@vzn/vx 0.0.638 → 0.0.640

package/src/cli/upgrade.ts

@@ -10,6 +10,8 @@
 // package manager (npm, pnpm, bun, yarn; global or a project's
 // dependency) is upgraded by that package manager, never by a rename over
 // a file it owns. vx never installs Node or a package manager.
+// Handed a call by a global vx, the project's vx moves that global too,
+// to the same version (`upgradeGlobal`).
 // Named `upgrade` (not `update`) per CLI convention: bun upgrade,
 // deno upgrade — "update" is what package managers do to indexes.
 
@@ -110,13 +112,18 @@ export function versionSpec(tag: string | undefined): string {
  * as an internal error with a stack (a network namespace without a
  * route, 2026-09-16). One line, the host and the reason.
  */
-async function fetchOrRefuse(url: string, init: RequestInit, what: string): Promise<Response> {
+async function fetchOrRefuse(
+  url: string,
+  init: RequestInit,
+  what: string,
+  verb = 'vx upgrade',
+): Promise<Response> {
   try {
     return await fetch(url, init)
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
     throw new UserError(
-      `vx upgrade: could not reach ${new URL(url).host} to ${what} (${message}) — check the network or the proxy and re-run`,
+      `${verb}: could not reach ${new URL(url).host} to ${what} (${message}) — check the network or the proxy and re-run`,
     )
   }
 }
@@ -128,33 +135,43 @@ async function fetchOrRefuse(url: string, init: RequestInit, what: string): Prom
  * connection was closed unexpectedly"), which `fetchOrRefuse` never sees
  * and the CLI printed as an internal error with a stack.
  */
-async function readOrRefuse<T>(read: () => Promise<T>, url: string, what: string): Promise<T> {
+async function readOrRefuse<T>(
+  read: () => Promise<T>,
+  url: string,
+  what: string,
+  verb = 'vx upgrade',
+): Promise<T> {
   try {
     return await read()
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
     throw new UserError(
-      `vx upgrade: could not ${what} from ${new URL(url).host} (${message}) — nothing replaced; check the network or the proxy and re-run`,
+      `${verb}: could not ${what} from ${new URL(url).host} (${message}) — nothing replaced; check the network or the proxy and re-run`,
     )
   }
 }
 
 /** The registry's document for `pkg@spec` (`latest` or a version). */
-export async function fetchManifest(pkg: string, spec: string): Promise<unknown> {
+export async function fetchManifest(
+  pkg: string,
+  spec: string,
+  verb = 'vx upgrade',
+): Promise<unknown> {
   const url = `${REGISTRY}/${pkg}/${spec}`
   const res = await fetchOrRefuse(
     url,
     { redirect: 'follow', headers: { Accept: 'application/json', 'User-Agent': `vx/${VERSION}` } },
     'read the release',
+    verb,
   )
   if (!res.ok) {
     throw new UserError(
-      `vx upgrade: could not read ${pkg}@${spec} from the npm registry (${res.status})${res.status === 404 && spec !== 'latest' ? ` — is ${spec} a published version?` : ''}`,
+      `${verb}: could not read ${pkg}@${spec} from the npm registry (${res.status})${res.status === 404 && spec !== 'latest' ? ` — is ${spec} a published version?` : ''}`,
     )
   }
   // A body that is not JSON (a captive portal's page, a proxy's error
   // page served with a 200) is the same refusal as a cut one.
-  return await readOrRefuse(() => res.json(), url, 'read the release')
+  return await readOrRefuse(() => res.json(), url, 'read the release', verb)
 }
 
