@vzn/vx 0.0.595 → 0.0.597

package/src/orchestrator/sandbox-request.ts

@@ -271,7 +271,7 @@ export async function sandboxRequestFor(
     // could copy a key into an output the cache shares (L-41).
     baseDenyRead: [
       ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
-      ...credentialStores(workspaceRoot),
+      ...(await credentialStores(workspaceRoot, config.allowWrite)),
     ],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
@@ -326,8 +326,11 @@ export interface WithheldLink {
  * task is granted and what it is not.
  *
  * One level deep, plus one level inside a `@scope/` directory — the shape
- * a package manager writes. Anything already inside a granted directory
- * is dropped; what is left is a sibling project's real path.
+ * a package manager writes — and then the same in the `node_modules` of
+ * each granted target, so a dependency's own workspace dependencies are
+ * reached as the runtime reaches them. A target inside the granted
+ * `node_modules` or inside the package holding the link is dropped; what
+ * is left is a sibling project's real path.
  *
  * A link to the task's OWN project, or to a directory holding it, is
  * dropped too: npm and Yarn classic link every workspace package at the
@@ -371,20 +374,39 @@ async function linkedDeps(
     }
     return found
   }
+  const keyedDirs =
+    keyed === undefined ? undefined : new Set(await Promise.all([...keyed].map((d) => realpath(d))))
+  const grants = (target: string): boolean =>
+    keyedDirs === undefined || !atOrUnder(target, root) || keyedDirs.has(target)
   // Merged in `dirs` order, so the link a hint names is the project's own
-  // when both have one.
+  // when both have one. A granted package is scanned in turn: pnpm and
+  // Bun link a dependency's own workspace dependencies only under ITS
+  // `node_modules`, so `app -> ui -> core` left core hidden and the import
+  // of ui failed with ENOENT, unreported.
   const targets = new Map<string, { link: string; name: string }>()
-  for (const found of await Promise.all(dirs.map((d) => scan(d, '')))) {
-    for (const [target, link, name] of found) {
-      if (!targets.has(target)) targets.set(target, { link, name })
+  let frontier: Array<[nodeModules: string, owner: string | undefined]> = dirs.map((d) => [
+    d,
+    undefined,
+  ])
+  while (frontier.length > 0) {
+    const next: typeof frontier = []
+    const scans = await Promise.all(frontier.map(([d]) => scan(d, '')))
+    for (const [i, found] of scans.entries()) {
+      const owner = frontier[i]![1]
+      for (const [target, link, name] of found) {
+        if (targets.has(target) || (owner !== undefined && atOrUnder(target, owner))) continue
+        targets.set(target, { link, name })
+        if (grants(target)) {
+          next.push([path.join(target, 'node_modules'), target])
+        }
+      }
     }
+    frontier = next
   }
-  if (keyed === undefined) return { granted: [...targets.keys()], withheld: [] }
-  const keyedDirs = new Set(await Promise.all([...keyed].map((d) => realpath(d))))
   const granted: string[] = []
   const withheld: WithheldLink[] = []
   for (const [target, { link, name }] of targets) {
-    if (!atOrUnder(target, root) || keyedDirs.has(target)) granted.push(target)
+    if (grants(target)) granted.push(target)
     else
       withheld.push({
         dir: target,
@@ -464,11 +486,13 @@ async function prepareOutputsForBind(
       await mkdir(abs, { recursive: true }).catch(() => undefined)
       continue
     }
-    if (hasWildcard || g.endsWith('/')) {
-      const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
-      await mkdir(abs, { recursive: true })
-    } else {
-      const abs = path.join(projectDir, g)
+    const dir = hasWildcard || g.endsWith('/')
+    const abs = path.join(projectDir, hasWildcard ? grantPrefix(g) : g)
+    try {
+      if (dir) {
+        await mkdir(abs, { recursive: true })
+        continue
+      }
       // Whatever is already there is what the task meant — a grant on the
       // project dir itself is a directory, and touching it as a file is
       // an EISDIR, not a missing bind. `lstat`, and an exclusive create: a
@@ -478,11 +502,33 @@ async function prepareOutputsForBind(
       await mkdir(path.dirname(abs), { recursive: true })
       await writeFile(abs, '', { flag: 'wx' })
       placeholders.push({ path: abs, mtimeMs: (await lstat(abs)).mtimeMs })
+    } catch (err) {
+      await sweepPlaceholders(placeholders)
+      const code = (err as NodeJS.ErrnoException).code
+      if (code !== 'EEXIST' && code !== 'ENOTDIR') throw err
+      // A file stands where the grant needs a directory: `out.txt/` over a
+      // file, or `a.txt/x/*.js`. It reached the user as an internal error.
+      const blocker = await fileOnPath(projectDir, dir ? abs : path.dirname(abs))
+      throw new UserError(
+        `exec.sandbox.allow.write: "${g}" needs a directory at ${blocker}, and a file is ` +
+          `there — remove the file, or grant a path beside it`,
+      )
     }
   }
   return placeholders
 }
 
