@vzn/vx 0.0.638 → 0.0.640

package/src/orchestrator/sandbox-fix.ts

@@ -85,7 +85,7 @@ export function sandboxFix(
   projectDir: string,
   mask: (text: string) => string = (t) => t,
   /**
-   * The task's `cache.inputs.files`, undefined when it does not cache: a
+   * The task's `inputs.files`, undefined when it does not cache: a
    * write under one is granted exactly, and a read of the project no glob
    * matches is named for the key too.
    */
@@ -124,19 +124,3 @@ export function sandboxFix(
     if (fix[k].size > 0) out[k] = [...new Set([...fix[k]].map(mask))].sort()
   return Object.keys(out).length > 0 ? out : undefined
 }
-
-/**
- * The fix as the config line it is: `exec.sandbox.allow: { read: ['a'] }`,
- * or undefined when every denial was a withheld credential path.
- */
-export function sandboxFixLine({
-  withheld: _,
-  inputs: __,
-  ...fix
-}: SandboxFix): string | undefined {
-  if (Object.keys(fix).length === 0) return undefined
-  const parts = Object.entries(fix).map(
-    ([k, list]: [string, string[]]) => `${k}: [${list.map((p) => `'${p}'`).join(', ')}]`,
-  )
-  return `exec.sandbox.allow: { ${parts.join(', ')} }`
-}

package/src/orchestrator/sandbox-request.ts

@@ -163,7 +163,7 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
  * cached path (through the executor) and the persistent path (spawned here).
  *
  * The user's grants derive NOTHING from `cache` (owner, 2026-09-05). Those
- * are two different questions: `cache.inputs` says what INVALIDATES the
+ * are two different questions: `inputs` says what INVALIDATES the
  * task, `sandbox.allow` says what it may TOUCH. Deriving one from the other
  * coupled them in both directions — a declaration added for caching
  * silently widened the sandbox, and a path the task needed had to be
@@ -476,7 +476,7 @@ export function withheldLinkLine(taskId: string, w: WithheldLink): string {
     `${w.name}, so an edit there would not re-run it. Add a \`dependsOn\` edge that ` +
     `reaches one (\`^build\` where ${w.name}#build keys its sources, or a \`source\` task: ` +
     `\`${w.name}#source\`), or grant and key the files yourself (\`allow.read\` plus ` +
-    `\`cache.inputs.workspaceFiles\`).`
+    `\`inputs.workspaceFiles\`).`
   )
 }
 

package/src/orchestrator/signals.ts

@@ -16,13 +16,13 @@
 import { signalExitCode } from '../exec/index.js'
 import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
-import type { Logger } from './logger.js'
+import type { Logger } from '../report/index.js'
 
 /**
  * How long a SIGTERMed child gets before SIGKILL on the way out. The
  * end-of-run persistent shutdown grants the same two seconds; both read
- * `VX_RUN_KILL_GRACE` (util/settle.ts) so the suites that prove the
- * escalation do not wait the full grace.
+ * `killGraceMs` (util/settle.ts) so the suites that prove the escalation
+ * do not wait the full grace.
  */
 export const SIGNAL_SHUTDOWN_GRACE_MS = 2000
 
@@ -125,6 +125,13 @@ export function forwardSignals(args: {
 }): SignalForwarding {
   const everyChild = (): Child[] => [...args.liveChildren, ...args.persistentRegistry.values()]
   const exit = (signal: StopSignal): never => {
+    // The run's own end already flushed the log; a second signal cut it
+    // short, so the failure frames it holds print now (idempotent).
+    try {
+      args.log.runEnd?.()
+    } catch {
+      // teardown must not throw on the way out
+    }
     for (const child of everyChild()) killTree(child, 'SIGKILL')
     try {
       args.cache.close()
@@ -152,10 +159,11 @@ export function forwardSignals(args: {
     stopping = signal
     claimExitForSignal()
     // Clear the live worker/status region BEFORE exiting so a TTY isn't
-    // left with a frozen region in the scrollback. runEnd is idempotent
-    // and a no-op for non-TTY loggers.
+    // left with a frozen region in the scrollback. Only the region: the
+    // tasks this stop aborts still list as rows, above the failure frames
+    // the run's own end prints.
     try {
-      args.log.runEnd?.()
+      args.log.runDone?.()
     } catch {
       // teardown must not throw on the way out
     }

