@vzn/vx 0.0.362 → 0.0.364

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.362",
+  "version": "0.0.364",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.362",
-    "@vzn/vx-linux-arm64": "0.0.362",
-    "@vzn/vx-darwin-x64": "0.0.362",
-    "@vzn/vx-darwin-arm64": "0.0.362"
+    "@vzn/vx-linux-x64": "0.0.364",
+    "@vzn/vx-linux-arm64": "0.0.364",
+    "@vzn/vx-darwin-x64": "0.0.364",
+    "@vzn/vx-darwin-arm64": "0.0.364"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/bin.ts

@@ -9,10 +9,14 @@ async function main(): Promise<void> {
     // `vx --version` needs one leaf module; the dispatcher and the util
     // barrel it pulled in were 20 ms of its 28 (2026-10-01).
     if (argv.length === 1 && (argv[0] === '--version' || argv[0] === 'version')) {
-      process.stdout.write(`vx ${(await import('./version.js')).VERSION}\n`)
+      // `Bun.stdout`, not `process.stdout`: the Node stream's first touch is
+      // ~7 ms, half of this verb (2026-10-02). A reader gone (EPIPE) is no
+      // failure of the line.
+      await Bun.write(Bun.stdout, `vx ${(await import('./version.js')).VERSION}\n`).catch(() => {})
       settled = true
       return
     }
+    listenForReadersGone()
     const { registerCoreAlias, run } = await import('./cli/index.js')
     // Every `import … from '@vzn/vx'` this process evaluates — a plugin
     // package, a workspace or project config — resolves to THIS core, not to
@@ -86,8 +90,11 @@ process.on('beforeExit', () => {
 // and exits with its own verdict; what was going to the reader goes
 // nowhere. Same for stderr (`2>&1 | head`). Here and not in the logger:
 // an embedder's streams are the embedder's.
-for (const stream of [process.stdout, process.stderr]) {
-  stream.on('error', () => {})
+// Set up past `--version`, which never touches the Node streams.
+function listenForReadersGone(): void {
+  for (const stream of [process.stdout, process.stderr]) {
+    stream.on('error', () => {})
+  }
 }
 
 void main()

package/src/cache/tar-stream.ts

@@ -53,6 +53,8 @@ function octal(h: Uint8Array, off: number, len: number): number {
     for (let i = off + 1; i < off + len; i++) n = n * 256 + h[i]!
     return n
   }
+  const plain = plainOctal(h, off, len)
+  if (plain !== null) return plain
   const s = field(h, off, len).trim()
   if (s === '') return 0
   // Every digit, not the longest parseable prefix: `parseInt` would read
@@ -61,10 +63,33 @@ function octal(h: Uint8Array, off: number, len: number): number {
   return parseInt(s, 8)
 }
 
+/**
+ * The field every writer emits — octal digits between ASCII spaces, ended
+ * by a NUL or the field's end — read off the bytes; null for anything
+ * else, which `octal` reads the slow way. Three fields a header through a
+ * decoder and a regex were most of a small artifact's read (2026-10-02).
+ */
+function plainOctal(h: Uint8Array, off: number, len: number): number | null {
+  const end = off + len
+  let i = off
+  while (i < end && h[i] === 0x20) i++
+  let n = 0
+  while (i < end && h[i]! >= 0x30 && h[i]! <= 0x37) n = n * 8 + (h[i++]! - 0x30)
+  while (i < end && h[i] === 0x20) i++
+  return i === end || h[i] === 0 ? n : null
+}
+
+function isZeroBlock(h: Uint8Array): boolean {
+  for (let i = 0; i < BLOCK; i++) if (h[i] !== 0) return false
+  return true
+}
+
 function checksumOk(h: Uint8Array): boolean {
   const stored = octal(h, 148, 8)
-  let sum = 0
-  for (let i = 0; i < BLOCK; i++) sum += i >= 148 && i < 156 ? 32 : h[i]!
+  // The checksum field counts as eight spaces.
+  let sum = 8 * 32
+  for (let i = 0; i < 148; i++) sum += h[i]!
+  for (let i = 156; i < BLOCK; i++) sum += h[i]!
   return sum === stored
 }
 
