@vzn/vx 0.0.591 → 0.0.595

package/src/cache/git-inputs.ts

@@ -8,11 +8,12 @@
 import path from 'node:path'
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import {
-  UserError,
   executablePath,
   gitSpawnRefusal,
   isInstalledPath,
   notAWorkTree,
+  relPosix,
+  UserError,
   xxh3hex,
 } from '../util/index.js'
 import { FILE_HASH_RACY_MS, racyWindowMs } from './layer.js'
@@ -70,7 +71,9 @@ export function repoFacts(dir: string): RepoFacts | null {
   // One line per flag, in order. A git that does not know
   // `--show-object-format` echoes it back, as it does any unknown flag,
   // which reads as sha1 — what the flag's own spawn answered there too.
-  const [prefix = '', commonDir = '', format = '', indexFile = ''] = new TextDecoder()
+  const [prefix = '', commonDir = '', format = '', indexFile = ''] = new TextDecoder('utf-8', {
+    ignoreBOM: true,
+  })
     .decode(proc.stdout)
     .split('\n')
     .map((l) => l.trim())
@@ -115,10 +118,10 @@ function repoFactsFromDisk(dir: string): RepoFacts | undefined {
         if (!st.isDirectory() || !existsSync(path.join(dotGit, 'HEAD'))) return undefined
         const objectFormat = configObjectFormat(readFileSync(path.join(dotGit, 'config'), 'utf8'))
         if (objectFormat === undefined) return undefined
-        const below = path.relative(at, real).split(path.sep).join('/')
+        const below = relPosix(at, real)
         return {
           prefix: below === '' ? '' : `${below}/`,
-          commonDir: path.relative(real, dotGit).split(path.sep).join('/'),
+          commonDir: relPosix(real, dotGit),
           objectFormat,
           indexFile: path.relative(real, path.join(dotGit, 'index')).split(path.sep).join('/'),
         }
@@ -270,7 +273,7 @@ export class GitFilesCache extends Map<string, readonly string[]> {
       for (const rel of relPaths) {
         const abs = path.resolve(workspaceRoot, rel)
         if (abs.startsWith(key + path.sep)) {
-          under.push(path.relative(key, abs).split(path.sep).join('/'))
+          under.push(relPosix(key, abs))
         }
       }
       if (under.length > 0) this.recordChanged(key, under)
@@ -427,8 +430,10 @@ function decodeGitZ(bytes: Uint8Array): { text: string; undecodable: Set<string>
   return { text, undecodable }
 }
 
-const LOSSY_UTF8 = new TextDecoder()
-const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true })
+// A default decoder strips a leading U+FEFF: the first path git lists
+// would lose it and name no file.
+const LOSSY_UTF8 = new TextDecoder('utf-8', { ignoreBOM: true })
+const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
 
 const LS_FILES_STAGE_RE = /^(?:([A-Za-z]) )?([0-7]{6}) ([0-9a-f]{40,64}) ([0-3])\t/
 
