@vzn/vx 0.0.21 → 0.0.23

package/src/cache/git-inputs.ts

@@ -6,8 +6,65 @@
 // task declared. Nothing here reads a config or applies a boundary.
 
 import path from 'node:path'
-import { existsSync } from 'node:fs'
-import { UserError } from '../util/index.js'
+import { existsSync, realpathSync } from 'node:fs'
+import { UserError, executablePath, gitSpawnRefusal } from '../util/index.js'
+
+/** Three facts of the repository a directory is in, from one `git rev-parse`. */
+export interface RepoFacts {
+  /** `--show-prefix`: the directory's path below the worktree root, `''` at the root. */
+  prefix: string
+  /** `--git-common-dir` as git prints it, relative to the directory asked. */
+  commonDir: string
+  /** `--show-object-format`: the hash the index's blob OIDs are in. */
+  objectFormat: 'sha1' | 'sha256'
+}
+
+const repoFactsMemo = new Map<string, RepoFacts>()
+
+/**
+ * The enumeration needs the prefix and the common dir, the file hasher the
+ * object format: one spawn answers all three, once per directory for the
+ * life of the process — none of them moves while vx runs. A failure (no
+ * git, not a repository) is not remembered; the callers degrade on null.
+ * Synchronous so a reader that cannot wait (`hashBytes`, in the config
+ * load) and the enumeration share one answer whichever asks first.
+ */
+export function repoFacts(dir: string): RepoFacts | null {
+  const hit = repoFactsMemo.get(dir)
+  if (hit !== undefined) return hit
+  let proc
+  try {
+    proc = Bun.spawnSync({
+      cmd: [
+        executablePath('git'),
+        'rev-parse',
+        '--show-prefix',
+        '--git-common-dir',
+        '--show-object-format',
+      ],
+      cwd: dir,
+      stdout: 'pipe',
+      stderr: 'ignore',
+    })
+  } catch {
+    return null
+  }
+  if (proc.exitCode !== 0) return null
+  // One line per flag, in order. A git that does not know
+  // `--show-object-format` echoes it back, as it does any unknown flag,
+  // which reads as sha1 — what the flag's own spawn answered there too.
+  const [prefix = '', commonDir = '', format = ''] = new TextDecoder()
+    .decode(proc.stdout)
+    .split('\n')
+    .map((l) => l.trim())
+  const facts: RepoFacts = {
+    prefix,
+    commonDir,
+    objectFormat: format === 'sha256' ? 'sha256' : 'sha1',
+  }
+  repoFactsMemo.set(dir, facts)
+  return facts
+}
 
 export class GitFilesCache extends Map<string, readonly string[]> {
   private changed = new Map<string, string[]>()
@@ -40,6 +97,27 @@ export class GitFilesCache extends Map<string, readonly string[]> {
    * populate runs, or when the status spawn failed (non-repo).
    */
   private dirty: boolean | null = null
+  /**
+   * Absolute paths, as git's lossy decoding spells them, of enumerated
+   * files whose names are not UTF-8 (`decodeGitZ`). Such a name cannot
+   * be opened from a string, so `resolveFiles` refuses one it would fold.
+   */
+  private undecodable = new Set<string>()
+  /**
+   * When the enumeration that vouched for `oids` started (ms since the
+   * epoch): an index OID says what a file held when `git status` looked,
+   * so a file changed since may hold something else (item 743). Unset on
+   * a cache no enumeration filled; its OIDs are then re-checked by content.
+   */
+  enumeratedAtMs: number | undefined
+
+  get undecodableNames(): ReadonlySet<string> {
+    return this.undecodable
+  }
+
+  markUndecodable(absPaths: readonly string[]): void {
+    for (const p of absPaths) this.undecodable.add(p)
+  }
 
   setWorkspaceRoot(root: string): void {
     this.wsRoot = root
@@ -106,6 +184,11 @@ export class GitFilesCache extends Map<string, readonly string[]> {
   }
 
   private recordChanged(partitionDir: string, relPaths: readonly string[]): void {
+    // A partition with no snapshot has nothing for a mark to invalidate
+    // (`snapshotFor` answers undefined either way), so this guard bounds
+    // memory for a project the enumeration left without a partition; it
+    // is not a rule, and deleting it survives the whole core suite (item
+    // 648).
     if (!this.has(partitionDir)) return
     const cur = this.changed.get(partitionDir)
     if (cur) cur.push(...relPaths)
@@ -149,6 +232,12 @@ export class GitFilesCache extends Map<string, readonly string[]> {
     this.oids.delete(key)
     return super.delete(key)
   }
+
+  override clear(): void {
+    this.changed.clear()
+    this.oids.clear()
+    super.clear()
+  }
 }
 
