@vzn/vx 0.0.636 → 0.0.637

package/src/orchestrator/sandbox-request.ts

@@ -7,7 +7,7 @@ import { existsSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import type { ExecConfig } from '../config.js'
+import type { ExecConfig, SandboxConfig } from '../config.js'
 import {
   bindableWrites,
   initSandbox,
@@ -25,7 +25,6 @@ import {
 } from '../exec/index.js'
 import type { TaskNode } from '../graph/index.js'
 import { grantPrefix, relPosix, UserError } from '../util/index.js'
-import { WORKSPACE_FINGERPRINT_FILES } from '../workspace/index.js'
 
 /**
  * Arm the sandbox runtime for a run, lazily: only when at least one task
@@ -188,7 +187,7 @@ export async function sandboxRequestFor(
   /** The projects nested in this one (their dirs): a wall its grants do not reach. */
   nested: readonly string[] = [],
   /**
-   * The run's cache directory. `.vx` is walled wherever it is; a
+   * The run's cache directory. `.vx/cache` is walled wherever it is; a
    * `cacheDir` configured inside a project was not, and a task whose write
    * grant covered it could plant artifacts and index rows (L-24).
    */
@@ -234,7 +233,7 @@ export async function sandboxRequestFor(
   const walls = [
     ...nested,
     path.join(workspaceRoot, '.git'),
-    path.join(workspaceRoot, '.vx'),
+    path.join(workspaceRoot, '.vx', 'cache'),
     ...(cacheDir !== undefined &&
     toRealPath(cacheDir).startsWith(toRealPath(workspaceRoot) + path.sep)
       ? [cacheDir]
@@ -290,6 +289,53 @@ export async function sandboxRequestFor(
   return { sandbox: request, placeholders, withheld: links.withheld }
 }
 
+/**
+ * Whether a sandboxed task could read `real` (a canonical path inside its
+ * project): under one of its read or write grants or its `node_modules`,
+ * and not behind a wall. vx packs a symlinked output as its target's
+ * bytes, outside the sandbox, so a link the task planted to a file it was
+ * denied (`dist/x -> ../.env` under `read: ['src/']`) packed that file
+ * into the cache wherever creating the link went unseen: seatbelt, or
+ * Linux untraced. The grants are matched as written, not expanded: a
+ * glob's hit made by the task itself counts.
+ */
+export function sandboxReadable(
+  node: TaskNode,
+  sandbox: SandboxConfig,
+  workspaceRoot: string,
+  nested: readonly string[] = [],
+): (real: string) => boolean {
+  const projectReal = toRealPath(node.projectDir)
+  const at = (p: string): string =>
+    p.startsWith('~')
+      ? path.join(homedir(), p.slice(1))
+      : path.isAbsolute(p)
+        ? p
+        : path.join(projectReal, p)
+  const grants = [...(sandbox.allow?.read ?? []), ...(sandbox.allow?.write ?? [])].map(at)
+  const literals = [
+    ...grants.filter(isMountableLiteral).map((g) => toRealPath(g.replace(/\/+$/, '') || '/')),
+    toRealPath(path.join(node.projectDir, 'node_modules')),
+    toRealPath(path.join(workspaceRoot, 'node_modules')),
+  ]
+  const globs = grants.filter((g) => !isMountableLiteral(g)).map((g) => new Bun.Glob(g))
+  const walls = [
+    ...nested,
+    path.join(workspaceRoot, '.git'),
+    path.join(workspaceRoot, '.vx', 'cache'),
+  ].map(toRealPath)
+  return (real) => {
+    if (walls.some((w) => atOrUnder(real, w))) return false
+    if (literals.some((l) => atOrUnder(real, l))) return true
+    // A directory a glob matches is granted whole.
+    for (let p = real; atOrUnder(p, projectReal); p = path.dirname(p)) {
+      if (globs.some((g) => g.match(p))) return true
+      if (p === projectReal) break
+    }
+    return false
+  }
+}
+
 /**
  * The sandbox half of the request, plus the empty files vx created so a
  * literal write grant had something to bind (`placeholders`). They are
@@ -619,9 +665,9 @@ export function untouchedPlaceholderLine(projectDir: string, placeholder: string
 /**
  * Where tools keep credentials under the user's home. A sandboxed task
  * reads none of them unless its `allow.read` names one (a publish task's
- * `~/.npmrc`).
+ * `~/.npmrc`), and `sandboxFix` never suggests one as a grant.
  */
-const CREDENTIAL_STORES = [
+export const CREDENTIAL_STORES = [
   '.ssh',
   '.gnupg',
   '.aws',
@@ -647,6 +693,26 @@ const CREDENTIAL_STORES = [
   '.terraform.d/credentials.tfrc.json',
   '.vault-token',
   '.pgpass',
+  // Deploy and service CLIs a JS build runs beside, each at its home on
+  // Linux and macOS, and the agent CLIs that may run vx itself.
+  '.config/configstore/firebase-tools.json',
+  '.local/share/com.vercel.cli/auth.json',
+  'Library/Application Support/com.vercel.cli/auth.json',
+  '.netlify/config.json',
+  '.config/netlify/config.json',
+  'Library/Preferences/netlify/config.json',
+  '.wrangler/config',
+  '.config/.wrangler/config',
+  'Library/Preferences/.wrangler/config',
+  '.fly/config.yml',
+  '.supabase/access-token',
+  '.config/doctl',
+  'Library/Application Support/doctl',
+  '.config/stripe/config.toml',
+  '.config/op',
+  '.expo/state.json',
+  '.claude/.credentials.json',
+  '.codex/auth.json',
 ]
 
