@vzn/vx 0.0.590 → 0.0.594

package/src/orchestrator/miss-save.ts

@@ -17,7 +17,14 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { TaskNode } from '../graph/index.js'
-import { asTrees, span, staticPrefix, taskGlob, wholeSubtreePrefixes } from '../util/index.js'
+import {
+  asTrees,
+  relPosix,
+  span,
+  staticPrefix,
+  taskGlob,
+  wholeSubtreePrefixes,
+} from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { TaskInputComponent } from './task-hash.js'
 
@@ -272,7 +279,7 @@ function markWritten(
   if (outputFiles.length > 0) {
     a.gitFilesCache?.markOutputsChanged(
       projectDir,
-      outputFiles.map((p) => path.relative(projectDir, p).split(path.sep).join('/')),
+      outputFiles.map((p) => relPosix(projectDir, p)),
     )
   }
   // Declared workspace outputs may have landed inside OTHER projects' dirs
@@ -281,7 +288,7 @@ function markWritten(
   if (wsOutputFiles.length > 0) {
     a.gitFilesCache?.markWorkspaceOutputsChanged(
       a.workspaceRoot,
-      wsOutputFiles.map((f) => path.relative(a.workspaceRoot, f).split(path.sep).join('/')),
+      wsOutputFiles.map((f) => relPosix(a.workspaceRoot, f)),
     )
   }
   // The workspace-wide partition (when one exists) spans this project's

package/src/orchestrator/placement.ts

@@ -281,13 +281,27 @@ export function hasPooledExecutor(executors: readonly TaskExecutor[]): boolean {
   return executors.some((e) => e.capacity !== undefined)
 }
 
+/**
+ * Each pooled executor's pool, under a name no other executor's pool
+ * shares: the scheduler counts a pool by its name, and one package declared
+ * twice (`@vzn/vx-reapi` against two clusters) names both executors alike,
+ * so their two capacities were one. A repeat takes `#2`, `#3` in placement
+ * order.
+ */
 export function poolOfPlacement(
   placements: Placements,
 ): (id: string) => { name: string; capacity: number } | undefined {
+  const pools = new Map<TaskExecutor, { name: string; capacity: number }>()
+  const taken = new Set<string>()
+  for (const executor of placements.executors.values()) {
+    if (executor.capacity === undefined || pools.has(executor)) continue
+    let name = executor.name
+    for (let n = 2; taken.has(name); n++) name = `${executor.name}#${n}`
+    taken.add(name)
+    pools.set(executor, { name, capacity: executor.capacity })
+  }
   return (id) => {
     const executor = placements.executors.get(id)
-    return executor?.capacity === undefined
-      ? undefined
-      : { name: executor.name, capacity: executor.capacity }
+    return executor === undefined ? undefined : pools.get(executor)
   }
 }

package/src/orchestrator/plugin-host.ts

@@ -7,6 +7,7 @@
 //
 // See docs/design/pipeline-2026-09.md.
 
+import path from 'node:path'
 import { ChainedCache, type CacheLayer } from '../cache/index.js'
 import { localExecutor, type TaskExecutor } from '../exec/index.js'
 import { settleWithin, teardownTimeoutMs, UserError } from '../util/index.js'
@@ -207,6 +208,21 @@ function checkNodeShapes(nodes: Map<string, TaskNode>): void {
     if (!Array.isArray(deps)) {
       throw new Error(`${key}'s deps is ${what(deps)}, not an array of task ids`)
     }
+    // A node a hook adds is read as it wrote it: one with no `projectDir`
+    // ran as `internal error in a#x: TypeError: The "path" property must
+    // be of type string`, and a relative one keyed and ran against
+    // whatever directory vx was started in.
+    const fields = node as { projectName?: unknown; taskName?: unknown; projectDir?: unknown }
+    const shown = (v: unknown): string => (typeof v === 'string' ? JSON.stringify(v) : what(v))
+    for (const field of ['projectName', 'taskName'] as const) {
+      if (typeof fields[field] !== 'string' || fields[field] === '') {
+        throw new Error(`${key}'s ${field} is ${shown(fields[field])}, not a name`)
+      }
+    }
+    const dir = fields.projectDir
+    if (typeof dir !== 'string' || !path.isAbsolute(dir)) {
+      throw new Error(`${key}'s projectDir is ${shown(dir)}, not an absolute path`)
+    }
   }
 }
 

package/src/orchestrator/plugin.ts

@@ -227,7 +227,14 @@ interface BaseContext {
   warn(message: string): void
 }
 
-export interface PluginSetupContext extends BaseContext {}
+/** What `setup` receives: the run's lifecycle, observe-only. */
+export interface PluginSetupContext extends BaseContext {
+  /**
+   * Subscribe a lifecycle handler; it leaves with the run. A throw or a
+   * rejection warns once and switches the plugin's handlers off for the run.
+   */
+  on<K extends PluginHookName>(hook: K, handler: PluginHookHandlers[K]): void
+}
 
