@vzn/vx 0.0.639 → 0.0.641

package/src/workspace/affected.ts

@@ -6,7 +6,7 @@
 // index + unstaged — so it captures everything you touched and nothing
 // the base branch moved on with. Matches Turbo's `[<since>]` semantics.
 
-import { realpath } from 'node:fs/promises'
+import { realpath, stat } from 'node:fs/promises'
 import path from 'node:path'
 import {
   executablePath,
@@ -75,7 +75,7 @@ export interface AffectedArgs {
   since: string
   projects: readonly ProjectMeta[]
   /**
-   * Which projects declare a `cache.inputs.workspaceFiles` glob matching one of
+   * Which projects declare a `inputs.workspaceFiles` glob matching one of
    * these workspace-relative paths.
    *
    * A workspace-anchored glob is the documented escape hatch for inputs
@@ -107,6 +107,12 @@ export interface AffectedArgs {
    * run then paid again (I-26).
    */
   untracked?: () => Promise<readonly string[] | null>
+  /**
+   * The tracked symlinks, workspace-relative, from the run's enumeration
+   * (its index OIDs spell one `120000:`); null or absent spawns `git ls-files
+   * -s` here. A changed or untracked link is a changed path already.
+   */
+  links?: () => Promise<readonly string[] | null>
 }
 
 export interface FingerprintClaims {
@@ -253,6 +259,16 @@ export async function affectedChanges(
   const changed = [...diffed.paths, ...untracked.filter((s) => !isInstalledPath(s))].filter(
     (s) => s !== LOCKFILE_NAME,
   )
+  // A symlinked input keys the content behind it (cache/linked-inputs.ts),
+  // and the diff names that content's path, never the link's: a link whose
+  // target changed is a changed path itself.
+  changed.push(
+    ...(await linkedChanges(
+      args.workspaceRoot,
+      (await args.links?.().catch(() => null)) ?? (await trackedLinks(args.workspaceRoot)),
+      changed,
+    )),
+  )
   // The nested repositories git reports as one path: a gitlink, or an
   // untracked embedded repository (`dir/`, the only path git prints so).
   const nested = new Set(diffed.gitlinks)
@@ -503,6 +519,69 @@ async function bytesOrNull(file: string): Promise<Uint8Array | null> {
   return (await f.exists()) ? await f.bytes() : null
 }
 
+/** The symlinks the index lists, workspace-relative. */
+async function trackedLinks(workspaceRoot: string): Promise<string[]> {
+  const out: string[] = []
+  for (const record of await gitPaths(workspaceRoot, ['ls-files', '-s', '-z'])) {
+    if (record.startsWith('120000 ')) out.push(record.slice(record.indexOf('\t') + 1))
+  }
+  return out
+}
+
+/**
+ * The links in `links` whose target changed: a file `changed` names, or a
+ * directory holding one. A target git cannot diff is changed on every run:
+ * one outside the workspace, or git-ignored (or ignored files under a linked
+ * directory), since the key reads it whatever git says. A dangling link
+ * reads nothing; retargeting it is a change to the link itself.
+ */
+async function linkedChanges(
+  workspaceRoot: string,
+  links: readonly string[],
+  changed: readonly string[],
+): Promise<string[]> {
+  if (links.length === 0) return []
+  const realRoot = await realpath(workspaceRoot).catch(() => workspaceRoot)
+  const out: string[] = []
+  const inside: Array<{ link: string; target: string; dir: boolean }> = []
+  for (const link of links) {
+    let real: string
+    let dir: boolean
+    try {
+      real = await realpath(path.join(workspaceRoot, link))
+      dir = (await stat(real)).isDirectory()
+    } catch {
+      continue
+    }
+    const rel = path.relative(realRoot, real)
+    if (rel.startsWith('..') || path.isAbsolute(rel)) out.push(link)
+    else inside.push({ link, target: rel.split(path.sep).join('/'), dir })
+  }
+  if (inside.length === 0) return out
+  const named = inside.map((l) => l.target).filter((t) => t !== '')
+  const ignored = await gitPaths(workspaceRoot, [
+    'ls-files',
+    '--others',
+    '--ignored',
+    '--exclude-standard',
+    '--directory',
+    '-z',
+    '--',
+    ...(named.length === inside.length ? named : ['.']),
+  ])
+  const changedSet = new Set(changed)
+  const under = (p: string, dir: string): boolean => dir === '' || p.startsWith(`${dir}/`)
+  for (const { link, target, dir } of inside) {
+    const unseen = ignored.some((i) => {
+      const at = i.replace(/\/$/, '')
+      return at === target || under(target, at) || (dir && under(at, target))
+    })
+    const hit = dir ? changed.some((c) => under(c, target)) : changedSet.has(target)
+    if (unseen || hit) out.push(link)
+  }
+  return out
+}
+
 /** Run a NUL-separated path-listing git command from the workspace root. */
 async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
   const proc = spawnGit([...cmd], workspaceRoot)