+/** The first path from `from` down to `to` that exists and is not a directory. */
+async function fileOnPath(from: string, to: string): Promise<string> {
+  let at = from
+  for (const part of path.relative(from, to).split(path.sep)) {
+    at = path.join(at, part)
+    const st = await lstat(at).catch(() => undefined)
+    if (st !== undefined && !st.isDirectory()) return at
+  }
+  return to
+}
+
 /**
  * The walls a project's grants stop at: its nested projects, the
  * repository and vx's directory (item 1010). A read grant around one is
@@ -589,13 +635,35 @@ const CREDENTIAL_STORES = [
   '.npmrc',
   '.yarnrc.yml',
   '.pypirc',
+  // Registry and service tokens of the same kind: Bun's global bunfig
+  // (`[install.scopes]` tokens) at either of its homes, Cargo's, RubyGems'.
+  '.bunfig.toml',
+  '.config/.bunfig.toml',
+  '.cargo/credentials',
+  '.cargo/credentials.toml',
+  '.gem/credentials',
+  '.config/hub',
+  '.config/containers/auth.json',
+  '.terraform.d/credentials.tfrc.json',
+  '.vault-token',
+  '.pgpass',
 ]
 
 /** The stores present on this host, learned once per home. */
 let presentStores: { home: string; paths: string[] } | undefined
 
-/** The credential stores to deny, less any that holds the workspace. */
-function credentialStores(workspaceRoot: string): string[] {
+/**
+ * The credential stores to deny, less any that holds the workspace, and
+ * punched around the task's write grants: a grant names a store as a read
+ * does. Denied whole, the store's mask landed on the grant's bind (a file
+ * grant binds its directory on Linux), so `write: ['~/.npmrc']` wrote to
+ * /dev/null with exit 0, and `~/.aws/config` left `~/.aws/credentials`
+ * readable. A grant above a store does not name it, so it stays denied.
+ */
+async function credentialStores(
+  workspaceRoot: string,
+  writes: readonly string[],
+): Promise<string[]> {
   const home = homedir()
   if (presentStores?.home !== home) {
     presentStores = {
@@ -603,9 +671,19 @@ function credentialStores(workspaceRoot: string): string[] {
       paths: CREDENTIAL_STORES.map((rel) => path.join(home, rel)).filter((p) => existsSync(p)),
     }
   }
-  return presentStores.paths.filter(
+  const stores = presentStores.paths.filter(
     (p) => workspaceRoot !== p && !workspaceRoot.startsWith(p + path.sep),
   )
+  return (await Promise.all(stores.map((p) => denyAround(toRealPath(p), writes)))).flat()
+}
+
+/** `dir` denied, or its entries no write grant lies under or at when one is inside it. */
+async function denyAround(dir: string, writes: readonly string[]): Promise<string[]> {
+  const inside = writes.filter((w) => atOrUnder(w, dir))
+  if (inside.length === 0) return [dir]
+  if (inside.includes(dir)) return []
+  const entries = await readdir(dir).catch(() => [])
+  return (await Promise.all(entries.map((e) => denyAround(path.join(dir, e), inside)))).flat()
 }
 