 /** The stores present on this host, learned once per home. */
@@ -697,7 +763,7 @@ export type WriteReach = 'none' | 'project' | 'workspace'
 /**
  * Where a task that ran a command may have written files no declaration
  * names — the files whose run-start facts (the git snapshot, its index
- * OIDs, the `package.json` digest) a later key must not reuse (item 743).
+ * OIDs) a later key must not reuse (item 743).
  *
  * A cached task declares its outputs and is held to them. A task with no
  * `cache` block can declare none, so it may have written anywhere
@@ -732,20 +798,25 @@ export function commandWriteReach(node: TaskNode, workspaceRoot: string): WriteR
 }
 
 /**
- * May this task's command rewrite a file the workspace fingerprint folds
- * (a lockfile, `pnpm-workspace.yaml`)? Those sit at the workspace root, so
+ * May this task's command rewrite a root file a plugin claims (`claimed`:
+ * a lockfile, `pnpm-workspace.yaml`)? Those sit at the workspace root, so
  * an unsandboxed task may only when the root is its own project (`pnpm
  * install` without `--frozen-lockfile` in a root task); a sandboxed one
  * when a write grant covers one. Anyone else writing there crosses a
- * project boundary, out of contract.
+ * project boundary, out of contract. With nothing claimed, no key folds a
+ * root file this way.
  */
-export function mayWriteFingerprint(node: TaskNode, workspaceRoot: string): boolean {
+export function mayWriteFingerprint(
+  node: TaskNode,
+  workspaceRoot: string,
+  claimed: readonly string[],
+): boolean {
   const exec = node.config.exec
-  if (exec === undefined) return false
+  if (exec === undefined || claimed.length === 0) return false
   if (exec.sandbox === undefined) return node.projectDir === workspaceRoot
   for (const grant of exec.sandbox.allow?.write ?? []) {
     const abs = path.resolve(node.projectDir, expandHome(grantPrefix(grant)))
-    for (const f of WORKSPACE_FINGERPRINT_FILES) {
+    for (const f of claimed) {
       if (atOrUnder(path.join(workspaceRoot, f), abs)) return true
     }
   }

