@vzn/vx 0.0.349 → 0.0.352

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.349",
+  "version": "0.0.352",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.349",
-    "@vzn/vx-linux-arm64": "0.0.349",
-    "@vzn/vx-darwin-x64": "0.0.349",
-    "@vzn/vx-darwin-arm64": "0.0.349"
+    "@vzn/vx-linux-x64": "0.0.352",
+    "@vzn/vx-linux-arm64": "0.0.352",
+    "@vzn/vx-darwin-x64": "0.0.352",
+    "@vzn/vx-darwin-arm64": "0.0.352"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -605,6 +605,14 @@ export class Cache implements CacheLayer {
       // every open there failed `attempt to write a readonly database`
       // before the not-writable refusal could name the directory (O-10).
       if (!absent) this.db.fileControl(SQLITE_FCNTL_PERSIST_WAL, 1)
+      // Any non-negative limit makes the last clean close truncate a
+      // persistent `-wal` to zero bytes once it is checkpointed (SQLite's
+      // walClose). At the default (-1) it kept every frame, so each later
+      // connection recovered them at open and copied them into the
+      // database again at its close: 738 frames, 4.5 MB, on a 1,000-project
+      // cache. The file stays (O-10 above); 64 MiB is far above what a run
+      // writes, so the limit never trims a WAL mid-run.
+      this.db.exec('PRAGMA journal_size_limit = 67108864')
       this.db.exec('PRAGMA synchronous = NORMAL')
       this.db.exec('PRAGMA foreign_keys = ON')
       this.db.exec(`
@@ -666,7 +674,7 @@ export class Cache implements CacheLayer {
             }
             if (found === SCHEMA_VERSION) return null
             this.db.exec(
-              'DROP TABLE IF EXISTS entries; DROP TABLE IF EXISTS runs; DROP TABLE IF EXISTS file_hashes; DROP TABLE IF EXISTS output_files; DROP TABLE IF EXISTS invocations; DROP TABLE IF EXISTS run_task_inputs; DROP TABLE IF EXISTS entry_inputs; DROP TABLE IF EXISTS config_evals; DROP TABLE IF EXISTS config_closures; DROP TABLE IF EXISTS output_dirs;',
+              'DROP TABLE IF EXISTS entries; DROP TABLE IF EXISTS runs; DROP TABLE IF EXISTS file_hashes; DROP TABLE IF EXISTS blob_sizes; DROP TABLE IF EXISTS output_files; DROP TABLE IF EXISTS invocations; DROP TABLE IF EXISTS run_task_inputs; DROP TABLE IF EXISTS entry_inputs; DROP TABLE IF EXISTS config_evals; DROP TABLE IF EXISTS config_closures; DROP TABLE IF EXISTS output_dirs;',
             )
             this.db
               .prepare("UPDATE schema_meta SET value = ? WHERE key = 'version'")
@@ -790,6 +798,14 @@ export class Cache implements CacheLayer {
   hashFiles(paths: readonly string[]): Promise<Map<string, string>> {
     return this.guard(() => this.files.hashFiles(paths))
   }
+  /** `BlobSizeMemo`: the sizes of these blobs this cache has learned. */
+  knownBlobSizes(oids: readonly string[]): Map<string, number> {
+    return this.guard(() => this.files.knownBlobSizes(oids))
+  }
+  /** `BlobSizeMemo`: remember blob sizes, honouring the local WRITE axis. */
+  rememberBlobSizes(sizes: ReadonlyMap<string, number>): void {
+    this.guard(() => this.files.rememberBlobSizes(sizes))
+  }
   /**
    * `relPosix` against the run's workspace root, memoized: the same three
    * thousand files are re-relativized for every task of the project, which
@@ -799,11 +815,25 @@ export class Cache implements CacheLayer {
    */
   private relMemo = new Map<string, string>()
   private relMemoRoot: string | undefined
+  /** `root` and a slash, when a file under it is relative by slicing; else undefined. */
+  private relPrefix: string | undefined
   private relFor(root: string, file: string): string {
     if (root !== this.relMemoRoot) {
       this.relMemoRoot = root
       this.relMemo.clear()
+      this.relPrefix =
+        path.sep === '/' && path.isAbsolute(root) && path.normalize(root) === root
+          ? root.endsWith('/')
+            ? root
+            : `${root}/`
+          : undefined
     }
+    // An input file is a normalized absolute path (`resolveInputs` makes
+    // every one), and under a normalized root that is the root, a slash and
+    // its relative path: a slice, where the memo hashed the whole path per
+    // file per task (~15 ms over 36,000 files, I-31).
+    const prefix = this.relPrefix
+    if (prefix !== undefined && file.startsWith(prefix)) return file.slice(prefix.length)
     let rel = this.relMemo.get(file)
     if (rel === undefined) this.relMemo.set(file, (rel = relPosix(root, file)))
     return rel