 /** One CLI verb contributed by a plugin. */
 export interface PluginCommand {
@@ -357,23 +364,12 @@ export interface ExecutorContext extends BaseContext {
   readonly concurrency: number
 }
 
-export interface PluginContext {
-  /** Where the workspace lives on disk. */
-  readonly workspaceRoot: string
-  /** Where vx's cache lives — read-only as far as the plugin is concerned. */
-  readonly cacheDir: string
-  /** Funnel warnings into the run:status channel, as every hook's context does. */
-  warn(message: string): void
+export interface PluginContext extends PluginSetupContext {
   /**
    * The run event bus. A plugin can subscribe directly if its needs exceed
    * the hooks; the subscription ends with the run, as a hook's does.
    */
   readonly bus: EventBus
-  /**
-   * Convenience: register a typed handler keyed off `RunEvent.kind`.
-   * Multiple hooks can chain via repeated calls.
-   */
-  on<K extends PluginHookName>(hook: K, handler: PluginHookHandlers[K]): void
 }
 
 export type PluginHookName =

package/src/orchestrator/projects.ts

@@ -43,16 +43,25 @@ export async function loadWorkspacePlugins(
   workspaceRoot: string,
   warn: (message: string) => void,
 ): Promise<{ workspaceConfig: WorkspaceConfig | null; plugins: readonly VxPlugin[] }> {
-  const workspaceConfig = await loadWorkspaceConfig(workspaceRoot)
-  const plugins = (workspaceConfig?.plugins ?? []) as readonly VxPlugin[]
-  if (workspaceConfig !== null && hasHook(plugins, 'config')) {
-    // Re-validated after each plugin, as the `project` stage is: an edit
-    // the loader would refuse from a user (`concurrency: -3`) hung the run,
-    // and `cacheDir: 42` reached `path.resolve` as a TypeError.
-    await applyConfigHooks(plugins, workspaceConfig, { workspaceRoot, warn }, (plugin) =>
-      validateWorkspace(workspaceConfig, `vx.workspace (after plugin '${plugin.name}')`),
-    )
+  const loaded = await loadWorkspaceConfig(workspaceRoot)
+  const plugins = (loaded?.plugins ?? []) as readonly VxPlugin[]
+  if (loaded === null || !hasHook(plugins, 'config')) return { workspaceConfig: loaded, plugins }
+  // Bun keeps one module per specifier, so the file's export is one object
+  // per process: the CLI's selection pass, the run and each `vx watch`
+  // cycle handed the hooks what the last load's hooks had edited
+  // (`concurrency *= 2` doubled per load). The hooks edit a copy; the file
+  // holds data and plugins, and validation refused anything else.
+  const { plugins: list, ...data } = loaded
+  const workspaceConfig: WorkspaceConfig = {
+    ...structuredClone(data),
+    ...(list !== undefined ? { plugins: [...list] } : {}),
   }
+  // Re-validated after each plugin, as the `project` stage is: an edit
+  // the loader would refuse from a user (`concurrency: -3`) hung the run,
+  // and `cacheDir: 42` reached `path.resolve` as a TypeError.
+  await applyConfigHooks(plugins, workspaceConfig, { workspaceRoot, warn }, (plugin) =>
+    validateWorkspace(workspaceConfig, `vx.workspace (after plugin '${plugin.name}')`),
+  )
   return { workspaceConfig, plugins }
 }
 

package/src/orchestrator/run-context.ts

@@ -13,7 +13,7 @@
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { executablePath, ulid, xxh3hex } from '../util/index.js'
+import { executablePath, relPosix, ulid, xxh3hex } from '../util/index.js'
 
