@vzn/vx 0.0.50 → 0.0.51

package/src/exec/sandbox-runtime.ts

@@ -33,6 +33,7 @@ import {
   drainOrAbort,
   POST_EXIT_CUT_LINE,
   shellQuote,
+  withForwardArgs,
   signalExitCode,
   spawnFailureText,
   streamToString,
@@ -41,6 +42,7 @@ import {
   type RunResult,
 } from './runner.js'
 import {
+  BUN_GLOB_WILDCARDS,
   executablePath,
   grantPrefix,
   isTmpdirRefusal,
@@ -48,7 +50,7 @@ import {
   UserError,
   xxh3hex,
 } from '../util/index.js'
-import { buildCustomConfig } from './sandbox-binds.js'
+import { bindableWrites, buildCustomConfig } from './sandbox-binds.js'
 import {
   isMountableLiteral,
   localBindingOn,
@@ -56,7 +58,7 @@ import {
   toRealPath,
   unique,
 } from './sandbox-paths.js'
-import { parseStraceViolations, reportableViolations } from './sandbox-violations.js'
+import { parseStraceViolations, refusedWrites, reportableViolations } from './sandbox-violations.js'
 import {
   closeSignalChannel,
   killTree,
@@ -613,6 +615,8 @@ function throughLinks(p: string, hops = 0): string {
 export function resolveSandboxConfig(
   cfg: SandboxConfig,
   projectDir: string,
+  /** Canonical directories a glob's hits stop at (sandbox-request.ts `wallOff`). */
+  walls: readonly string[] = [],
 ): ResolvedSandboxConfig {
   const resolve = (p: string): string => {
     if (p.startsWith('~')) return toRealPath(path.join(os.homedir(), p.slice(1)))
@@ -621,7 +625,7 @@ export function resolveSandboxConfig(
   }
   const a = cfg.allow ?? {}
   const r: ResolvedSandboxConfig = {
-    allowRead: expandGrants((a.read ?? []).map(resolve), 'read'),
+    allowRead: expandGrants((a.read ?? []).map(resolve), 'read', walls),
     allowWrite: expandGrants(
       (a.write ?? []).map((p) => {
         const real = resolve(p)
@@ -629,6 +633,7 @@ export function resolveSandboxConfig(
         return real
       }),
       'write',
+      walls,
     ),
   }
   if (a.network !== undefined) r.network = a.network
@@ -644,10 +649,19 @@ export function resolveSandboxConfig(
     r.weakerNetworkIsolation = cfg.weakerNetworkIsolation
   }
   if (cfg.ignore !== undefined) {
-    // Relative patterns anchor at the project dir; absolute and `~` ones
-    // are taken as written. NOT realpath'd — a pattern is not a path.
-    const anchor = (pat: string): string =>
-      pat.startsWith('~') || path.isAbsolute(pat) ? pat : path.join(projectDir, pat)
+    // Relative patterns anchor at the project dir; `~` ones are taken as
+    // written. A pattern is not a path, but its literal head is: both
+    // producers record where a denial LANDS, so the head is canonicalized
+    // like every other side of the policy. Anchored at a project reached
+    // through a link (macOS's `/var`), no pattern matched and the denial it
+    // named failed the task (B-2).
+    const anchor = (pat: string): string => {
+      if (pat.startsWith('~')) return pat
+      const abs = path.isAbsolute(pat) ? pat : path.join(projectDir, pat)
+      const wild = abs.search(BUN_GLOB_WILDCARDS)
+      const head = wild === -1 ? abs : abs.slice(0, abs.lastIndexOf(path.sep, wild)) || path.sep
+      return toRealPath(head) + abs.slice(head.length)
+    }
     r.ignore = {
       ...(cfg.ignore.read ? { read: cfg.ignore.read.map(anchor) } : {}),
       ...(cfg.ignore.write ? { write: cfg.ignore.write.map(anchor) } : {}),
@@ -726,15 +740,14 @@ export async function wrapSandboxedCommand(
   wrapped: string
   tag: string
   taggedCommand: string
+  /** What SRT wrapped, and so what its store keys a record by (the group wrapper included on Linux). */
+  srtCommand: string
   baselines: CanonicalBaselines
   /** The command reads its polite signals off fd 3: spawn it with one and `signalThrough` it. */
   forwardsSignals: boolean
 }> {
   const { SandboxManager } = await loadSrt()
-  const userCommand =
-    args.forwardArgs && args.forwardArgs.length > 0
-      ? args.command + ' ' + args.forwardArgs.map(shellQuote).join(' ')
-      : args.command
+  const userCommand = withForwardArgs(args.command, args.forwardArgs)
 