 /** `~/x` against the user's home; anything else unchanged. */

package/src/orchestrator/save-lane.ts

@@ -21,22 +21,22 @@ export interface SaveLane {
 
 export function createSaveLane(cap: number, onError: (err: unknown) => void): SaveLane {
   const queue: Array<{ save: () => Promise<void>; settle: () => void }> = []
-  const running = new Set<Promise<void>>()
+  let running = 0
   const start = (save: () => Promise<void>, settle: () => void): void => {
-    const p = save()
+    void save()
       .catch(onError)
       .then(() => {
-        running.delete(p)
+        running--
         settle()
         const next = queue.shift()
         if (next !== undefined) start(next.save, next.settle)
       })
-    running.add(p)
+    running++
   }
   return {
     defer(save) {
       return new Promise<void>((settle) => {
-        if (running.size < cap) start(save, settle)
+        if (running < cap) start(save, settle)
         else queue.push({ save, settle })
       })
     },

package/src/orchestrator/signals.ts

@@ -2,8 +2,8 @@
 // — the scheduler dispatches nothing more, and the signal is forwarded to
 // everything live, SIGKILLed after a bounded grace — then waits, bounded,
 // for run() to leave its own end-of-run path (telemetry flush, each
-// plugin's teardown, the cache close), and exits 128+signo (130/143). A
-// second signal exits at once. Without the forward, a
+// plugin's teardown, the cache close), and dies of the signal (130/143 to
+// its parent). A second signal does so at once. Without the forward, a
 // programmatic signal to the vx process alone (CI cancellation,
 // `kill <pid>`) orphans every running child — terminal Ctrl-C only worked
 // via process-group propagation. Without the escalation (added
@@ -14,7 +14,7 @@
 // them to the runner around every spawn.
 
 import { signalExitCode } from '../exec/index.js'
-import { claimExitForSignal, killGraceMs, settleWithin } from '../util/index.js'
+import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
 import type { Logger } from './logger.js'
 
@@ -111,6 +111,13 @@ export function forwardSignals(args: {
   done: Promise<void>
   /** How long a signal waits for `done` before it exits anyway. */
   boundMs: number
+  /**
+   * A task may be handed the terminal (`exec.interactive` on a TTY) and may
+   * leave it raw or without echo. Bun puts back the terminal it started
+   * with when it exits, not when a signal kills it, so this run exits with
+   * the signal's code rather than dying of the signal.
+   */
+  handsTerminal?: boolean
   /** In-flight children; the runner adds and removes each around its spawn. */
   liveChildren: ReadonlySet<Child>
   /** Ready persistent tasks the orchestrator owns until the graph finishes. */
@@ -124,6 +131,16 @@ export function forwardSignals(args: {
     } catch {
       // double-close race with the normal path; we're exiting anyway
     }
+    // Die of the signal once the exit hooks have run: a shell running vx
+    // in a script stops it on Ctrl-C only when its child died of SIGINT,
+    // and a 130 exit ran the script's next line. The code stays the
+    // fallback should the signal not land.
+    if (args.handsTerminal !== true) {
+      process.once('exit', () => {
+        process.removeAllListeners(signal)
+        process.kill(process.pid, signal)
+      })
+    }
     process.exit(signalExitCode(signal))
   }
   let stopping: StopSignal | undefined
@@ -158,7 +175,8 @@ export function forwardSignals(args: {
   if (args.enabled) {
     process.on('SIGINT', onSigint)
     process.on('SIGTERM', onSigterm)
-    process.on('SIGHUP', onSighup)
+    // A hang-up vx was started deaf to (nohup) stays ignored.
+    if (!hangupIgnored()) process.on('SIGHUP', onSighup)
   }
   return {
     remove: () => {