 /** No glob metacharacter — the entry names one exact path. */
@@ -168,8 +257,48 @@ interface GitLsResult {
   oids: Map<string, string>
   /** Paths flagged skip-worktree / assume-unchanged (only when `-v` was passed). */
   flagged: Set<string>
+  /** cwd-relative paths whose names are not UTF-8, spelled lossily (`decodeGitZ`). */
+  undecodable: string[]
 }
 
+/**
+ * git's `-z` output as text, plus the NUL-separated records that were not
+ * UTF-8. git prints a path's bytes as they are, and a lossy decode turns
+ * `x\xffy` into `x\ufffdy`, which names no file: the name reached the
+ * input set, failed the disk probe, and dropped out of the key silently,
+ * so every edit to it was a hit (turborepo#9345). Nothing in vx can open a
+ * path a string cannot spell, so such a record is kept (lossily, so a
+ * glob still matches it) and named, for `resolveFiles` to refuse.
+ *
+ * The common output holds no U+FFFD at all. Measured on a 1.3 MB,
+ * 15,000-record listing (min of 2,000, interleaved): the lossy decode plus
+ * the U+FFFD check cost 0.17 ms against 0.10 for the `Response.text()` it
+ * replaced, and the check alone 0.003; a fatal decode of the whole output
+ * ran 0.73 ms at the median against 0.26. Only output holding a U+FFFD,
+ * from an invalid byte or from a name that really holds one, is split at
+ * its NULs and each record decoded fatally, which tells the two apart.
+ */
+function decodeGitZ(bytes: Uint8Array): { text: string; undecodable: Set<string> } {
+  const undecodable = new Set<string>()
+  const text = LOSSY_UTF8.decode(bytes)
+  if (!text.includes('\ufffd')) return { text, undecodable }
+  let start = 0
+  for (let i = 0; i <= bytes.length; i++) {
+    if (i < bytes.length && bytes[i] !== 0) continue
+    const record = bytes.subarray(start, i)
+    try {
+      FATAL_UTF8.decode(record)
+    } catch {
+      undecodable.add(LOSSY_UTF8.decode(record))
+    }
+    start = i + 1
+  }
+  return { text, undecodable }
+}
+
+const LOSSY_UTF8 = new TextDecoder()
+const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true })
+
 const LS_FILES_STAGE_RE = /^(?:([A-Za-z]) )?([0-7]{6}) ([0-9a-f]{40,64}) ([0-3])\t/
 
 /**
@@ -187,15 +316,13 @@ export function runGitLsFiles(cwd: string): GitLsResult {
   let proc
   try {
     proc = Bun.spawnSync({
-      cmd: ['git', 'ls-files', '-s', '--others', '--exclude-standard', '-z', '.'],
+      cmd: [executablePath('git'), 'ls-files', '-s', '--others', '--exclude-standard', '-z', '.'],
       cwd,
       stdout: 'pipe',
       stderr: 'pipe',
     })
   } catch {
-    throw new UserError(
-      `vx requires git: failed to spawn 'git' (working dir: ${cwd}). Install git and re-run.`,
-    )
+    throw gitSpawnRefusal(cwd)
   }
   if (proc.exitCode !== 0) {
     // Exit 128 = not a git work tree; other non-zero = git failure.
@@ -206,7 +333,21 @@ export function runGitLsFiles(cwd: string): GitLsResult {
         `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
     )
   }
-  return parseLsFilesOutput(new TextDecoder().decode(proc.stdout))
+  const { text, undecodable } = decodeGitZ(proc.stdout)
+  return parseLsFilesOutput(text, undecodable)
+}
+
+/**
+ * A file's identity as the key folds it: its blob OID, prefixed by its git
+ * mode unless that is a plain file's (100644). A blob OID holds no mode, so
+ * a `chmod +x` or a symlink swapped for a file of its target's bytes kept
+ * the key while `git status` and `--affected` saw the change, and the task
+ * replayed the old output (item 887). The plain mode stays unprefixed, so
+ * only executables and symlinks moved key. `hashFile` spells it the same
+ * way from a stat.
+ */
+export function fileIdentity(mode: string, oid: string): string {
+  return mode === '100644' ? oid : `${mode}:${oid}`
 }
 