 /** What a verified registry document names: the version, its tarball and the signed integrity. */
@@ -290,17 +307,19 @@ export function binaryFromTarball(tgz: Uint8Array): Uint8Array {
 /**
  * The binary of `pkg@spec`, verified: the registry document's signature,
  * then the tarball's integrity, then the extraction, each refusing before
- * the next step runs. Null when the release is this vx's own version;
- * `announce` hears the version before the download starts.
+ * the next step runs. Null when the release is `current`, the version of
+ * the vx being replaced; `announce` hears the version before the download
+ * starts.
  */
 export async function releaseBinary(
   pkg: string,
   spec: string,
   announce: (version: string) => void,
   key: SigningKey = NPM_SIGNING_KEY,
+  current = VERSION,
 ): Promise<Uint8Array | null> {
   const release = verifiedRelease(await fetchManifest(pkg, spec), pkg, key)
-  if (release.version === VERSION) return null
+  if (release.version === current) return null
   announce(release.version)
   return binaryFromTarball(await downloadVerified(release))
 }
@@ -391,6 +410,8 @@ export interface ManagedInstall {
   cwd: string
   /** The project field that lists `@vzn/vx`. */
   field?: 'dependencies' | 'devDependencies' | 'optionalDependencies'
+  /** The `@vzn/vx-*` plugins the same package.json lists from the registry, moved with core. */
+  plugins?: string[]
 }
 
 const FIELDS = ['devDependencies', 'dependencies', 'optionalDependencies'] as const
@@ -413,6 +434,45 @@ function listingField(dir: string): ManagedInstall['field'] | undefined {
   })
 }
 
+/** A release's platform binary, which the launcher pulls in itself: no plugin. */
+const PLATFORM = /^@vzn\/vx-(?:darwin|linux)-(?:x64|arm64)$/
+
+/**
+ * The `@vzn/vx-*` plugins `dir`'s package.json lists from the registry
+ * (a `workspace:` or `file:` link is the repo's own). Every @vzn package
+ * releases together, so they move with core in its one install (M,
+ * 2026-10-16); one in another field would move fields under core's flag,
+ * so it is refused.
+ */
+function pluginsBeside(dir: string, field: NonNullable<ManagedInstall['field']>): string[] {
+  const pkg = readJson(path.join(dir, 'package.json'))
+  const plugins: string[] = []
+  for (const f of FIELDS) {
+    const deps = pkg?.[f]
+    if (typeof deps !== 'object' || deps === null) continue
+    for (const [name, spec] of Object.entries(deps as Record<string, unknown>)) {
+      if (!name.startsWith(`${PACKAGE}-`) || PLATFORM.test(name)) continue
+      if (typeof spec !== 'string' || /^(?:workspace|file|link|portal):/.test(spec)) continue
+      if (f !== field) {
+        throw new UserError(
+          `vx upgrade: ${name} is in ${f} and ${PACKAGE} in ${field}; list them in one field so one install moves them together`,
+        )
+      }
+      plugins.push(name)
+    }
+  }
+  return plugins.sort()
+}
+
+/** The version of `pkg` installed where `dir` resolves it, if any. */
+function installedVersion(dir: string, pkg: string): string | undefined {
+  for (let d = dir; ; d = path.dirname(d)) {
+    const v = readJson(path.join(d, 'node_modules', pkg, 'package.json'))?.['version']
+    if (typeof v === 'string') return v
+    if (path.dirname(d) === d) return undefined
+  }
+}
+
 /** The project's package manager: its lockfile, then `packageManager`, then the tree's shape. */
 function projectManager(dir: string, execPath: string): ManagedInstall['manager'] {
   for (let d = dir; ; d = path.dirname(d)) {
@@ -459,12 +519,15 @@ export function managedInstall(execPath: string, cwd: string): ManagedInstall |
   if (/\/yarn\/global\//.test(p)) return { manager: 'yarn', scope: 'global', cwd: root }
   const field = listingField(root)
   if (field !== undefined) {
-    return { manager: projectManager(root, execPath), scope: 'project', cwd: root, field }
+    const plugins = pluginsBeside(root, field)
+    return { manager: projectManager(root, execPath), scope: 'project', cwd: root, field, plugins }
   }
   for (let d = path.resolve(cwd); d.startsWith(root); d = path.dirname(d)) {
     const f = listingField(d)
-    if (f !== undefined)
-      return { manager: projectManager(d, execPath), scope: 'project', cwd: d, field: f }
+    if (f !== undefined) {
+      const plugins = pluginsBeside(d, f)
+      return { manager: projectManager(d, execPath), scope: 'project', cwd: d, field: f, plugins }
+    }
     if (path.dirname(d) === d) break
   }
   // npm's global tree: `<prefix>/lib/node_modules` (nvm, volta, Homebrew alike).
@@ -499,7 +562,8 @@ export function upgradeArgv(install: ManagedInstall, version: string): string[]
     bun: { devDependencies: '--dev', dependencies: '', optionalDependencies: '--optional' },
     yarn: { devDependencies: '--dev', dependencies: '', optionalDependencies: '--optional' },
   }[manager][field]
-  const argv = manager === 'npm' ? ['npm', 'install', spec] : [manager, 'add', spec]
+  const specs = [spec, ...(install.plugins ?? []).map((p) => `${p}@${version}`)]
+  const argv = manager === 'npm' ? ['npm', 'install', ...specs] : [manager, 'add', ...specs]
   if (flag !== '') argv.push(flag)
   // pnpm refuses an `add` at a workspace's root without saying it means the root.
   if (manager === 'pnpm' && existsSync(path.join(install.cwd, 'pnpm-workspace.yaml')))
@@ -507,26 +571,40 @@ export function upgradeArgv(install: ManagedInstall, version: string): string[]
   return argv
 }
 