package/src/orchestrator/signals.ts

@@ -21,7 +21,7 @@ import type { Logger } from './logger.js'
 /**
  * How long a SIGTERMed child gets before SIGKILL on the way out. The
  * end-of-run persistent shutdown grants the same two seconds; both read
- * `VX_KILL_GRACE_MS` (util/settle.ts) so the suites that prove the
+ * `VX_RUN_KILL_GRACE` (util/settle.ts) so the suites that prove the
  * escalation do not wait the full grace.
  */
 export const SIGNAL_SHUTDOWN_GRACE_MS = 2000

package/src/orchestrator/stable-keys.ts

@@ -28,7 +28,8 @@ export interface DeriveStableKeysArgs {
   nodes: Map<string, TaskNode>
   cache: CacheLayer
   workspaceRoot: string
-  workspaceFingerprint: string
+  /** The root files the plugins claim (`VxPlugin.fingerprint`), for `mayWriteFingerprint`. */
+  claimedFiles: readonly string[]
   forwardArgs?: readonly string[] | undefined
   nestedDirsByProject: Map<string, string[]>
   gitFilesCache: GitFilesCache
@@ -58,7 +59,7 @@ export interface StableKey {
  * cache-enabled, non-group tasks paired with their keys.
  *
  * Reuses the run's `hashCache`, so execute-task's later computeTaskHash
- * for the same node hits the memo (package.json bytes + task config) —
+ * for the same node hits the memo (the task config hash, file lists) —
  * the key bytes are derived here, the heavy per-project hashing is
  * shared. No cache layer is touched: keys only.
  */
@@ -82,8 +83,8 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   //   - wsOutputUpstream: any upstream declares cache.outputs.workspaceFiles
   //     (root-anchored, boundary-ignoring outputs), or has no cache block
   //     and a sandbox write grant elsewhere in the workspace, or may rewrite
-  //     a file the workspace fingerprint folds (a root `pnpm install`): every
-  //     key folds that digest, taken once per run.
+  //     a root file a plugin claims (a root `pnpm install`): every key folds
+  //     what the claimant took from it, once per run.
   //   - rewritersById / unfoldedById: the projects of every upstream CACHED
   //     task that may rewrite its own inputs in place (a formatter declaring
   //     no outputs; `commandWriteReach`), and the subset this task's key does
@@ -93,7 +94,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   //     unfolded dependency covered is still uncovered here: its key is not
   //     in this one.
   //   - wsRewriters: the same for a cached rewriter whose reach is every
-  //     project (a write grant elsewhere in the workspace, or a fingerprinted
+  //     project (a write grant elsewhere in the workspace, or a claimed root
   //     file, `mayWriteFingerprint`); one this key does not fold makes it
   //     preliminary. A dependency this key folds needs no pass-through here:
   //     a keyed task with such a rewriter unfolded is unstable itself, and
@@ -175,14 +176,17 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