 // Each `ls-files -s -v` record is `[<flag> ]<mode> <oid> <stage>\t<path>` —
@@ -214,25 +355,24 @@ export function runGitLsFiles(cwd: string): GitLsResult {
 // `h`, …) in front. `--others` paths print bare; with `-z`, core.quotePath
 // quoting is off, so a bare path containing a literal tab still cannot
 // match the fixed-form prefix. Both answers come from ONE spawn.
-function parseLsFilesOutput(out: string): GitLsResult {
+function parseLsFilesOutput(out: string, undecodableRecords: ReadonlySet<string>): GitLsResult {
   const files: string[] = []
   const oids = new Map<string, string>()
   const flagged = new Set<string>()
-  if (out.length === 0) return { files, oids, flagged }
+  const undecodable: string[] = []
+  if (out.length === 0) return { files, oids, flagged, undecodable }
   // NUL-separated; trailing NUL produces an empty segment we skip.
   for (const record of out.split('\0')) {
     if (record.length === 0) continue
     const m = LS_FILES_STAGE_RE.exec(record)
-    if (m === null) {
-      files.push(record) // --others entry: bare path
-      continue
-    }
-    const filePath = record.slice(m[0].length)
+    const filePath = m === null ? record : record.slice(m[0].length) // --others: bare path
     files.push(filePath)
+    if (undecodableRecords.size > 0 && undecodableRecords.has(record)) undecodable.push(filePath)
+    if (m === null) continue
     const mode = m[2]!
     const stage = m[4]!
     if ((mode === '100644' || mode === '100755' || mode === '120000') && stage === '0') {
-      oids.set(filePath, m[3]!)
+      oids.set(filePath, fileIdentity(mode, m[3]!))
     }
     // A LOWERCASE letter means skip-worktree or assume-unchanged (`S` is the
     // older spelling of skip-worktree): git has been told to stop looking at
@@ -240,7 +380,7 @@ function parseLsFilesOutput(out: string): GitLsResult {
     const flag = m[1]
     if (flag !== undefined && (flag === 'S' || (flag >= 'a' && flag <= 'z'))) flagged.add(filePath)
   }
-  return { files, oids, flagged }
+  return { files, oids, flagged, undecodable }
 }
 
 /** One completed `git` invocation. */
@@ -248,10 +388,12 @@ interface GitRun {
   exitCode: number
   stdout: string
   stderr: string
+  /** `stdout`'s records that were not UTF-8 (`decodeGitZ`). */
+  undecodable: ReadonlySet<string>
 }
 