package/src/orchestrator/stable-keys.ts

@@ -5,17 +5,30 @@
 // out so the two callers can never drift on the stability gate.
 //
 // A task's key is "stable" only if its inputs can't be altered by an
-// upstream's outputs (a `cache.inputs.files` glob that could match a
+// upstream's outputs (a `inputs.files` glob that could match a
 // sibling's declared output has a PRELIMINARY key until that upstream
 // runs — probing it would target the wrong artifact). Unstable tasks
 // fall back to lazy read-through in execute-task, which is always
 // correct. The check is conservative: when unsure, treat as unstable.
 
-import { isGroupTask, outputTakenBack, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import {
+  foldedDeps,
+  isGroupTask,
+  outputTakenBack,
+  type TaskNode,
+  type TaskOutcome,
+} from '../graph/index.js'
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
-import { isLiteralPattern, normalizeGlob, relPosix } from '../util/index.js'
+import {
+  checkIgnore,
+  ignoreProbes,
+  isLiteralPattern,
+  normalizeGlob,
+  relPosix,
+  taskGlob,
+  wholeIgnored,
+} from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
-import { foldedDeps } from './keyed-projects.js'
 import {
   computeGroupHash,
   computeTaskHash,
@@ -116,16 +129,17 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
     if (list === undefined) outputsOf.set(n.projectName, [...files])
     else list.push(...files)
   }
+  const readableOf = readableOutputs(outputsOf, args.nodes, args.workspaceRoot, args.gitFilesCache)
   const rewritersById = new Map<string, ProjectSet>()
   const unfoldedById = new Map<string, ProjectSet>()
   const wsRewriters = new Set<string>()
   // A cached rewriter matters only to a key that leaves a dependency's key
-  // out: a `cache.inputs.tasks` filter. With none in the graph every edge
+  // out: a `inputs.tasks` filter. With none in the graph every edge
   // folds and the sets above stay empty, so they are not built (about 2 ms,
   // median, of a 27 ms memoised walk over the 3,000-task bench; item 750).
   let anyUnfolded = false
   for (const n of args.nodes.values()) {
-    if (n.config.cache?.inputs?.tasks !== undefined) {
+    if (n.config.inputs?.tasks !== undefined) {
       anyUnfolded = true
       break
     }
@@ -232,7 +246,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
       // cascade (and forward their producers, above). They inherit
       // instability from any unstable member.
       // `computeGroupKey`, with the unkeyed branch kept synchronous.
-      if (node.config.cache === undefined) {
+      if (node.config.inputs === undefined) {
         const key = computeGroupHash(upstream)
         keyById.set(id, key)
         args.groupKeys?.set(id, { key, upstream })
@@ -277,15 +291,15 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
         {
           wide: unfolded === undefined ? wide : wide === undefined ? unfolded : wide.or(unfolded),
           outputsOf,
+          readableOf,
         },
       )
     if (unstable) unstableById.add(id)
 
     const cacheEnabled = node.config.cache !== undefined
     if (cacheEnabled && !unstable) stableKeys.push({ hash, node })
-    // An uncached key reads its whole project, so `dependsOnSiblingOutputs`
-    // (which answers false for it) is not the gate: any upstream that may
-    // write into this project, or anywhere, leaves the key preliminary.
+    // An uncached key stays preliminary behind any upstream that may write
+    // into this project, or anywhere: none of its writes is declared.
     else if (
       !cacheEnabled &&
       !unstable &&
@@ -299,10 +313,94 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   return stableKeys
 }
 