         ;(wide ??= projects.empty()).add(depNode.projectName)
       } else if (reach === 'workspace') wsOutputUpstream = true
       const cached = depNode.config.cache !== undefined
-      if (!cached && mayWriteFingerprint(depNode, args.workspaceRoot)) wsOutputUpstream = true
+      if (!cached && mayWriteFingerprint(depNode, args.workspaceRoot, args.claimedFiles))
+        wsOutputUpstream = true
       if (!anyUnfolded) continue
       // The cached twin: a formatter rewriting its own input ahead of a
       // reader that folds no key of it replayed seed B's build under seed A
       // on the fourth run, the same way (item 750).
       const rewrites = cached ? commandWriteReach(depNode, args.workspaceRoot) : 'none'
       const rewritesWs =
-        cached && (rewrites === 'workspace' || mayWriteFingerprint(depNode, args.workspaceRoot))
+        cached &&
+        (rewrites === 'workspace' ||
+          mayWriteFingerprint(depNode, args.workspaceRoot, args.claimedFiles))
       const rewritersOfDep = rewritersById.get(dep)
       const wsRewriterOfDep = wsRewriters.has(dep)
       if (
@@ -239,7 +243,6 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
             node,
             upstream,
             workspaceRoot: args.workspaceRoot,
-            workspaceFingerprint: args.workspaceFingerprint,
             cache: args.cache,
             forwardArgs: args.forwardArgs,
             nestedProjectDirs: args.nestedDirsByProject.get(node.projectName) ?? [],
@@ -256,7 +259,6 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
       node,
       upstream,
       workspaceRoot: args.workspaceRoot,
-      workspaceFingerprint: args.workspaceFingerprint,
       cache: args.cache,
       forwardArgs: args.forwardArgs,
       nestedProjectDirs: args.nestedDirsByProject.get(node.projectName) ?? [],
@@ -339,7 +341,7 @@ export function probesAfterWrites(
   }
   if (!anyProbe) return late
   // A sandbox with no write grant still writes the declared outputs. A
-  // fingerprinted file is only writable where `commandWriteReach` is not
+  // claimed root file is only writable where `commandWriteReach` is not
   // 'none' already (`mayWriteFingerprint`).
   const writers = new Set<string>()
   for (const n of nodes.values()) {
@@ -469,7 +471,7 @@ export function dependsOnSiblingOutputs(
     if (inputs === undefined || outputs.length === 0) return true
     // An output the reader's own `!` inputs take back whole is not in its
     // key: `['**/*', '!dist/**']` beside a `dist/**` producer keys the same
-    // before and after it, which is what `rules.upfrontKeys` asks a config
+    // before and after it, which is what `run.rules.upfrontKeys` asks a config
     // to write (X-54).
     const back = inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
     const reach = back.length === 0 ? outputs : outputs.filter((o) => !outputTakenBack(o, back))