 /**
- * Parse `git check-attr -z text eol ident` output — a flat stream of
+ * Parse `git check-attr -z text eol ident filter working-tree-encoding` output — a flat stream of
  * `<path>\0<attr>\0<value>\0` triples — into the set of paths where a clean
  * filter can rewrite bytes. `unspecified` means no rule matched and
  * `unset` (`-text`) explicitly disables conversion; both leave the index blob
@@ -280,12 +422,14 @@ export function parseCheckAttrOutput(out: string): Set<string> {
  *  1. If `core.autocrlf` is true/input, conversion applies to every
  *     auto-detected text file with no attribute needed — trust nothing.
  *  2. Else, if no attributes source exists anywhere (no in-tree
- *     `.gitattributes`, no `$GIT_DIR/info/attributes`, no
- *     `core.attributesFile`), no rule can name a filter — return untouched,
- *     zero extra work. This is the default `git init` repo.
+ *     `.gitattributes`, no `$GIT_DIR/info/attributes`, none of the files
+ *     outside the tree git reads — `attributeFilesOutsideTree`), no rule
+ *     can name a filter — return untouched, zero extra work. This is the
+ *     default `git init` repo.
  *  3. Otherwise ask `git check-attr` (measured 21 ms; it resolves attributes
  *     from the index WITHOUT reading worktree content) and drop only the
- *     paths that actually carry `text`/`eol`/`ident`.
+ *     paths that actually carry `text`/`eol`/`ident`/`filter`/
+ *     `working-tree-encoding`.
  *
  * Never throws: a probe that fails leaves the map as-is, which is exactly the
  * behaviour before this gate existed.
@@ -293,75 +437,213 @@ export function parseCheckAttrOutput(out: string): Set<string> {
 async function dropFilteredOids(
   trusted: Map<string, string>,
   args: {
+    /** Every path the enumeration listed: tracked (dirty ones too) and untracked. */
+    listed: readonly string[]
     workspaceRoot: string
     gitDir: string
-    coreConfig: string
+    gitPrefix: string
+    pathspecs: readonly string[]
+    gitVars: string
     spawnGit: (a: string[], stdin?: string) => Promise<GitRun | null>
   },
 ): Promise<void> {
   if (trusted.size === 0) return
-  if (autocrlfConverts(args.coreConfig)) {
+  if (autocrlfConverts(args.gitVars)) {
     trusted.clear()
     return
   }
   // Cheap checks first, and nothing is materialized until one of them fires —
   // on a 15k-file repo with no attributes this whole function is a size check,
-  // a substring scan of an empty string, one stat, and a key walk that exits
-  // on the first `.gitattributes` it does not find.
+  // a line scan of `git var -l`, three stats, and a key walk that exits on the
+  // first `.gitattributes` it does not find.
   let attributesPossible =
-    args.coreConfig.toLowerCase().includes('core.attributesfile') ||
+    attributeFilesOutsideTree(args.gitVars, process.env).some((f) =>
+      existsSync(path.resolve(args.workspaceRoot, f)),
+    ) ||
     (args.gitDir !== '' &&
       existsSync(path.resolve(args.workspaceRoot, args.gitDir, 'info', 'attributes')))
+  // Every listed path, not only the trusted ones: git applies a
+  // `.gitattributes` that is untracked or modified as well, and scanned in
+  // the trusted set alone such a file was never seen, so a CRLF file's LF
+  // index blob keyed it through an edit (item 977).
   if (!attributesPossible) {
-    for (const rel of trusted.keys()) {
+    for (const rel of args.listed) {
       if (rel === '.gitattributes' || rel.endsWith('/.gitattributes')) {
         attributesPossible = true
         break
       }
     }
   }
+  // The scan above can only see what the enumeration LISTED, and a scoped
+  // run lists the project dirs alone (`gitPathspecs`). A `.gitattributes`
+  // ABOVE them — the workspace root's own, which is where a monorepo puts
+  // it — is therefore invisible, and the gate read "no attributes
+  // anywhere" and kept every filtered OID. Measured on the real CLI: the
+  // same workspace and the same CRLF→LF edit is a miss under `--all`
+  // (pathspec `.`, so the root file is listed) and a STALE HIT under
+  // `--filter app`. Git resolves attributes from every directory between
+  // the repo root and the file, so walk those directories — bounded by
+  // depth and project count, never by file count, which is what the
+  // gate's cost rule cares about.
+  if (!attributesPossible) attributesPossible = attributesAbove(args)
   if (!attributesPossible) return
 
+  // `filter` and `working-tree-encoding` rewrite bytes too: a clean driver
+  // (nbstripout, a `sed`) can map two worktree files to one blob, so the
+  // blob's OID keyed an edit git calls clean, and the run replayed the old
+  // output (item 978). Git LFS is a `filter` as well: its files are hashed
+  // from disk now, the one honest identity of what a task reads.
   const res = await args.spawnGit(
-    ['check-attr', '--stdin', '-z', 'text', 'eol', 'ident'],
+    ['check-attr', '--stdin', '-z', 'text', 'eol', 'ident', 'filter', 'working-tree-encoding'],
     [...trusted.keys()].join('\0'),
   )
   if (res === null || res.exitCode !== 0) return
   for (const rel of parseCheckAttrOutput(res.stdout)) trusted.delete(rel)
 }
 