package/src/cache/file-hashes.ts

@@ -68,12 +68,42 @@ export class FileHashStore {
     if (last !== null && now - Number(last.value) < DAY_MS) return
     this.db.transaction(() => {
       this.db.prepare('DELETE FROM file_hashes WHERE seen_at < ?').run(cutoff)
+      this.db.prepare('DELETE FROM blob_sizes WHERE seen_at < ?').run(cutoff)
       this.db
         .prepare('INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)')
         .run(FILE_HASHES_SWEPT_AT, String(now))
     })()
   }
 
+  /** Each of `oids` whose size a `rememberBlobSizes` stored: one `IN` query per 900. */
+  knownBlobSizes(oids: readonly string[]): Map<string, number> {
+    const out = new Map<string, number>()
+    for (let i = 0; i < oids.length; i += 900) {
+      const chunk = oids.slice(i, i + 900)
+      const rows = this.db
+        .query(`SELECT oid, size FROM blob_sizes WHERE oid IN (${chunk.map(() => '?').join(',')})`)
+        .all(...chunk) as Array<{ oid: string; size: number }>
+      for (const r of rows) out.set(r.oid, r.size)
+    }
+    return out
+  }
+
+  /** Store blob sizes in one transaction; a memo, so a full disk skips it. */
+  rememberBlobSizes(sizes: ReadonlyMap<string, number>): void {
+    if (!this.write || sizes.size === 0) return
+    const now = Date.now()
+    const insert = this.db.prepare(
+      'INSERT OR REPLACE INTO blob_sizes(oid, size, seen_at) VALUES (?, ?, ?)',
+    )
+    try {
+      this.db.transaction(() => {
+        for (const [oid, size] of sizes) insert.run(oid, size, now)
+      })()
+    } catch (err) {
+      if (!isIndexFull(err)) throw err
+    }
+  }
+
   /**
    * Content-hash a file (as a git blob OID, v20) with an mtime+size
    * fast path. If the `file_hashes` table has a row for `path` whose

package/src/cache/git-inputs.ts

@@ -6,7 +6,7 @@
 // task declared. Nothing here reads a config or applies a boundary.
 
 import path from 'node:path'
-import { existsSync, lstatSync, realpathSync } from 'node:fs'
+import { existsSync, lstatSync, readdirSync, realpathSync } from 'node:fs'
 import { UserError, executablePath, gitSpawnRefusal } from '../util/index.js'
 