-/** The version `tag` names, or the registry's latest, read for the "already at" check. */
-async function targetVersion(tag: string | undefined): Promise<string> {
+/**
+ * The version `tag` names, or the registry's latest: read for the "already
+ * at" check, and by `vx init`, which always installs the latest release.
+ */
+export async function targetVersion(tag: string | undefined, verb = 'vx upgrade'): Promise<string> {
   const spec = versionSpec(tag)
   if (spec !== 'latest') return spec
-  const v = ((await fetchManifest(PACKAGE, 'latest')) as { version?: unknown } | null)?.version
+  const v = ((await fetchManifest(PACKAGE, 'latest', verb)) as { version?: unknown } | null)
+    ?.version
   if (typeof v !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(v)) {
-    throw new UserError(`vx upgrade: the npm registry named no latest version of ${PACKAGE}`)
+    throw new UserError(`${verb}: the npm registry named no latest version of ${PACKAGE}`)
   }
   return v
 }
 
-/** Run the package manager that owns this vx; vx never installs one. */
-async function upgradeManaged(install: ManagedInstall, tag: string | undefined): Promise<number> {
-  const version = await targetVersion(tag)
-  if (version === VERSION) {
-    ui.print('out', ui.status('info', 'vx upgrade', `already at ${VERSION}`))
-    return 0
+/**
+ * Run the package manager that owns a vx at `current` to bring it to
+ * `version`; vx never installs one. `step` names the install when a run
+ * moves two (`project `, `global `).
+ */
+export async function upgradeManaged(
+  install: ManagedInstall,
+  version: string,
+  current = VERSION,
+  step = '',
+): Promise<void> {
+  const plugins = install.plugins ?? []
+  if (version === current && plugins.every((p) => installedVersion(install.cwd, p) === version)) {
+    ui.print('out', ui.status('info', 'vx upgrade', `${step}already at ${current}`))
+    return
   }
   const argv = upgradeArgv(install, version)
-  const bin = Bun.which(argv[0]!)
+  // PATH as it is now: `Bun.which` alone reads the one the process started with.
+  const bin = Bun.which(argv[0]!, { PATH: process.env['PATH'] ?? '' })
   if (bin === null) {
     throw new UserError(
       `vx upgrade: this vx was installed by ${argv[0]}, which is not on PATH — vx does not install package managers; run it yourself: ${argv.join(' ')} (in ${install.cwd})`,
@@ -534,7 +612,11 @@ async function upgradeManaged(install: ManagedInstall, tag: string | undefined):
   }
   ui.print(
     'out',
-    ui.status('info', 'vx upgrade', `${VERSION} → ${version}`),
+    ui.status(
+      'info',
+      'vx upgrade',
+      `${step}${version === current ? 'plugins' : current} → ${version}`,
+    ),
     ui.text([ui.cmd(argv.join(' ')), ui.dim(` in ${install.cwd}`)]),
   )
   const proc = Bun.spawnSync({
@@ -544,10 +626,100 @@ async function upgradeManaged(install: ManagedInstall, tag: string | undefined):
   })
   if (proc.exitCode !== 0) {
     throw new UserError(
-      `vx upgrade: ${argv.join(' ')} failed (exit ${proc.exitCode}) — vx changed nothing itself`,
+      `vx upgrade: ${argv.join(' ')} failed (exit ${proc.exitCode}) — vx changed nothing itself${
+        // The install is pinned, so pnpm refuses a release younger than