 export interface GitContext {
   /** `git rev-parse HEAD`, or null outside a repo / on failure. */
@@ -410,7 +410,7 @@ function workTreePath(root: string): string | undefined {
   const abs = path.resolve(root)
   for (let dir = abs; ;) {
     if (fs.existsSync(path.join(dir, '.git'))) {
-      return path.relative(dir, abs).split(path.sep).join('/') || '.'
+      return relPosix(dir, abs) || '.'
     }
     const up = path.dirname(dir)
     if (up === dir) return undefined

package/src/orchestrator/run-lock.ts

@@ -41,8 +41,8 @@
 // A holder's pid can come back: the temp directory outlives a container
 // restart, and the restarted container's vx got the dead run's pid (1) and
 // waited for itself forever (nx#36473 reproduced on vx, 2026-09-24). So a
-// lock naming OUR pid is stale — a run of this process would be in
-// `heldHere` — and on Linux the entry also carries the holder's start
+// lock naming OUR pid is stale unless this process placed that entry and
+// has not left it (`placed`) — and on Linux the entry also carries the holder's start
 // time, so a pid another process now wears is stale too. Where the lock
 // cannot be made or read for any reason but "held" (a temp directory this
 // user cannot write), the run says so once and proceeds unlocked: the
@@ -71,6 +71,12 @@ import { isTmpdirRefusal, procfsIsOwn, TMPDIR_HINT, xxh3hex } from '../util/inde
 const heldHere = new Map<string, number>()
 /** The entry this process's taking of each held lock wrote. */
 const takers = new Map<string, string>()
+/**
+ * Every entry this process has placed and not yet left, listed before its
+ * rename: a concurrent taking here reads it before `heldHere` names it, and
+ * must wait for it, not reclaim it as a dead run of this pid.
+ */
+const placed = new Set<string>()
 
 /**
  * A signal exit is `process.exit` (signals.ts): no finally runs and nothing
@@ -248,7 +254,7 @@ function nextEntry(): string {
  * procfs once per holder, not once per poll.
  */
 function holderLive(h: Holder, sameAsLast: boolean): boolean {
-  if (h.pid === process.pid) return false
+  if (h.pid === process.pid) return placed.has(h.entry)
   if (!alive(h.pid)) return false
   if (h.start === null || sameAsLast) return true
   const now = startTime(h.pid)
@@ -278,11 +284,13 @@ async function place(lockDir: string): Promise<string | null> {
   // directory a killed pid 1 left, and refuse every run after it.
   const staging = `${lockDir}.${entry}.${Math.random().toString(36).slice(2)}`
   await mkdir(staging)
+  placed.add(entry)
   try {
     await writeFile(path.join(staging, entry), '')
     await rename(staging, lockDir)
     return entry
   } catch (err) {
+    placed.delete(entry)
     await rm(staging, { recursive: true, force: true })
     const code = (err as NodeJS.ErrnoException).code
     if (code === 'ENOTEMPTY' || code === 'EEXIST') return null
@@ -327,6 +335,8 @@ export async function acquireRunLock(
     }
     heldHere.delete(lockDir)
     const taker = takers.get(lockDir)
+    // Leaving: a taking here from now on may reclaim it, as before its unlink.
+    if (taker !== undefined) placed.delete(taker)
     // The unlink of this taking's own entry is the proof no later run
     // reclaimed the lock: had one, the entry is gone and nothing else is
     // touched. A run that joined another's taking in this process leaves
@@ -388,6 +398,6 @@ export async function acquireRunLock(
         opts.log(`[vx] waiting for another vx run (pid ${h.pid}) on this workspace to finish…`)
       }
     }
-    await new Promise((r) => setTimeout(r, POLL_MS))
+    await Bun.sleep(POLL_MS)
   }
 }

