@vzn/vx 0.0.638 → 0.0.639

package/src/orchestrator/sandbox-fix.ts

@@ -124,19 +124,3 @@ export function sandboxFix(
     if (fix[k].size > 0) out[k] = [...new Set([...fix[k]].map(mask))].sort()
   return Object.keys(out).length > 0 ? out : undefined
 }
-
-/**
- * The fix as the config line it is: `exec.sandbox.allow: { read: ['a'] }`,
- * or undefined when every denial was a withheld credential path.
- */
-export function sandboxFixLine({
-  withheld: _,
-  inputs: __,
-  ...fix
-}: SandboxFix): string | undefined {
-  if (Object.keys(fix).length === 0) return undefined
-  const parts = Object.entries(fix).map(
-    ([k, list]: [string, string[]]) => `${k}: [${list.map((p) => `'${p}'`).join(', ')}]`,
-  )
-  return `exec.sandbox.allow: { ${parts.join(', ')} }`
-}

package/src/orchestrator/signals.ts

@@ -16,13 +16,13 @@
 import { signalExitCode } from '../exec/index.js'
 import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
-import type { Logger } from './logger.js'
+import type { Logger } from '../report/index.js'
 
 /**
  * How long a SIGTERMed child gets before SIGKILL on the way out. The
  * end-of-run persistent shutdown grants the same two seconds; both read
- * `VX_RUN_KILL_GRACE` (util/settle.ts) so the suites that prove the
- * escalation do not wait the full grace.
+ * `killGraceMs` (util/settle.ts) so the suites that prove the escalation
+ * do not wait the full grace.
  */
 export const SIGNAL_SHUTDOWN_GRACE_MS = 2000
 
@@ -125,6 +125,13 @@ export function forwardSignals(args: {
 }): SignalForwarding {
   const everyChild = (): Child[] => [...args.liveChildren, ...args.persistentRegistry.values()]
   const exit = (signal: StopSignal): never => {
+    // The run's own end already flushed the log; a second signal cut it
+    // short, so the failure frames it holds print now (idempotent).
+    try {
+      args.log.runEnd?.()
+    } catch {
+      // teardown must not throw on the way out
+    }
     for (const child of everyChild()) killTree(child, 'SIGKILL')
     try {
       args.cache.close()
@@ -152,10 +159,11 @@ export function forwardSignals(args: {
     stopping = signal
     claimExitForSignal()
     // Clear the live worker/status region BEFORE exiting so a TTY isn't
-    // left with a frozen region in the scrollback. runEnd is idempotent
-    // and a no-op for non-TTY loggers.
+    // left with a frozen region in the scrollback. Only the region: the
+    // tasks this stop aborts still list as rows, above the failure frames
+    // the run's own end prints.
     try {
-      args.log.runEnd?.()
+      args.log.runDone?.()
     } catch {
       // teardown must not throw on the way out
     }

package/src/orchestrator/stable-keys.ts

@@ -13,7 +13,15 @@
 
 import { isGroupTask, outputTakenBack, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
-import { isLiteralPattern, normalizeGlob, relPosix } from '../util/index.js'
+import {
+  checkIgnore,
+  ignoreProbes,
+  isLiteralPattern,
+  normalizeGlob,
+  relPosix,
+  taskGlob,
+  wholeIgnored,
+} from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
 import { foldedDeps } from './keyed-projects.js'
 import {
@@ -116,6 +124,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
     if (list === undefined) outputsOf.set(n.projectName, [...files])
     else list.push(...files)
   }
+  const readableOf = readableOutputs(outputsOf, args.nodes, args.workspaceRoot, args.gitFilesCache)
   const rewritersById = new Map<string, ProjectSet>()
   const unfoldedById = new Map<string, ProjectSet>()
   const wsRewriters = new Set<string>()
@@ -277,6 +286,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
         {
           wide: unfolded === undefined ? wide : wide === undefined ? unfolded : wide.or(unfolded),
           outputsOf,
+          readableOf,
         },
       )
     if (unstable) unstableById.add(id)
@@ -299,6 +309,90 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   return stableKeys
 }
 