-/** `true` when git may rewrite bytes for EVERY auto-detected text file. */
-export function autocrlfConverts(coreConfig: string): boolean {
-  for (const line of coreConfig.split('\n')) {
-    const [name, value] = [line.slice(0, line.indexOf(' ')), line.slice(line.indexOf(' ') + 1)]
-    if (name.toLowerCase() === 'core.autocrlf') {
-      const v = value.trim().toLowerCase()
-      return v === 'true' || v === 'input'
+/**
+ * The repository root, derived from the workspace root and git's own
+ * `--show-prefix` (the repo→workspace path). Exact and free: the prefix
+ * came from the same spawn. Deriving it from the git DIRECTORY instead
+ * is wrong in a linked worktree, where `--git-dir` names
+ * `<main>/.git/worktrees/<name>` — not an ancestor of the worktree's
+ * files at all, so a walk stopping there never stops and runs to `/`.
+ */
+export function repoRootOf(workspaceRoot: string, gitPrefix: string): string {
+  const depth = gitPrefix.split('/').filter((p) => p !== '' && p !== '.').length
+  return depth === 0 ? workspaceRoot : path.resolve(workspaceRoot, ...Array(depth).fill('..'))
+}
+
+/**
+ * Is there a `.gitattributes` at or above the scanned dirs, up to the repo
+ * root? Only the directories are stat'd — one per level per pathspec — so
+ * this stays a handful of syscalls on any repo size.
+ */
+function attributesAbove(args: {
+  workspaceRoot: string
+  gitPrefix: string
+  pathspecs: readonly string[]
+}): boolean {
+  const top = repoRootOf(args.workspaceRoot, args.gitPrefix)
+  const seen = new Set<string>()
+  for (const spec of args.pathspecs) {
+    let dir = path.resolve(args.workspaceRoot, spec)
+    for (;;) {
+      if (!seen.has(dir)) {
+        seen.add(dir)
+        if (existsSync(path.join(dir, '.gitattributes'))) return true
+      }
+      const parent = path.dirname(dir)
+      // Stop at the repo root, and never walk past the filesystem root on a
+      // workspace whose git dir could not be read.
+      if (dir === top || parent === dir) break
+      dir = parent
     }
   }
   return false
 }
 
-function parseStatusOutput(out: string): { dirty: Set<string>; untracked: string[] } {
+/**
+ * `git var -l` as `name → value`, the last line for a name winning, as the
+ * last value of a config key does in git. Config keys come first and
+ * lower-cased; git's own variables (`GIT_ATTR_GLOBAL`, …) follow.
+ */
+function gitVarList(listing: string): Map<string, string> {
+  const vars = new Map<string, string>()
+  for (const line of listing.split('\n')) {
+    const eq = line.indexOf('=')
+    if (eq > 0) vars.set(line.slice(0, eq), line.slice(eq + 1))
+  }
+  return vars
+}
+
+/** `true` when git may rewrite bytes for EVERY auto-detected text file. */
+export function autocrlfConverts(gitVars: string): boolean {
+  const v = gitVarList(gitVars).get('core.autocrlf')?.trim().toLowerCase()
+  return v === 'true' || v === 'input'
+}
+
+/**
+ * The attributes files outside the work tree git reads, from the same
+ * `git var -l` the gate already spawns. Git 2.42 and later name both:
+ * `GIT_ATTR_GLOBAL` is `core.attributesFile` or, unset, the default
+ * `$XDG_CONFIG_HOME/git/attributes` (`~/.config/git/attributes` without
+ * it), and `GIT_ATTR_SYSTEM` is the build's `$(sysconfdir)/gitattributes`,
+ * absent under `GIT_ATTR_NOSYSTEM`. The gate read only the config key, so
+ * `* text` in the default file left a CRLF file's LF blob trusted, a
+ * stale hit (the upstream survey's row X).
+ *
+ * An older git names neither; its global lookup is the documented one,
+ * mirrored here, and its system file sits where its build put it, which
+ * only git knows: `/etc/gitattributes` for a `/usr` build, else
+ * `<prefix>/etc/gitattributes` beside the binary's `bin/`. A path may be
+ * relative (a relative `core.attributesFile`), to the workspace root.
+ */
+export function attributeFilesOutsideTree(
+  gitVars: string,
+  env: Readonly<Record<string, string | undefined>>,
+): string[] {
+  const vars = gitVarList(gitVars)
+  const global = vars.get('GIT_ATTR_GLOBAL')
+  const system = vars.get('GIT_ATTR_SYSTEM')
+  if (global !== undefined || system !== undefined || vars.has('GIT_CONFIG_GLOBAL')) {
+    return [global, system].filter((f): f is string => f !== undefined && f !== '')
+  }
+  const out: string[] = []
+  const configured = vars.get('core.attributesfile')
+  const home = env.HOME ?? ''
+  if (configured !== undefined && configured !== '') {
+    out.push(configured.startsWith('~/') ? path.join(home, configured.slice(2)) : configured)
+  } else if ((env.XDG_CONFIG_HOME ?? '') !== '') {
+    out.push(path.join(env.XDG_CONFIG_HOME!, 'git', 'attributes'))
+  } else if (home !== '') {
+    out.push(path.join(home, '.config', 'git', 'attributes'))
+  }
+  const noSystem = (env.GIT_ATTR_NOSYSTEM ?? '').toLowerCase()
+  if (!['1', 'true', 'yes', 'on'].includes(noSystem)) {
+    out.push('/etc/gitattributes')
+    try {
+      const prefix = path.dirname(path.dirname(realpathSync(executablePath('git'))))
+      out.push(path.join(prefix, 'etc', 'gitattributes'))
+    } catch {
+      // No git to resolve: the enumeration has already refused the run.
+    }
+  }
+  return out
+}
+
+function parseStatusOutput(
+  out: string,
+  undecodableRecords: ReadonlySet<string>,
+): { dirty: Set<string>; untracked: string[]; undecodable: Set<string> } {
   const tokens = out.split('\0')
   const dirty = new Set<string>()
   const untracked: string[] = []
+  const undecodable = new Set<string>()
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]!
     if (token.length < 4) continue
+    if (undecodableRecords.size > 0 && undecodableRecords.has(token))
+      undecodable.add(token.slice(3))
     if (token[0] === '?') {
       untracked.push(token.slice(3))
       continue
     }
     dirty.add(token.slice(3))
-    // X = R or C → the next token is the rename/copy source path.
+    // An R or C in either column → the next token is the rename/copy
+    // source path. Y carries it for a rename git sees in the worktree (the
+    // copy added with `git add -N`, the original removed): read on X alone,
+    // the source was parsed as a record of its own, stayed trusted, and a
+    // deleted file was keyed from the index (item 976).
     const x = token[0]
-    if ((x === 'R' || x === 'C') && i + 1 < tokens.length && tokens[i + 1]!.length > 0) {
+    const y = token[1]
+    const renamed = x === 'R' || x === 'C' || y === 'R' || y === 'C'
+    if (renamed && i + 1 < tokens.length && tokens[i + 1]!.length > 0) {
       i++
       dirty.add(tokens[i]!)
     }
   }
-  return { dirty, untracked }
+  return { dirty, untracked, undecodable }
 }
 