 /** Three facts of the repository a directory is in, from one `git rev-parse`. */
@@ -394,7 +394,14 @@ function expandNestedRepos(
     }
     out ??= files.slice(0, i)
     const abs = path.join(cwd, nested)
-    if (!existsSync(path.join(abs, '.git'))) continue
+    if (!existsSync(path.join(abs, '.git'))) {
+      // No repository answers for it: a submodule never initialised (empty)
+      // or one whose `.git` was removed to vendor its files, the gitlink
+      // left in the index and `git status` silent. Its files are what the
+      // task reads, so a walk lists them; they hash by content (A-61).
+      for (const f of walkFiles(abs)) out.push(`${nested}/${f}`)
+      continue
+    }
     const inner = runGitLsFiles(abs)
     for (const f of inner.files) out.push(`${nested}/${f}`)
     for (const f of inner.undecodable) undecodable.push(`${nested}/${f}`)
@@ -402,6 +409,24 @@ function expandNestedRepos(
   return { files: out ?? files, undecodable }
 }
 
+/** Every file and symlink under `dir`, relative and `/`-separated; a `.git` is skipped, a link not followed. */
+function walkFiles(dir: string, rel = ''): string[] {
+  let entries
+  try {
+    entries = readdirSync(path.join(dir, rel), { withFileTypes: true })
+  } catch {
+    return []
+  }
+  const out: string[] = []
+  for (const e of entries) {
+    if (e.name === '.git') continue
+    const r = rel === '' ? e.name : `${rel}/${e.name}`
+    if (e.isDirectory()) out.push(...walkFiles(dir, r))
+    else out.push(r)
+  }
+  return out
+}
+
 /**
  * A file's identity as the key folds it: its blob OID, prefixed by its git
  * mode unless that is a plain file's (100644). A blob OID holds no mode, so
@@ -451,6 +476,108 @@ function parseLsFilesOutput(out: string, undecodableRecords: ReadonlySet<string>
   return { files, oids, flagged, gitlinks, undecodable }
 }
 