package/src/workspace/config-eval.ts

@@ -103,7 +103,7 @@ const nonJsonPaths = ${nonJsonPaths.toString()}
     throw new Error('process.exit(' + (code ?? '') + ') in a config: ' + ${JSON.stringify(CONFIG_EXIT)})
   }
 }
-// Bun's resolver reads \\ as a separator, so a config under a\\b is served
+// Bun's resolver reads \\ as a separator and ? as a query, so a config under a\\b or a?b is served
 // from the path as written (project-loader.ts's LITERAL_QUERY), read now.
 let literal = false
 const serveLiteral = () => {
@@ -172,7 +172,7 @@ self.onmessage = async (e) => {
     if (umaskIn !== null && globalThis.process.umask() !== umaskIn) globalThis.process.umask(umaskIn)
   }
   try {
-    const literalPath = path.includes('\\\\')
+    const literalPath = /[\\\\?]/.test(path)
     if (literalPath) serveLiteral()
     const ns = await import(literalPath ? path + '?vx-literal' : path)
     // Awaited as the in-process load's async return flattens it: a Promise

package/src/workspace/config-imports.ts

@@ -1,7 +1,7 @@
 // The third `changed file → project` channel for `--affected`.
 //
 // Directory containment answers "which project owns this file", and
-// `cache.inputs.workspaceFiles` answers "which project declared it". Neither
+// `inputs.workspaceFiles` answers "which project declared it". Neither
 // can see the one remaining way a file reaches a task: a project's
 // `vx.config.*` IMPORTS it. Resolved-config hashing folds the imported values
 // into the cache key (architecture principle #4), so editing such a file