@@ -1193,7 +1198,7 @@ export function gitPathspecs(
   projectDirs: readonly string[],
   workspaceWide: boolean,
 ): string[] {
-  const rels = projectDirs.map((d) => path.relative(workspaceRoot, d).split(path.sep).join('/'))
+  const rels = projectDirs.map((d) => relPosix(workspaceRoot, d))
   const scoped =
     !workspaceWide &&
     rels.length > 0 &&
@@ -1299,8 +1304,11 @@ export async function startGitEnumeration(
   const facts = repoFacts(workspaceRoot)
   // The blob-size check's verdict is a function of the index's entries, so
   // the index file's bytes key it: one read, where `ls-files --debug` and a
-  // lookup per entry cost 550 ms at 100,000 files (A-60).
-  const pathspecKey = xxh3hex(pathspecs.join('\0'))
+  // lookup per entry cost 550 ms at 100,000 files (A-60). The verdict's
+  // paths are workspace-relative, so the repo→workspace prefix keys it too:
+  // a nested workspace sharing the cache read the outer one's verdict and
+  // trusted a resized blob.
+  const pathspecKey = xxh3hex([facts?.prefix ?? '', ...pathspecs].join('\0'))
   const indexFile =
     facts === null || facts.indexFile === ''
       ? undefined
@@ -1516,9 +1524,10 @@ export async function applyGitEnumeration(
   // Sort once, then each project's files are a contiguous range found
   // by binary search on its `dir/` prefix — O((F+P) log F) instead of
   // the O(P·F) per-project startsWith scan (54 ms at 1090 projects ×
-  // ~9k files; ~5 ms this way). '/' sorts below most filename chars,
-  // so the range [prefix, prefix+'\xff…') is contiguous in the sorted
-  // array; lowerBound on `prefix` and on `prefix + '￿'` bracket it.
+  // ~9k files; ~5 ms this way). Every path under `dir/` sorts in
+  // [`dir/`, `dir0`): '0' is the code unit after '/'. An upper bound of
+  // `dir/` + U+FFFF left out a file whose name starts with U+FFFF, and
+  // it never entered the key.
   // Git lists in order; a list that already is skips the sort.
   let inOrder = true
   for (let i = 1; i < all.length; i++) {
@@ -1552,10 +1561,15 @@ export async function applyGitEnumeration(
     return lo
   }
   for (const projectDir of projectDirs) {
-    const relPrefix =
+    const spelled =
       base !== undefined && projectDir.startsWith(base) && path.normalize(projectDir) === projectDir
         ? projectDir.slice(base.length).replace(/\/$/, '')
-        : path.relative(workspaceRoot, projectDir).split(path.sep).join('/')
+        : relPosix(workspaceRoot, projectDir)
+    // macOS git reports paths NFC (core.precomposeunicode) while a dir
+    // discovered by readdir keeps the spelling it was created with: match
+    // NFC, and key the OIDs by the project's spelling, which is how
+    // `resolveFiles` looks them up.
+    const relPrefix = spelled.normalize('NFC')
     if (relPrefix === '' || relPrefix === '.') {
       cache.set(projectDir, all)
       const rootOids = new Map<string, string>()
@@ -1565,14 +1579,16 @@ export async function applyGitEnumeration(
     }
     const prefix = `${relPrefix}/`
     const start = lowerBound(prefix)
-    const end = lowerBound(`${prefix}￿`)
+    const end = lowerBound(`${relPrefix}0`)
     const matches: string[] = []
     const projOids = new Map<string, string>()
+    const projAbs =
+      relPrefix === spelled ? abs : (rel: string) => path.join(projectDir, rel.slice(prefix.length))
     for (let i = start; i < end; i++) {
       const rel = sorted[i]!
       matches.push(rel.slice(prefix.length))
       const oid = trusted.get(rel)
-      if (oid !== undefined) projOids.set(abs(rel), oid)
+      if (oid !== undefined) projOids.set(projAbs(rel), oid)
     }
     // An empty slice is a directory git did not see, not an empty project:
     // a project has at least its package.json, tracked or untracked. A

package/src/cache/inputs.ts

@@ -28,9 +28,10 @@ import {
   isLiteralPattern,
   normalizeGlob,
   outputMatcher,
+  relPosix,
   shellArgv,
-  splitNegations,
   slashBraceExpansions,
+  splitNegations,
   staticPrefix,
   taskGlob,
   UserError,
@@ -181,11 +182,14 @@ export type ProjectFilesCache = Map<
 >
 