+/**
+ * The same-project outputs a reader's inputs reach, root-relative, each with
+ * its project dir and project-relative glob: the outputs the gate would key
+ * a reader late over, unless git ignores them (`askIgnoredOutputs`).
+ */
+export function gatedOutputs(
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string,
+): Map<string, { projectDir: string; glob: string }> {
+  const out = new Map<string, { projectDir: string; glob: string }>()
+  // Each project's positive outputs with their literal heads, read once:
+  // 1,000 projects' tasks spent 5-8 ms here re-splitting the same globs.
+  const outputsOf = new Map<string, { glob: string; head: string }[]>()
+  for (const n of nodes.values()) {
+    const files = n.config.cache?.outputs.files
+    if (files === undefined || files.length === 0) continue
+    let list = outputsOf.get(n.projectName)
+    if (list === undefined) outputsOf.set(n.projectName, (list = []))
+    for (const glob of files)
+      if (!glob.startsWith('!')) list.push({ glob, head: literalPrefix(glob) })
+  }
+  if (outputsOf.size === 0) return out
+  for (const n of nodes.values()) {
+    const inputs = n.config.cache?.inputs?.files
+    const outputs = outputsOf.get(n.projectName)
+    if (inputs === undefined || outputs === undefined || isGroupTask(n)) continue
+    let back: string[] | undefined
+    let rel: string | undefined
+    for (const { glob: o, head } of outputs) {
+      if (!workspaceInputsReach(inputs, [head])) continue
+      rel ??= relPosix(workspaceRoot, n.projectDir)
+      back ??= inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
+      const rooted = rel === '' ? o : `${rel}/${o}`
+      if (out.has(rooted) || (back.length > 0 && outputTakenBack(o, back))) continue
+      out.set(rooted, { projectDir: n.projectDir, glob: o })
+    }
+  }
+  return out
+}
+
+/**
+ * Asks git which of `gated` it ignores, started beside the run's
+ * enumeration; the call it returns settles `files.ignoredOutputs` once that
+ * enumeration is in, whose listing says whether a tracked or re-included
+ * file lies under a glob. Nothing gated: no spawn.
+ */
+export function askIgnoredOutputs(
+  gated: ReadonlyMap<string, { projectDir: string; glob: string }>,
+  workspaceRoot: string,
+): (files: GitFilesCache) => Promise<void> {
+  if (gated.size === 0) return async () => {}
+  const paths = [...gated.keys()].flatMap((g) => ignoreProbes(g)?.paths ?? [])
+  const asked = paths.length === 0 ? Promise.resolve(null) : checkIgnore(workspaceRoot, paths)
+  return async (files) => {
+    files.ignoredOutputs = wholeIgnored(gated.keys(), await asked, (g) => {
+      const { projectDir, glob } = gated.get(g)!
+      const listed = files.get(projectDir)
+      return listed === undefined || listed.some((f) => taskGlob(glob).match(f))
+    })
+  }
+}
+
+/** `outputsOf` less what git ignores whole; the same map when it ignores none. */
+function readableOutputs(
+  outputsOf: ReadonlyMap<string, string[]>,
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string,
+  files: GitFilesCache,
+): ReadonlyMap<string, readonly string[]> {
+  const ignored = files.ignoredOutputs
+  if (ignored.size === 0) return outputsOf
+  const dirOf = new Map<string, string>()
+  for (const n of nodes.values()) dirOf.set(n.projectName, relPosix(workspaceRoot, n.projectDir))
+  const out = new Map<string, readonly string[]>()
+  for (const [project, outputs] of outputsOf) {
+    const rel = dirOf.get(project)!
+    out.set(
+      project,
+      outputs.filter((o) => !ignored.has(rel === '' ? o : `${rel}/${o}`)),
+    )
+  }
+  return out
+}
+
 const probesAfterWritesOf = new WeakMap<ReadonlyMap<string, TaskNode>, ReadonlySet<string>>()
 