+/**
+ * The same-project outputs a reader's inputs reach, root-relative, each with
+ * its project dir and project-relative glob: the outputs the gate would key
+ * a reader late over, unless git ignores them (`askIgnoredOutputs`).
+ */
+export function gatedOutputs(
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string,
+): Map<string, { projectDir: string; glob: string }> {
+  const out = new Map<string, { projectDir: string; glob: string }>()
+  // Each project's positive outputs with their literal heads, read once:
+  // 1,000 projects' tasks spent 5-8 ms here re-splitting the same globs.
+  const outputsOf = new Map<string, { glob: string; head: string }[]>()
+  for (const n of nodes.values()) {
+    const files = n.config.cache?.outputs.files
+    if (files === undefined || files.length === 0) continue
+    let list = outputsOf.get(n.projectName)
+    if (list === undefined) outputsOf.set(n.projectName, (list = []))
+    for (const glob of files)
+      if (!glob.startsWith('!')) list.push({ glob, head: literalPrefix(glob) })
+  }
+  if (outputsOf.size === 0) return out
+  for (const n of nodes.values()) {
+    const inputs = n.config.inputs?.files
+    const outputs = outputsOf.get(n.projectName)
+    if (inputs === undefined || outputs === undefined || isGroupTask(n)) continue
+    let back: string[] | undefined
+    let rel: string | undefined
+    for (const { glob: o, head } of outputs) {
+      if (!workspaceInputsReach(inputs, [head])) continue
+      rel ??= relPosix(workspaceRoot, n.projectDir)
+      back ??= inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
+      const rooted = rel === '' ? o : `${rel}/${o}`
+      if (out.has(rooted) || (back.length > 0 && outputTakenBack(o, back))) continue
+      out.set(rooted, { projectDir: n.projectDir, glob: o })
+    }
+  }
+  return out
+}
+
+/**
+ * Asks git which of `gated` it ignores, started beside the run's
+ * enumeration; the call it returns settles `files.ignoredOutputs` once that
+ * enumeration is in, whose listing says whether a tracked or re-included
+ * file lies under a glob. Nothing gated: no spawn.
+ */
+export function askIgnoredOutputs(
+  gated: ReadonlyMap<string, { projectDir: string; glob: string }>,
+  workspaceRoot: string,
+): (files: GitFilesCache) => Promise<void> {
+  if (gated.size === 0) return async () => {}
+  const paths = [...gated.keys()].flatMap((g) => ignoreProbes(g)?.paths ?? [])
+  const asked = paths.length === 0 ? Promise.resolve(null) : checkIgnore(workspaceRoot, paths)
+  return async (files) => {
+    files.ignoredOutputs = wholeIgnored(gated.keys(), await asked, (g) => {
+      const { projectDir, glob } = gated.get(g)!
+      const listed = files.get(projectDir)
+      return listed === undefined || listed.some((f) => taskGlob(glob).match(f))
+    })
+  }
+}
+
+/** `outputsOf` less what git ignores whole; the same map when it ignores none. */
+function readableOutputs(
+  outputsOf: ReadonlyMap<string, string[]>,
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string,
+  files: GitFilesCache,
+): ReadonlyMap<string, readonly string[]> {
+  const ignored = files.ignoredOutputs
+  if (ignored.size === 0) return outputsOf
+  const dirOf = new Map<string, string>()
+  for (const n of nodes.values()) dirOf.set(n.projectName, relPosix(workspaceRoot, n.projectDir))
+  const out = new Map<string, readonly string[]>()
+  for (const [project, outputs] of outputsOf) {
+    const rel = dirOf.get(project)!
+    out.set(
+      project,
+      outputs.filter((o) => !ignored.has(rel === '' ? o : `${rel}/${o}`)),
+    )
+  }
+  return out
+}
+
 const probesAfterWritesOf = new WeakMap<ReadonlyMap<string, TaskNode>, ReadonlySet<string>>()
 