 export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedInputs> {
+  const projectRel = path.relative(args.workspaceRoot, args.projectDir).split(path.sep).join('/')
   const { files: projectFiles, listing } = await resolveFiles({
     projectDir: args.projectDir,
     workspaceRoot: args.workspaceRoot,
     files: args.inputs?.files,
     ownOutputs: args.ownOutputs,
+    ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
+    projectRel,
     nestedProjectDirs: args.nestedProjectDirs,
     ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
     ...(args.projectFilesCache !== undefined ? { projectFilesCache: args.projectFilesCache } : {}),
@@ -198,6 +202,8 @@ export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedIn
       workspaceRoot: args.workspaceRoot,
       workspaceFiles: wsDecl,
       ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
+      ownOutputs: args.ownOutputs,
+      projectRel,
       ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
       ...(args.workspaceFilesCache !== undefined ? { memo: args.workspaceFilesCache } : {}),
     })
@@ -257,6 +263,9 @@ function resolveWorkspaceFiles(args: {
   workspaceRoot: string
   workspaceFiles: readonly string[]
   ownWorkspaceOutputs: readonly string[]
+  /** The task's project-relative `outputs.files`, and its project's root-relative directory. */
+  ownOutputs: readonly string[]
+  projectRel: string
   gitFilesCache?: GitFilesCache
   memo?: WorkspaceFilesCache
 }): { files: Promise<string[]>; listing: InputListing } | undefined {
@@ -273,6 +282,11 @@ function resolveWorkspaceFiles(args: {
   // A path the task's own outputs take back with `!` is no output, so it
   // stays an input (A-44).
   const ownOutput = outputMatcher(args.ownWorkspaceOutputs)
+  // Its project outputs too, which a root-anchored glob can reach as well:
+  // left in, the task's own build moved its key, and no run was ever saved.
+  let ownProjectOutput: ((rel: string) => boolean) | undefined
+  const ownProject = (rel: string): boolean =>
+    (ownProjectOutput ??= underProject(args.projectRel, outputMatcher(args.ownOutputs)))(rel)
   const positiveGlobs = asTrees(positive).map(globFor)
   // Workspace-wide partition, keyed by the workspace root. Populated
   // up-front by `populateGitFilesCache(..., workspaceWide: true)` when
@@ -292,9 +306,15 @@ function resolveWorkspaceFiles(args: {
   const memoKey =
     args.memo === undefined
       ? undefined
-      : JSON.stringify([positive, negative, args.ownWorkspaceOutputs])
+      : JSON.stringify([
+          positive,
+          negative,
+          args.ownWorkspaceOutputs,
+          args.ownOutputs,
+          args.projectRel,
+        ])
   let isPositive: ((rel: string) => boolean) | undefined
-  const excluded = (rel: string): boolean => isExcluded(rel) || ownOutput(rel)
+  const excluded = (rel: string): boolean => isExcluded(rel) || ownOutput(rel) || ownProject(rel)
   const listing: InputListing = {
     root: args.workspaceRoot,
     listed: gitFiles,
@@ -351,6 +371,24 @@ async function resolveWorkspaceFilesOver(
   return candidates.filter((abs) => oids?.has(abs) === true || isInputOnDisk(abs)).sort()
 }
 
+/** A project-relative matcher asked of root-relative paths: false outside the project. */
+function underProject(
+  projectRel: string,
+  matches: (rel: string) => boolean,
+): (rel: string) => boolean {
+  if (projectRel === '') return matches
+  const prefix = `${projectRel}/`
+  return (rel) => rel.startsWith(prefix) && matches(rel.slice(prefix.length))
+}
+
+/** A root-relative matcher asked of project-relative paths. */
+function inProject(
+  projectRel: string,
+  matches: (rel: string) => boolean,
+): (rel: string) => boolean {
+  return projectRel === '' ? matches : (rel) => matches(`${projectRel}/${rel}`)
+}
+
 /** Anything at the path — file, directory, symlink to anything or to nothing. */
 function existsOnDisk(abs: string): boolean {
   try {
@@ -417,7 +455,11 @@ async function runRuntimeCommand(
   owner: RuntimeMemo | undefined,
 ): Promise<string> {
   const ambient = process.env['PATH']
-  const prefix = binDirs.join(path.delimiter)
+  // As the task's PATH does (exec/env.ts): a dir holding the delimiter
+  // splits into an entry relative to the probe's cwd.
+  const PATH = [...binDirs.filter((dir) => !dir.includes(path.delimiter)), ambient]
+    .filter((entry) => entry)
+    .join(path.delimiter)
   let proc
   try {
     // vx's own `sh`, resolved on its PATH before the probe's: Bun.spawn looks
@@ -425,7 +467,7 @@ async function runRuntimeCommand(
     // `node_modules/.bin`, so a dependency's `sh` bin ran every probe (J-69).
     proc = Bun.spawn(shellArgv(command), {
       cwd,
-      env: { ...process.env, PATH: ambient ? `${prefix}${path.delimiter}${ambient}` : prefix },
+      env: { ...process.env, PATH },
       stdin: 'ignore',
       stdout: 'pipe',
       stderr: 'pipe',
@@ -454,22 +496,49 @@ async function runRuntimeCommand(
   let stdout, stderr, exitCode
   try {
     ;[stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
+      new Response(proc.stdout).bytes(),
+      new Response(proc.stderr).bytes(),
       proc.exited,
     ])
   } finally {
     liveProbes.delete(proc)
     mine?.delete(proc)
   }
-  const output = `${stdout}${stderr}`.trim()
   if (exitCode !== 0) {
+    const lossy = new TextDecoder()
+    const shown = `${lossy.decode(stdout)}${lossy.decode(stderr)}`.trim()
     throw new UserError(
       `cache.inputs runtime command exited ${exitCode}: ${command} (cwd: ${cwd})` +
-        (output ? `\n${output}` : ''),
+        (shown ? `\n${shown}` : ''),
     )
   }
-  return output
+  let out: string
+  let err: string
+  try {
+    out = FATAL_UTF8.decode(stdout)
+    err = FATAL_UTF8.decode(stderr)
+  } catch {
+    // A lossy decode keys every invalid byte as U+FFFD: Latin-1 é and è
+    // folded the same output and replayed each other's build.
+    throw new UserError(
+      `cache.inputs runtime command printed bytes that are not UTF-8: ${command} (cwd: ${cwd}). ` +
+        `Pipe it through a hash or od.`,
+    )
+  }
+  return probeOutput(out, err)
+}
+
+/**
+ * The probe's output as the key folds it. Plain concatenation keyed stdout
+ * `ab` and stdout `a` + stderr `b` alike. A probe with no stderr and no NUL
+ * folds its trimmed stdout, as before; any other is framed with a leading
+ * NUL and stdout's length, a form no unframed output takes.
+ */
+function probeOutput(stdout: string, stderr: string): string {
+  const out = stdout.trim()
+  const err = stderr.trim()
+  if (err === '' && !out.includes('\0')) return out
+  return `\0${out.length}\0${out}${err}`
 }
 