@@ -107,6 +132,18 @@ class Source {
 
   /** Exactly `n` bytes, or null at a clean end (nothing buffered), or a TarFormatError mid-entry. */
   async exact(n: number, what: string): Promise<Uint8Array | null> {
+    // Within one chunk, a view: the copy below was a third of a small
+    // artifact's read. Nothing writes to what this returns.
+    const c0 = this.chunks[0]
+    if (c0 !== undefined && c0.byteLength - this.head >= n) {
+      const view = c0.subarray(this.head, this.head + n)
+      this.head += n
+      if (this.head === c0.byteLength) {
+        this.chunks.shift()
+        this.head = 0
+      }
+      return view
+    }
     const out = new Uint8Array(n)
     let got = 0
     while (got < n) {
@@ -163,7 +200,7 @@ export async function* tarEntries(stream: ReadableStream<Uint8Array>): AsyncGene
       if (zeroBlocks === 0) throw new TarFormatError('archive has no end-of-archive marker')
       return
     }
-    if (h.every((b) => b === 0)) {
+    if (isZeroBlock(h)) {
       zeroBlocks++
       if (zeroBlocks >= 2) return
       continue

package/src/cli/lock.ts

@@ -4,7 +4,7 @@
 
 import type { ProjectConfig } from '../config.js'
 import { flagHint, refusedWord, seeHelp } from './help.js'
-import { relPosix, xxh3hex } from '../util/index.js'
+import { relPosix, secretMask, xxh3hex } from '../util/index.js'
 import {
   findWorkspaceRoot,
   type LoadReads,
@@ -86,6 +86,15 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   const projects: Record<string, LockfileEntry> = {}
   // `listProjects` sorts by name — stable lockfile diffs for free.
   for (let i = 0; i < metas.length; i++) projects[metas[i]!.name] = entries[i]!
+  const leaks = secretsIn(projects)
+  if (leaks.length > 0) {
+    process.stderr.write(
+      `vx lock: ${LOCKFILE_NAME} is committed, and these configs evaluated to a secret value:\n` +
+        leaks.map((l) => `  ${l}\n`).join('') +
+        `let the shell expand it ($API_TOKEN in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
+    )
+    return 1
+  }
   const lock: Lockfile = { version: LOCKFILE_VERSION, projects }
   await writeLockfile(root, lock)
   const n = metas.length
@@ -95,6 +104,40 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   return 0
 }
 
+/**
+ * Each place an evaluated config holds the value of a secret in this
+ * environment, by the rule output masking uses (a secret-named variable,
+ * or one a task lists in `exec.env.secret`). The lock is committed, so
+ * such a value would be published, and masking it would freeze a `***`
+ * that `--frozen` runs (L-42).
+ */
+function secretsIn(projects: Record<string, LockfileEntry>): string[] {
+  const named = new Set<string>()
+  for (const entry of Object.values(projects)) {
+    for (const task of Object.values(entry.config.tasks ?? {}))
+      for (const n of task?.exec?.env?.secret ?? []) named.add(n)
+  }
+  const secrets: [value: string, name: string][] = []
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && secretMask([{ [name]: value }], named.has(name) ? [name] : []))
+      secrets.push([value, name])
+  }
+  if (secrets.length === 0) return []
+  const found: string[] = []
+  const walk = (project: string, at: string, v: unknown): void => {
+    if (typeof v === 'string') {
+      for (const [value, name] of secrets)
+        if (v.includes(value)) found.push(`${project}: ${at} holds $${name}`)
+    } else if (Array.isArray(v)) {
+      v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
+    } else if (v !== null && typeof v === 'object') {
+      for (const [k, x] of Object.entries(v)) walk(project, at === '' ? k : `${at}.${k}`, x)
+    }
+  }
+  for (const [project, entry] of Object.entries(projects)) walk(project, '', entry.config)
+  return found
+}
+
 /**
  * Audit the lock. Two layers, strictly stronger than what runs do:
  *   1. The same hash check runs perform (file bytes vs lock hash).