   const tag = xxh3hex(`${args.cwd}|${userCommand}|${process.hrtime.bigint()}`).slice(0, 16)
   const tmp = taskTmpdir(tag)
@@ -775,7 +788,14 @@ export async function wrapSandboxedCommand(
   if (process.platform === 'linux' && wrapped.startsWith('bwrap ')) wrapped = `exec ${wrapped}`
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) spawnHostBridges(ports, tag)
-  return { wrapped, tag, taggedCommand, baselines, forwardsSignals: grouped.forwards }
+  return {
+    wrapped,
+    tag,
+    taggedCommand,
+    srtCommand: inner,
+    baselines,
+    forwardsSignals: grouped.forwards,
+  }
 }
 
 /**
@@ -962,6 +982,45 @@ export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRun
   }
 }
 
+/** The records collected for the commands running, by SRT's key for each. */
+const collecting = new Map<string, SandboxViolation[]>()
+let collectorOn = false
+
+/**
+ * Start collecting SRT's store records for `command`; the returned function
+ * stops and hands them over. The store is a 100-record ring the whole run
+ * shares, and on Linux its write observer reports every write any task
+ * makes, so a refused write followed by 150 declared ones was gone before
+ * the task's exit read it (B-7). One subscription takes each record as it
+ * arrives and keeps it only for a command still running. SRT keys a record
+ * by the base64 of the command's first 100 characters
+ * (`encodeSandboxedCommand`, not exported).
+ */
+function collectRecords(
+  store: ReturnType<SrtModule['SandboxManager']['getSandboxViolationStore']>,
+  command: string,
+): () => SandboxViolation[] {
+  if (!collectorOn) {
+    collectorOn = true
+    let seen = store.getTotalCount()
+    store.subscribe((all) => {
+      const total = store.getTotalCount()
+      const fresh = Math.min(total - seen, all.length)
+      seen = total
+      for (const v of fresh > 0 ? all.slice(-fresh) : []) {
+        collecting.get(v.encodedCommand ?? '')?.push({ line: v.line, timestamp: v.timestamp })
+      }
+    })
+  }
+  const key = Buffer.from(command.slice(0, 100)).toString('base64')
+  const list: SandboxViolation[] = []
+  collecting.set(key, list)
+  return () => {
+    collecting.delete(key)
+    return list
+  }
+}
+
 /** strace's own message, as the last line a failed traced task printed. */
 const STRACE_OWN_ERROR = /^strace: /
 
@@ -979,12 +1038,11 @@ async function runSandboxedOnce(
 ): Promise<SandboxedRunResult & { tracerFailed: boolean }> {
   const start = Date.now()
   const { SandboxManager } = await loadSrt()
-  const { wrapped, tag, taggedCommand, baselines, forwardsSignals } =
-    await wrapSandboxedCommand(args)
+  const { wrapped, tag, srtCommand, baselines, forwardsSignals } = await wrapSandboxedCommand(args)
+  const takeRecords = collectRecords(SandboxManager.getSandboxViolationStore(), srtCommand)
 