 /**
@@ -680,43 +749,36 @@ export async function cleanOutputs(args: {
   projectDir: string
   outputs: string[]
   nestedProjectDirs: string[]
-  /**
-   * Before a miss: keep the directory each wildcard glob is rooted at
-   * (`dist` for `dist/**`). The task writes its matches under it, so a
-   * remove there bought only an rmdir and the task's mkdir: 0.4 ms of a
-   * 4.9 ms one-file miss (B-49). A restore prunes it, since the entry's
-   * shape decides there.
-   */
-  keepGlobRoots?: boolean
 }): Promise<string[]> {
   const files = await resolveOutputs(args)
   // `force: true` makes rm tolerate ENOENT (e.g. when two output
   // globs overlap and a sibling already deleted a path mid-iteration).
   // A symlink is unlinked, never followed.
   const removed = await removeAll(files, args.projectDir)
-  await pruneEmptiedDirs(
-    args.projectDir,
-    removed,
-    args.keepGlobRoots === true ? globRoots(args.projectDir, args.outputs) : undefined,
-  )
+  await pruneEmptiedDirs(args.projectDir, removed, pruneScope(args.projectDir, args.outputs))
   // Project-relative posix paths of what was removed — the caller
   // feeds these to GitFilesCache.markOutputsChanged after a restore.
-  return files.map((f) => path.relative(args.projectDir, f).split(path.sep).join('/'))
+  return files.map((f) => relPosix(args.projectDir, f))
 }
 
 /**
  * Remove exactly these project-relative paths — the recorded rows of an
  * ADDITIVE task's own artifact (item 588), never a glob: the glob would
  * take the upstream's files the task adds beside. Emptied directories are
- * pruned as `cleanOutputs` prunes them, and stop at one the upstream still
- * fills.
+ * pruned as `cleanOutputs` prunes them, only inside the declared `outputs`
+ * (`pruneScope`), and stop at one the upstream still fills.
  */
 export async function cleanOutputPaths(args: {
   projectDir: string
   rels: readonly string[]
+  outputs: readonly string[]
 }): Promise<void> {
   const files = args.rels.map((r) => path.resolve(args.projectDir, r))
-  await pruneEmptiedDirs(args.projectDir, await removeAll(files, args.projectDir))
+  await pruneEmptiedDirs(
+    args.projectDir,
+    await removeAll(files, args.projectDir),
+    pruneScope(args.projectDir, args.outputs),
+  )
 }
 