+/**
+ * `ls-files -s -v -z --debug` as the plain `-s -v -z` stream, plus the size
+ * the index records for each regular stage-0 entry's worktree file and its
+ * raw OID. With `-z`, each record's NUL is followed by its five
+ * newline-ended debug lines (ctime, mtime, dev/ino, uid/gid, size/flags),
+ * then the next record.
+ */
+function stripLsDebug(run: GitRun): {
+  plain: string
+  undecodable: Set<string>
+  indexed: Map<string, { oid: string; size: number }>
+} {
+  const segs = run.stdout.split('\0')
+  const records: string[] = []
+  const undecodable = new Set<string>()
+  const indexed = new Map<string, { oid: string; size: number }>()
+  let record = segs[0]!
+  let recordRaw = record
+  for (let i = 1; i <= segs.length; i++) {
+    const seg = segs[i]
+    let rest = ''
+    let size = -1
+    if (seg !== undefined) {
+      let at = 0
+      for (let k = 0; k < 5 && at >= 0; k++) {
+        const nl = seg.indexOf('\n', at)
+        if (nl < 0) at = -1
+        else {
+          if (k === 4) size = Number(/size: (\d+)/.exec(seg.slice(at, nl))?.[1] ?? -1)
+          at = nl + 1
+        }
+      }
+      rest = at < 0 ? '' : seg.slice(at)
+    }
+    if (record.length > 0) {
+      records.push(record)
+      if (run.undecodable.has(recordRaw)) undecodable.add(record)
+      const m = LS_FILES_STAGE_RE.exec(record)
+      if (m !== null && m[4] === '0' && (m[2] === '100644' || m[2] === '100755')) {
+        indexed.set(record.slice(m[0].length), { oid: m[3]!, size })
+      }
+    }
+    record = rest
+    recordRaw = seg ?? ''
+  }
+  return { plain: records.join('\0'), undecodable, indexed }
+}
+
+/** Blob sizes learned once and kept: a blob's size is fixed for its OID. `Cache` is one. */
+export interface BlobSizeMemo {
+  knownBlobSizes(oids: readonly string[]): Map<string, number>
+  rememberBlobSizes(sizes: ReadonlyMap<string, number>): void
+}
+
+/**
+ * Drop each trusted OID whose blob is not the size the index recorded for
+ * the worktree file (A-60). A clean filter's blob differs from the file it
+ * was added from, and git holds a stat-clean entry clean without re-reading
+ * it once the filter is gone (`core.autocrlf` turned off, a `.gitattributes`
+ * rule removed): `status` and the filter gate, which reads today's config,
+ * both let the blob stand for bytes it does not hold. The recorded sizes
+ * cost no read of the worktree; the blob sizes come from `memo`, and only
+ * the ones it lacks from one `cat-file` (65 ms over 3,000 loose objects,
+ * the whole of the cost, measured 2026-10-02). A smudged (racy) entry
+ * records 0 and is hashed from disk. An answer that cannot be read trusts
+ * nothing.
+ */
+async function dropResizedOids(enumeration: GitEnumeration, memo?: BlobSizeMemo): Promise<void> {
+  const { trusted, indexed } = enumeration
+  const wanted = new Set<string>()
+  for (const rel of trusted.keys()) {
+    const entry = indexed.get(rel)
+    if (entry !== undefined) wanted.add(entry.oid)
+  }
+  if (wanted.size === 0) return
+  const sizes = memo?.knownBlobSizes([...wanted]) ?? new Map<string, number>()
+  const unknown = [...wanted].filter((oid) => !sizes.has(oid))
+  if (unknown.length > 0) {
+    const run = await enumeration.catFile(unknown.join('\n') + '\n')
+    if (run === null || run.exitCode !== 0) {
+      trusted.clear()
+      return
+    }
+    const learned = new Map<string, number>()
+    for (const line of run.stdout.split('\n')) {
+      const sp = line.indexOf(' ')
+      const n = Number(line.slice(sp + 1))
+      if (sp > 0 && line.slice(sp + 1) !== '' && Number.isInteger(n))
+        learned.set(line.slice(0, sp), n)
+    }
+    for (const [oid, n] of learned) sizes.set(oid, n)
+    memo?.rememberBlobSizes(learned)
+  }
+  for (const rel of trusted.keys()) {
+    const entry = indexed.get(rel)
+    if (entry === undefined) continue // a symlink: its blob is its target string
+    const size = sizes.get(entry.oid)
+    // The index keeps the low 32 bits of a size.
+    if (size === undefined || size % 2 ** 32 !== entry.size) trusted.delete(rel)
+  }
+}
+
 /** One completed `git` invocation. */
 interface GitRun {
   exitCode: number
@@ -825,7 +952,7 @@ export async function populateGitFilesCache(
     workspaceRoot,
     gitPathspecs(workspaceRoot, projectDirs, workspaceWide),
   )
-  applyGitEnumeration(enumeration, workspaceRoot, projectDirs, cache, workspaceWide)
+  await applyGitEnumeration(enumeration, workspaceRoot, projectDirs, cache, workspaceWide)
 }
 
 /** What one workspace-wide enumeration learned, before it is partitioned per project. */
@@ -851,8 +978,15 @@ export interface GitEnumeration {
   undecodable: readonly string[]
   /** `Date.now()` before the spawns: what `trusted` says is true as of no earlier. */
   startedAtMs: number
+  /** Each regular stage-0 entry's raw OID and the worktree size the index recorded. */
+  indexed: ReadonlyMap<string, { oid: string; size: number }>
+  /** `git cat-file --batch-check` over `stdin`'s OIDs; null when it could not spawn. */
+  catFile(stdin: string): Promise<{ exitCode: number; stdout: string } | null>
 }
 