+        // its minimumReleaseAge instead of mixing releases; its words
+        // print above, so the way out is named (as vx-migrate does).
+        install.manager === 'pnpm'
+          ? `; if pnpm refused a version published within its minimumReleaseAge, list ${[PACKAGE, ...plugins].join(', ')} under minimumReleaseAgeExclude in pnpm-workspace.yaml`
+          : ''
+      }`,
     )
   }
-  return 0
+}
+
+/**
+ * Replace the binary at `dest`, at `current`, with the verified release
+ * `spec` names (`latest` or a version). `step` as in `upgradeManaged`.
+ */
+async function upgradeBinary(
+  dest: string,
+  spec: string,
+  current = VERSION,
+  step = '',
+  key: SigningKey = NPM_SIGNING_KEY,
+): Promise<void> {
+  const pkg = platformPackage()
+  let installed: string | undefined
+  const replaced = await replaceBinary(
+    dest,
+    () =>
+      releaseBinary(
+        pkg,
+        spec,
+        (version) =>
+          ui.print(
+            'out',
+            ui.status('info', 'vx upgrade', `${step}${current} → ${version}`),
+            ui.text(ui.dim(dest)),
+          ),
+        key,
+        current,
+      ),
+    // The replaced binary's own version: the new build speaks for itself
+    // rather than this process guessing, and one that cannot is rolled back.
+    (bin) => {
+      installed = answeredVersion(bin)
+      return installed !== undefined
+    },
+  )
+  ui.print(
+    'out',
+    replaced
+      ? ui.status('ok', 'vx upgrade', `${step}installed ${installed}`)
+      : ui.status('info', 'vx upgrade', `${step}already at ${current}`),
+  )
+}
+
+/** The version `bin --version` answers, without the hand-off note a handed-off run adds. */
+function answeredVersion(bin: string): string | undefined {
+  return startedVersion(bin)?.split(' ')[1]
+}
+
+/**
+ * Bring `from`, the global vx that handed this run to the project's own
+ * (`VX_HANDED_OFF`), to `version`, the way it was installed: a binary
+ * installed by hand is replaced, a package manager's global install is
+ * updated by that manager. A refusal names it.
+ */
+export async function upgradeGlobal(
+  from: string,
+  version: string,
+  key: SigningKey = NPM_SIGNING_KEY,
+): Promise<void> {
+  await named(`global vx ${from}`, async () => {
+    const current = answeredVersion(from)
+    if (current === undefined) {
+      throw new UserError('vx upgrade: it did not answer `--version`, so it is left as it is')
+    }
+    if (current === version) {
+      ui.print('out', ui.status('info', 'vx upgrade', `global already at ${current}`))
+      return
+    }
+    const install = managedInstall(from, path.dirname(from))
+    if (install === null) await upgradeBinary(from, version, current, 'global ', key)
+    else await upgradeManaged(install, version, current, 'global ')
+  })
+}
+
+/** `run`, its refusal naming `what` after the verb: a run that moves two installs says which failed. */
+async function named(what: string, run: () => Promise<void>): Promise<void> {
+  try {
+    await run()
+  } catch (err) {
+    if (!(err instanceof UserError)) throw err
+    throw new UserError(err.message.replace(/^vx upgrade: /, `vx upgrade: ${what}: `), err.code)
+  }
 }
 