 /**
@@ -839,7 +901,7 @@ const SYNC_CLEAN_MAX = 128
 async function removeAll(all: readonly string[], root: string): Promise<string[]> {
   const files = notThroughLink(all, root)
   const refused = (f: string, err: NodeJS.ErrnoException): UserError => {
-    const rel = path.relative(root, f).split(path.sep).join('/')
+    const rel = relPosix(root, f)
     return new UserError(
       `cannot remove declared output ${rel}: ${err.code ?? err.message} — vx clears a task's ` +
         `declared outputs before it runs and before a restore; make the path removable ` +
@@ -882,7 +944,10 @@ function notThroughLink(files: readonly string[], root: string): string[] {
       return null
     }
   }
-  const realRoot = real(root) ?? root
+  // Resolved only once a directory exists to compare: after a clean pruned
+  // the outputs (the common restore) nothing does, and the call was most
+  // of an empty clean.
+  let realRoot: string | undefined
   const own = new Map<string, boolean>()
   return files.filter((f) => {
     const dir = path.dirname(f)
@@ -891,7 +956,8 @@ function notThroughLink(files: readonly string[], root: string): string[] {
       // A directory already gone has nothing to delete through; its path
       // stays so the prune still reaches the parents it emptied.
       const r = real(dir)
-      ok = r === null || r === path.join(realRoot, path.relative(root, dir))
+      ok =
+        r === null || r === path.join((realRoot ??= real(root) ?? root), path.relative(root, dir))
       own.set(dir, ok)
     }
     return ok
@@ -905,12 +971,13 @@ function notThroughLink(files: readonly string[], root: string): string[] {
  * wrote `dist/out/…` and now writes `dist/out`) blocks the rename, and an
  * empty directory is not an output anyone declared. A directory that still
  * holds something — a stray the globs do not cover — stays, and the restore
- * says so if it is in the way.
+ * says so if it is in the way. With a `scope`, only a directory inside it
+ * goes (`pruneScope`).
  */
 async function pruneEmptiedDirs(
   root: string,
   removed: readonly string[],
-  keep?: ReadonlySet<string>,
+  scope?: PruneScope,
 ): Promise<void> {
   const rootResolved = path.resolve(root)
   // LEVEL ORDER, not a walk-up per directory. A parent is attempted only
@@ -928,7 +995,9 @@ async function pruneEmptiedDirs(
     const parents = new Set<string>()
     const dirs = [...level].filter(
       (dir) =>
-        dir !== rootResolved && dir.startsWith(rootResolved + path.sep) && keep?.has(dir) !== true,
+        dir !== rootResolved &&
+        dir.startsWith(rootResolved + path.sep) &&
+        (scope === undefined || inScope(dir, scope)),
     )
     const gone = (err: NodeJS.ErrnoException): boolean => err.code === 'ENOENT'
     if (dirs.length <= SYNC_CLEAN_MAX) {
@@ -951,19 +1020,42 @@ async function pruneEmptiedDirs(
   }
 }
 
+interface PruneScope {
+  /** Wildcard globs' roots (`dist` for `dist/**`): prune strictly below. */
+  below: string[]
+  /** Literal outputs (`out` as a tree): prune the path itself and below. */
+  atOrBelow: string[]
+}
+
 /**
- * The directories the wildcard output globs are rooted at, absolute. A
- * literal names a file or a tree whose shape the task decides, so it has
- * none; nor has a glob rooted at the project itself.
+ * Where a clean, before a miss or a restore, may prune: only the trees the
+ * task declared. A directory above a glob's root or holding a literal
+ * output (`out` for `out/a.txt`) stays: a sibling task running beside this
+ * one may have just made it and not yet written into it, and pruning it
+ * failed that task "Directory nonexistent". A glob's root stays: the task
+ * writes under it, and a remove there bought only an rmdir and the task's
+ * mkdir (B-49). A literal's own path goes: the entry or the task may need
+ * a file there. A glob rooted at the project prunes nothing.
  */
-function globRoots(projectDir: string, outputs: readonly string[]): Set<string> {
-  const roots = new Set<string>()
+function pruneScope(base: string, outputs: readonly string[]): PruneScope {
+  const scope: PruneScope = { below: [], atOrBelow: [] }
   for (const g of outputs) {
-    if (g.startsWith('!') || isLiteralPattern(g)) continue
+    if (g.startsWith('!')) continue
+    if (isLiteralPattern(g)) {
+      scope.atOrBelow.push(path.resolve(base, stripTrailingSlash(normalizeGlob(g))))
+      continue
+    }
     const prefix = staticPrefix(g)
-    if (prefix !== '.') roots.add(path.resolve(projectDir, prefix))
+    if (prefix !== '.') scope.below.push(path.resolve(base, prefix))
   }
-  return roots
+  return scope
+}
+
+function inScope(dir: string, scope: PruneScope): boolean {
+  return (
+    scope.below.some((r) => dir.startsWith(r + path.sep)) ||
+    scope.atOrBelow.some((r) => dir === r || dir.startsWith(r + path.sep))
+  )
 }
 