+/** Above this many project dirs the enumeration walks the whole tree. */
+export const MAX_SCOPED_PATHSPECS = 64
+
 /**
  * Pathspec scoping: when the run only needs a handful of projects
  * (scoped config loading), let git scan just those dirs — 75 ms →
@@ -868,7 +1002,7 @@ export function gitPathspecs(
   const scoped =
     !workspaceWide &&
     rels.length > 0 &&
-    rels.length <= 64 &&
+    rels.length <= MAX_SCOPED_PATHSPECS &&
     rels.every((r) => r !== '' && r !== '.')
   return scoped ? rels : ['.']
 }
@@ -888,7 +1022,11 @@ export async function startGitEnumeration(
   // bulk-populate costs max(ls-files, status) wall time, not the sum
   // (status alone is ~74 ms on a 1000-project tree; serial spawning
   // was a measurable warm-path regression vs the pre-OID code).
-  const spawnGit = async (args: string[], stdin?: string): Promise<GitRun | null> => {
+  const spawnGit = async (
+    args: string[],
+    stdin?: string,
+    env?: Record<string, string>,
+  ): Promise<GitRun | null> => {
     try {
       const proc = Bun.spawn({
         // `status` refreshes the index when it can take `index.lock`, so
@@ -900,6 +1038,7 @@ export async function startGitEnumeration(
         stdin: stdin === undefined ? 'ignore' : new TextEncoder().encode(stdin),
         stdout: 'pipe',
         stderr: 'pipe',
+        ...(env !== undefined ? { env: { ...process.env, ...env } } : {}),
       })
       const [stdout, stderr, exitCode] = await Promise.all([
         new Response(proc.stdout).bytes(),
@@ -921,8 +1060,14 @@ export async function startGitEnumeration(
   // tracked paths are dirty AND which files are untracked. Asking
   // `ls-files --others` for the untracked set walked the same tree a second
   // time (~50 ms of CPU, concurrent with status but contending with it).
+  // `--debug` adds each entry's recorded stat, for the blob-size check
+  // (`dropResizedOids`, A-60).
+  const listing = spawnGit(['ls-files', '-s', '-v', '-z', '--debug', '--', ...pathspecs]).then(
+    (run) =>
+      run === null || run.exitCode !== 0 ? { run, debug: null } : { run, debug: stripLsDebug(run) },
+  )
   const running = Promise.all([
-    spawnGit(['ls-files', '-s', '-v', '-z', '--', ...pathspecs]),
+    listing,
     // `--ignored=matching` names an ignored path without descending into an
     // ignored directory: git applies an ignored `.gitattributes` as it does
     // any other, and the filter gate below must see it (A-19).
@@ -962,7 +1107,7 @@ export async function startGitEnumeration(
   // at all. `--git-dir` named the per-worktree directory, so the gate
   // looked where the rule can never be.
   const facts = repoFacts(workspaceRoot)
-  const [ls, status, vars] = await running
+  const [{ run: ls, debug }, status, vars] = await running
   if (ls === null) {
     throw gitSpawnRefusal(workspaceRoot)
   }
@@ -979,7 +1124,7 @@ export async function startGitEnumeration(
     flagged,
     gitlinks,
     undecodable,
-  } = parseLsFilesOutput(ls.stdout, ls.undecodable)
+  } = parseLsFilesOutput(debug!.plain, debug!.undecodable)
   // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
   // the `--show-prefix`) so the dirty set is keyed identically to the trusted
   // OID map. Without this, when the workspace root is a git subdir, a modified
@@ -1057,6 +1202,13 @@ export async function startGitEnumeration(
     untracked: dirty === null ? null : untracked,
     undecodable,
     startedAtMs,
+    indexed: debug!.indexed,
+    // A missing blob is an answer ("missing"), never a fetch from a partial
+    // clone's promisor remote.
+    catFile: (stdin) =>
+      spawnGit(['cat-file', '--batch-check=%(objectname) %(objectsize)'], stdin, {
+        GIT_NO_LAZY_FETCH: '1',
+      }),
   }
 }
 
@@ -1086,13 +1238,15 @@ export function lazyGitEnumeration(workspaceRoot: string): LazyGitEnumeration {
 }
 