 export async function upgradeCmd(args: readonly string[]): Promise<number> {
@@ -575,33 +747,21 @@ export async function upgradeCmd(args: readonly string[]): Promise<number> {
   }
   const dest = process.execPath
   const install = managedInstall(dest, process.cwd())
-  if (install !== null) return await upgradeManaged(install, tag)
-  const pkg = platformPackage()
-  const spec = versionSpec(tag)
-  let installed = ''
-  const replaced = await replaceBinary(
-    dest,
-    () =>
-      releaseBinary(pkg, spec, (version) =>
-        ui.print(
-          'out',
-          ui.status('info', 'vx upgrade', `${VERSION} → ${version}`),
-          ui.text(ui.dim(dest)),
-        ),
-      ),
-    // The replaced binary's own version: the new build speaks for itself
-    // rather than this process guessing, and one that cannot is rolled back.
-    (bin) => {
-      installed = startedVersion(bin) ?? ''
-      return installed !== ''
-    },
-  )
-  ui.print(
-    'out',
-    replaced
-      ? ui.status('ok', 'vx upgrade', `installed ${installed.replace(/^vx /, '')}`)
-      : ui.status('info', 'vx upgrade', `already at ${VERSION}`),
-  )
+  // A global vx handed this run to the project's own: both move, to one
+  // version, the project first (owner, 2026-10-15).
+  const from = process.env['VX_HANDED_OFF']
+  if (from !== undefined) {
+    const version = await targetVersion(tag)
+    await named('project vx', () =>
+      install === null
+        ? upgradeBinary(dest, version, VERSION, 'project ')
+        : upgradeManaged(install, version, VERSION, 'project '),
+    )
+    await upgradeGlobal(from, version)
+    return 0
+  }
+  if (install !== null) await upgradeManaged(install, await targetVersion(tag))
+  else await upgradeBinary(dest, versionSpec(tag))
   return 0
 }
 

package/src/cli/watch-cycle.ts

@@ -5,7 +5,8 @@
 // as Ctrl-C would and the loop starts the next one; a cycle running any
 // other work is never stopped.
 
-import { createEventBus, type RunOptions } from '../orchestrator/index.js'
+import { type RunOptions } from '../orchestrator/index.js'
+import { createEventBus } from '../report/index.js'
 
 export interface WatchCycle {
   /** The options for this cycle's run: its own bus and a stop of its own beside watch's. */

package/src/cli/watch-filter.ts

@@ -2,6 +2,7 @@
 // rules, git-ignored paths, the root arm's filter) and which files reshape
 // the watched set. Pure decisions over paths; the loop acts on them.
 
+import fs from 'node:fs'
 import path from 'node:path'
 import {
   executablePath,
@@ -369,12 +370,14 @@ export function gitSpeller(root: string): (p: string) => string {
  * a project moved away whole is one event on its directory): what existed
  * when watch armed, so a path born and gone since is told from a deletion
  * (watch-judge.ts). `tracked` is the files git tracks: a user edits those,
- * so a server cannot be blamed for one. Undefined when git cannot answer:
+ * so a server cannot be blamed for one. `links` is the symlinks among the
+ * files: a key reads what each points to (cache/linked-inputs.ts), so watch
+ * arms that too. Undefined when git cannot answer:
  * no inventory, every gone path is a deletion as before.
  */
 export function gitFiles(
   workspaceRoot: string,
-): { listed: Set<string>; tracked: Set<string> } | undefined {
+): { listed: Set<string>; tracked: Set<string>; links: Set<string> } | undefined {
   let proc: ReturnType<typeof Bun.spawnSync>
   try {
     proc = Bun.spawnSync({
@@ -383,6 +386,7 @@ export function gitFiles(
         'ls-files',
         '-z',
         '-t',
+        '-s',
         '--cached',
         '--others',
         '--exclude-standard',
@@ -398,18 +402,30 @@ export function gitFiles(
   if (proc.exitCode !== 0) return undefined
   const files = new Set<string>()
   const tracked = new Set<string>()
+  const links = new Set<string>()
   for (const entry of new TextDecoder('utf-8', { ignoreBOM: true })
     .decode(proc.stdout)
     .split('\0')) {
     if (entry.length === 0) continue
-    // `-t` prefixes a tag and a space; `?` is untracked.
-    const p = entry.slice(2)
+    // `-t` prefixes a tag and a space; `?` is untracked, a bare path. A
+    // tracked entry is `-s`'s `<mode> <oid> <stage>\t<path>` after the tag.
+    const untracked = entry[0] === '?'
+    const p = untracked ? entry.slice(2) : entry.slice(entry.indexOf('\t') + 1)
     // An untracked nested repository is listed as `dir/`.
     let abs = path.join(workspaceRoot, p.endsWith('/') ? p.slice(0, -1) : p)
     files.add(abs)
-    if (entry[0] !== '?') tracked.add(abs)
+    if (!untracked) tracked.add(abs)
+    if (untracked ? isLink(abs) : entry.startsWith('120000 ', 2)) links.add(abs)
     for (abs = path.dirname(abs); abs !== workspaceRoot && !files.has(abs); abs = path.dirname(abs))
       files.add(abs)
   }
-  return { listed: files, tracked }
+  return { listed: files, tracked, links }
+}
+
+function isLink(abs: string): boolean {
+  try {
+    return fs.lstatSync(abs).isSymbolicLink()
+  } catch {
+    return false
+  }
 }