 /**
@@ -452,6 +546,8 @@ export function dependsOnSiblingOutputs(
     wide: ProjectNames | undefined
     /** Each project's declared `outputs.files`, over all its tasks. */
     outputsOf: ReadonlyMap<string, readonly string[]>
+    /** The same less what git ignores whole: no key reads those. */
+    readableOf?: ReadonlyMap<string, readonly string[]>
   },
 ): boolean {
   const cache = node.config.cache
@@ -473,8 +569,10 @@ export function dependsOnSiblingOutputs(
     // key: `['**/*', '!dist/**']` beside a `dist/**` producer keys the same
     // before and after it, which is what `run.rules.upfrontKeys` asks a config
     // to write (X-54).
+    // Nor is an output git ignores whole: a key reads only what git lists.
+    const readable = sameProject.readableOf?.get(node.projectName) ?? outputs
     const back = inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
-    const reach = back.length === 0 ? outputs : outputs.filter((o) => !outputTakenBack(o, back))
+    const reach = back.length === 0 ? readable : readable.filter((o) => !outputTakenBack(o, back))
     if (reach.length > 0 && workspaceInputsReach(inputs, reach.map(literalPrefix))) return true
     // Nor where it WRITES inside another task's tree: restored ahead of
     // that producer, its restore raced the producer's clean and extract
@@ -546,14 +644,20 @@ export function workspaceInputsReach(
 
 /** A glob's leading literal segments, `''` when its first holds a wildcard. */
 function literalPrefix(glob: string): string {
+  let prefix = literalPrefixes.get(glob)
+  if (prefix !== undefined) return prefix
   const literal: string[] = []
   for (const seg of normalizeGlob(glob).split('/')) {
     if (!isLiteralPattern(seg)) break
     literal.push(seg)
   }
-  return literal.join('/')
+  literalPrefixes.set(glob, (prefix = literal.join('/')))
+  return prefix
 }
 
+/** Per glob string, which the configs bound: every task repeats a few. */
+const literalPrefixes = new Map<string, string>()
+
 /** What the stability gate reads of a set of project names. */
 interface ProjectNames extends Iterable<string> {
   has(name: string): boolean

package/src/orchestrator/steps.ts

@@ -0,0 +1,50 @@
+// vx's own steps (reading the lock, keying, uploads, teardown) rendered as
+// tasks (M, 2026-10-15): `vx:<step>`, and `<plugin package>:setup` /
+// `:teardown`. `:` is no task id's separator, so a step never collides with
+// a project named `vx` or a plugin package's own `#setup` task. A step is
+// not a task: no stat, history row or telemetry record counts it.
+import type { Logger } from '../report/index.js'
+
+export interface Steps {
+  /** Time `work` as step `id` when steps show; else run it as it is. */
+  step<T>(id: string, work: () => Promise<T>): Promise<T>
+  stepSync<T>(id: string, work: () => T): T
+}
+
+const unseen: Steps = {
+  step: (_id, work) => work(),
+  stepSync: (_id, work) => work(),
+}
+
+/** Steps that tell `log`, or none when nothing renders them (zero cost). */
+export function createSteps(log: Logger, shown: boolean): Steps {
+  if (!shown) return unseen
+  const end = (id: string, t0: number, ok: boolean): void =>
+    log.stepEnd?.(id, { durationMs: performance.now() - t0, ok })
+  return {
+    async step(id, work) {
+      const t0 = performance.now()
+      log.stepStart?.(id)
+      let ok = false
+      try {
+        const value = await work()
+        ok = true
+        return value
+      } finally {
+        end(id, t0, ok)
+      }
+    },
+    stepSync(id, work) {
+      const t0 = performance.now()
+      log.stepStart?.(id)
+      let ok = false
+      try {
+        const value = work()
+        ok = true
+        return value
+      } finally {
+        end(id, t0, ok)
+      }
+    },
+  }
+}

package/src/orchestrator/task-hash.ts

@@ -13,6 +13,7 @@ import {
   racyWindowMs,
   resolveInputs,
   type GitFilesCache,
+  type TaskInputComponent,
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { InputFile, TaskInputs } from '../exec/index.js'
@@ -52,20 +53,6 @@ export function createHashCache(): HashCache {
   }
 }
 