package/src/orchestrator/stable-keys.ts

@@ -17,7 +17,7 @@ import { isLiteralPattern, normalizeGlob, relPosix } from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
 import { foldedDeps } from './keyed-projects.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyUpstream } from './upstream.js'
+import { filterUpstreamHashes, keyedOutcome, keyUpstream } from './upstream.js'
 
 export interface DeriveStableKeysArgs {
   nodes: Map<string, TaskNode>
@@ -382,9 +382,7 @@ function foldedBy(
 }
 
 /**
- * Synthetic upstream outcomes for key derivation. Only `node` + `hash`
- * are read by filterUpstreamHashes / computeGroupHash; the rest of
- * TaskOutcome is irrelevant here, so we cast a minimal shape.
+ * Synthetic upstream outcomes for key derivation (`keyedOutcome`).
  */
 function synthUpstream(
   node: TaskNode,
@@ -395,13 +393,7 @@ function synthUpstream(
   for (const dep of node.deps) {
     const depNode = nodes.get(dep)
     if (!depNode) continue
-    out.push({
-      node: depNode,
-      status: 'success',
-      exitCode: 0,
-      durationMs: 0,
-      hash: keyById.get(dep),
-    } as TaskOutcome)
+    out.push(keyedOutcome(depNode, keyById.get(dep)))
   }
   return keyUpstream(node, out)
 }

package/src/orchestrator/summary.ts

@@ -6,7 +6,7 @@
 import type { TaskOutcome } from '../graph/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { tallyOutcomes } from './tally.js'
-import { outcomeLabel, projectOutcome } from './events.js'
+import { outcomeLabel, projectOutcome, ranNoCache } from './events.js'
 import { isGroupTask } from '../graph/index.js'
 import { formatElapsed } from '../util/index.js'
 
@@ -264,7 +264,7 @@ export function formatSummarySection(
   let spread = ''
   if (stats.spread !== null && stats.spread.count > 0) {
     const { maxMs, minMs, sumMs, count } = stats.spread
-    spread = ` ${dim(`\u00b7 max ${formatDuration(maxMs)} \u00b7 avg ${formatDuration(sumMs / count)} \u00b7 min ${formatDuration(minMs)}`)}`
+    spread = ` ${dim(`\u00b7 max ${formatElapsed(maxMs)} \u00b7 avg ${formatElapsed(sumMs / count)} \u00b7 min ${formatElapsed(minMs)}`)}`
   }
   // Run-shape footer (final summary only): worker pool + cache mode,
   // grouped with time under a blank line below the meters.
@@ -280,15 +280,15 @@ export function formatSummarySection(
     // (2026-09-15), so the line says it is a sum.
     if (stats.held !== undefined && stats.held.count > 0) {
       info.push(
-        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatDuration(stats.held.sumMs)} in all`,
+        `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatElapsed(stats.held.sumMs)} in all`,
       )
     }
-    lines.push('', row('info', join(info)), row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('info', join(info)), row('time', `${formatElapsed(totalMs)}${spread}`))
     // The run in one line, last, where the eye lands: what a Turbo user
     // reads first in its own summary (tasks, cached, time), in vx's words.
     if (stats.total > 0) lines.push(row('result', resultLine(stats, hits, totalMs, colors)))
   } else {
-    lines.push('', row('time', `${formatDuration(totalMs)}${spread}`))
+    lines.push('', row('time', `${formatElapsed(totalMs)}${spread}`))
   }
   return lines
 }
@@ -320,7 +320,7 @@ function resultLine(
         : `${hits} cached (${Math.floor((hits / cacheable) * 100)}%)`,
     )
   if (noCache > 0) parts.push(paint('', `${noCache} no-cache`, colors, { dim: true }))
-  parts.push(formatDuration(totalMs))
+  parts.push(formatElapsed(totalMs))
   return parts.join(` ${paint('', '\u00b7', colors, { dim: true })} `)
 }
 