package/src/orchestrator/run.ts

@@ -4,6 +4,7 @@
 
 import type { ProjectEntry } from '../workspace/index.js'
 import { loadWorkspace, unreachedHint, unreachedPackages } from '../workspace/index.js'
+import { realpathSync } from 'node:fs'
 import path from 'node:path'
 import { Cache, type CacheLayer, type CachePolicy, stopRuntimeProbes } from '../cache/index.js'
 import { VERSION } from '../version.js'
@@ -18,6 +19,7 @@ import { resolveDownloadModes } from './download-policy.js'
 import type { TaskExecutor } from '../exec/index.js'
 import {
   deadServerBehind,
+  declaredTask,
   isGroupTask,
   markSurfacedDeps,
   runGraph,
@@ -366,8 +368,10 @@ async function runOnBus(
   // its tasks escape the schedule, the concurrency budget and this task's
   // cache key. The markers `taskEnv` sets on every child (exec/env.ts)
   // name the task; the check is on the root so both shapes are caught.
+  // Compared canonical: a root reached through a symlink (`run({ cwd })`,
+  // macOS's /var/folders) and the inner vx's realpath'd cwd are one tree.
   const outerRoot = process.env[VX_RUN_WORKSPACE_ENV]
-  if (outerRoot !== undefined && path.resolve(outerRoot) === path.resolve(prepared.workspaceRoot)) {
+  if (outerRoot !== undefined && canonical(outerRoot) === canonical(prepared.workspaceRoot)) {
     await teardown()
     prepared.cache.close()
     throw new UserError(
@@ -395,7 +399,8 @@ async function runOnBus(
     const reachedNone =
       options.affected !== undefined &&
       [...prepared.projects.values()].some(
-        (p) => inScope.has(p.name) && options.tasks.some((t) => p.config.tasks?.[t] !== undefined),
+        (p) =>
+          inScope.has(p.name) && options.tasks.some((t) => declaredTask(p.config, t) !== undefined),
       )
     log.status(
       reachedNone
@@ -427,7 +432,7 @@ async function runOnBus(
   let telemetry: TelemetryHandle | undefined
   try {
     disposePlugins = await installPlugins({
-      plugins: prepared.plugins as never,
+      plugins: prepared.plugins,
       bus,
       workspaceRoot: prepared.workspaceRoot,
       cacheDir: prepared.cacheDir,
@@ -930,6 +935,9 @@ async function runOnBus(
     const explainMiss =
       telemetry === undefined ? undefined : createMissExplainer(prepared.localCache.dbHandle())
     const lateProbes = probesAfterWrites(nodes, workspaceRoot)
+    // The scheduler's fail-fast stop, as the retry loop of a task already
+    // in flight sees it.
+    const failFast = new AbortController()
     const buildExecuteArgs = (node: TaskNode, upstream: TaskOutcome[], reuseProbe = true) => {
       const probe = reuseProbe ? shortCircuit.preProbed.get(node.id) : undefined
       const upfrontKey = shortCircuit.uncachedKeys.get(node.id)
@@ -977,6 +985,7 @@ async function runOnBus(
         deferSave: saveLane.defer,
         deferredSaves,
         stopSignal: stopRun.signal,
+        failFast: failFast.signal,
       }
     }
 
@@ -1025,6 +1034,7 @@ async function runOnBus(
       ...(holders.size > 0 ? { exclusive: holders } : {}),
       ...(options.continueMode !== undefined ? { continueMode: options.continueMode } : {}),
       serverDied,
+      onFailFast: () => failFast.abort(),
       signal: stopRun.signal,
       onStart: (node) => {
         log.taskStart?.(node)
@@ -1371,9 +1381,20 @@ async function runOnBus(
       }
     }
     if (keepAlive.children.length > 0) {
-      const first = await Promise.race(
-        keepAlive.children.map((c, i) => c.exited.then((code) => ({ code, i }))),
-      )
+      // A server kept only as a dependency that exits 0 is a daemon that
+      // forked and returned (schema.md), not the end of the session: a
+      // `db: 'docker compose up -d'` under `app#dev` stopped the dev server
+      // right after the summary (WD-3). It ends the wait only as the last.
+      const first = await new Promise<{ code: number; i: number }>((resolve) => {
+        let left = keepAlive.children.length
+        keepAlive.children.forEach((c, i) => {
+          void c.exited.then((code) => {
+            left--
+            const n = keepAlive.nodes[i]!
+            if (code !== 0 || n.requested || n.surfaced === true || left === 0) resolve({ code, i })
+          })
+        })
+      })
       const node = keepAlive.nodes[first.i]!
       const others = keepAlive.nodes.length - 1
       // Not when the run was stopped: the server ended because the user
@@ -1387,7 +1408,11 @@ async function runOnBus(
               : ''),
         )
       }
-      await terminateChildren(() => keepAlive.children)
+      // Under a stop the abort is already taking them down with the stop's
+      // signal; a second SIGTERM in its grace cut short the graceful
+      // shutdown of a server that reads it as "quit now" (WD-16).
+      if (stopRun.signal.aborted) await aborting?.catch(() => {})
+      else await terminateChildren(() => keepAlive.children)
       // The server that ended the session on its own, not cleanly, failed:
       // the rewritten summary said `ok: false` over every task `success`
       // and `failed: 0`, and so did the outcomes `--report` renders (C-53).
@@ -1652,7 +1677,7 @@ export function nxProjectTarget(
   if (colon <= 0 || spec.includes('#')) return undefined
   const [typed, task] = [spec.slice(0, colon), spec.slice(colon + 1)]
   const project = projectNamed(typed, projects)
-  return project === undefined || projects.get(project)?.config.tasks?.[task] === undefined
+  return project === undefined || declaredTask(projects.get(project)?.config, task) === undefined
     ? undefined
     : `${project}#${task}`
 }
@@ -1692,3 +1717,12 @@ function flakyCandidates(outcomes: readonly TaskOutcome[]): FlakyCandidate[] {
   }
   return out
 }
+
+/** `dir` with its links resolved; as written when it is gone (a stale marker). */
+function canonical(dir: string): string {
+  try {
+    return realpathSync(dir)
+  } catch {
+    return path.resolve(dir)
+  }
+}