package/src/cli/plugin-commands.ts

@@ -10,7 +10,7 @@
 import type { VxPlugin, PluginCommand, CommandContext } from '../orchestrator/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { loadCliWorkspace } from './workspace-config.js'
-import { machineParallelism } from '../util/index.js'
+import { machineParallelism, maskedLine } from '../util/index.js'
 
 export interface ResolvedPluginCommand {
   plugin: VxPlugin
@@ -92,7 +92,7 @@ export async function resolvePluginCommand(
         workspaceRoot: ws.workspaceRoot,
         cacheDir: ws.cacheDir,
         concurrency: ws.concurrency,
-        warn: (m) => process.stderr.write(`${m}\n`),
+        warn: (m) => process.stderr.write(`${maskedLine(m)}\n`),
       },
     }
   }

package/src/cli/select.ts

@@ -25,7 +25,7 @@ import {
 import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
-import { nearest, UserError } from '../util/index.js'
+import { maskedLine, nearest, UserError } from '../util/index.js'
 import { claimedAffected, fingerprintClaims, gitOfDiscovery } from '../orchestrator/index.js'
 import {
   type CliLoadOptions,
@@ -104,7 +104,7 @@ async function workspaceFingerprintClaims(
   const ctx = {
     workspaceRoot: root,
     cacheDir: load.cacheDir ?? ws.cacheDir,
-    warn: (m: string) => process.stderr.write(`${m}\n`),
+    warn: (m: string) => process.stderr.write(`${maskedLine(m)}\n`),
     projects: projects.map((p) => ({ name: p.name, dir: p.dir })),
   }
   return {

package/src/exec/sandbox-binds.ts

@@ -333,3 +333,40 @@ export function buildCustomConfig(
   }
   return custom
 }
+
+/**
+ * Linux: SRT's bwrap line with each `--tmpfs` it lays over a read-denied
+ * directory (the workspace root, a sibling's tree, the cwd with no read
+ * grant) remounted read-only once the mounts beneath it are made. bwrap's
+ * tmpfs is writable, so a write there succeeded and vanished with the
+ * sandbox: a task that wrote `../../dist` went green with its output gone,
+ * where seatbelt refuses the same write. Now it is `EROFS` on both, and a
+ * failed task's hint names the path. The mask a `scratch` glob's writes
+ * land in stays writable: that is the grant (`scratchWrites`). Placed
+ * before the `--` that ends bwrap's options; the words are SRT's own
+ * quoting, copied as they are.
+ */
+export function readOnlyMasks(wrapped: string, scratch: readonly string[] = []): string {
+  const masks: string[] = []
+  let prev = ''
+  for (const m of wrapped.matchAll(/(?:'[^']*'|"[^"]*"|[^\s'"])+/g)) {
+    if (m[0] === '--') {
+      const held = scratch.map((g) => {
+        const dir = toRealPath(path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS) + 1)))
+        const holding = masks.filter((w) => atOrUnder(dir, unquoted(w)))
+        return holding.sort((a, b) => unquoted(b).length - unquoted(a).length)[0]
+      })
+      const ro = masks.filter((w) => !held.includes(w))
+      if (ro.length === 0) return wrapped
+      const words = ro.map((w) => `--remount-ro ${w} `).join('')
+      return `${wrapped.slice(0, m.index)}${words}${wrapped.slice(m.index)}`
+    }
+    if (prev === '--tmpfs') masks.push(m[0])
+    prev = m[0]
+  }
+  return wrapped
+}
+
+/** A word as SRT's `quote` spells it, read back: single-quoted runs and `"'"`. */
+const unquoted = (word: string): string =>
+  word.replace(/'([^']*)'|"([^"]*)"/g, (_, a: string | undefined, b: string | undefined) => a ?? b!)