 /**
- * The cached tasks whose `cache.inputs.runtime` / `workspaceRuntime` probes
+ * The cached tasks whose `inputs.runtime` / `workspaceRuntime` probes
  * may read what an upstream writes this run while the key folds nothing of
  * that upstream (X-34). A probe is a shell command and may read anywhere,
  * so no glob bounds it, and its answer taken before the writer ran is the
@@ -330,8 +428,8 @@ export function probesAfterWrites(
   const late = new Set<string>()
   probesAfterWritesOf.set(nodes, late)
   const probes = (n: TaskNode): boolean =>
-    (n.config.cache?.inputs?.runtime?.length ?? 0) > 0 ||
-    (n.config.cache?.inputs?.workspaceRuntime?.length ?? 0) > 0
+    (n.config.inputs?.runtime?.length ?? 0) > 0 ||
+    (n.config.inputs?.workspaceRuntime?.length ?? 0) > 0
   let anyProbe = false
   for (const n of nodes.values()) {
     if (probes(n)) {
@@ -361,7 +459,7 @@ export function probesAfterWrites(
     let writer = false
     let unfolded = false
     // No filter and no order-only edge: the key folds every dependency.
-    const foldsAll = node.orderOnly === undefined && node.config.cache?.inputs?.tasks === undefined
+    const foldsAll = node.orderOnly === undefined && node.config.inputs?.tasks === undefined
     let folds: Set<string> | undefined
     for (const dep of node.deps) {
       if (!nodes.has(dep)) continue
@@ -389,7 +487,7 @@ function foldedBy(
   upstream: TaskOutcome[],
   keyById: Map<string, string>,
 ): (dep: string) => boolean {
-  const filter = node.config.cache?.inputs?.tasks
+  const filter = node.config.inputs?.tasks
   if (isGroupTask(node) || filter === undefined) return (dep) => keyById.has(dep)
   const hashes = new Set(
     filterUpstreamHashes(upstream, filter, node.projectName, node.id).map(([, h]) => h),
@@ -431,7 +529,7 @@ function synthUpstream(
  *     `outputs.files` — direct or transitive — makes the key
  *     preliminary. Project boundaries are hard, so only SAME-project
  *     outputs can reach a project-relative input.
- *   - `cache.inputs.workspaceFiles` is boundary-free: it can read ANY
+ *   - `inputs.workspaceFiles` is boundary-free: it can read ANY
  *     project's dir (so any upstream `outputs.files`, in any project,
  *     matters) or a root-anchored location (so any upstream
  *     `outputs.workspaceFiles` matters). Either → preliminary key. This
@@ -452,12 +550,14 @@ export function dependsOnSiblingOutputs(
     wide: ProjectNames | undefined
     /** Each project's declared `outputs.files`, over all its tasks. */
     outputsOf: ReadonlyMap<string, readonly string[]>
+    /** The same less what git ignores whole: no key reads those. */
+    readableOf?: ReadonlyMap<string, readonly string[]>
   },
 ): boolean {
   const cache = node.config.cache
-  // A cache-disabled task has no key to prefetch anyway; treat as
-  // unstable-irrelevant (caller filters on cacheEnabled).
-  if (cache === undefined) return false
+  const declared = node.config.inputs
+  // A task with no inputs has no key to take up front.
+  if (declared === undefined) return false
   if (upstreamOutputProjects.has(node.projectName)) {
     // A same-project producer whose writes are all declared reaches this
     // task's inputs only where the globs can meet: a `test` reading `src/**`
@@ -466,21 +566,29 @@ export function dependsOnSiblingOutputs(
     // projects (A-20). Undeclared writes, and a rewriter this key does not
     // fold, may land anywhere: those stay project-wide.
     if (sameProject === undefined || sameProject.wide?.has(node.projectName) === true) return true
-    const inputs = cache.inputs?.files
+    const inputs = declared.files
     const outputs = sameProject.outputsOf.get(node.projectName) ?? []
-    if (inputs === undefined || outputs.length === 0) return true
+    if (outputs.length === 0) return true
     // An output the reader's own `!` inputs take back whole is not in its
     // key: `['**/*', '!dist/**']` beside a `dist/**` producer keys the same
-    // before and after it, which is what `run.rules.upfrontKeys` asks a config
-    // to write (X-54).
+    // before and after it, which is what `vx lock` asks a config to write
+    // (X-54).
+    // Nor is an output git ignores whole: a key reads only what git lists.
+    // Unless an entry starts inside it (`dist/**`): naming an ignored path
+    // makes it an input (`ignoredReach` in cache/inputs.ts).
+    const readable = withNamedIgnored(
+      inputs,
+      outputs,
+      sameProject.readableOf?.get(node.projectName) ?? outputs,
+    )
     const back = inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
-    const reach = back.length === 0 ? outputs : outputs.filter((o) => !outputTakenBack(o, back))
+    const reach = back.length === 0 ? readable : readable.filter((o) => !outputTakenBack(o, back))
     if (reach.length > 0 && workspaceInputsReach(inputs, reach.map(literalPrefix))) return true
     // Nor where it WRITES inside another task's tree: restored ahead of
     // that producer, its restore raced the producer's clean and extract
     // (M-5; invariant 2 of docs/design/overlapping-outputs-2026-09.md).
     // `outputsOf` holds this task's own globs too; set them aside once.
-    const own = cache.outputs.files
+    const own = cache?.outputs.files ?? []
     if (own.length > 0) {
       const others = [...outputs]
       for (const g of own) {
@@ -499,7 +607,7 @@ export function dependsOnSiblingOutputs(
   // `app` read `gen/**` project-relative), so the mere presence of a
   // workspace-output producer upstream makes the key preliminary.
   if (hasWsOutputUpstream) return true
-  const wsInputs = cache.inputs?.workspaceFiles ?? []
+  const wsInputs = declared.workspaceFiles ?? []
   if (wsInputs.length > 0 && upstreamOutputProjects.size > 0) {
     // Without the dirs the old answer stands: a workspace reader over any
     // producer is preliminary. With them, only a reader whose globs can
@@ -519,6 +627,29 @@ export function dependsOnSiblingOutputs(
   return false
 }
 