-  // Linux: SRT's SandboxViolationStore is macOS-only, so structured
-  // detection on Linux requires us to wrap the spawn with strace and
-  // parse the trace for denied syscalls. The trace is per-task (unique
+  // Linux: SRT's store sees only writes (below), so read denials need
+  // the spawn wrapped with strace and the trace parsed for denied syscalls. The trace is per-task (unique
   // log path keyed by the command tag) so parallel tasks don't share
   // a stream. Skipped when strace isn't on PATH — bwrap still enforces
   // structurally; we just lose the structured violation list.
@@ -1044,6 +1102,7 @@ async function runSandboxedOnce(
     const stderr = spawnFailureText(err, args.cwd, 'sandboxed task')
     args.onStderr?.(stderr)
     releaseBridges(tag)
+    takeRecords()
     return {
       exitCode: 127,
       durationMs: Date.now() - start,
@@ -1106,25 +1165,21 @@ async function runSandboxedOnce(
   // DROPPED by the unified log under pressure, not delayed. Reporting on
   // macOS is therefore lossy-by-OS under load; ENFORCEMENT is unaffected
   // (every observed loss still denied the read and failed the child).
-  const store = SandboxManager.getSandboxViolationStore()
-  // EVERY record the store holds for this command, unfiltered (owner,
+  // EVERY record SRT's store saw for this command, unfiltered (owner,
   // 2026-09-05). A sandboxed task that fails must say what it was denied;
   // deciding on the user's behalf that a record was "just traversal" is how
   // a failure ends up with an empty violations section and no explanation.
-  const readMacViolations = (): SandboxViolation[] =>
-    store.getViolationsForCommand(taggedCommand).map((v) => ({
-      line: v.line,
-      timestamp: v.timestamp,
-    }))
-  // Darwin only. Since SRT 0.0.75 the store is fed on Linux too, by the
-  // seccomp helper's write observer — but SRT judges those reports against
-  // the GLOBAL `filesystem.allowWrite` from `initialize` (empty here; the
-  // per-task list travels in `customConfig`, which the monitor never sees),
-  // so every write a task makes to its own declared output arrived as
-  // `deny openat <output>` and failed the task (reproduced 2026-09-04 in a
-  // Linux container: exit 1, empty stderr). Linux detection is the strace
-  // pass below, judged against the task's own baselines.
-  let macViolations = process.platform === 'darwin' ? readMacViolations() : []
+  const records = takeRecords()
+  // Read as is on darwin only. Since SRT 0.0.75 the store is fed on Linux
+  // too, by the seccomp helper's write observer — but SRT judges those
+  // reports against the GLOBAL `filesystem.allowWrite` from `initialize`
+  // (empty here; the per-task list travels in `customConfig`, which the
+  // monitor never sees), so every write a task makes to its own declared
+  // output arrived as `deny openat <output>` and, read as is, failed the
+  // task (reproduced 2026-09-04 in a Linux container: exit 1, empty
+  // stderr). On Linux the records are judged against the task's own binds
+  // below (`refusedWrites`).
+  const macViolations = process.platform === 'darwin' ? records : []
   // No settle window: the store is read once, right after the child exits
   // (owner, 2026-09-05). It cost 300ms on EVERY clean sandboxed task — the
   // full budget, since a task with nothing to report can only prove that by
@@ -1139,9 +1194,28 @@ async function runSandboxedOnce(
   // syscall on a path inside denyRead that wasn't unconditionally
   // allowed. Best-effort — if parsing fails we surface no Linux
   // violations rather than fail the whole task.
-  const linuxViolations: SandboxViolation[] = straceLog
-    ? await parseStraceViolations(straceLog, args, baselines).catch(() => [])
-    : []
+  //
+  // strace never sees a write: SRT's seccomp step hands every write-intent
+  // syscall to its observer (USER_NOTIF, which takes precedence over
+  // strace's TRACE), and the observer feeds the store with every ATTEMPT,
+  // judged against the run-wide config, which grants no write. Judged here