package/src/exec/sandbox-runtime.ts

@@ -70,6 +70,7 @@ import {
   bindableReads,
   bindableWrites,
   buildCustomConfig,
+  readOnlyMasks,
   scratchWrites,
   widenedEntries,
 } from './sandbox-binds.js'
@@ -88,6 +89,7 @@ import {
 } from './sandbox-deny-scan.js'
 import {
   parseStraceViolations,
+  refusedConnections,
   refusedWrites,
   refusedWritesOutside,
   reportableViolations,
@@ -1065,7 +1067,8 @@ export async function wrapSandboxedCommand(
   // sandboxed server and all it forked outlived vx (turborepo#9666). Now
   // the namespace goes with vx, a `setsid` daemon inside included, a
   // traced one-shot task too: its strace runs inside (B-11).
-  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped)) wrapped = `exec ${wrapped}`
+  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped))
+    wrapped = `exec ${readOnlyMasks(wrapped, scratch)}`
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   if (args.server === true) liveServers.add(tag)
@@ -1730,6 +1733,7 @@ async function runSandboxedOnce(
             bindableWrites(args.config.allowWrite),
             scratch,
           ),
+          ...refusedConnections(records.map((v) => v.line)),
         ]
       : []
   if (straceLog) {

package/src/exec/sandbox-violations.ts

@@ -419,6 +419,8 @@ function matchesIgnore(
  * crossing, and the task can grant it.
  */
 function describeMacViolation(line: string): Partial<SandboxViolation> {
+  const proxy = PROXY_DENY_RE.exec(line)
+  if (proxy !== null) return { target: proxy[1]!, ignorable: ['network'] }
   const m = /deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/.exec(line)
   if (m === null) return {}
   const [op, target] = [m[1]!, m[2]!]
@@ -589,6 +591,28 @@ function filterIgnored(
   return violations.filter((v) => !matchesIgnore(v, ignore))
 }
 
+/**
+ * SRT's filtering proxy records a connection it refused as `deny
+ * network-outbound <host>:<port> (<reason>)`, on both platforms: the one
+ * component that knows the host. Read as its own shape, so `ignore.network`
+ * silences it by host; the seatbelt pattern above wants `deny(<n>)`.
+ */
+const PROXY_DENY_RE = /^deny network-outbound (\S+) \([^)]*\)$/
+
+/**
+ * Linux: the connections the proxy refused, from the store records. Only
+ * the write observer's records were read there, so a task denied a host
+ * failed with its own `403` and no report, and one that survived the
+ * refusal passed, where macOS reports the same record (2026-10-02).
+ */
+export function refusedConnections(records: readonly string[]): SandboxViolation[] {
+  return [...new Set(records.filter((r) => PROXY_DENY_RE.test(r)))].map((line) => ({
+    line,
+    timestamp: new Date(),
+    ...describeMacViolation(line),
+  }))
+}
+
 /**
  * The writes SRT's Linux observer saw that this task's binds do not cover.
  * The observer reports every write-intent syscall as `deny <syscall>
@@ -612,6 +636,11 @@ export function refusedWrites(
     const m = /^deny (\S+) (\/.*)$/.exec(record)
     if (m === null) continue
     const [, syscall, raw] = m as unknown as [string, string, string]
+    // A descriptor or pseudo-file is the task's, and resolving it here
+    // reads vx's own: strace's log is `/dev/fd/5`, and a vx started with
+    // `5>out.log` in the project reported a write to `out.log` and failed
+    // a clean task (2026-10-02).
+    if (/^\/(?:dev|proc)\//.test(raw)) continue
     const abs = toRealPath(raw)
     if (isUnderAny(abs, binds) || underGlob(abs, globs)) continue
     const key = `${syscall}|${abs}`

package/src/graph/scheduler.ts

@@ -6,7 +6,7 @@ import {
   OUT_OF_FDS_HINT,
 } from '../util/index.js'
 import { computeReverseDepCount, mergePriorities, tieredReverseDepCount } from './priorities.js'
-import type { TaskNode } from './task-graph.js'
+import { isGroupTask, type TaskNode } from './task-graph.js'
 