package/src/cli/watch-judge.ts

@@ -4,6 +4,7 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
+import { filesBehind } from '../cache/index.js'
 import { xxh3 } from '../util/index.js'
 import { gitIgnored, gitSpeller } from './watch-filter.js'
 import { modifiedBefore } from './watch-fs.js'
@@ -13,9 +14,10 @@ const ABSENT = -1n
 function settledState(abs: string): bigint {
   let st: fs.Stats
   try {
-    // A link is its target string, as the key folds it: following it saw
-    // a retarget to equal bytes as "the same" and ran nothing.
-    if (fs.lstatSync(abs).isSymbolicLink()) return xxh3(`link:${fs.readlinkSync(abs)}`)
+    // A link is its target string and what it points to, as the key folds
+    // it: following it alone saw a retarget to equal bytes as "the same".
+    if (fs.lstatSync(abs).isSymbolicLink())
+      return xxh3(`link:${fs.readlinkSync(abs)}\0${behindState(abs)}`)
     st = fs.statSync(abs)
   } catch {
     return ABSENT
@@ -50,6 +52,34 @@ function settledState(abs: string): bigint {
   return xxh3(Buffer.from(entries.join('\n')))
 }
 
+/**
+ * What a link points to, as change detection reads it: a file's bytes and
+ * mode, a directory's files by size and times (cache/linked-inputs.ts keys
+ * their bytes), nothing for a dangling link.
+ */
+function behindState(link: string): string {
+  let real: string
+  let st: fs.Stats
+  try {
+    real = fs.realpathSync(link)
+    st = fs.statSync(real)
+  } catch {
+    return ''
+  }
+  if (st.isFile()) return `${xxh3(fs.readFileSync(real))}:${st.mode & 0o7777}`
+  if (!st.isDirectory()) return ''
+  return filesBehind(real)
+    .map((rel) => {
+      try {
+        const f = fs.statSync(path.join(real, rel))
+        return `${rel}\0${f.size}\0${f.mtimeMs}\0${f.ctimeMs}`
+      } catch {
+        return rel
+      }
+    })
+    .join('\n')
+}
+
 /** What the judgement reads from the loop, which owns it and may replace it. */
 export interface JudgeContext {
   workspaceRoot: string
@@ -59,6 +89,8 @@ export interface JudgeContext {
   held(): boolean
   /** Projects whose uncached task may read a git-ignored file. */
   uncached(): ReadonlySet<string>
+  /** Paths a task's inputs name outright: a git-ignored file at or under one is an input. */
+  namedIgnored?(): readonly string[]
   /** Whether `abs`, under the project at `ownDir`, lies in a project nested there (`makeFence`). */
   fenced?(ownDir: string, abs: string): boolean
   /** The files git listed at the arm; absent when git could not answer. */
@@ -113,6 +145,15 @@ export class ChangeJudge {
 