@@ -365,9 +365,7 @@ export function formatRunSummary(
   // distinction — it never consulted the cache, so it is not a miss.
   const noCache = outcomes.filter(
     (o) =>
-      !isGroupTask(o.node) &&
-      (o.status === 'success' || o.status === 'failed') &&
-      o.node.config.cache === undefined,
+      !isGroupTask(o.node) && (o.status === 'success' || o.status === 'failed') && ranNoCache(o),
   ).length
   const t = tallyOutcomes(outcomes)
   // Spread over executed tasks only — `success`/`failed` statuses ran
@@ -428,7 +426,3 @@ export function neverStarted(
 ): boolean {
   return o.status === 'aborted' && o.wallclockStartNs === undefined
 }
-
-export function formatDuration(ms: number): string {
-  return formatElapsed(ms)
-}

package/src/orchestrator/task-hash.ts

@@ -16,8 +16,8 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { InputFile, TaskInputs } from '../exec/index.js'
-import type { TaskNode, TaskOutcome } from '../graph/index.js'
-import { span, relPosix, xxh3hex } from '../util/index.js'
+import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import { isUserError, relPosix, secretMask, span, UserError, xxh3hex } from '../util/index.js'
 import { expandGroupUpstream, filterUpstreamHashes } from './upstream.js'
 
 /**
@@ -296,6 +296,13 @@ async function resolveKeyInput(
           projectFilesCache: args.hashCache.projectFiles,
         }
       : {}),
+  }).catch((err: unknown) => {
+    // A failed probe's message quotes its command and output, and the probe
+    // runs in vx's own environment: `echo $NPM_TOKEN` printed the token in
+    // the task's stream and `--dry`'s stderr.
+    if (!isUserError(err)) throw err
+    const secrets = secretMask([process.env, cfg.exec?.env?.define], cfg.exec?.env?.secret)
+    throw secrets === null ? err : new UserError(secrets.mask(err.message))
   })
 
   const upstreamPairs = filterUpstreamHashes(
@@ -338,7 +345,10 @@ async function resolveKeyInput(
     fileHashes,
   )
 
-  const effectiveForwardArgs = args.node.requested ? (args.forwardArgs ?? []) : []
+  // Args after `--` reach a requested command; the default build (a keyed
+  // group) runs none, and folded, they moved every key that folds its own.
+  const effectiveForwardArgs =
+    args.node.requested && !isGroupTask(args.node) ? (args.forwardArgs ?? []) : []
 
   const input: CacheKeyInput = {
     taskId: args.node.id,

package/src/orchestrator/telemetry.ts

@@ -481,6 +481,15 @@ export interface TelemetrySource {
 /** How often a running task's process tree is sampled. */
 const SAMPLE_MS = 1000
 