-/**
- * One cache-key component captured at hash time. On a cache MISS the
- * orchestrator persists these to `entry_inputs` (keyed by the entry
- * hash, inside the save transaction) so a later run can diff its inputs
- * against this one (the Tier-3 "why did this re-run?" moat). A cache
- * HIT never saves, so it captures nothing — the warm path is free.
- * Mirrors `Cache.key()`'s fold-site rows one-for-one.
- */
-export interface TaskInputComponent {
-  kind: string
-  name: string
-  hash: string
-}
-
 export interface ComputeHashArgs {
   node: TaskNode
   upstream: TaskOutcome[]
@@ -94,8 +81,8 @@ export interface ComputeHashArgs {
 /**
  * Resolve every input the cache key depends on (file content, env
  * values, upstream hashes, config bytes, forwardArgs) and ask the cache layer to combine them. Used by both
- * `executeTask` for the real run and `plan()` for `--dry-run` /
- * `--graph` previews.
+ * `executeTask` for the real run and `plan()` for `--dry`
+ * previews.
  *
  * Caller is responsible for handling the group-task case before
  * calling this — groups have no `exec` and no `cache.inputs`, so the

package/src/orchestrator/task-log-buffer.ts

@@ -21,7 +21,7 @@
 // task printed nothing".
 
 import type { TaskStatus } from '../graph/index.js'
-import type { CacheSource } from './telemetry.js'
+import type { CacheSource } from '../graph/index.js'
 
 /** Version of the drained-bundle shape below. It is the canonical drained
  *  logs format, not one transport's: every sink ships the same object. */

package/src/orchestrator/task-process.ts

@@ -0,0 +1,94 @@
+// What a task's process runs with (its env, its timeout) and what an
+// undeclared write costs the run's memos. Shared by the one-shot path
+// (execute-task.ts) and the server path (persistent-task.ts).
+
+import path from 'node:path'
+import type { ExecConfig } from '../config.js'
+import type { GitFilesCache } from '../cache/index.js'
+import {
+  buildIsolatedEnv,
+  packageManagerPath,
+  PM_EXEC_ENV,
+  VX_RUN_TASK_ENV,
+  VX_RUN_WORKSPACE_ENV,
+} from '../exec/index.js'
+import type { TaskNode } from '../graph/index.js'
+import { parseDuration } from '../util/index.js'
+
+/**
+ * Drop the run's facts about files a task may have written without
+ * declaring them (`undeclaredWriteReach`): the project's git snapshot and
+ * its index OIDs. The next reader
+ * re-enumerates the project (one `git ls-files`) and hashes its files by
+ * content; the per-declaration file-list memos are keyed on the snapshot
+ * array, so they miss with it (item 743).
+ */
+export function forgetUndeclaredWrites(
+  args: { node: TaskNode; gitFilesCache?: GitFilesCache | undefined },
+  reach: 'none' | 'project' | 'workspace',
+): void {
+  if (reach === 'none') return
+  if (reach === 'workspace') {
+    args.gitFilesCache?.clear()
+    return
+  }
+  args.gitFilesCache?.delete(args.node.projectDir)
+  args.gitFilesCache?.invalidateWorkspacePartition()
+}
+
+/** The two bin directories a task's PATH starts with: its own, then the root's (once when they coincide). */
+export function taskBinDirs(node: TaskNode, workspaceRoot: string): string[] {
+  const bins = [path.join(node.projectDir, 'node_modules', '.bin')]
+  const rootBin = path.join(workspaceRoot, 'node_modules', '.bin')
+  // Identical when the root is itself a project — dedupe rather than list it
+  // twice, so PATH reads the same either way.
+  if (rootBin !== bins[0]) bins.push(rootBin)
+  return bins
+}
+
+/**
+ * Build the child-process env for one task. Same arguments at every call site
+ * (persistent + cached). Two `node_modules/.bin` directories are prepended to
+ * PATH: the project's own, then the WORKSPACE ROOT's. Never a sibling
+ * project's, and never an arbitrary ancestor — that is the project-isolation
+ * rule, and the root is not a sibling.
+ *
+ * The root entry is where a monorepo's shared tooling actually lives: declare
+ * `oxlint` once as a root devDependency and every member's `.bin` is empty of
+ * it. Without the root on PATH such a task exits 127, which is what this
+ * repo's own gate did the moment core stopped BEING the root and the two
+ * paths stopped coinciding. It also removes a divergence that mattered more:
+ * the REAPI executor already rebuilds both entries in the action's command,
+ * so a task that resolved on a worker failed on the machine that submitted
+ * it. npm/pnpm/yarn all put the ancestor chain on PATH for the same reason.
+ */
+export function taskEnv(
+  node: TaskNode,
+  step: ExecConfig,
+  workspaceRoot: string,
+): NodeJS.ProcessEnv {
+  const bins = taskBinDirs(node, workspaceRoot)
+  const env = buildIsolatedEnv({
+    passThrough: step.env?.passThrough ?? [],
+    define: step.env?.define ?? {},
+    source: process.env,
+    binPaths: bins,
+  })
+  env[VX_RUN_WORKSPACE_ENV] = workspaceRoot
+  env[VX_RUN_TASK_ENV] = node.id
+  // A task's own passThrough or define wins.
+  if (env[PM_EXEC_ENV] === undefined) {
+    const manager = packageManagerPath(workspaceRoot)
+    if (manager !== null) env[PM_EXEC_ENV] = manager
+  }
+  return env
+}
+
+/** A task's own `exec.timeout` in ms; the schema has checked its form. */
+export function taskTimeoutMs(step: ExecConfig): number | undefined {
+  return step.timeout === undefined ? undefined : parseDuration(step.timeout)!
+}
+
+export function isAborted(signal: AbortSignal | undefined): boolean {
+  return signal?.aborted === true
+}