+/**
+ * `readable`, plus each output git ignores whole that a positive entry of
+ * `inputs` starts inside: its literal prefix at or below the output's.
+ */
+function withNamedIgnored(
+  inputs: readonly string[],
+  outputs: readonly string[],
+  readable: readonly string[],
+): readonly string[] {
+  if (readable.length === outputs.length) return readable
+  const named = outputs.filter((o) => {
+    if (readable.includes(o)) return false
+    const at = literalPrefix(o)
+    if (at === '') return false
+    return inputs.some((g) => {
+      if (g.startsWith('!')) return false
+      const p = literalPrefix(g)
+      return p === at || p.startsWith(`${at}/`)
+    })
+  })
+  return named.length === 0 ? readable : [...readable, ...named]
+}
+
 /**
  * Can any positive `workspaceFiles` entry match a path inside one of
  * `dirs` (workspace-relative project dirs)? An entry's reach is its
@@ -546,14 +677,20 @@ export function workspaceInputsReach(
 
 /** A glob's leading literal segments, `''` when its first holds a wildcard. */
 function literalPrefix(glob: string): string {
+  let prefix = literalPrefixes.get(glob)
+  if (prefix !== undefined) return prefix
   const literal: string[] = []
   for (const seg of normalizeGlob(glob).split('/')) {
     if (!isLiteralPattern(seg)) break
     literal.push(seg)
   }
-  return literal.join('/')
+  literalPrefixes.set(glob, (prefix = literal.join('/')))
+  return prefix
 }
 
+/** Per glob string, which the configs bound: every task repeats a few. */
+const literalPrefixes = new Map<string, string>()
+
 /** What the stability gate reads of a set of project names. */
 interface ProjectNames extends Iterable<string> {
   has(name: string): boolean