 /**
  * Thrown by `execute` for a restore-tier task that turned out to have
@@ -572,6 +572,19 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     // could fail anyway.
     const aborted = (): boolean => options.signal?.aborted === true
     const serverDied = options.serverDied ?? ((): boolean => false)
+    // The dead server a dependency stands for: itself, or one a group
+    // reaches. A group is a name for its deps, and it finished the moment
+    // the server was ready, so a task behind it ran against the dead one.
+    const deadServerVia = (id: string): string | undefined => {
+      if (serverDied(id)) return id
+      const n = nodes.get(id)
+      if (n === undefined || !isGroupTask(n)) return undefined
+      for (const d of n.deps) {
+        const dead = deadServerVia(d)
+        if (dead !== undefined) return dead
+      }
+      return undefined
+    }
     const servers =
       options.serverDied === undefined
         ? []
@@ -600,7 +613,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           u?.status === 'skipped' ||
           u?.status === 'aborted' ||
           blockedRestores.has(d) ||
-          serverDied(d)
+          deadServerVia(d) !== undefined
         )
       })
     }
@@ -671,7 +684,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           const viaRestore = node.deps.find((d) => blockedRestores.has(d))
           const blockedBy =
             blocker?.node.id ??
-            node.deps.find(serverDied) ??
+            node.deps.map(deadServerVia).find((d) => d !== undefined) ??
             viaSkip?.blockedBy ??
             (viaRestore === undefined ? undefined : blockedRestores.get(viaRestore))
           finishOne(id, {

package/src/orchestrator/events.ts

@@ -9,7 +9,7 @@
 import { exitSignal } from '../exec/index.js'
 import type { TaskNode, TaskOutcome } from '../graph/index.js'
 import { isGroupTask } from '../graph/index.js'
-import { maskedCommand } from '../util/index.js'
+import { maskedCommand, secretMask } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { RunContext } from './summary.js'
 
@@ -103,8 +103,11 @@ export function busLogger(bus: EventBus): Logger {
   // run() reaches runEnd on its success path, in its finally and from a
   // signal; a plugin's onRunEnd hears the first only.
   let ended = false
+  // A status line carries plugin warnings, and a remote layer's warning
+  // quotes the server's reply, which may echo what it was sent (L-40).
+  const secrets = secretMask([process.env])
   return {
-    status: (line) => bus.emit({ kind: 'run:status', line }),
+    status: (line) => bus.emit({ kind: 'run:status', line: secrets?.mask(line) ?? line }),
     taskStdout: (node, chunk) => bus.emit({ kind: 'task:stdout', node, chunk }),
     taskStderr: (node, chunk) => bus.emit({ kind: 'task:stderr', node, chunk }),
     taskComplete: (node, outcome) => bus.emit({ kind: 'task:complete', node, outcome }),

package/src/orchestrator/execute-task.ts

@@ -915,7 +915,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         signal: res.signal,
         hidden: req.sandbox && ((f: string) => !sandboxReads(req.sandbox!, f)),
       })
-      if (verdict !== undefined) log.taskStderr(node, `\n${verdict}\n`)
+      // The line quotes the command's first word, which a config may have
+      // built from a secret: masked as the task's own output is (L-37).
+      if (verdict !== undefined) log.taskStderr(node, `\n${secrets?.mask(verdict) ?? verdict}\n`)
       // A committed file another task's clean removed, still gone: vx
       // cleans outputs before a run where Turbo does not, so a reader with
       // no edge to the producer fails naming only the file (A-48).

package/src/orchestrator/plugin.ts

@@ -358,6 +358,8 @@ export interface PluginContext {
   readonly workspaceRoot: string
   /** Where vx's cache lives — read-only as far as the plugin is concerned. */
   readonly cacheDir: string
+  /** Funnel warnings into the run:status channel, as every hook's context does. */
+  warn(message: string): void
   /**
    * The run event bus. A plugin can subscribe directly if its needs exceed
    * the hooks; the subscription ends with the run, as a hook's does.
@@ -539,6 +541,7 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
     const ctx: PluginContext = {
       workspaceRoot,
       cacheDir,
+      warn,
       // A subscription made past the hooks leaves with the run like a
       // hook's does: the bus can outlive the run (`RunOptions.bus`), and
       // one left behind hears every later run on it (item 635).