package/src/orchestrator/telemetry-host.ts

@@ -11,7 +11,7 @@
 //
 // See docs/design/observability-architecture-2026-06.md §1, §3.
 
-import type { EventBus } from './events.js'
+import type { EventBus } from '../report/index.js'
 import type { TaskNode } from '../graph/index.js'
 import type {
   RunContextRecord,

package/src/orchestrator/telemetry.ts

@@ -18,6 +18,9 @@
 
 import { sampleTrees } from '../exec/index.js'
 import {
+  type CacheSource,
+  deriveCacheSource,
+  isCacheHit,
   isGroupTask,
   type InputChanges,
   type TaskNode,
@@ -25,88 +28,10 @@ import {
   type TaskStatus,
 } from '../graph/index.js'
 import { maskedCommand, settleWithin, teardownTimeoutMs } from '../util/index.js'
-import type { RunEvent, RunEventSubscriber } from './events.js'
+import type { RunEvent, RunEventSubscriber } from '../report/index.js'
 
 /** Bumped when the record shape changes. Readers MUST check `v`. */
-export const TELEMETRY_SCHEMA_VERSION = 3
-
-/** Where a task's result came from, derived ONCE in core from the status. */
-export type CacheSource = 'miss' | 'local' | 'remote' | 'none'
-
-/**
- * Map a task outcome status to its cache source. `success`/`failed` ran
- * (a miss as far as the cache read is concerned); the two cache-hit
- * statuses restored from local/remote; `skipped`/`aborted` never engaged
- * the cache. Pure function — the single place this mapping is decided;
- * `isCacheHit` below is derived from it rather than re-listing the two
- * hit statuses, so there is one decision, not two that can disagree.
- */
-export function deriveCacheSource(status: TaskStatus): CacheSource {
-  switch (status) {
-    case 'cache-hit':
-      return 'local'
-    case 'cache-hit-remote':
-      return 'remote'
-    case 'success':
-    case 'failed':
-      return 'miss'
-    case 'skipped':
-    case 'aborted':
-      return 'none'
-  }
-}
-
-/**
- * Whether each status counts as a PASS. Written as a `Record<TaskStatus, …>`
- * rather than a `new Set([...])` on purpose: a Record must name every member,
- * so adding a status to the union is a COMPILE error HERE and the omission
- * cannot ship. A Set of string literals has no such tripwire — it silently
- * answers `false` for the new member, which is how ten hand-rolled copies of
- * this vocabulary accumulated across core, cloud and the dashboard.
- */
-const PASSES: Record<TaskStatus, boolean> = {
-  success: true,
-  'cache-hit': true,
-  'cache-hit-remote': true,
-  failed: false,
-  skipped: false,
-  aborted: false,
-}
-
-/**
- * Every `TaskStatus`, at runtime. Read off `PASSES`'s keys, which the
- * `Record<TaskStatus, …>` type guarantees is exactly the union — so this is
- * derived, not a second list that can fall behind. Exported so a consumer that
- * cannot import the type (a test asserting a copy of this vocabulary in
