@vzn/vx 0.0.553 → 0.0.555

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.553",
+  "version": "0.0.555",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.553",
-    "@vzn/vx-linux-arm64": "0.0.553",
-    "@vzn/vx-darwin-x64": "0.0.553",
-    "@vzn/vx-darwin-arm64": "0.0.553"
+    "@vzn/vx-linux-x64": "0.0.555",
+    "@vzn/vx-linux-arm64": "0.0.555",
+    "@vzn/vx-darwin-x64": "0.0.555",
+    "@vzn/vx-darwin-arm64": "0.0.555"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/layer.ts

@@ -329,7 +329,8 @@ export interface PruneResult {
  * the full `workspace-outputs/<rel-to-root>` tar entry name as the
  * discriminator — least-invasive row format, no schema change. A
  * project output dir literally named `workspace-outputs/` would
- * collide with the namespace; the name is reserved.
+ * collide with the namespace; the name is reserved, and a project
+ * output glob under it is refused at load (config-schema.ts).
  */
 export const WORKSPACE_OUTPUT_PREFIX = 'workspace-outputs/'
 

package/src/workspace/config-schema.ts

@@ -24,6 +24,9 @@ import {
   UserError,
   BUN_GLOB_WILDCARDS,
   EXTGLOB,
+  anyTaskGlob,
+  asTrees,
+  isLiteralPattern,
 } from '../util/index.js'
 import { nonJsonMessage, nonJsonPaths } from './json-data.js'
 
@@ -650,6 +653,15 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `name the directory the task writes, such as "dist/**"`,
           )
         }
+        // An artifact stores workspace outputs under `workspace-outputs/`,
+        // and its index read a project output there as one: every hit was
+        // a "corrupt artifact", dropped and run again.
+        if (!g.startsWith('!') && normalizeGlob(g).split('/')[0] === 'workspace-outputs') {
+          throw new UserError(
+            `${where}.cache.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
+              `artifacts reserve for outputs.workspaceFiles — write the task's files to another directory`,
+          )
+        }
         // A `!` entry takes a path back from the outputs (A-44): it is not
         // cleaned, saved or restored, and it stays an input.
         assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
@@ -713,6 +725,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
       // error for the same reason. Refusing costs nothing: such a config was
       // already silently broken, so no working key changes.
       assertNotNegationOnly((inputs as { files: string[] }).files, `${where}.cache.inputs.files`)
+      assertNoLiteralTakenBack((inputs as { files: string[] }).files, `${where}.cache.inputs.files`)
       // The only CacheInputs field that reached the run unvalidated: a
       // non-string entry crashes deep in `filterUpstreamHashes` /
       // `parseDependencySpec` with a raw TypeError naming neither the task
@@ -1329,6 +1342,28 @@ function assertNotNegationOnly(globs: readonly string[], where: string): void {
   )
 }
 
+/**
+ * A `!` entry subtracts wherever it sits in the list, so a file named
+ * outright after it (`['src/**', '!src/gen/**', 'src/gen/keep.ts']`) never
+ * entered the key, and an edit to it replayed the old output. Refusing is
+ * free: the literal already selected nothing.
+ */
+function assertNoLiteralTakenBack(globs: readonly string[], where: string): void {
+  const negative = globs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
+  if (negative.length === 0) return
+  const taken = anyTaskGlob(asTrees(negative))
+  for (const g of globs) {
+    if (g.startsWith('!')) continue
+    const lit = normalizeGlob(g).replace(/\/+$/, '')
+    if (!isLiteralPattern(lit) || !taken(lit)) continue
+    const by = negative.find((n) => anyTaskGlob(asTrees([n]))(lit))
+    throw new UserError(
+      `${where}: "${g}" is taken back by "!${by}" — a \`!\` entry subtracts wherever it sits in ` +
+        `the list, so the file never enters the key. Narrow the negation so it leaves "${g}".`,
+    )
+  }
+}
+
 /**
  * `negation: false` for OUTPUT globs: a `!` entry takes a path back (A-44),
  * and a list of only negations selects nothing and is refused.
@@ -1361,8 +1396,10 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
     }
     assertNotDoubleNegated(g, where)
   }
-  if (negation) assertNotNegationOnly(v as string[], where)
-  else assertOutputsNotNegationOnly(v as string[], where)
+  if (negation) {
+    assertNotNegationOnly(v as string[], where)
+    assertNoLiteralTakenBack(v as string[], where)
+  } else assertOutputsNotNegationOnly(v as string[], where)
 }
 
 /**