 /**
@@ -427,6 +709,10 @@ export interface GitEnumeration {
   trusted: Map<string, string>
   /** Whether the worktree had uncommitted changes; null when `git status` failed. */
   dirty: boolean | null
+  /** Workspace-relative paths whose names are not UTF-8 (`decodeGitZ`). */
+  undecodable: readonly string[]
+  /** `Date.now()` before the spawns: what `trusted` says is true as of no earlier. */
+  startedAtMs: number
 }
 
 /**
@@ -467,49 +753,66 @@ export async function startGitEnumeration(
   const spawnGit = async (args: string[], stdin?: string): Promise<GitRun | null> => {
     try {
       const proc = Bun.spawn({
-        cmd: ['git', ...args],
+        // `status` refreshes the index when it can take `index.lock`, so
+        // the user's own `git add` or `commit` failed on the lock while a
+        // vx run held it (12 in 1,165 across 80 runs, item 880). Read-only, as
+        // editors and prompts run it; a clean tree costs the same.
+        cmd: [executablePath('git'), '--no-optional-locks', ...args],
         cwd: workspaceRoot,
         stdin: stdin === undefined ? 'ignore' : new TextEncoder().encode(stdin),
         stdout: 'pipe',
         stderr: 'pipe',
       })
       const [stdout, stderr, exitCode] = await Promise.all([
-        new Response(proc.stdout).text(),
+        new Response(proc.stdout).bytes(),
         new Response(proc.stderr).text(),
         proc.exited,
       ])
-      return { exitCode, stdout, stderr }
+      const { text, undecodable } = decodeGitZ(stdout)
+      return { exitCode, stdout: text, stderr, undecodable }
     } catch {
       return null
     }
   }
-  // Four spawns, one worktree walk. `ls-files -s -v` reads the INDEX only
+  const startedAtMs = Date.now()
+  // Four spawns at most (the rev-parse is memoized per process), one
+  // worktree walk. `ls-files -s -v` reads the INDEX only
   // (~9 ms on a 1000-project tree) and answers two questions at once: every
   // tracked path's OID and its cache-state flag. `status -uall` is the one
   // command that walks the worktree, and it answers two as well: which
   // tracked paths are dirty AND which files are untracked. Asking
   // `ls-files --others` for the untracked set walked the same tree a second
   // time (~50 ms of CPU, concurrent with status but contending with it).
-  const [ls, status, prefixRes, coreCfg] = await Promise.all([
+  const running = Promise.all([
     spawnGit(['ls-files', '-s', '-v', '-z', '--', ...pathspecs]),
     spawnGit(['status', '--porcelain', '-z', '-uall', '--', ...pathspecs]),
-    // Two answers from one spawn. `--show-prefix` is the repo→workspace path
-    // (empty when the workspace root IS the git root): `ls-files` prints
-    // cwd(workspace)-relative paths but `status` prints repo-root-relative
-    // ones, so when the workspace root is a SUBDIR of the git repo the two
-    // disagree; this lets us key both the same way below. `--git-dir` locates
-    // `info/attributes` for the filter gate (it is not always `.git/` — a
-    // linked worktree's `.git` is a FILE pointing elsewhere).
-    spawnGit(['rev-parse', '--show-prefix', '--git-dir']),
-    // Reads three config keys, no tree scan — the gate for whether a clean
-    // filter can rewrite bytes between the index and the worktree. Exits 1
-    // when none are set, which is the common case and means "no gate".
-    spawnGit(['config', '--get-regexp', '^core\\.(autocrlf|eol|attributesfile)$']),
+    // The gate for whether a clean filter can rewrite bytes between the
+    // index and the worktree: git's merged config (`core.autocrlf`) and,
+    // from git 2.42, the attributes files it reads outside the tree
+    // (`attributeFilesOutsideTree`). No tree scan. It replaced a
+    // `config --get-regexp` of three keys at the same cost (1.29 against
+    // 1.32 ms, min of 30), which could not name the default global file.
+    // Not foldable into the rev-parse below: rev-parse prints no config.
+    spawnGit(['var', '-l']),
   ])
+  // Asked while the three above run, from the memo the file hasher reads
+  // too (`repoFacts`). `prefix` is the repo→workspace path (empty when the
+  // workspace root IS the git root): `ls-files` prints cwd(workspace)-