- * another package agrees) can still enumerate the real set.
- */
-export const TASK_STATUSES: readonly TaskStatus[] = Object.keys(PASSES) as TaskStatus[]
-
-/**
- * Did the task pass? A cache hit counts — it produced the same result without
- * spending the time, which is the whole point. `skipped` and `aborted` do NOT:
- * neither finished on its own terms, so neither can vouch for anything.
- *
- * Takes `string`, not `TaskStatus`, because most callers hold a status that
- * arrived over a wire or out of a database column. An unrecognised string
- * reads as NOT passing — the safe direction, since the alternative is calling
- * a run green on a status this build has never heard of.
- */
-export function isPassStatus(status: string): boolean {
-  return PASSES[status as TaskStatus] === true
-}
-
-/**
- * Did the task's result come out of the cache (either layer)? Derived from
- * `deriveCacheSource` rather than re-listing the two hit statuses, so the two
- * cannot disagree about what a hit is. Unknown strings read as not-a-hit.
- */
-export function isCacheHit(status: string): boolean {
-  // No known-status guard: an unknown string falls through the switch to
-  // undefined, which is neither hit source (the guard survived item 654).
-  const source = deriveCacheSource(status as TaskStatus)
-  return source === 'local' || source === 'remote'
-}
+export const TELEMETRY_SCHEMA_VERSION = 4
 
 /** Identifies which run a record belongs to + its captured context. Maps
  *  cleanly onto OTel CI/CD + VCS resource attributes. */
@@ -162,8 +87,6 @@ export interface RunContextRecord {
   host: string | null
   os: string
   arch: string
-  /** `--tag k=v` pairs. */
-  tags: Readonly<Record<string, string>>
 }
 
 /** One attempt of a retried task that failed and was run again. */

package/src/{orchestrator → report}/events.ts

@@ -16,7 +16,7 @@ import type { RunContext } from './summary.js'
 /**
  * A task no cache answered for: it declares no `cache`, or the run's policy
  * read and wrote nothing. Its run is `no-cache`, never a miss, on every
- * surface — `--dry`'s plan, the frame, the footer, `--report`, `--summarize`.
+ * surface — `--dry`'s plan, the frame, the footer, the run history.
  */
 export function ranNoCache(o: { node: TaskNode; cacheOff?: boolean }): boolean {
   return o.node.config.cache === undefined || o.cacheOff === true
@@ -50,7 +50,12 @@ export type RunEvent =
   | { kind: 'task:stderr'; node: TaskNode; chunk: string }
   | { kind: 'task:complete'; node: TaskNode; outcome: TaskOutcome }
   | { kind: 'run:status'; line: string }
+  /** A warning, which the terminal prints on stderr. */
+  | { kind: 'run:status'; line: string; warn: true }
+  | { kind: 'step:start'; id: string }
+  | { kind: 'step:end'; id: string; durationMs: number; ok: boolean }
   | { kind: 'run:end' }
+  | { kind: 'run:done' }
 