 /** The partition half of `populateGitFilesCache`: store per-project slices of one enumeration. */
-export function applyGitEnumeration(
+export async function applyGitEnumeration(
   enumeration: GitEnumeration,
   workspaceRoot: string,
   projectDirs: readonly string[],
   cache: GitFilesCache,
   workspaceWide = false,
-): void {
+  memo?: BlobSizeMemo,
+): Promise<void> {
+  await dropResizedOids(enumeration, memo)
   const { all, trusted } = enumeration
   cache.setWorktreeDirty(enumeration.dirty)
   cache.enumeratedAtMs = enumeration.startedAtMs

package/src/cache/index.ts

@@ -43,12 +43,14 @@ export {
   ownWorkspaceOutputsSince,
   stampOutputs,
   stampWorkspaceOutputs,
+  stopRuntimeProbes,
   type OutputStamp,
 } from './inputs.js'
 export {
   GitFilesCache,
   applyGitEnumeration,
   gitPathspecs,
+  MAX_SCOPED_PATHSPECS,
   repoRootOf,
   startGitEnumeration,
   lazyGitEnumeration,

package/src/cache/inputs.ts

@@ -448,6 +448,22 @@ async function runRuntimeCommand(
  */
 const liveProbes = new Set<ReturnType<typeof Bun.spawn>>()
 let probeExitHooked = false
+
+/**
+ * Kill every runtime probe still running, with its tree. A run's stop asks
+ * this: a Ctrl-C while a probe ran waited for the probe, or for the signal
+ * handler's bound, about 7 s, before vx exited (C-65). Its answer is no
+ * longer needed; its caller sees it fail and the run reads it aborted.
+ */
+export function stopRuntimeProbes(): void {
+  for (const p of liveProbes) {
+    try {
+      process.kill(-p.pid, 'SIGKILL')
+    } catch {
+      // the group is gone
+    }
+  }
+}
 function killProbesOnExit(): void {
   if (probeExitHooked) return
   probeExitHooked = true
@@ -1032,27 +1048,75 @@ function refuseOneAlternativeBrace(
   }
 }
 
-async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
+/** What a `files` declaration and its task's outputs compile to, whatever the project. */
+interface FilesPlan {
+  positive: string[]
+  negative: string[]
+  excludeGlobs: Bun.Glob[]
+  ownOutput: (rel: string) => boolean
+  positiveGlobs: Bun.Glob[]
+  /** The literal entries, each naming one path (see `unmatchedLiterals`). */
+  literals: string[]
+  /**
+   * Whether a project-relative path is an input by the declaration alone:
+   * a positive glob selects it, and no exclude and no own output takes it
+   * back. Projects repeat their relative paths (`src/index.ts`,
+   * `package.json`), so each is matched once per plan.
+   */
+  verdicts: Map<string, boolean>
+}
+
+/**
+ * Compiled once per declaration for the life of the process: a workspace
+ * declares a handful of `files` lists over thousands of tasks, and
+ * splitting, normalizing and compiling them per task was ~6 ms of a
+ * 1,000-task warm run (I-29). A refused declaration is never stored, so it
+ * throws for every task that carries it.
+ */
+const filesPlans = new Map<string, FilesPlan | null>()
+
+function filesPlan(
+  files: readonly string[] | undefined,
+  ownOutputs: readonly string[],
+): FilesPlan | null {
+  const key = JSON.stringify([files ?? null, ownOutputs])
+  const memo = filesPlans.get(key)
+  if (memo !== undefined) return memo
   const positive: string[] = []
   const negative: string[] = []
-
-  if (args.files === undefined) {
+  if (files === undefined) {
     positive.push(...DEFAULT_FILE_GLOBS)
   } else {
-    refuseOneAlternativeBrace(args.files, 'files')
-    for (const entry of args.files) {
+    refuseOneAlternativeBrace(files, 'files')
+    for (const entry of files) {
       if (entry.startsWith('!')) negative.push(entry.slice(1))
       else positive.push(entry)
     }
   }
+  const plan =
+    positive.length === 0
+      ? null
+      : {
+          positive,
+          negative,
+          excludeGlobs: [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor),
+          // A path the task's own outputs take back with `!` is no output, so it
+          // stays an input: a tracked file under `dist` the build reads (A-44).
+          ownOutput: outputMatcher(ownOutputs, globFor),
+          positiveGlobs: asTrees(positive).map(globFor),
+          literals: positive.map(normalizeGlob).filter(isLiteralPattern).map(stripTrailingSlash),
+          verdicts: new Map<string, boolean>(),
+        }
+  filesPlans.set(key, plan)
+  return plan
+}
 