package/src/workspace/config-schema.ts

@@ -567,7 +567,7 @@ export function validateProjectConfig(
             )
           }
           // `VITE_*` passed nothing through and loaded clean (Turbo's
-          // passThroughEnv expands it), where `cache.inputs.env` refused the
+          // passThroughEnv expands it), where `inputs.env` refused the
           // same text below: one refusal for the class (item 1090).
           assertNoEnvNegation(passThrough as string[], `${where}.exec.env.passThrough`)
           const wild = (passThrough as string[]).find((n) => BUN_GLOB_WILDCARDS.test(n))
@@ -691,11 +691,11 @@ export function validateProjectConfig(
       // so a dependant's `^build` finds it and waits on nothing
       // (the quickstart). The comment here used to call that case
       // "almost certainly a config mistake" while the docs taught it.
-      // A keyed group (`cache` with no `exec`) is a declaration on its own:
+      // A keyed group (`inputs` with no `exec`) is a declaration on its own:
       // its inputs are a key that dependants fold, with no process.
-      if (dependsOn === undefined && cache === undefined) {
+      if (dependsOn === undefined && (task as { inputs?: unknown }).inputs === undefined) {
         throw new UserError(
-          `${where}: a task with no \`exec\` must declare \`dependsOn\` or \`cache.inputs\` ` +
+          `${where}: a task with no \`exec\` must declare \`dependsOn\` or \`inputs\` ` +
             `(group tasks exist to chain dependencies or carry a key)`,
         )
       }
@@ -712,31 +712,14 @@ export function validateProjectConfig(
         )
       }
     }
-    if (cache !== undefined) {
-      if (typeof cache !== 'object' || cache === null) {
-        throw new UserError(
-          `${where}.cache must be an object when present — \`cache: { inputs: { files: [...] }, outputs: { files: [...] } }\`, or no \`cache\` for a task that never caches`,
-        )
-      }
-      assertKnownFields(cache, CACHE_FIELDS, `${where}.cache`)
-      const stability = (cache as { inputStability?: unknown }).inputStability
-      if (stability !== undefined)
-        validateInputStability(stability, `${where}.cache.inputStability`)
-      const inputs = (cache as { inputs?: unknown }).inputs
-      const outputs = (cache as { outputs?: unknown }).outputs
-      // A present field of the wrong shape (`outputs: 'dist'`) was told it
-      // was missing; an array is named in `assertKnownFields`.
-      if (inputs === undefined || inputs === null) {
-        throw new UserError(`${where}.cache.inputs is required when \`cache\` is set`)
+    const inputs = (task as { inputs?: unknown }).inputs
+    if (inputs !== undefined) {
+      if (typeof inputs !== 'object' || inputs === null) {
+        throw new UserError(`${where}.inputs must be an object — \`inputs: { files: [...] }\``)
       }
-      if (typeof inputs !== 'object') {
-        throw new UserError(
-          `${where}.cache.inputs must be an object — \`inputs: { files: [...] }\``,
-        )
-      }
-      assertKnownFields(inputs, CACHE_INPUT_FIELDS, `${where}.cache.inputs`)
+      assertKnownFields(inputs, INPUT_FIELDS, `${where}.inputs`)
       if (!Array.isArray((inputs as { files?: unknown }).files)) {
-        throw new UserError(`${where}.cache.inputs.files must be an array of glob strings`)
+        throw new UserError(`${where}.inputs.files must be an array of glob strings`)
       }
       const envList = (inputs as { env?: unknown }).env
       if (envList !== undefined) {
@@ -746,10 +729,10 @@ export function validateProjectConfig(
           envList.some((s) => !isEnvName(s))
         ) {
           throw new UserError(
-            `${where}.cache.inputs.env must be an array of env var names (non-empty, no '=' or NUL)`,
+            `${where}.inputs.env must be an array of env var names (non-empty, no '=' or NUL)`,
           )
         }
-        assertNoEnvNegation(envList as string[], `${where}.cache.inputs.env`)
+        assertNoEnvNegation(envList as string[], `${where}.inputs.env`)
         for (const name of envList as string[]) {
           // Reject wildcards explicitly so users don't silently miss
           // env vars they thought they were tracking. Turbo supports
@@ -761,107 +744,35 @@ export function validateProjectConfig(
           // whole `Bun.Glob` alphabet stays refused here.
           if (BUN_GLOB_WILDCARDS.test(name)) {
             throw new UserError(
-              `${where}.cache.inputs.env: wildcards in env names are not supported ` +
+              `${where}.inputs.env: wildcards in env names are not supported ` +
                 `(got "${name}") — list explicit env var names instead`,
             )
           }
         }
       }
-      if (outputs === undefined || outputs === null) {
-        throw new UserError(`${where}.cache.outputs is required when \`cache\` is set`)
-      }
-      if (typeof outputs !== 'object') {