 /**
@@ -1001,8 +1093,12 @@ export async function cleanWorkspaceOutputs(args: {
   outputs: string[]
 }): Promise<string[]> {
   const files = await resolveWorkspaceOutputs(args)
-  await pruneEmptiedDirs(args.workspaceRoot, await removeAll(files, args.workspaceRoot))
-  return files.map((f) => path.relative(args.workspaceRoot, f).split(path.sep).join('/'))
+  await pruneEmptiedDirs(
+    args.workspaceRoot,
+    await removeAll(files, args.workspaceRoot),
+    pruneScope(args.workspaceRoot, args.outputs),
+  )
+  return files.map((f) => relPosix(args.workspaceRoot, f))
 }
 
 function stripTrailingSlash(p: string): string {
@@ -1101,6 +1197,9 @@ interface ResolveFilesArgs {
   workspaceRoot: string
   files: string[] | undefined
   ownOutputs: string[]
+  /** Root-relative `outputs.workspaceFiles`, and the project's root-relative directory. */
+  ownWorkspaceOutputs: readonly string[]
+  projectRel: string
   nestedProjectDirs: string[]
   gitFilesCache?: GitFilesCache
   projectFilesCache?: ProjectFilesCache
@@ -1136,7 +1235,7 @@ function refuseUndecodable(
   if (undecodable === undefined || undecodable.size === 0) return
   const bad = candidates.filter((abs) => undecodable.has(abs) && undecodableOnDisk(abs))
   if (bad.length === 0) return
-  const names = bad.map((abs) => JSON.stringify(path.relative(root, abs).split(path.sep).join('/')))
+  const names = bad.map((abs) => JSON.stringify(relPosix(root, abs)))
   throw new UserError(
     `cache.inputs.${field} matched ${names.join(', ')} in ${root}: the name is not valid UTF-8 ` +
       `(shown with \ufffd), and vx cannot read a file by it. Rename it, or exclude it with a ` +
@@ -1292,6 +1391,8 @@ async function resolveFiles(
   const { positive, negative, isExcluded, ownOutput, positiveGlobs, isPositive } = plan
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
+  // Its root-anchored outputs that land in the project, as `files` sees them.
+  const ownWsOutput = inProject(args.projectRel, outputMatcher(args.ownWorkspaceOutputs))
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
   // files, .git/info/exclude, and global excludes all participate
@@ -1303,7 +1404,7 @@ async function resolveFiles(
   // duration of one orchestrator run.
   // Everything below the snapshot that decides the result: the project, what
   // it declares, what it excludes as its own outputs, and the boundaries.
-  const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
+  const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.ownWorkspaceOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
   let gitFiles = args.gitFilesCache?.snapshotFor(args.projectDir, positiveGlobs)
   let undecodable = args.gitFilesCache?.undecodableNames
   if (gitFiles !== undefined) {
@@ -1314,7 +1415,7 @@ async function resolveFiles(
     if (memo !== undefined && memo.snapshot === gitFiles) {
       return {
         files: [...memo.result],
-        listing: listingFor(args.projectDir, gitFiles, plan, nested),
+        listing: listingFor(args.projectDir, gitFiles, plan, nested, ownWsOutput),
       }
     }
   }
@@ -1365,7 +1466,7 @@ async function resolveFiles(
       input = isPositive(rel) && !isExcluded(rel) && !ownOutput(rel)
       verdicts.set(rel, input)
     }
-    if (!input || nested(rel)) continue
+    if (!input || nested(rel) || ownWsOutput(rel)) continue
     candidates.push(base === undefined ? path.resolve(args.projectDir, rel) : base + rel)
   }
   const unmatchedLiterals = unanswered(plan.literals, gitFiles)
@@ -1392,7 +1493,10 @@ async function resolveFiles(
   // Stored only on the way out: a declaration whose literal named an
   // invisible file threw above, and every task sharing it must throw too.
   args.projectFilesCache?.set(memoKey, { snapshot: gitFiles, result: resolved })
-  return { files: [...resolved], listing: listingFor(args.projectDir, gitFiles, plan, nested) }
+  return {
+    files: [...resolved],
+    listing: listingFor(args.projectDir, gitFiles, plan, nested, ownWsOutput),
+  }
 }
 