   constructor(private readonly ctx: JudgeContext) {}
 
+  /**
+   * Record a path's state as it is, if this loop has not: a link armed for
+   * what it points to, whose own times say "before the arm" whatever
+   * changed behind it, so its first sighting compares against this.
+   */
+  seed(abs: string): void {
+    if (!this.lastState.has(abs)) this.lastState.set(abs, settledState(abs))
+  }
+
   // A path this loop has never judged is a change only if it moved since
   // the watchers went live (its mtime or ctime, `modifiedBefore`). macOS delivers the initial run's own writes
   // AFTER the arm (CI, 2026-09-11: `app dist; re-running...` with no edit
@@ -192,10 +233,13 @@ export class ChangeJudge {
     // user wrote it; one the last cycle wrote (the pid file an uncached
     // task rewrites every run, the loop the filter exists for) stays out,
     // as does one in a project nested under it, which it does not own.
+    // So is one a task's inputs name outright (`.env.local`, `dist/**`).
     const editForUncached = (p: string): boolean =>
-      [...this.ctx.uncached()].some(
+      ([...this.ctx.uncached()].some(
         (dir) => p.startsWith(dir + path.sep) && this.ctx.fenced?.(dir, p) !== true,
-      ) && !this.writtenDuringLastCycle(p)
+      ) ||
+        (this.ctx.namedIgnored?.() ?? []).some((n) => p === n || p.startsWith(n + path.sep))) &&
+      !this.writtenDuringLastCycle(p)
     // A path still there names the cycle before a gone one: an editor or
     // `sed -i` saving through a temporary file fires that file first, and
     // the cycle was announced by a name already renamed away.

package/src/cli/watch-set.ts

@@ -5,6 +5,7 @@
 
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
+import { namedOutright } from '../cache/index.js'
 import {
   buildPackageGraph,
   lockKey,
@@ -64,6 +65,8 @@ export interface ConfigSweep {
   inputs: Map<string, string[][]>
   /** Projects with a task that has a command and no cache: it reads what it likes, git-ignored files included. */
   uncached: Set<string>
+  /** Paths a task's inputs name outright (`namedOutright`), absolute: a git-ignored one is an input. */
+  namedIgnored: string[]
   /** Files the project configs import by relative path (item 949). */
   configImports: string[]
   /** Files the workspace config imports by relative path: loaded once per process (item 949). */
@@ -115,6 +118,7 @@ export async function sweepConfigs(
     addTo(outputs, dir, globs)
   const workspaceInputs = new Set<string>()
   const uncached = new Set<string>()
+  const namedIgnored = new Set<string>()
   const folded: [string, ProjectConfig][] = []
   const fold = (dir: string, config: ProjectConfig): void => {
     folded.push([dir, config])
@@ -131,15 +135,20 @@ export async function sweepConfigs(
       add(dir, task.cache?.outputs?.files)
       add(workspaceRoot, task.cache?.outputs?.workspaceFiles)
       if (names !== null && !names.has(name)) continue
-      if (task.cache === undefined && task.exec !== undefined && task.exec.persistent === undefined)
-        uncached.add(dir)
-      for (const g of task.cache?.inputs?.workspaceFiles ?? []) workspaceInputs.add(g)
-      addInputs(dir, task.cache?.inputs?.files, task.cache?.outputs?.files)
-      addInputs(
-        workspaceRoot,
-        task.cache?.inputs?.workspaceFiles,
-        task.cache?.outputs?.workspaceFiles,
+      if (
+        task.inputs === undefined &&
+        task.exec !== undefined &&
+        task.exec.persistent === undefined
       )
+        uncached.add(dir)
+      if (task.inputs !== undefined && task.exec !== undefined) {
+        const named = namedOutright(task)
+        for (const rel of named.files) namedIgnored.add(path.join(dir, rel))
+        for (const rel of named.workspaceFiles) namedIgnored.add(path.join(workspaceRoot, rel))
+      }
+      for (const g of task.inputs?.workspaceFiles ?? []) workspaceInputs.add(g)
+      addInputs(dir, task.inputs?.files, task.cache?.outputs?.files)
+      addInputs(workspaceRoot, task.inputs?.workspaceFiles, task.cache?.outputs?.workspaceFiles)
     }
   }
   const result = (staged: Map<string, ProjectEntry> | null): ConfigSweep => ({
@@ -148,6 +157,7 @@ export async function sweepConfigs(
     outputs,
     inputs,
     uncached,
+    namedIgnored: [...namedIgnored],
     configImports: [...projectImports],
     workspaceConfigImports: [...wsImports],
     staged,