package/src/orchestrator/run.ts

@@ -693,7 +693,11 @@ async function runOnBus(
         vxVersion: VERSION,
         // An embedder's `command` is redacted as the argv is: it passed a
         // token after `--` to every sink verbatim (C-67).
-        command: invocationCommand(options.command?.split(' ') ?? process.argv.slice(1)),
+        // Masked as the stored line is: `--tag key=$DEPLOY_KEY` sits before
+        // the `--` the count covers (L-44).
+        command: maskInvocation(
+          invocationCommand(options.command?.split(' ') ?? process.argv.slice(1)),
+        ),
         requestedTasks: [...options.tasks],
         cachePolicy: compactCachePolicy(policy),
         concurrency,

package/src/orchestrator/sandbox-request.ts

@@ -3,6 +3,7 @@
 // (bwrap cannot bind a path that does not exist). Shared by the cached path
 // (through the executor) and the persistent path (spawned in execute-task).
 
+import { existsSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
@@ -254,7 +255,13 @@ export async function sandboxRequestFor(
     // 0.0.76). A grant naming a wall is not strictly outside it and wins.
     // Without it a root task's `read: ['.']` read its nested projects under
     // seatbelt (B-4).
-    baseDenyRead: process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot],
+    // The host's credential stores are denied too: the rest of home stays
+    // readable (tools need `~/.cache`), but a dependency the task runs
+    // could copy a key into an output the cache shares (L-41).
+    baseDenyRead: [
+      ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
+      ...credentialStores(workspaceRoot),
+    ],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
     // walk `bun build --compile` makes from `/` down to its cwd lists
@@ -555,6 +562,44 @@ export function untouchedPlaceholderLine(projectDir: string, placeholder: string
   )
 }
 
+/**
+ * Where tools keep credentials under the user's home. A sandboxed task
+ * reads none of them unless its `allow.read` names one (a publish task's
+ * `~/.npmrc`).
+ */
+const CREDENTIAL_STORES = [
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.config/gcloud',
+  '.config/gh',
+  '.docker/config.json',
+  '.netrc',
+  '.git-credentials',
+  '.npmrc',
+  '.yarnrc.yml',
+  '.pypirc',
+]
+
+/** The stores present on this host, learned once per home. */
+let presentStores: { home: string; paths: string[] } | undefined
+
+/** The credential stores to deny, less any that holds the workspace. */
+function credentialStores(workspaceRoot: string): string[] {
+  const home = homedir()
+  if (presentStores?.home !== home) {
+    presentStores = {
+      home,
+      paths: CREDENTIAL_STORES.map((rel) => path.join(home, rel)).filter((p) => existsSync(p)),
+    }
+  }
+  return presentStores.paths.filter(
+    (p) => workspaceRoot !== p && !workspaceRoot.startsWith(p + path.sep),
+  )
+}
+
 /** `~/x` against the user's home; anything else unchanged. */
 function expandHome(p: string): string {
   return p.startsWith('~') ? path.join(homedir(), p.slice(1)) : p

package/src/util/index.ts

@@ -55,4 +55,11 @@ export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.
 export { executablePath, shellArgv } from './which.js'
 export { procfsIsOwn } from './procfs.js'
 export { realPath } from './real-path.js'
-export { maskedCommand, maskedEmitter, MASKED, secretMask, type SecretMask } from './secret-mask.js'
+export {
+  maskedCommand,
+  maskedEmitter,
+  maskedLine,
+  MASKED,
+  secretMask,
+  type SecretMask,
+} from './secret-mask.js'

package/src/util/secret-mask.ts

@@ -124,6 +124,11 @@ export function maskedCommand(command: string, env?: TaskEnvSecrets): string {
   return secretMask([process.env, env?.define], env?.secret)?.mask(command) ?? command
 }
 