package/src/orchestrator/steps.ts

@@ -0,0 +1,70 @@
+// vx's own steps (reading the lock, keying, uploads, teardown) rendered as
+// tasks (M, 2026-10-15): `vx:<step>`, and `<plugin package>:setup` /
+// `:teardown`. `:` is no task id's separator, so a step never collides with
+// a project named `vx` or a plugin package's own `#setup` task. A step is
+// not a task: no stat, history row or telemetry record counts it.
+//
+// A run shows only the steps it waits on, before its first task or its end
+// (M, 2026-10-16). One that runs beside the tasks (`vx:prefetch`) is a
+// `background` step: never shown, and kept for `vx last` (run-steps.ts).
+import type { Logger } from '../report/index.js'
+import type { RunStep } from './run-steps.js'
+
+export interface Steps {
+  /** Time `work` as step `id` when steps show; else run it as it is. */
+  step<T>(id: string, work: () => Promise<T>): Promise<T>
+  stepSync<T>(id: string, work: () => T): T
+  /** Time `work`, which the run does not wait on, as step `id` into `background`. */
+  background<T>(id: string, work: () => Promise<T>): Promise<T>
+  /** The background steps that have ended. */
+  readonly ended: readonly RunStep[]
+}
+
+/** Steps that tell `log`, or none when nothing renders them (zero cost). */
+export function createSteps(log: Logger, shown: boolean): Steps {
+  const ended: RunStep[] = []
+  // Timed whether or not anything shows: only a run with a remote starts one.
+  const background = async <T>(id: string, work: () => Promise<T>): Promise<T> => {
+    const t0 = performance.now()
+    let ok = false
+    try {
+      const value = await work()
+      ok = true
+      return value
+    } finally {
+      ended.push({ id, durationMs: Math.round(performance.now() - t0), ok })
+    }
+  }
+  if (!shown)
+    return { step: (_id, work) => work(), stepSync: (_id, work) => work(), background, ended }
+  const end = (id: string, t0: number, ok: boolean): void =>
+    log.stepEnd?.(id, { durationMs: performance.now() - t0, ok })
+  return {
+    background,
+    ended,
+    async step(id, work) {
+      const t0 = performance.now()
+      log.stepStart?.(id)
+      let ok = false
+      try {
+        const value = await work()
+        ok = true
+        return value
+      } finally {
+        end(id, t0, ok)
+      }
+    },
+    stepSync(id, work) {
+      const t0 = performance.now()
+      log.stepStart?.(id)
+      let ok = false
+      try {
+        const value = work()
+        ok = true
+        return value
+      } finally {
+        end(id, t0, ok)
+      }
+    },
+  }
+}

package/src/orchestrator/task-hash.ts

@@ -1,6 +1,6 @@
 import { lstatSync } from 'node:fs'
 import path from 'node:path'
-import type { TaskConfig, CacheConfig } from '../config.js'
+import type { TaskConfig } from '../config.js'
 import type { ProjectFilesCache, WorkspaceFilesCache } from '../cache/index.js'
 import {
   ABSENT_INPUT,
@@ -13,6 +13,7 @@ import {
   racyWindowMs,
   resolveInputs,
   type GitFilesCache,
+  type TaskInputComponent,
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { InputFile, TaskInputs } from '../exec/index.js'
@@ -52,20 +53,6 @@ export function createHashCache(): HashCache {
   }
 }
 
-/**
- * One cache-key component captured at hash time. On a cache MISS the
- * orchestrator persists these to `entry_inputs` (keyed by the entry
- * hash, inside the save transaction) so a later run can diff its inputs
- * against this one (the Tier-3 "why did this re-run?" moat). A cache
- * HIT never saves, so it captures nothing — the warm path is free.
- * Mirrors `Cache.key()`'s fold-site rows one-for-one.
- */
-export interface TaskInputComponent {
-  kind: string
-  name: string
-  hash: string
-}
-
 export interface ComputeHashArgs {
   node: TaskNode
   upstream: TaskOutcome[]
@@ -94,15 +81,16 @@ export interface ComputeHashArgs {
 /**
  * Resolve every input the cache key depends on (file content, env
  * values, upstream hashes, config bytes, forwardArgs) and ask the cache layer to combine them. Used by both
- * `executeTask` for the real run and `plan()` for `--dry-run` /
- * `--graph` previews.
+ * `executeTask` for the real run and `plan()` for `--dry`
+ * previews.
  *
  * Caller is responsible for handling the group-task case before
- * calling this — groups have no `exec` and no `cache.inputs`, so the
+ * calling this — an unkeyed group has no `exec` and no `inputs`, so the
  * key-derivation steps below would all fall back to defaults.
  * `computeGroupKey` is exported for that purpose.
  */
 export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
+  if (isKeyless(args.node.config)) return keylessHash(args.node.id)
   const end = span('task hash')
   try {
     return await args.cache.key((await resolveKeyInput(args)).input)
@@ -111,6 +99,27 @@ export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
   }
 }
 