+  // relative paths but `status` prints repo-root-relative ones, so when the
+  // workspace root is a SUBDIR of the git repo the two disagree; this lets
+  // us key both the same way below. `commonDir` locates `info/attributes`
+  // for the filter gate: it is not always `.git/` (a linked worktree's
+  // `.git` is a FILE pointing elsewhere), and it is the COMMON dir rather
+  // than the per-worktree one because that is where git reads the file
+  // from — probed, 2026-09-20: from inside a worktree `git check-attr text`
+  // goes `unspecified` → `auto` when the rule is written to the common
+  // dir's `info/attributes`, while the per-worktree gitdir has no such file
+  // at all. `--git-dir` named the per-worktree directory, so the gate
+  // looked where the rule can never be.
+  const facts = repoFacts(workspaceRoot)
+  const [ls, status, vars] = await running
   if (ls === null) {
-    throw new UserError(
-      `vx requires git: failed to spawn 'git' (working dir: ${workspaceRoot}). Install git and re-run.`,
-    )
+    throw gitSpawnRefusal(workspaceRoot)
   }
   if (ls.exitCode !== 0) {
     const stderr = ls.stderr.trim()
@@ -518,7 +821,12 @@ export async function startGitEnumeration(
         `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
     )
   }
-  const { files: tracked, oids, flagged } = parseLsFilesOutput(ls.stdout)
+  const {
+    files: tracked,
+    oids,
+    flagged,
+    undecodable,
+  } = parseLsFilesOutput(ls.stdout, ls.undecodable)
   // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
   // the `--show-prefix`) so the dirty set is keyed identically to the trusted
   // OID map. Without this, when the workspace root is a git subdir, a modified
@@ -526,13 +834,12 @@ export async function startGitEnumeration(
   // a STALE cache hit serving old outputs. Empty prefix (workspace == git root,
   // the common case) is a zero-cost no-op. Paths above the workspace can't be
   // inputs, so they drop out of the set.
-  // One spawn, two lines: `--show-prefix` then `--git-dir`.
-  const revLines =
-    prefixRes !== null && prefixRes.exitCode === 0 ? prefixRes.stdout.split('\n') : []
-  const gitPrefix = (revLines[0] ?? '').trim()
-  const gitDir = (revLines[1] ?? '').trim()
+  const gitPrefix = facts?.prefix ?? ''
+  const gitDir = facts?.commonDir ?? ''
   const parsedStatus =
-    status !== null && status.exitCode === 0 ? parseStatusOutput(status.stdout) : null
+    status !== null && status.exitCode === 0
+      ? parseStatusOutput(status.stdout, status.undecodable)
+      : null
   const dirty = parsedStatus === null ? null : stripPrefixFromSet(parsedStatus.dirty, gitPrefix)
   // Untracked files are inputs too (a new file is the commonest edit there
   // is). They come from the status walk, repo-root-relative like the dirty
@@ -557,7 +864,7 @@ export async function startGitEnumeration(
   // fall out of the input set while unmaterialized.
   for (const rel of flagged) trusted.delete(rel)
   // An index OID is only the file's content hash when git stores the worktree
-  // bytes VERBATIM. Under a clean filter (`text`/`eol`/`ident`) the blob is a
+  // bytes VERBATIM. Under a clean filter (`text`/`eol`/`ident`/`filter`/`working-tree-encoding`) the blob is a
   // DIFFERENT sequence of bytes — the LF-normalized form — while the task
   // reads the CRLF worktree file. `git status` compares AFTER filtering, so
   // such a file reports clean and keeps its OID: the CRLF and LF states then
@@ -568,12 +875,18 @@ export async function startGitEnumeration(
   // all along. The only cost is the read, so the gate below is about paying it
   // ONLY where a filter can actually apply.
   await dropFilteredOids(trusted, {
+    listed: all,
     workspaceRoot,
     gitDir,
-    coreConfig: coreCfg !== null && coreCfg.exitCode === 0 ? coreCfg.stdout : '',
+    gitPrefix,
+    pathspecs,
+    gitVars: vars !== null && vars.exitCode === 0 ? vars.stdout : '',
     spawnGit,
   })
-  return { all, trusted, dirty: worktreeDirty }
+  if (parsedStatus !== null && parsedStatus.undecodable.size > 0) {
+    undecodable.push(...stripPrefixFromSet(parsedStatus.undecodable, gitPrefix))
+  }
+  return { all, trusted, dirty: worktreeDirty, undecodable, startedAtMs }
 }
 