+/** A line vx prints for no one task (a plugin's warning): this process's secrets masked. */
+export function maskedLine(line: string): string {
+  return secretMask([process.env])?.mask(line) ?? line
+}
+
 /** What of a task's `exec.env` names its secrets. */
 export interface TaskEnvSecrets {
   readonly define?: Readonly<Record<string, string>>

package/src/workspace/affected.ts

@@ -123,28 +123,32 @@ export interface FingerprintClaims {
  * or `<since>` doesn't resolve to a commit.
  */
 export async function affectedProjects(args: AffectedArgs): Promise<Set<string>> {
+  // Turbo's CI spelling, `[origin/main...HEAD]`, is the base alone here:
+  // vx already diffs from the merge base (three dots' meaning), and the
+  // working tree it diffs to holds HEAD (D-117). Any other range is refused.
+  const since = /^(.+)\.\.\.HEAD$/.exec(args.since)?.[1] ?? args.since
   // The base reaches git as an argument, never through a shell, so `$(…)`
   // is opaque — but an option-like value is not: `--output=<path>` is a
   // real `git diff` option and an arbitrary file write. This is a security
   // boundary, so it is a check that knows it is one, before any spawn, and
   // every git call below also ends its options (`--end-of-options`) so a
   // second caller cannot lose the guard by accident.
-  if (args.since.length === 0 || args.since.startsWith('-')) {
+  if (since.length === 0 || since.startsWith('-')) {
     throw new UserError(
-      `git ref "${args.since}" is not a ref: a base cannot be empty or start with "-".`,
+      `git ref "${since}" is not a ref: a base cannot be empty or start with "-".`,
     )
   }
   // `A..B` / `A...B` reached `rev-parse --verify`, which refuses a range, and
   // the user read "did not resolve" about refs that both exist. `..` is
   // illegal in a ref name (git-check-ref-format), so this refuses no ref.
-  const range = args.since.indexOf('..')
+  const range = since.indexOf('..')
   if (range >= 0) {
     throw new UserError(
-      `git ref "${args.since}" is a range: ranges are not supported — pass the base alone ` +
-        `("${args.since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
+      `git ref "${since}" is a range: ranges are not supported — pass the base alone ` +
+        `("${since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
     )
   }
-  await verifyRef(args.workspaceRoot, args.since)
+  await verifyRef(args.workspaceRoot, since)
   // Diff from the MERGE BASE of `since` and HEAD, not from `since` itself:
   // on a branch whose base has moved on, `git diff <base>` reports every
   // file OTHER people changed on the base (over-selection that defeats a
@@ -152,7 +156,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   // byte-identical content. Turbo and Nx both diff from the merge base;
   // when there is none (unrelated histories, a detached probe) the ref
   // itself is the base, as before.
-  const base = await mergeBase(args.workspaceRoot, args.since)
+  const base = await mergeBase(args.workspaceRoot, since)
 
   const [diffed, untracked] = await Promise.all([
     // `--no-renames` is crucial for project-affected detection: with

package/src/workspace/config-schema.ts

@@ -777,6 +777,36 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         'a command run outside vx: a task never reads the terminal (its stdin is EOF, or a pipe vx holds under `persistent`)',
     },
   ],
+  // wireit's `files` / `output` and include-style spellings written into
+  // a cache block, refused with no word on where they go (D-118).
+  [
+    CACHE_FIELDS,
+    {
+      files: '`inputs.files`',
+      output: '`outputs.files`',
+      env: '`inputs.env`',
+      dependencies: "the task's `dependsOn` (an upstream's key folds into this one)",
+      enabled: 'no field: a task with a `cache` block caches, one without runs every time',
+    },
+  ],
+  [
+    CACHE_INPUT_FIELDS,
+    {
+      globs: '`files`',
+      include: '`files`',
+      patterns: '`files`',
+      exclude: "`files` with a `!` entry (`'!**/*.test.ts'`)",
+      ignore: "`files` with a `!` entry (`'!**/*.test.ts'`)",
+    },
+  ],
+  [
+    CACHE_OUTPUT_FIELDS,
+    {
+      globs: '`files`',
+      include: '`files`',
+      exclude: "`files` with a `!` entry (`'!dist/cache/**'`)",
+    },
+  ],
   // A package's turbo.json and Nx's project.json keys, written into a
   // project's vx.config (D-56). `tags` had read as a typo of `tasks`.
   [