package/src/orchestrator/status-line.ts

@@ -26,6 +26,8 @@ export interface StatusStream {
    * TTY) means the region is never drawn anyway.
    */
   columns?: number
+  /** Terminal height in rows, read per draw as `columns` is. */
+  rows?: number
 }
 
 export interface OutputWriter {
@@ -137,14 +139,37 @@ export function createOutputWriter(
    * it. Reachable only on a TTY whose winsize ioctl fails, since a non-TTY
    * disables the region outright.
    */
-  const regionRows = (lines: readonly string[]): number => {
+  const lineRows = (line: string): number => {
     const cols = stream.columns
-    if (cols === undefined || cols <= 0) return lines.length
+    if (cols === undefined || cols <= 0) return 1
+    return Math.max(1, Math.ceil(Bun.stringWidth(line) / cols))
+  }
+  const regionRows = (lines: readonly string[]): number => {
     let rows = 0
-    for (const line of lines) rows += Math.max(1, Math.ceil(Bun.stringWidth(line) / cols))
+    for (const line of lines) rows += lineRows(line)
     return rows
   }
 
+  /**
+   * The leading lines that fit the terminal's height, one row spared.
+   * Cursor-up stops at the top of the screen, and a row that scrolled into
+   * the scrollback is out of the erase's reach: a region taller than the
+   * terminal left its top behind on every redraw, one stacked block per tick
+   * (VS Code's short panel, 2026-10-14). The first line always shows.
+   */
+  const fitted = (lines: readonly string[]): readonly string[] => {
+    const height = stream.rows
+    if (height === undefined || height <= 0) return lines
+    let rows = 0
+    let n = 0
+    for (const line of lines) {
+      rows += lineRows(line)
+      if (n > 0 && rows > height - 1) break
+      n++
+    }
+    return n === lines.length ? lines : lines.slice(0, n)
+  }
+
   // Erase sequence for whatever is currently shown. A single row keeps
   // the exact legacy bytes (ESC[2K\r); anything taller moves to its
   // top row and clears to end of screen.
@@ -155,9 +180,10 @@ export function createOutputWriter(
     // only repeat these bytes.
     cancelTrailing()
     const erase = shown ? eraseSeq() : CLEAR
-    stream.write(erase + current!.join('\n'))
+    const lines = fitted(current!)
+    stream.write(erase + lines.join('\n'))
     shown = true
-    shownRows = regionRows(current!)
+    shownRows = regionRows(lines)
     lastDraw = now()
   }
   const set = (lines: readonly string[], o: { force?: boolean }): void => {
@@ -246,6 +272,8 @@ export interface StatusRegionState {
   blocks?: ReadonlyMap<string, number>
   /** The running task at the head of the longest unfinished chain. */
   critical?: string
+  /** A running task's usual duration from history; its row shows it. */
+  expected?: ReadonlyMap<string, number>
   /**
    * Ready persistent tasks (dev servers …) whose children keep
    * running after their outcome lands. Pinned until runEnd — the
@@ -349,13 +377,14 @@ export function formatStatusRegion(
     const notes: string[] = []
     if (s.critical === slot.id && busy > 1) notes.push(paint(WARN, 'critical path', colors))
     if (waiting > 0) notes.push(dim(`blocks ${waiting}`))
+    const usual = s.expected?.get(slot.id)
     lines.push(
       formatTaskRow(
         ' ',
         Math.max(0, s.nowMs - slot.startedMs),
         'running',
         ACCENT,
-        '',
+        usual === undefined ? '' : formatExpected(usual),
         '',
         paintPinnedId(slot.id, colors),
         colors,
@@ -370,3 +399,16 @@ export function formatStatusRegion(
   lines.push(...s.summaryLines)
   return lines
 }
+
+/**
+ * A running task's usual duration, fixed while the elapsed time counts up
+ * toward it (M, 2026-10-14): `~5.2s`, `~42s`, `~2m 05s`. Fits the cache
+ * column below 100 minutes.
+ */
+function formatExpected(ms: number): string {
+  if (ms < 1000) return `~${Math.round(ms)}ms`
+  if (ms < 9950) return `~${(ms / 1000).toFixed(1)}s`
+  const s = Math.round(ms / 1000)
+  if (s < 60) return `~${s}s`
+  return `~${Math.floor(s / 60)}m ${String(s % 60).padStart(2, '0')}s`
+}

package/src/orchestrator/summary.ts

@@ -21,6 +21,7 @@ const LOCAL = '#38bdf8' // sky-400
 const REMOTE = '#2563eb' // blue-600
 const ERROR = '#ef4444'
 const ABORTED = '#f97316' // orange-500: red's neighbour, not a failure
+const NOT_RUN = '#a855f7' // purple-500: stopped before it began, apart from every other state
 const ACCENT = '#06b6d4' // cyan-500: the live region's running word
 
 const BAR_WIDTH = 50
@@ -137,7 +138,7 @@ export interface SummaryStats {
  */
 export interface RunContext {
   version: string
-  /** Projects covered by the graph — the "in run" half of the bar. */
+  /** Projects covered by the graph — the "affected" half of the bar. */
   packageCount: number
   /** Worker-pool size for this run; shown on the `info` row. */
   concurrency?: number
@@ -164,25 +165,25 @@ export function formatSummarySection(
   const row = (label: string, value: string): string => `  ${dim(label.padEnd(8))}  ${value}`
   const join = (parts: string[]): string => parts.join(` ${dim('\u00b7')} `)
 