+/** Call `fn` every `ms` until the returned stop is called. */
+type Every = (ms: number, fn: () => Promise<void>) => () => void
+
+const everyInterval: Every = (ms, fn) => {
+  const timer = setInterval(() => void fn(), ms)
+  timer.unref()
+  return () => clearInterval(timer)
+}
+
 const DEFAULT_KINDS: ReadonlyArray<TelemetryRecord['kind']> = [
   'run.start',
   'task.start',
@@ -508,6 +517,8 @@ export function createTelemetrySource(args: {
   owners?: ReadonlyMap<TelemetrySink, string>
   /** The run's task graph, to see a group dependency through to the tasks behind it. */
   nodes?: ReadonlyMap<string, TaskNode>
+  /** The sampler's clock; a test ticks it by hand instead of waiting on the wall. */
+  every?: Every
 }): TelemetrySource {
   const { sinks, run, warn } = args
   const runId = run.runId
@@ -543,12 +554,13 @@ export function createTelemetrySource(args: {
   // only while one runs; a tick still reading when the next is due is not
   // doubled.
   const tracked = new Map<string, number>()
-  let timer: ReturnType<typeof setInterval> | undefined
+  const every = args.every ?? everyInterval
+  let stopEvery: (() => void) | undefined
   let sampling = false
   let ended = false
   const stopTimer = (): void => {
-    if (timer !== undefined) clearInterval(timer)
-    timer = undefined
+    stopEvery?.()
+    stopEvery = undefined
   }
   const untrack = (taskId: string, pid: number): void => {
     if (tracked.get(taskId) === pid) tracked.delete(taskId)
@@ -587,10 +599,7 @@ export function createTelemetrySource(args: {
   const track = (taskId: string, pid: number): (() => void) => {
     if (ended) return () => {}
     tracked.set(taskId, pid)
-    if (timer === undefined) {
-      timer = setInterval(() => void tick(), SAMPLE_MS)
-      timer.unref()
-    }
+    stopEvery ??= every(SAMPLE_MS, tick)
     return () => untrack(taskId, pid)
   }
 

package/src/orchestrator/upstream.ts

@@ -28,6 +28,17 @@ export function keyUpstream(node: TaskNode, upstream: TaskOutcome[]): TaskOutcom
   return node.excludedUpstream === undefined ? keyed : [...keyed, ...node.excludedUpstream]
 }
 
+/** A dependency as a key reads it: only `node` and `hash` matter. */
+export function keyedOutcome(node: TaskNode, hash: string | undefined): TaskOutcome {
+  return {
+    node,
+    status: 'success',
+    exitCode: 0,
+    durationMs: 0,
+    ...(hash !== undefined ? { hash } : {}),
+  }
+}
+
 /** `node.deps` less its ordering-only edges: the dependencies a key may fold. */
 export function keyedDeps(node: TaskNode): readonly string[] {
   const order = node.orderOnly

package/src/util/hangup.ts

@@ -0,0 +1,42 @@
+// Did this process start with SIGHUP ignored? `nohup` and a supervisor
+// that wants a job to outlive its terminal say so through the inherited
+// disposition, and a `process.on('SIGHUP')` replaces it: vx under nohup
+// stopped its run and exited 129 when the terminal closed. The POSIX idiom
+// is to ask before installing; Node has no API for it, so Linux reads
+// `/proc/self/status` (self is this process in any pid namespace's procfs)
+// and macOS asks `sigaction` itself. Read once, before the first handler.
+
+import { readFileSync } from 'node:fs'
+import { dlopen, FFIType, ptr } from 'bun:ffi'
+
+let ignored: boolean | undefined
+
+export function hangupIgnored(): boolean {
+  ignored ??= read()
+  return ignored
+}
+
+function read(): boolean {
+  try {
+    if (process.platform === 'linux') {
+      const mask = /^SigIgn:\s*([0-9a-f]+)$/m.exec(readFileSync('/proc/self/status', 'utf8'))
+      return mask !== null && (BigInt(`0x${mask[1]}`) & 1n) === 1n
+    }
+    if (process.platform === 'darwin') return darwinIgnored()
+  } catch {}
+  return false
+}
+
+function darwinIgnored(): boolean {
+  // Opened only here: bun:ffi compiles a trampoline per call site, ~1 ms.
+  const lib = dlopen('/usr/lib/libSystem.B.dylib', {
+    sigaction: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+  })
+  try {
+    // `struct sigaction` opens with the handler; SIG_IGN is 1. SIGHUP is 1.
+    const old = new BigUint64Array(4)
+    return lib.symbols.sigaction(1, null, ptr(old)) === 0 && old[0] === 1n
+  } finally {
+    lib.close()
+  }
+}