-        throw new UserError(
-          `${where}.cache.outputs must be an object — \`outputs: { files: [...] }\``,
-        )
-      }
-      assertKnownFields(outputs, CACHE_OUTPUT_FIELDS, `${where}.cache.outputs`)
-      const clean = (outputs as { clean?: unknown }).clean
-      if (clean !== undefined && typeof clean !== 'boolean') {
-        throw new UserError(`${where}.cache.outputs.clean must be true or false`)
-      }
-      const outFiles = (outputs as { files?: unknown }).files
-      if (!Array.isArray(outFiles)) {
-        throw new UserError(`${where}.cache.outputs.files must be an array of glob strings`)
-      }
-      // Reject zero-length strings and absolute paths up front.
-      // Both reach `resolveOutputs` as undefined behavior; the error
-      // surfaces deep inside the glob resolver with no line pointing
-      // at the user's config. Fail loud at load time.
-      for (const g of outFiles as unknown[]) {
-        if (typeof g !== 'string' || g.length === 0) {
-          throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
-        }
-        if (isAbsoluteGlob(g)) {
-          throw new UserError(
-            `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
-              `outputs must be project-relative globs`,
-          )
-        }
-        if (hasParentSegment(g)) {
-          throw new UserError(
-            `${where}.cache.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
-              `outputs must stay within the project (a glob that escapes the project dir would ` +
-              `let cleanOutputs delete files outside it)`,
-          )
-        }
-        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
-        assertNoForeignToken(g, `${where}.cache.outputs.files`)
-        if (namesDirItself(g)) {
-          throw new UserError(
-            `${where}.cache.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
-              `name the directory the task writes, such as "dist/**"`,
-          )
-        }
-        // An artifact stores workspace outputs under `workspace-outputs/`,
-        // and its index read a project output there as one: every hit was
-        // a "corrupt artifact", dropped and run again.
-        if (!g.startsWith('!') && normalizeGlob(g).split('/')[0] === 'workspace-outputs') {
-          throw new UserError(
-            `${where}.cache.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
-              `artifacts reserve for outputs.workspaceFiles — write the task's files to another directory`,
-          )
-        }
-        // A `!` entry takes a path back from the outputs (A-44): it is not
-        // cleaned, saved or restored, and it stays an input.
-        assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
-        // Taken back by a `!`, the file is never cleaned or restored.
-        const own = g.startsWith('!')
-          ? undefined
-          : ownFilesCovered(g, ownConfig).find((f) => !takenBack(outFiles as unknown[], f))
-        if (own !== undefined) {
-          throw new UserError(
-            `${where}.cache.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
-              `task's outputs before it runs and restores them on a hit, so the project would lose ` +
-              `its config. Name the directory the task writes, such as "dist/**", ` +
-              `or take the file back with "!${own}".`,
-          )
-        }
-      }
-      assertOutputsNotNegationOnly(outFiles as string[], `${where}.cache.outputs.files`)
       // Same for inputs.files.
       for (const g of (inputs as { files: unknown[] }).files) {
         if (typeof g !== 'string' || g.length === 0) {
-          throw new UserError(`${where}.cache.inputs.files must be an array of non-empty strings`)
+          throw new UserError(`${where}.inputs.files must be an array of non-empty strings`)
         }
         if (!g.startsWith('!/') && isAbsoluteGlob(g)) {
           throw new UserError(
-            `${where}.cache.inputs.files: absolute paths are not allowed (got "${g}") — ` +
+            `${where}.inputs.files: absolute paths are not allowed (got "${g}") — ` +
               `inputs must be project-relative globs`,
           )
         }
         if (hasParentSegment(g)) {
           throw new UserError(
-            `${where}.cache.inputs.files: '..' path segments are not allowed (got "${g}") — ` +
+            `${where}.inputs.files: '..' path segments are not allowed (got "${g}") — ` +
               `inputs must be project-relative (a '..' glob silently matches nothing; ` +
-              `use cache.inputs.workspaceFiles for workspace-root-relative inputs)`,
+              `use inputs.workspaceFiles for workspace-root-relative inputs)`,
           )
         }
-        assertPosixGlob(g, `${where}.cache.inputs.files`, 'project')
-        assertNoForeignToken(g, `${where}.cache.inputs.files`)
+        assertPosixGlob(g, `${where}.inputs.files`, 'project')