 function listingFor(
@@ -1400,11 +1504,12 @@ function listingFor(
   listed: readonly string[],
   plan: FilesPlan,
   nested: (rel: string) => boolean,
+  ownWsOutput: (rel: string) => boolean,
 ): InputListing {
   return {
     root,
     listed,
-    isInput: (rel) => inPlan(plan, rel),
+    isInput: (rel) => inPlan(plan, rel) && !ownWsOutput(rel),
     nested,
     prefixes: plan.prefixes,
     literals: plan.literals,
@@ -1448,7 +1553,7 @@ function undecodableOnDisk(abs: string): boolean {
   } catch {
     return false
   }
-  const lossy = new TextDecoder()
+  const lossy = new TextDecoder('utf-8', { ignoreBOM: true })
   for (const name of raw) {
     if (lossy.decode(name) !== next) continue
     try {
@@ -1589,7 +1694,7 @@ function addedTo(
   return undefined
 }
 
-const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true })
+const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
 
 /**
  * Union of the OUTPUT files matching any positive pattern in `cwd`, minus
@@ -1676,9 +1781,7 @@ function globFor(pattern: string): Bun.Glob {
  */
 function inNestedProject(projectDir: string, nestedDirs: string[]): (rel: string) => boolean {
   if (nestedDirs.length === 0) return () => false
-  const dirs = new Set(
-    nestedDirs.map((d) => path.relative(projectDir, d).split(path.sep).join('/')),
-  )
+  const dirs = new Set(nestedDirs.map((d) => relPosix(projectDir, d)))
   return (rel) => {
     for (let i = rel.indexOf('/'); i !== -1; i = rel.indexOf('/', i + 1)) {
       if (dirs.has(rel.slice(0, i))) return true

package/src/cache/layered-cache.ts

@@ -185,7 +185,27 @@ class ScopedRemote implements RemoteCacheLayer {
   }
 
   async has(hash: string): Promise<boolean> {
-    return (await this.remote.has(this.scoped(hash))) || this.remote.has(hash)
+    return this.fallThrough(
+      () => this.remote.has(this.scoped(hash)),
+      () => this.remote.has(hash),
+    )
+  }
+
+  /**
+   * The scope's answer, else the trusted one. A scope lookup that fails
+   * still asks the trusted key, so a hit there is not lost; its error is
+   * rethrown (and warned) when the trusted key fails or has nothing too.
+   */
+  private async fallThrough<T>(own: () => Promise<T>, trusted: () => Promise<T>): Promise<T> {
+    let found: T
+    try {
+      found = await own()
+    } catch (err) {
+      const fallback = await trusted().catch(() => undefined)
+      if (!fallback) throw err
+      return fallback
+    }
+    return found || trusted()
   }
 
   private async scopedHasMany(hashes: readonly string[]): Promise<Set<string> | null> {
@@ -207,7 +227,10 @@ class ScopedRemote implements RemoteCacheLayer {
     hash: string,
   ): Promise<{ body: Blob | Response; durationMs: number | undefined } | null> {
     if (this.trustedOnly.has(hash)) return this.remote.get(hash)
-    return (await this.remote.get(this.scoped(hash))) ?? this.remote.get(hash)
+    return this.fallThrough(
+      () => this.remote.get(this.scoped(hash)),
+      () => this.remote.get(hash),
+    )
   }
 
   put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {

package/src/cache/tar-stream.ts

@@ -11,7 +11,7 @@
 // short entry. Non-regular entries are reported with their type and their
 // bodies skipped; the caller decides what to materialise (nothing but `0`).
 
-export interface TarEntry {
+interface TarEntry {
   name: string
   size: number
   /** POSIX typeflag: '0' regular, '5' directory, '2' symlink, … */
@@ -38,7 +38,9 @@ const BLOCK = 512
  * numbers; a MiB is far past any writer's.
  */
 const MAX_EXTENDED_HEADER = 1024 * 1024
-const decoder = new TextDecoder()
+// `ignoreBOM`: a default decoder drops a leading U+FEFF, and a name or
+// prefix field that began with one read back without it.
+const decoder = new TextDecoder('utf-8', { ignoreBOM: true })
 
 function field(h: Uint8Array, off: number, len: number): string {
   let end = off