package/src/orchestrator/sandbox-request.ts

@@ -24,7 +24,7 @@ import {
   type SandboxViolation,
 } from '../exec/index.js'
 import type { TaskNode } from '../graph/index.js'
-import { grantPrefix, UserError } from '../util/index.js'
+import { grantPrefix, relPosix, UserError } from '../util/index.js'
 import { WORKSPACE_FINGERPRINT_FILES } from '../workspace/index.js'
 
 /**
@@ -350,6 +350,7 @@ async function linkedDeps(
   keyed: ReadonlySet<string> | undefined,
 ): Promise<{ granted: string[]; withheld: WithheldLink[] }> {
   const [self, root] = await Promise.all([realpath(projectDir), realpath(workspaceRoot)])
+  const realDirs = dirs.map(toRealPath)
   const scan = async (dir: string, scope: string): Promise<Array<[string, string, string]>> => {
     const found: Array<[target: string, link: string, name: string]> = []
     const entries = await readdir(dir, { withFileTypes: true }).catch(() => [])
@@ -359,7 +360,7 @@ async function linkedDeps(
         const target = await realpath(full).catch(() => undefined)
         if (
           target !== undefined &&
-          !dirs.some((d) => atOrUnder(target, d)) &&
+          !realDirs.some((d) => atOrUnder(target, d)) &&
           !atOrUnder(self, target)
         ) {
           found.push([target, full, scope + e.name])
@@ -388,8 +389,8 @@ async function linkedDeps(
       withheld.push({
         dir: target,
         name,
-        target: posixRel(root, target),
-        link: posixRel(workspaceRoot, link),
+        target: relPosix(root, target),
+        link: relPosix(workspaceRoot, link),
       })
   }
   return { granted, withheld }
@@ -421,11 +422,6 @@ export function reachedWithheld(
   )
 }
 
-/** `p` relative to `from`, with `/` separators. */
-function posixRel(from: string, p: string): string {
-  return path.relative(from, p).split(path.sep).join('/')
-}
-
 /**
  * Ensure each declared write path exists on the host as either an empty
  * file (a literal path) or a directory (a glob's static prefix, or a
@@ -565,7 +561,7 @@ export function placeholderSweeper(placeholders: readonly Placeholder[]): () =>
  * never reddens a pass and never buries a real denial.
  */
 export function untouchedPlaceholderLine(projectDir: string, placeholder: string): string {
-  const rel = path.relative(projectDir, placeholder).split(path.sep).join('/')
+  const rel = relPosix(projectDir, placeholder)
   return (
     `vx: the sandbox write grant \`${rel}\` named nothing on disk, so vx bound it as an empty ` +
     `file, which the task never wrote (removed again). If the task creates a directory there ` +