+  // against this task's own binds, what is left is a write bwrap refused,
+  // or one into the anchor's scratch that vanished with the sandbox: a
+  // task that swallowed it exited 0 with nothing reported (B-5).
+  const linuxViolations: SandboxViolation[] =
+    process.platform === 'linux'
+      ? [
+          ...(straceLog
+            ? await parseStraceViolations(straceLog, args, baselines).catch(() => [])
+            : []),
+          ...refusedWrites(
+            // Keyed by what SRT wrapped, the in-sandbox group wrapper
+            // included, not by the tagged command macOS is keyed by.
+            records.map((v) => v.line),
+            bindableWrites(args.config.allowWrite),
+          ),
+        ]
+      : []
   if (straceLog) {
     // Listed until the unlink lands, as the run lock's taking (item 868).
     await unlink(straceLog).catch(() => undefined)
@@ -1197,7 +1271,15 @@ async function runSandboxedOnce(
     violations,
     ...(proc.signalCode ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
-    ...resourceUsageToCpuRss(proc.resourceUsage()),
+    // Linux: the task's CPU and peak never reach this wait. bwrap runs it
+    // in a pid namespace (`--unshare-pid`), and what the namespace's
+    // processes used is not folded into bwrap's usage: a 500 ms busy loop
+    // read 2 ms under it and 510 without the flag, and the peak read was
+    // vx's own high-water mark, inherited at exec (a sandboxed `true` from a
+    // 300 MB vx: 353 MB; B-3). Nothing is reported rather than a number
+    // that is someone else's. macOS's `sandbox-exec` execs the command, so
+    // its usage is the task's.
+    ...(process.platform === 'linux' ? {} : resourceUsageToCpuRss(proc.resourceUsage())),
     tracerFailed:
       straceLog !== undefined &&
       exitCode !== 0 &&
@@ -1239,7 +1321,7 @@ function sbplToken(value: string, field: string): string {
  * `systemInfo` has no SRT field at any level. The rest DO have fields,
  * but SRT reads `network.allowLocalBinding` / `allowUnixSockets` /
  * `allowMachLookup` off the config given to `initialize()` and never off
- * the per-call one (`sandbox-manager.js` getters, 0.0.75) — so a per-task
+ * the per-call one (`sandbox-manager.js` getters, 0.0.75 and 0.0.76) — so a per-task
  * grant passed there is silently dropped. vx is per-task by definition,
  * so it emits them itself. The rule text mirrors SRT's own.
  */
@@ -1391,7 +1473,11 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  * NOT `isLiteralPattern`: its docblock says why the brace is not a wildcard
  * to a grant.
  */
-function expandGrants(paths: readonly string[], kind: 'read' | 'write'): string[] {
+function expandGrants(
+  paths: readonly string[],
+  kind: 'read' | 'write',
+  walls: readonly string[],
+): string[] {
   // A pattern covering a directory WHOLE is that directory. `<d>/**/*` and
   // `<d>/**` match everything UNDER `<d>` and never `<d>` itself, so a task
   // granted `read: ['**/*']` still could not list its own cwd — the exact
@@ -1421,10 +1507,15 @@ function expandGrants(paths: readonly string[], kind: 'read' | 'write'): string[
     const head = p.slice(0, p.search(MOUNT_WILDCARDS))
     const home = toRealPath(head.endsWith('/') ? head.slice(0, -1) : path.dirname(head))
     let hits = 0
-    for (const hit of new Bun.Glob(pattern).scanSync({ cwd: base, onlyFiles: false, dot: true })) {
+    for (const hit of scanOrNothing(pattern, base)) {
       const abs = path.join(base, hit)
       const real = toRealPath(abs)
       if (real !== home && !real.startsWith(home + path.sep)) continue
+      // A hit that IS a wall, or lies inside one, was matched, not named:
+      // `read: ['*']` in a root project bound `.git` and `.vx`, and
+      // `packages/*` a nested project its key excludes (B-1). A grant that
+      // names a wall literally never reaches this loop and stays.
+      if (walls.some((w) => real === w || real.startsWith(w + path.sep))) continue
       out.push(abs)
       hits++
     }
@@ -1433,6 +1524,24 @@ function expandGrants(paths: readonly string[], kind: 'read' | 'write'): string[
   return out
 }
 