+/**
+ * A task that runs a command and declares no `inputs`: nothing says what
+ * it read, so no key can stand for its outputs, and a key that folds it
+ * would replay a stale entry (owner, 2026-10-16).
+ */
+export function isKeyless(task: TaskConfig): boolean {
+  return task.exec !== undefined && task.inputs === undefined
+}
+
+/**
+ * Drawn once per process, so no run derives another run's keyless keys;
+ * on first use, as the browser playground loads this module with no `crypto`.
+ */
+let keylessSalt: string | undefined
+
+/** A keyless task's key: this run's alone, so every key folding it misses. */
+function keylessHash(taskId: string): string {
+  keylessSalt ??= crypto.randomUUID()
+  return xxh3hex(`keyless\0${keylessSalt}\0${taskId}`)
+}
+
 /**
  * One file the key folded: the digest it folded, and since when (ms since
  * the epoch) that digest is known to be the file's content — the
@@ -263,14 +272,14 @@ async function resolveKeyInput(
   args: ComputeHashArgs,
 ): Promise<{ input: CacheKeyInput; listings: InputListing[] }> {
   const cfg = args.node.config
-  const cacheCfg: CacheConfig | undefined = cfg.cache
+  const cacheCfg = cfg.cache
   const outputs = cacheCfg?.outputs.files ?? []
 
   const resolved = await resolveInputs({
     projectDir: args.node.projectDir,
     workspaceRoot: args.workspaceRoot,
     envSource: process.env,
-    inputs: cacheCfg?.inputs,
+    inputs: cfg.inputs,
     ownOutputs: outputs,
     ownWorkspaceOutputs: cacheCfg?.outputs.workspaceFiles ?? [],
     nestedProjectDirs: args.nestedProjectDirs,
@@ -295,7 +304,7 @@ async function resolveKeyInput(
 
   const upstreamPairs = filterUpstreamHashes(
     args.upstream,
-    cacheCfg?.inputs?.tasks,
+    cfg.inputs?.tasks,
     args.node.projectName,
     args.node.id,
   )
@@ -303,7 +312,7 @@ async function resolveKeyInput(
   // hash → upstream task id, for capture-row naming only (not folded).
   const upstreamIds = new Map(upstreamPairs.map(([id, hash]) => [hash, id]))
   // The DEPENDENCY closure, groups expanded — for the executor's input root.
-  // Deliberately NOT the filtered set above: `cache.inputs.tasks` says which
+  // Deliberately NOT the filtered set above: `inputs.tasks` says which
   // upstream KEYS this task's key folds, and what a task may READ is
   // `dependsOn`. Locally every dependency's outputs are on disk before the
   // command runs however the filter is written, so an executor that ships the
@@ -319,7 +328,7 @@ async function resolveKeyInput(
   // also merge the workspace-wide partition's OIDs (keyed by abs
   // path, so the two maps agree wherever they overlap).
   let fileHashes = args.gitFilesCache?.oidsFor(args.node.projectDir)
-  if ((cacheCfg?.inputs.workspaceFiles?.length ?? 0) > 0) {
+  if ((cfg.inputs?.workspaceFiles?.length ?? 0) > 0) {
     const wsOids = args.gitFilesCache?.oidsFor(args.workspaceRoot)
     if (wsOids !== undefined && wsOids !== fileHashes) {
       fileHashes = fileHashes === undefined ? wsOids : new Map([...wsOids, ...fileHashes])
@@ -403,12 +412,12 @@ function hashableConfig(cfg: TaskConfig): unknown {
 }
 
 /**
- * A group's key: its upstream, and for a keyed group — one with `cache`,
+ * A group's key: its upstream, and for a keyed group — one with `inputs`,
  * the default `build` (projects.ts) or a config's — its own inputs too,
  * the way a task's key folds them.
  */
 export async function computeGroupKey(args: ComputeHashArgs): Promise<string> {
-  if (args.node.config.cache === undefined) return computeGroupHash(args.upstream)
+  if (args.node.config.inputs === undefined) return computeGroupHash(args.upstream)
   return computeTaskHash(args)
 }
 

package/src/orchestrator/task-log-buffer.ts

@@ -21,7 +21,7 @@
 // task printed nothing".
 
 import type { TaskStatus } from '../graph/index.js'
-import type { CacheSource } from './telemetry.js'
+import type { CacheSource } from '../graph/index.js'
 
 /** Version of the drained-bundle shape below. It is the canonical drained
  *  logs format, not one transport's: every sink ships the same object. */