package/src/workspace/affected.ts

@@ -19,7 +19,7 @@ import {
   relPosix,
 } from '../util/index.js'
 import { LOCKFILE_NAME } from './lockfile.js'
-import { configImportOwners } from './config-imports.js'
+import { configImportOwners, realpathOr } from './config-imports.js'
 import { configImports } from './config-cache.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { bunPatchFiles, WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
@@ -570,7 +570,7 @@ async function workspaceConfigChanged(
   if (config === undefined) return false
   const root = realpathSync(workspaceRoot)
   for (const file of await configImports(config)) {
-    if (set.has(path.relative(root, file).split(path.sep).join('/'))) return true
+    if (set.has(relPosix(root, file))) return true
   }
   return false
 }
@@ -613,7 +613,10 @@ async function bytesOrNull(file: string): Promise<Uint8Array | null> {
 /** Run a NUL-separated path-listing git command from the workspace root. */
 async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
   const proc = spawnGit([...cmd], workspaceRoot)
-  const stdout = await new Response(proc.stdout).text()
+  // `Response.text()` strips a leading U+FEFF, the first path's own.
+  const stdout = new TextDecoder('utf-8', { ignoreBOM: true }).decode(
+    await new Response(proc.stdout).bytes(),
+  )
   const stderr = await new Response(proc.stderr).text()
   const exit = await proc.exited
   if (exit !== 0) {
@@ -755,6 +758,17 @@ async function mergeBase(workspaceRoot: string, ref: string): Promise<string> {
   const sha = out.trim()
   if (exit === 0 && sha.length > 0) return sha
   await verifyRef(workspaceRoot, ref)
+  // `<rev>:<path>` names the tree (or blob) at <path>: diffed against the
+  // working tree, its paths miss the <path>/ prefix, and `develop:pkgs`
+  // selected projects nothing had changed, green. A root tree
+  // (`develop^{tree}`, the empty tree) diffs right and stays a base.
+  const sub = /^([^:]*):(?!\/)(.+)$/s.exec(ref)
+  if (sub !== null) {
+    throw new UserError(
+      `git ref "${ref}" names what is at ${sub[2]}, not a commit: vx diffs the whole ` +
+        `workspace, so pass the commit alone ("${sub[1] || 'HEAD'}").`,
+    )
+  }
   return ref
 }
 
@@ -800,14 +814,6 @@ function isDirectory(abs: string): boolean {
   }
 }
 
-function realpathOr(p: string): string {
-  try {
-    return realpathSync(p)
-  } catch {
-    return p
-  }
-}
-
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],

package/src/workspace/config-eval.ts

@@ -292,7 +292,11 @@ function acquireWorker(): Worker {
     // config reports the same text it would from an in-process import.
     const err = new Error(msg.message) as Error & { position?: WorkerReply['position'] }
     err.name = msg.name
+    // A stackless throw stays stackless: the rebuilt Error's own stack names
+    // this file, and `configLoadError` reads a stack naming no file as Bun's
+    // JSON loader's.
     if (msg.stack !== null) err.stack = msg.stack
+    else delete err.stack
     if (msg.position !== null) err.position = msg.position
     p.reject(err)
   }

package/src/workspace/config-imports.ts

@@ -281,7 +281,7 @@ function tsconfigTarget(spec: string, fromDir: string, memo?: TsconfigMemo): str
 }
 
 /** A path as Bun names it: realpath'd when it exists. */
-function realpathOr(file: string): string {
+export function realpathOr(file: string): string {
   try {
     return realpathSync(file)
   } catch {

package/src/workspace/config-schema.ts

@@ -28,6 +28,7 @@ import {
   asTrees,
   isLiteralPattern,
 } from '../util/index.js'
+import { compileNameGlob } from './filter.js'
 import { nonJsonMessage, nonJsonPaths } from './json-data.js'
 
 // Mirrors `WorkspaceConfig` in src/config.ts. Unknown keys are REJECTED for
@@ -663,6 +664,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `let cleanOutputs delete files outside it)`,
           )
         }
+        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
         assertNoForeignToken(g, `${where}.cache.outputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
@@ -714,6 +716,7 @@ export function validateProjectConfig(config: ProjectConfig, configPath: string)
               `use cache.inputs.workspaceFiles for workspace-root-relative inputs)`,
           )
         }
+        assertPosixGlob(g, `${where}.cache.inputs.files`, 'project')
         assertNoForeignToken(g, `${where}.cache.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
@@ -1196,6 +1199,39 @@ function isAbsoluteGlob(glob: string): boolean {
   return g.startsWith('/') || (g.includes('{') && /[{,]\//.test(g))
 }
 