package/src/util/index.ts

@@ -43,6 +43,7 @@ export {
   relPosix,
   splitNegations,
   staticPrefix,
+  stripTrailingSlash,
   anyTaskGlob,
   isInstalledPath,
   taskGlob,
@@ -72,6 +73,7 @@ export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
 export { executablePath, shellArgv, taskShell } from './which.js'
 export { procfsIsOwn } from './procfs.js'
+export { hangupIgnored } from './hangup.js'
 export { realPath } from './real-path.js'
 export {
   maskedCommand,

package/src/util/paths.ts

@@ -198,6 +198,12 @@ export function taskGlob(pattern: string): Bun.Glob {
   // A `]` with no `[` before it is already literal to `Bun.Glob`.
   const source = pattern.includes('[') ? pattern.replace(/(?<!\\)[[\]]/g, '\\$&') : pattern
   const glob = new Bun.Glob(source)
+  const alternatives = braceAlternatives(pattern)
+  if (alternatives.length > 1) {
+    const any = anyTaskGlob(alternatives)
+    glob.match = (rel: string): boolean => any(rel)
+    return glob
+  }
   const re = regExpSource(pattern)
   if (re === null) return glob
   const compiled = new RegExp(`^${re}$`, 'u')
@@ -216,8 +222,13 @@ export function taskGlob(pattern: string): Bun.Glob {
  * RegExp for the lot when every pattern has one, else a glob each. An input
  * file was matched against a dozen globs (its positives, the always-ignored
  * list, its negatives) one native call at a time.
+ *
+ * A brace is expanded first, never matched by `Bun.Glob`: its match reads a
+ * `**` that ends an alternative as one name, so `{src/**,lib/**}` took
+ * `src/a.ts` and never `src/deep/a.ts`, and an edit there was a stale hit.
  */
-export function anyTaskGlob(patterns: readonly string[]): (rel: string) => boolean {
+export function anyTaskGlob(rawPatterns: readonly string[]): (rel: string) => boolean {
+  const patterns = rawPatterns.flatMap(braceAlternatives)
   if (patterns.length === 0) return () => false
   const sources = patterns.map(regExpSource)
   const globs = patterns.map(taskGlob)
@@ -261,7 +272,7 @@ function regExpSource(pattern: string): string | null {
   return out
 }
 
-function stripTrailingSlash(p: string): string {
+export function stripTrailingSlash(p: string): string {
   return p.replace(/\/+$/, '')
 }
 
@@ -339,6 +350,15 @@ export function outputMatcher(globs: readonly string[]): (rel: string) => boolea
  * is left to the glob.
  */
 export function slashBraceExpansions(pattern: string): string[] {
+  return expandBraces(pattern, true)
+}
+
+/** `pattern` with every brace group of two or more alternatives expanded. */
+function braceAlternatives(pattern: string): string[] {
+  return expandBraces(pattern, false)
+}
+
+function expandBraces(pattern: string, slashOnly: boolean): string[] {
   if (pattern.includes('\\')) return [pattern]
   for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
     let depth = 0
@@ -352,14 +372,14 @@ export function slashBraceExpansions(pattern: string): string[] {
     }
     if (close === -1) return [pattern]
     const body = pattern.slice(open + 1, close)
-    if (cuts.length === 0 || !body.includes('/')) continue
+    if (cuts.length === 0 || (slashOnly && !body.includes('/'))) continue
     const head = pattern.slice(0, open)
     const tail = pattern.slice(close + 1)
     const bounds = [open, ...cuts, close]
     const out: string[] = []
     for (let k = 0; k + 1 < bounds.length; k++) {
       const alt = pattern.slice(bounds[k]! + 1, bounds[k + 1])
-      out.push(...slashBraceExpansions(head + alt + tail))
+      out.push(...expandBraces(head + alt + tail, slashOnly))
     }
     return [...new Set(out)]
   }