-  // Tasks meter + numbers, fixed order: failed · success · skipped,
-  // then a dim total so the legend reads against the whole graph.
+  // Tasks meter + numbers, fixed order: failed · success · skipped ·
+  // aborted · not run, then a dim total, last on its line. Every task in
+  // the run counts, each state its own segment (M, 2026-10-14).
+  const runTotal = stats.total + aborted + notRun
   const taskParts: string[] = []
   if (stats.failed > 0)
     taskParts.push(paint(ERROR, `${stats.failed} failed`, colors, { bold: true }))
   if (stats.successful > 0) taskParts.push(paint(SUCCESS, `${stats.successful} success`, colors))
   if (stats.skipped > 0) taskParts.push(paint(WARN, `${stats.skipped} skipped`, colors))
-  if (stats.total > 0) taskParts.push(dim(`${stats.total} total`))
-  // Rows in the task list, but outside `total`: history and telemetry count
-  // the same tasks the total does, and an aborted task did no work.
-  const uncounted: string[] = []
-  if (aborted > 0) uncounted.push(paint(ABORTED, `${aborted} aborted`, colors))
-  if (notRun > 0) uncounted.push(dim(`${notRun} not run`))
-  if (uncounted.length > 0) taskParts.push(`${dim('not counted:')} ${uncounted.join(dim(', '))}`)
+  if (aborted > 0) taskParts.push(paint(ABORTED, `${aborted} aborted`, colors))
+  if (notRun > 0) taskParts.push(paint(NOT_RUN, `${notRun} not run`, colors))
+  if (runTotal > 0) taskParts.push(dim(`${runTotal} total`))
   const taskBar = segmentBar(
     [
       { n: stats.failed, color: ERROR },
       { n: stats.successful, color: SUCCESS },
       { n: stats.skipped, color: WARN },
+      { n: aborted, color: ABORTED },
+      { n: notRun, color: NOT_RUN },
       remainder,
     ],
     colors,
@@ -211,7 +212,7 @@ export function formatSummarySection(
         paint('', '▱'.repeat(BAR_WIDTH - cells), colors, { dim: true })
       lines.push(
         row('projects', bar),
-        legend([paint(WARN, `${context.packageCount} in run`, colors), dim(`${wsTotal} total`)]),
+        legend([paint(WARN, `${context.packageCount} affected`, colors), dim(`${wsTotal} total`)]),
       )
     }
   }
@@ -256,27 +257,48 @@ export function formatSummarySection(
       cacheParts.push(paint(LOCAL, `${stats.restoredLocal} local`, colors))
     if (stats.restoredRemote > 0)
       cacheParts.push(paint(REMOTE, `${stats.restoredRemote} remote`, colors))
-    // Skipped tasks have no cache provenance, but omitting them made
-    // the cache legend sum below the tasks legend (owner-reported
-    // confusion) — on the bar and in the legend, yellow like the
-    // tasks meter.
-    if (stats.skipped > 0) cacheParts.push(paint(WARN, `${stats.skipped} skipped`, colors))
+    // Skipped tasks ride the bar, yellow like the tasks meter, so the two
+    // bars fill alike; their count is the tasks legend's alone (the footer
+    // never says a fact twice, M, 2026-10-14).
     lines.push(row('cache', cacheBar))
     if (cacheParts.length > 0) lines.push(legend(cacheParts))
   }
 