+        assertNoForeignToken(g, `${where}.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
-            `${where}.cache.inputs.files: "${g}" names the project directory itself and selects nothing — use "**" for everything under it`,
+            `${where}.inputs.files: "${g}" names the project directory itself and selects nothing — use "**" for everything under it`,
           )
         }
         // A negated absolute path subtracts nothing (the positive globs are
@@ -869,11 +780,11 @@ export function validateProjectConfig(
         // `workspaceFiles` refuses both spellings the same way (item 679).
         if (g.startsWith('!/')) {
           throw new UserError(
-            `${where}.cache.inputs.files: absolute paths are not allowed (got "${g}") — ` +
+            `${where}.inputs.files: absolute paths are not allowed (got "${g}") — ` +
               `inputs must be project-relative globs`,
           )
         }
-        assertNotDoubleNegated(g, `${where}.cache.inputs.files`)
+        assertNotDoubleNegated(g, `${where}.inputs.files`)
       }
       // A list of ONLY negations selects nothing at all. `resolveFiles`
       // builds the file set from the POSITIVE globs and uses the `!` entries
@@ -885,9 +796,9 @@ export function validateProjectConfig(
       // "everything except specs", and Turbo makes exactly this a hard config
       // error for the same reason. Refusing costs nothing: such a config was
       // already silently broken, so no working key changes.
-      assertNotNegationOnly((inputs as { files: string[] }).files, `${where}.cache.inputs.files`)
-      assertNoLiteralTakenBack((inputs as { files: string[] }).files, `${where}.cache.inputs.files`)
-      // The only CacheInputs field that reached the run unvalidated: a
+      assertNotNegationOnly((inputs as { files: string[] }).files, `${where}.inputs.files`)
+      assertNoLiteralTakenBack((inputs as { files: string[] }).files, `${where}.inputs.files`)
+      // The only InputsConfig field that reached the run unvalidated: a
       // non-string entry crashes deep in `filterUpstreamHashes` /
       // `parseDependencySpec` with a raw TypeError naming neither the task
       // nor the config. Entry SYNTAX is already checked downstream (a
@@ -900,7 +811,7 @@ export function validateProjectConfig(
           taskFilters.some((s) => typeof s !== 'string' || s.length === 0)
         ) {
           throw new UserError(
-            `${where}.cache.inputs.tasks must be an array of non-empty strings ` +
+            `${where}.inputs.tasks must be an array of non-empty strings ` +
               `(Turbo/Nx micro-syntax: 'name', '^name', 'pkg#name', '*', '^*', '!name')`,
           )
         }
@@ -916,7 +827,7 @@ export function validateProjectConfig(
             list.some((s) => typeof s !== 'string' || s.trim() === '' || s.includes('\0'))
           ) {
             throw new UserError(
-              `${where}.cache.inputs.${field} must be an array of non-empty shell command strings with no NUL`,
+              `${where}.inputs.${field} must be an array of non-empty shell command strings with no NUL`,
             )
           }
         }
@@ -925,17 +836,107 @@ export function validateProjectConfig(
       // never absolute (they're workspace-root-relative by definition).
       const wsInputs = (inputs as { workspaceFiles?: unknown }).workspaceFiles
       if (wsInputs !== undefined) {
-        validateWorkspaceGlobs(wsInputs, `${where}.cache.inputs.workspaceFiles`, true)
+        validateWorkspaceGlobs(wsInputs, `${where}.inputs.workspaceFiles`, true)
       }
-      const wsOutputs = (outputs as { workspaceFiles?: unknown }).workspaceFiles
-      if (wsOutputs !== undefined) {
-        validateWorkspaceGlobs(wsOutputs, `${where}.cache.outputs.workspaceFiles`, false)
+    }
+    if (cache !== undefined) {
+      if (typeof cache !== 'object' || cache === null) {
+        throw new UserError(
+          `${where}.cache must be an object when present — \`inputs: { files: [...] }, cache: { outputs: { files: [...] } }\`, or no \`cache\` for a task that never caches`,
+        )
+      }
+      assertKnownFields(cache, CACHE_FIELDS, `${where}.cache`)
+      const stability = (cache as { inputStability?: unknown }).inputStability
+      if (stability !== undefined)
+        validateInputStability(stability, `${where}.cache.inputStability`)
+      // The key is the task's inputs, and a group runs nothing to cache.
+      if (exec === undefined) {
+        throw new UserError(
+          `${where}: \`cache\` needs \`exec\` — a task with no command produces nothing to cache`,
+        )
       }
-      if (exec === undefined && (outFiles.length > 0 || wsOutputs !== undefined)) {
+      if (inputs === undefined) {
         throw new UserError(
-          `${where}.cache.outputs: a task with no \`exec\` writes nothing — \`outputs: { files: [] }\``,
+          `${where}: \`cache\` needs \`inputs\` — the key is the task's inputs, \`inputs: { files: [...] }\``,
