ -822,7 +1212,11 @@ async function scanUnion(
 ): Promise<Set<string>> {
   const matches = new Set<string>()
   for (const pattern of positive) {
-    const glob = new Bun.Glob(pattern)
+    const glob = globFor(pattern)
+    // Async scan, deliberately: the sync walk is faster in isolation (37 µs
+    // vs 56 µs on a one-file `dist/**`) but SERIALISES on the main thread,
+    // and this runs under the scheduler's concurrency — measured 2026-09-02,
+    // switching it to scanSync made a 1000-hit warm run 40 ms SLOWER.
     for await (const rel of glob.scan({ cwd, onlyFiles: true, dot: true })) {
       if (excludeGlobs.some((g) => g.match(rel))) continue
       matches.add(path.resolve(cwd, rel))
@@ -831,6 +1225,16 @@ async function scanUnion(
   return matches
 }
 
+// Compiled once per pattern string for the life of the process: a `Bun.Glob`
+// is immutable, and the same handful of declared globs are compiled again
+// for every task otherwise (three sites, up to thousands of times per run).
+const globMemo = new Map<string, Bun.Glob>()
+function globFor(pattern: string): Bun.Glob {
+  let g = globMemo.get(pattern)
+  if (g === undefined) globMemo.set(pattern, (g = new Bun.Glob(pattern)))
+  return g
+}
+
 function boundaryIgnorePatterns(projectDir: string, nestedDirs: string[]): string[] {
   return nestedDirs.map((d) => {
     const rel = path.relative(projectDir, d).split(path.sep).join('/')