 export type RunEventSubscriber = (event: RunEvent) => void
 
@@ -112,11 +117,13 @@ export function busLogger(bus: EventBus): Logger {
   // run() reaches runEnd on its success path, in its finally and from a
   // signal; a plugin's onRunEnd hears the first only.
   let ended = false
+  let done = false
   // A status line carries plugin warnings, and a remote layer's warning
   // quotes the server's reply, which may echo what it was sent (L-40).
   const secrets = secretMask([process.env])
   return {
     status: (line) => bus.emit({ kind: 'run:status', line: secrets?.mask(line) ?? line }),
+    warn: (line) => bus.emit({ kind: 'run:status', line: secrets?.mask(line) ?? line, warn: true }),
     taskStdout: (node, chunk) => bus.emit({ kind: 'task:stdout', node, chunk }),
     taskStderr: (node, chunk) => bus.emit({ kind: 'task:stderr', node, chunk }),
     taskComplete: (node, outcome) => bus.emit({ kind: 'task:complete', node, outcome }),
@@ -127,6 +134,13 @@ export function busLogger(bus: EventBus): Logger {
       ended = true
       bus.emit({ kind: 'run:end' })
     },
+    stepStart: (id) => bus.emit({ kind: 'step:start', id }),
+    stepEnd: (id, info) => bus.emit({ kind: 'step:end', id, ...info }),
+    runDone: () => {
+      if (done) return
+      done = true
+      bus.emit({ kind: 'run:done' })
+    },
   }
 }
 
@@ -156,11 +170,21 @@ export function terminalSubscriber(sink: Logger): RunEventSubscriber {
         sink.taskComplete(event.node, event.outcome)
         return
       case 'run:status':
-        sink.status(event.line)
+        if ('warn' in event && sink.warn !== undefined) sink.warn(event.line)
+        else sink.status(event.line)
+        return
+      case 'step:start':
+        sink.stepStart?.(event.id)
+        return
+      case 'step:end':
+        sink.stepEnd?.(event.id, { durationMs: event.durationMs, ok: event.ok })
         return
       case 'run:end':
         sink.runEnd?.()
         return
+      case 'run:done':
+        sink.runDone?.()
+        return
     }
   }
 }
@@ -234,9 +258,8 @@ export interface OutcomeView {
   durationMs: number
   /**
    * Group node (no `exec`) — organizational, not work. `TaskView` carries
-   * this too, but a consumer that only holds outcomes (the `--report`
-   * writer) has no node to ask, and counting groups as executed tasks is
-   * exactly how it drifted from the terminal and `--summarize`.
+   * this too, but a consumer that only holds outcomes has no node to ask,
+   * and counting groups as executed tasks drifts from the terminal.
    */
   isGroup?: boolean
   /** Executed with no `cache` block: never consulted the cache, not a miss. */
@@ -329,7 +352,7 @@ export function skippedReason(blockedBy: string | undefined): string {
 }
 
 /** `skipped (blocked by lib#build)`, or a bare `skipped` for fail-fast's. */
-export function skippedLabel(blockedBy: string | undefined): string {
+function skippedLabel(blockedBy: string | undefined): string {
   const why = skippedReason(blockedBy)
   return why === '' ? 'skipped' : `skipped (${why})`
 }
@@ -439,7 +462,12 @@ export type WireEvent =
   | { kind: 'task:stderr'; taskId: string; chunk: string }
   | { kind: 'task:complete'; outcome: OutcomeView }
   | { kind: 'run:status'; line: string }
+  /** A warning, which the terminal prints on stderr. */
+  | { kind: 'run:status'; line: string; warn: true }
+  | { kind: 'step:start'; id: string }
+  | { kind: 'step:end'; id: string; durationMs: number; ok: boolean }
   | { kind: 'run:end' }
+  | { kind: 'run:done' }
 
 /** Map an in-process event to its serializable wire form. */
 export function toWireEvent(event: RunEvent): WireEvent {
@@ -455,8 +483,13 @@ export function toWireEvent(event: RunEvent): WireEvent {
     case 'task:complete':
       return { kind: 'task:complete', outcome: projectOutcome(event.outcome) }
     case 'run:status':
-      return { kind: 'run:status', line: event.line }
+      return 'warn' in event
+        ? { kind: 'run:status', line: event.line, warn: true }
+        : { kind: 'run:status', line: event.line }
+    case 'step:start':
+    case 'step:end':
     case 'run:end':
-      return { kind: 'run:end' }
+    case 'run:done':
+      return event
   }
 }