+/**
+ * A glob's hits under `base`, or none when `base` does not exist yet:
+ * `Bun.Glob` throws ENOENT there, and a cache not yet populated on a fresh
+ * runner (`~/.cache/x/y/*`) failed its task with the raw errno and no word
+ * of the grant (B-6). A missing base matches nothing, as an empty one does.
+ */
+function scanOrNothing(pattern: string, base: string): Iterable<string> {
+  const glob = new Bun.Glob(pattern)
+  try {
+    // Materialised here: the throw comes from the first step, not the call.
+    return [...glob.scanSync({ cwd: base, onlyFiles: false, dot: true })]
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code
+    if (code === 'ENOENT' || code === 'ENOTDIR') return []
+    throw err
+  }
+}
+
 /** Grants already reported — once per process, not per spawn. */
 const warnedEmptyWriteGrant = new Set<string>()
 

package/src/exec/sandbox-violations.ts

@@ -273,16 +273,12 @@ function withinReported(
 }
 
 /**
- * Apply the task's user-provided `sandbox.ignore` grants on top
- * of whatever the macOS log monitor + Linux strace pass produced.
- * Mirrors SRT's own substring-match semantics:
- *   - `'*'` entries match every command
- *   - other keys match commands whose userCommand string CONTAINS the key
- *   - the array of strings under each key is substring-matched against
- *     the violation line
- *
- * The defaults installed in `initSandbox` already filter on the macOS
- * side; this pass catches per-task additions + Linux strace results.
+ * Apply the task's own `sandbox.ignore` lists on top of whatever the
+ * macOS log monitor and the Linux strace pass produced: a record is
+ * dropped when a list its operation names (`matchesIgnore`) holds a
+ * pattern equal to its target or matching it as a glob. Not SRT's
+ * per-command substring match, which is what the defaults installed in
+ * `initSandbox` use on the macOS side.
  */
 function filterIgnored(
   violations: SandboxViolation[],
@@ -291,3 +287,39 @@ function filterIgnored(
   if (ignore === undefined) return violations
   return violations.filter((v) => !matchesIgnore(v, ignore))
 }
+
+/**
+ * The writes SRT's Linux observer saw that this task's binds do not cover.
+ * The observer reports every write-intent syscall as `deny <syscall>
+ * <path>` (it cannot see the mount table), so a record under a path bwrap
+ * binds writable — `bindableWrites` of the task's grants — was a write
+ * that landed, and anything else was refused or fell into the deny
+ * anchor's scratch and vanished with the sandbox. Deduplicated by syscall
+ * and canonical path; only a `write` ignore list can silence one.
+ */
+export function refusedWrites(
+  records: readonly string[],
+  writable: readonly string[],
+): SandboxViolation[] {
+  const binds = new Set(writable.map((w) => toRealPath(absolutize(w))))
+  const seen = new Set<string>()
+  const out: SandboxViolation[] = []
+  for (const record of records) {
+    const m = /^deny (\S+) (\/.*)$/.exec(record)
+    if (m === null) continue
+    const [, syscall, raw] = m as unknown as [string, string, string]
+    const abs = toRealPath(raw)
+    if (isUnderAny(abs, binds)) continue
+    const key = `${syscall}|${abs}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push({
+      line: `${syscall}(${raw}) = a write no grant covers  [${abs}]`,
+      timestamp: new Date(),
+      target: abs,
+      path: abs,
+      ignorable: ['write'],
+    })
+  }
+  return out
+}

package/src/graph/scheduler.ts

@@ -389,9 +389,15 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // the exec cap: on the 1,000-project bench with every task a restore,
   // 4 → 8 workers cut the run-graph stage 683–754 → 556–595 ms and 16 was
   // no better (2026-09-10). Exec-tier work keeps the CPU-shaped cap; the
-  // two lanes never wait on each other. `--concurrency 1` stays serial.
+  // two lanes never wait on each other. `--concurrency 1` stays serial:
+  // the two lanes share its one slot, where a lane each let an 80 MB
+  // restore run inside another task's execution (item 1103).
   let activeRestore = 0
-  const restoreConcurrency = concurrency === 1 ? 1 : 2 * concurrency
+  const restoreConcurrency = 2 * concurrency
+  const serial = concurrency === 1
+  const execRoom = (): boolean => (serial ? active + activeRestore < 1 : active < concurrency)
+  const restoreRoom = (): boolean =>
+    serial ? active + activeRestore < 1 : activeRestore < restoreConcurrency
   let resolved = false
 