 /** The partition half of `populateGitFilesCache`: store per-project slices of one enumeration. */
@@ -586,6 +899,8 @@ export function applyGitEnumeration(
 ): void {
   const { all, trusted } = enumeration
   cache.setWorktreeDirty(enumeration.dirty)
+  cache.enumeratedAtMs = enumeration.startedAtMs
+  cache.markUndecodable(enumeration.undecodable.map((rel) => path.join(workspaceRoot, rel)))
   // Sort once, then each project's files are a contiguous range found
   // by binary search on its `dir/` prefix — O((F+P) log F) instead of
   // the O(P·F) per-project startsWith scan (54 ms at 1090 projects ×
@@ -623,6 +938,20 @@ export function applyGitEnumeration(
       const oid = trusted.get(rel)
       if (oid !== undefined) projOids.set(path.join(workspaceRoot, rel), oid)
     }
+    // An empty slice is a directory git did not see, not an empty project:
+    // a project has at least its package.json, tracked or untracked. What
+    // hides a directory from this listing is a nested repository — a
+    // submodule, an embedded repository — which the workspace's git holds as
+    // ONE entry (a gitlink, `dir/` when untracked) and, under a pathspec
+    // naming the project, as nothing at all; or a directory ignored
+    // outright. Storing the empty slice made the key never move: `cache.inputs
+    // matched no files`, then a stale hit under a green run once the source
+    // changed (2026-09-16). No partition instead: `resolveFiles` spawns
+    // `git ls-files` in the project's own directory, which a nested
+    // repository answers, and the files hash by content (no index OID
+    // trusted from here) — one spawn per such project per run, nothing for
+    // a workspace without one.
+    if (matches.length === 0) continue
     // setOids AFTER set — set() drops the project's OID slot.
     cache.set(projectDir, matches)
     cache.setOids(projectDir, projOids)