-  if (positive.length === 0) return []
+async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
+  const plan = filesPlan(args.files, args.ownOutputs)
+  if (plan === null) return []
+  const { positive, negative, excludeGlobs, ownOutput, positiveGlobs } = plan
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
-  const excludeGlobs = [...ALWAYS_IGNORE, ...asTrees(negative)].map(globFor)
-  // A path the task's own outputs take back with `!` is no output, so it
-  // stays an input: a tracked file under `dist` the build reads (A-44).
-  const ownOutput = outputMatcher(args.ownOutputs, globFor)
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
   // files, .git/info/exclude, and global excludes all participate
@@ -1062,7 +1126,6 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // per task (build + test + lint + …). Spawning git N times for the
   // same project per run is wasteful; we cache the result for the
   // duration of one orchestrator run.
-  const positiveGlobs = asTrees(positive).map(globFor)
   // Everything below the snapshot that decides the result: the project, what
   // it declares, what it excludes as its own outputs, and the boundaries.
   const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
@@ -1102,22 +1165,21 @@ async function resolveFiles(args: ResolveFilesArgs): Promise<string[]> {
   // an artifact built from an older version of a file the config explicitly
   // claims as an input. See the refusal below for why this is not simply
   // honoured instead.
-  const unmatchedLiterals = new Set(
-    positive.map(normalizeGlob).filter(isLiteralPattern).map(stripTrailingSlash),
-  )
+  const unmatchedLiterals = new Set(plan.literals)
   // First pass: glob-filter to candidate absolute paths (no I/O).
   const candidates: string[] = []
+  const verdicts = plan.verdicts
   for (const rel of gitFiles) {
     if (unmatchedLiterals.size > 0) settleLiterals(unmatchedLiterals, rel)
-    let matched = false
-    for (const g of positiveGlobs) {
-      if (g.match(rel)) {
-        matched = true
-        break
-      }
+    let input = verdicts.get(rel)
+    if (input === undefined) {
+      input =
+        positiveGlobs.some((g) => g.match(rel)) &&
+        !excludeGlobs.some((g) => g.match(rel)) &&
+        !ownOutput(rel)
+      verdicts.set(rel, input)
     }
-    if (!matched) continue
-    if (nested(rel) || excludeGlobs.some((g) => g.match(rel)) || ownOutput(rel)) continue
+    if (!input || nested(rel)) continue
     candidates.push(path.resolve(args.projectDir, rel))
   }
   if (unmatchedLiterals.size > 0) {

package/src/cache/key-fold.ts

@@ -99,7 +99,11 @@ import type { CacheKeyInput } from './layer.js'
 // v37: an entry saved while `git status` hid a deletion (paired as an
 // unmerged path's rename source) holds output built without a file its key
 // folds (A-59).
-export const CACHE_VERSION = 'vx-cache-v37'
+// v38: an entry saved while the key folded a filtered LF blob for CRLF
+// bytes on disk, the filter since removed, holds the CRLF build (A-60).
+// v39: an entry saved while a gitlink without `.git` held files the key
+// never listed sits under the key of that directory empty (A-61).
+export const CACHE_VERSION = 'vx-cache-v39'
 