+const DRIVE = /(^|[{,])[A-Za-z]:[\\/]+/g
+
+/**
+ * True when a backslash in the glob is a Windows separator. One before a
+ * bracket, a brace, a `!` or a backslash is an escape (`app/\[id\]`,
+ * `\{b\}`); one before anything else is a separator — `a\*b` reads as
+ * `a/*b` on Windows far more often than as a file named with a star, which
+ * `a?b` still selects.
+ */
+function hasBackslashSeparator(body: string): boolean {
+  for (let i = body.indexOf('\\'); i !== -1; i = body.indexOf('\\', i + 2)) {
+    if (!'[]{}!\\'.includes(body[i + 1] ?? '/')) return true
+  }
+  return false
+}
+
+/**
+ * A Windows spelling (`src\**`, `C:/src/**`) loaded with only a "matched no
+ * files" warning, and a task keyed on it never saw its source (X-67).
+ */
+function assertPosixGlob(glob: string, where: string, base: string): void {
+  const neg = glob.startsWith('!') ? '!' : ''
+  const body = glob.slice(neg.length)
+  DRIVE.lastIndex = 0
+  const drive = DRIVE.test(body)
+  if (!drive && !hasBackslashSeparator(body)) return
+  const write = neg + body.replace(DRIVE, '$1').replace(/\\(?![[\]{}!\\])/g, '/')
+  throw new UserError(
+    `${where}: "${glob}" ${drive ? 'starts with a Windows drive' : 'uses a backslash as a path separator'} — ` +
+      `task globs are ${base}-relative with forward slashes: write "${write}"`,
+  )
+}
+
 /**
  * `!!x` INVERTS the input set instead of double-negating it.
  *
@@ -1251,7 +1287,7 @@ function assertFilterNamesDeclaredDeps(
 ): void {
   const declared = (dependsOn ?? []).map(specForm)
   const matches = (pattern: string, name: string): boolean =>
-    pattern.includes('*') ? taskPatternRegExp(pattern).test(name) : pattern === name
+    pattern.includes('*') ? compileNameGlob(pattern).test(name) : pattern === name
   const named = (f: SpecForm): boolean =>
     declared.some((d) => {
       if (!matches(d.task, f.task)) return false
@@ -1331,12 +1367,6 @@ export function taskNameProblem(name: string): string | null {
             : null
 }
 
-/** The graph's `*`-only task glob (`compileTaskPattern`), mirrored: `*` is the sole metacharacter. */
-function taskPatternRegExp(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')
-  return new RegExp(`^${escaped}$`)
-}
-
 /**
  * Refuse a non-empty glob list made up ENTIRELY of negations.
  *
@@ -1405,6 +1435,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
           `entries are workspace-root-relative and must stay within the workspace root`,
       )
     }
+    assertPosixGlob(g, where, 'workspace-root')
     assertNoForeignToken(g, where)
     if (namesDirItself(g)) {
       throw new UserError(

package/src/workspace/filter.ts

@@ -20,7 +20,7 @@
 // given, the base set is "all projects" and excluded packages are removed.
 
 import path from 'node:path'
-import { BUN_GLOB_WILDCARDS, UserError } from '../util/index.js'
+import { BUN_GLOB_WILDCARDS, relPosix, UserError } from '../util/index.js'
 import type { PackageGraph } from './package-graph.js'
 import type { ProjectMeta } from './workspace.js'
 
@@ -180,7 +180,7 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
     // against the workspace root like the literal form.
     // A member glob, not a task glob: `Bun.Glob`'s alphabet, the class included.
     if (BUN_GLOB_WILDCARDS.test(pathForm)) {
-      const rel = path.relative(workspaceRoot, matcher).split(path.sep).join('/')
+      const rel = relPosix(workspaceRoot, matcher)
       const glob = rel.replace(/\/+$/, '')
       pathGlob = new Bun.Glob(glob)
       if (glob.endsWith('/**')) pathGlobBase = new Bun.Glob(glob.slice(0, -3))
@@ -293,9 +293,10 @@ function matchSelector(
  * Compile a name pattern where `*` is the sole metacharacter and means "any
  * characters" — pnpm's rule. A path glob would treat `/` as a separator, so
  * `*` could never cross the `@scope/` boundary: `--filter '*'` would select
- * only UNSCOPED packages, and `*core*` would match nothing at all.
+ * only UNSCOPED packages, and `*core*` would match nothing at all. Task
+ * patterns share it: it mirrors the graph's `compileTaskPattern`.
  */
-function compileNameGlob(pattern: string): RegExp {
+export function compileNameGlob(pattern: string): RegExp {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')
   return new RegExp(`^${escaped}$`)
 }