   // Cache-miss duration spread (owner: hits' restore times polluted
   // it — only tasks that actually executed count). Dim: context.
-  let spread = ''
-  if (stats.spread !== null && stats.spread.count > 0) {
+  // A value already on the row is not said again: one executed task read
+  // as its own max, avg and min (M, 2026-10-14). Tasks that all took the
+  // same time have no spread to show.
+  const total = formatElapsed(totalMs)
+  const said = new Set([total])
+  const spreadParts: string[] = []
+  if (
+    stats.spread !== null &&
+    formatElapsed(stats.spread.maxMs) !== formatElapsed(stats.spread.minMs)
+  ) {
     const { maxMs, minMs, sumMs, count } = stats.spread
-    spread = ` ${dim(`\u00b7 max ${formatElapsed(maxMs)} \u00b7 avg ${formatElapsed(sumMs / count)} \u00b7 min ${formatElapsed(minMs)}`)}`
+    for (const [label, ms] of [
+      ['max', maxMs],
+      ['avg', sumMs / count],
+      ['min', minMs],
+    ] as const) {
+      const v = formatElapsed(ms)
+      if (said.has(v)) continue
+      said.add(v)
+      spreadParts.push(`${label} ${v}`)
+    }
   }
+  const timeParts = [total]
+  // What the cache paid back, beside what the run cost: the stored exec
+  // time of every hit, never the restore this run spent on it.
+  if ((stats.savedMs ?? 0) >= 1)
+    timeParts.push(paint(SUCCESS, `${formatElapsed(stats.savedMs!)} saved`, colors))
   // The live run's forecast leads the spread: the one number on the row
   // that is about the future.
-  if (stats.etaMs !== undefined) {
-    spread = ` ${dim('\u00b7')} ${paint(ACCENT, `${formatEta(stats.etaMs)} left`, colors)}${spread}`
-  }
+  if (stats.etaMs !== undefined)
+    timeParts.push(paint(ACCENT, `${formatEta(stats.etaMs)} left`, colors))
+  for (const p of spreadParts) timeParts.push(dim(p))
+  const timeRow = row('time', join(timeParts))
   // Run-shape footer (final summary only): worker pool + cache mode,
   // grouped with time under a blank line below the meters.
   if (context !== undefined) {
@@ -294,12 +316,9 @@ export function formatSummarySection(
         `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatElapsed(stats.held.sumMs)} in all`,
       )
     }
-    lines.push('', row('info', join(info)), row('time', `${formatElapsed(totalMs)}${spread}`))
-    // The run in one line, last, where the eye lands: what a Turbo user
-    // reads first in its own summary (tasks, cached, time), in vx's words.
-    if (stats.total > 0) lines.push(row('result', resultLine(stats, hits, totalMs, colors)))
+    lines.push('', row('info', join(info)), timeRow)
   } else {
-    lines.push('', row('time', `${formatElapsed(totalMs)}${spread}`))
+    lines.push('', timeRow)
   }
   return lines
 }
@@ -315,41 +334,6 @@ function formatEta(ms: number): string {
   return `~${Math.floor(s / 60)}m ${String(s % 60).padStart(2, '0')}s`
 }
 
-/**
- * `42 tasks · 38 cached (90%) · 3.2s`, `2 tasks · all cached · 23ms`,
- * with the failures first when there are any. Cached is every hit (up to
- * date, restored locally or remotely) over every task that consulted a
- * cache: a skipped or not-yet-run task never did.
- */
-function resultLine(
-  stats: SummaryStats,
-  hits: number,
-  totalMs: number,
-  colors: ColorSupport,
-): string {
-  const parts = [`${stats.total} task${stats.total === 1 ? '' : 's'}`]
-  if (stats.failed > 0) parts.push(paint(ERROR, `${stats.failed} failed`, colors, { bold: true }))
-  // A task with no `cache` block could never hit: it is counted apart, not
-  // as a miss, or `vx run dev` would read "0 cached (0%)". A skipped task
-  // never asked either, and counted as a miss it put "0 cached (0%)" on a
-  // run in which no task has a cache.
-  const noCache = stats.noCache ?? 0
-  const cacheable = stats.total - noCache - stats.skipped - (stats.left ?? 0)
-  if (cacheable > 0)
-    parts.push(
-      hits === cacheable
-        ? paint(SUCCESS, 'all cached', colors, { bold: true })
-        : `${hits} cached (${Math.floor((hits / cacheable) * 100)}%)`,
-    )
-  if (noCache > 0) parts.push(paint('', `${noCache} no-cache`, colors, { dim: true }))
-  // What the cache paid back, beside what the run cost: the stored exec
-  // time of every hit, never the restore this run spent on it.
-  if ((stats.savedMs ?? 0) >= 1)
-    parts.push(paint(SUCCESS, `${formatElapsed(stats.savedMs!)} saved`, colors))
-  parts.push(formatElapsed(totalMs))
-  return parts.join(` ${paint('', '\u00b7', colors, { dim: true })} `)
-}
-
 /**
  * The `--verbosity 1` per-task table (`RunOptions.summaryTable`). Groups are
  * left out as the footer and `--report` leave them: a group ran no command.