 /**
  * The digest a key folds for an input gone between its enumeration and its

package/src/cache/schema.ts

@@ -115,6 +115,15 @@ export function createTables(db: Database): void {
       content_hash TEXT NOT NULL,
       seen_at      INTEGER NOT NULL
     );
+    -- The size of each index blob the enumeration checked against the
+    -- worktree size git recorded (A-60). Fixed for its OID, so a warm
+    -- run asks git for none; swept with file_hashes by seen_at, the
+    -- time the row was written.
+    CREATE TABLE IF NOT EXISTS blob_sizes (
+      oid     TEXT PRIMARY KEY,
+      size    INTEGER NOT NULL,
+      seen_at INTEGER NOT NULL
+    );
     -- v16: per-output-file fingerprints, scoped by the cache entry
     -- that produced them. Lets loadOutputFilesBatch(hashes) answer
     -- "for entry X, what are its outputs supposed to look like?"

package/src/cli/show.ts

@@ -339,6 +339,12 @@ function taskBlock(taskName: string, raw: TaskConfig): string {
     add('outputs.workspaceFiles', list(cache.outputs.workspaceFiles))
   }
   const labelW = Math.max(...rows.map(([label]) => label.length))
-  const body = rows.map(([label, value]) => `  ${`${label}:`.padEnd(labelW + 1)} ${value}`)
+  // A multi-line value (a generated `vx_script` wrapper, a heredoc)
+  // continues under its first line, not at column 0 where it reads as
+  // the next task's header.
+  const indent = `\n${' '.repeat(labelW + 4)}`
+  const body = rows.map(
+    ([label, value]) => `  ${`${label}:`.padEnd(labelW + 1)} ${value.replaceAll('\n', indent)}`,
+  )
   return `${taskName}\n${body.join('\n')}\n`
 }

package/src/cli/workspace-config.ts

@@ -141,7 +141,7 @@ export async function loadCliProjects(
       projectMetas: metas,
       seeds: scope,
       closure: false,
-      lock,
+      lock: lock === null ? null : async () => lock,
       evalCache:
         cache === null
           ? undefined

package/src/exec/index.ts

@@ -29,7 +29,13 @@ export {
   thrownReason,
 } from './sandbox-runtime.js'
 export { type DeniedCall } from './sandbox-violations.js'
-export { atOrUnder, isMountableLiteral, MOUNT_WILDCARDS, toRealPath } from './sandbox-paths.js'
+export {
+  atOrUnder,
+  isMountableLiteral,
+  MOUNT_WILDCARDS,
+  sandboxReads,
+  toRealPath,
+} from './sandbox-paths.js'
 export { bindableWrites, punchWalls } from './sandbox-binds.js'
 export { isLocalExecutor, localExecutor } from './local-executor.js'
 export { holdGroups, killTree, untilGroupsGone } from './kill-tree.js'

package/src/exec/sandbox-paths.ts

@@ -76,3 +76,25 @@ export function unique(arr: readonly string[]): string[] {
 export function localBindingOn(c: { localBinding?: boolean | readonly number[] }): boolean {
   return c.localBinding === true || (Array.isArray(c.localBinding) && c.localBinding.length > 0)
 }
+
+/**
+ * Whether a sandboxed task may read `file`: it lies under a read grant,
+ * a write grant or a baseline read, by its canonical path. A path no
+ * grant holds is not there inside the sandbox, which the shell reports
+ * as "not found" with no denial a trace can see (an `execve`).
+ */
+export function sandboxReads(
+  sandbox: {
+    readonly baseAllowRead: readonly string[]
+    readonly config: {
+      readonly allowRead: readonly string[]
+      readonly allowWrite: readonly string[]
+    }
+  },
+  file: string,
+): boolean {
+  const real = toRealPath(file)
+  return [...sandbox.baseAllowRead, ...sandbox.config.allowRead, ...sandbox.config.allowWrite].some(
+    (g) => atOrUnder(real, toRealPath(g)),
+  )
+}