   // Admission policy over the count limit (a plugin's `admit`). Inactive
@@ -416,7 +422,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   const hasRoom = (id: string): boolean => {
     const pool = poolOf?.(id)
     if (pool === undefined) {
-      return inRestoreTier(id) ? activeRestore < restoreConcurrency : active < concurrency
+      return inRestoreTier(id) ? restoreRoom() : execRoom()
     }
     return (poolActive.get(pool.name) ?? 0) < pool.capacity
   }
@@ -579,7 +585,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
         // 6,000-task scale pin went 0.5 s → 28 s when the restore lane's
         // first cut let the scan run past a full exec lane, 2026-09-10).
         // This is the legacy O(1) gate, kept per lane.
-        const execAdmissible = poolOf !== undefined || admitActive || active < concurrency
+        const execAdmissible = poolOf !== undefined || admitActive || execRoom()
         if (execAdmissible) {
           while (execReady.size > 0) {
             const seq = execReady.peekSeq()
@@ -594,7 +600,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           }
         }
         // Restore-tier tasks are local disk work, on their own lane.
-        return activeRestore < restoreConcurrency ? restoreReady.pop() : undefined
+        return restoreRoom() ? restoreReady.pop() : undefined
       }
 
       for (;;) {

package/src/graph/task-graph.ts

@@ -1,3 +1,4 @@
+import path from 'node:path'
 import type { ProjectConfig, TaskConfig } from '../config.js'
 import {
   asTrees,
@@ -258,6 +259,13 @@ export interface BuildGraphOptions {
    * workspace and the builder refuses it itself.
    */
   undeclaredDeps?: (taskId: string, name: string) => void
+  /**
+   * The workspace root, where `cache.outputs.workspaceFiles` is anchored.
+   * Given, a root-anchored output is also compared with every project's
+   * `files` outputs (item 1088); absent (a graph built for a unit row), only
+   * with other root-anchored ones.
+   */
+  workspaceRoot?: string
 }
 
 /**
@@ -505,7 +513,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     }
   }
 
-  checkGraph(nodes)
+  checkGraph(nodes, options.workspaceRoot)
   return nodes
 }
 
@@ -520,7 +528,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
  * marks are derived here, so they are cleared first and follow the edges
  * the graph has now.
  */
-export function checkGraph(nodes: Map<string, TaskNode>): void {
+export function checkGraph(nodes: Map<string, TaskNode>, workspaceRoot?: string): void {
   for (const [key, node] of nodes) {
     if (node.id !== key) {
       throw new Error(`the task ${node.id} is stored under '${key}', not its own id`)
@@ -534,7 +542,7 @@ export function checkGraph(nodes: Map<string, TaskNode>): void {
     delete node.outputsAddedToBy
   }
   detectCycle(nodes)
-  detectOutputCollisions(nodes)
+  detectOutputCollisions(nodes, workspaceRoot)
 }
 
 /**
@@ -718,7 +726,7 @@ function covers(tree: string, glob: string): boolean {
  * project boundaries by design, so ANY two tasks can. No cache key changes —
  * this only refuses a graph that was already destroying files.
  */
-function detectOutputCollisions(nodes: Map<string, TaskNode>): void {
+function detectOutputCollisions(nodes: Map<string, TaskNode>, workspaceRoot?: string): void {
   // Does `from` reach `to` through deps? Asked only for a colliding pair,
   // so the walk is rare; memoised per source across the detector's calls.
   const reachMemo = new Map<string, Set<string>>()
@@ -778,11 +786,87 @@ function detectOutputCollisions(nodes: Map<string, TaskNode>): void {
       collide(a, b, filesOf(a), filesOf(b), 'files', reaches)
     }
   }
-  if (wsDeclarers.length < 2) return
-  for (const [i, j] of overlapCandidates(wsDeclarers, wsFilesOf)) {
-    const a = wsDeclarers[i]!
-    const b = wsDeclarers[j]!
-    collide(a, b, wsFilesOf(a), wsFilesOf(b), 'workspaceFiles', reaches)
+  if (wsDeclarers.length >= 2) {
+    for (const [i, j] of overlapCandidates(wsDeclarers, wsFilesOf)) {
+      const a = wsDeclarers[i]!
+      const b = wsDeclarers[j]!
+      collide(a, b, wsFilesOf(a), wsFilesOf(b), 'workspaceFiles', reaches)
+    }
+  }
+  // A root-anchored output that reaches into ANOTHER project's `files`
+  // outputs was compared with neither: `a` writing `packages/b/dist/a.txt`
+  // beside `b`'s `dist/**` had its file deleted by `b`'s clean and still
+  // replayed `up-to-date` (item 1088). Each `files` declarer joins the
+  // root-anchored domain with its globs rebased to the root, and only the
+  // mixed pairs are compared.
+  if (wsDeclarers.length === 0 || workspaceRoot === undefined) return
+  interface Entry {
+    node: TaskNode
+    globs: readonly string[]
+    /** The project's root-relative dir for a rebased `files` entry; undefined for a root-anchored one. */
+    rel?: string
+  }
+  const entries: Entry[] = wsDeclarers.map((node) => ({ node, globs: wsFilesOf(node) ?? [] }))
+  for (const bucket of byProject.values()) {
+    for (const node of bucket) {
+      const rel = path.relative(workspaceRoot, node.projectDir).split(path.sep).join('/')
+      const globs = (filesOf(node) ?? []).map((g) => (rel === '' ? g : `${rel}/${g}`))
+      entries.push({ node, globs, rel })
+    }
+  }
+  for (const [i, j] of overlapCandidates(entries, (e) => e.globs)) {
+    const x = entries[i]!
+    const y = entries[j]!
+    if ((x.rel === undefined) === (y.rel === undefined) || x.node === y.node) continue
+    const [ws, files] = x.rel === undefined ? [x, y] : [y, x]
+    collideAcross(ws.node, ws.globs, files.node, files.globs, files.rel!, reaches)
+  }
+}
+
+/**
+ * `collide` for a root-anchored output against another project's `files`
+ * output rebased to the root. With an edge the dependant adds to its
+ * upstream's tree, and the upstream is told the dependant's globs in its
+ * OWN namespace: root-relative for the root-anchored side, project-relative
+ * for the `files` side, where a glob that does not start in that project
+ * cannot be told apart and the pair is refused.
+ */
+function collideAcross(
+  ws: TaskNode,
+  wsGlobs: readonly string[],
+  files: TaskNode,
+  rebased: readonly string[],
+  rel: string,
+  reaches: (from: string, to: string) => boolean,
+): void {
+  if (neverWritesLocally(ws) || neverWritesLocally(files)) return
+  for (const ga of wsGlobs) {
+    for (const gb of rebased) {
+      if (!outputsOverlap(ga, gb)) continue
+      if (reaches(files.id, ws.id)) {
+        ;(files.addsToOutputsOf ??= []).push(ws.id)
+        ;(ws.outputsAddedToBy ??= []).push(...rebased)
+        return
+      }
+      if (reaches(ws.id, files.id)) {
+        const own = wsGlobs.map((g) =>
+          rel === '' ? g : g.startsWith(`${rel}/`) ? g.slice(rel.length + 1) : null,
+        )
+        if (own.every((g): g is string => g !== null)) {
+          ;(ws.addsToOutputsOf ??= []).push(files.id)
+          ;(files.outputsAddedToBy ??= []).push(...own)
+          return
+        }
+      }
+      throw new UserError(
+        `${ws.id} declares the output ${JSON.stringify(ga)} in cache.outputs.workspaceFiles, ` +
+          `inside ${files.id}'s ${JSON.stringify(gb.slice(rel === '' ? 0 : rel.length + 1))} in ` +
+          `cache.outputs.files — vx cleans a task's declared outputs before it runs and before a ` +
+          `cache-hit restore, so whichever of these runs second DELETES the other's output and ` +
+          `the run still reports success. Give each task its own output path, or make one ` +
+          `depend on the other.`,
+      )
+    }
   }
 }
 
@@ -815,9 +899,9 @@ const GLOB_HEAD_END = /[*?{}\\!]/
  * literal prefix lies at or under it, found the same way from the glob's
  * side (item 941).
  */
-function overlapCandidates(
-  tasks: readonly TaskNode[],
-  globsOf: (n: TaskNode) => readonly string[] | undefined,
+function overlapCandidates<T>(
+  tasks: readonly T[],
+  globsOf: (n: T) => readonly string[] | undefined,
 ): Array<[number, number]> {
   const globs = new Map<string, number[]>()
   const globsUnder = new Map<string, number[]>()