         )
       }
+      const outputs = (cache as { outputs?: unknown }).outputs
+      if (outputs === undefined || outputs === null) {
+        throw new UserError(`${where}.cache.outputs is required when \`cache\` is set`)
+      }
+      if (typeof outputs !== 'object') {
+        throw new UserError(
+          `${where}.cache.outputs must be an object — \`outputs: { files: [...] }\``,
+        )
+      }
+      assertKnownFields(outputs, CACHE_OUTPUT_FIELDS, `${where}.cache.outputs`)
+      const clean = (outputs as { clean?: unknown }).clean
+      if (clean !== undefined && typeof clean !== 'boolean') {
+        throw new UserError(`${where}.cache.outputs.clean must be true or false`)
+      }
+      const outFiles = (outputs as { files?: unknown }).files
+      if (!Array.isArray(outFiles)) {
+        throw new UserError(`${where}.cache.outputs.files must be an array of glob strings`)
+      }
+      // Reject zero-length strings and absolute paths up front.
+      // Both reach `resolveOutputs` as undefined behavior; the error
+      // surfaces deep inside the glob resolver with no line pointing
+      // at the user's config. Fail loud at load time.
+      for (const g of outFiles as unknown[]) {
+        if (typeof g !== 'string' || g.length === 0) {
+          throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
+        }
+        if (isAbsoluteGlob(g)) {
+          throw new UserError(
+            `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
+              `outputs must be project-relative globs`,
+          )
+        }
+        if (hasParentSegment(g)) {
+          throw new UserError(
+            `${where}.cache.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
+              `outputs must stay within the project (a glob that escapes the project dir would ` +
+              `let cleanOutputs delete files outside it)`,
+          )
+        }
+        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
+        assertNoForeignToken(g, `${where}.cache.outputs.files`)
+        if (namesDirItself(g)) {
+          throw new UserError(
+            `${where}.cache.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
+              `name the directory the task writes, such as "dist/**"`,
+          )
+        }
+        // An artifact stores workspace outputs under `workspace-outputs/`,
+        // and its index read a project output there as one: every hit was
+        // a "corrupt artifact", dropped and run again.
+        if (!g.startsWith('!') && normalizeGlob(g).split('/')[0] === 'workspace-outputs') {
+          throw new UserError(
+            `${where}.cache.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
+              `artifacts reserve for outputs.workspaceFiles — write the task's files to another directory`,
+          )
+        }
+        // A `!` entry takes a path back from the outputs (A-44): it is not
+        // cleaned, saved or restored, and it stays an input.
+        assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
+        // Taken back by a `!`, the file is never cleaned or restored.
+        const own = g.startsWith('!')
+          ? undefined
+          : ownFilesCovered(g, ownConfig).find((f) => !takenBack(outFiles as unknown[], f))
+        if (own !== undefined) {
+          throw new UserError(
+            `${where}.cache.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
+              `task's outputs before it runs and restores them on a hit, so the project would lose ` +
+              `its config. Name the directory the task writes, such as "dist/**", ` +
+              `or take the file back with "!${own}".`,
+          )
+        }
+      }
+      assertOutputsNotNegationOnly(outFiles as string[], `${where}.cache.outputs.files`)
+      const wsOutputs = (outputs as { workspaceFiles?: unknown }).workspaceFiles
+      if (wsOutputs !== undefined) {
+        validateWorkspaceGlobs(wsOutputs, `${where}.cache.outputs.workspaceFiles`, false)
+      }
     }
   }
 }
@@ -949,7 +950,7 @@ export function validateProjectConfig(
 // `tasks` first: `nearest` breaks a tie by order, and `taks` is one edit
 // from both.
 const PROJECT_FIELDS = new Set(['name', 'tasks', 'tags'])
-const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'cache'])
+const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'inputs', 'cache'])
 const EXEC_FIELDS = new Set([
   'command',
   'env',
@@ -962,8 +963,8 @@ const EXEC_FIELDS = new Set([
 ])
 const PERSISTENT_FIELDS = new Set(['readyWhen'])
 const ENV_FIELDS = new Set(['passThrough', 'define', 'secret'])
-const CACHE_FIELDS = new Set(['inputs', 'outputs', 'inputStability'])
-const CACHE_INPUT_FIELDS = new Set([
+const CACHE_FIELDS = new Set(['outputs', 'inputStability'])
+const INPUT_FIELDS = new Set([
   'files',
   'workspaceFiles',
   'env',
@@ -983,9 +984,8 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
   [
     TASK_FIELDS,
     {
-      inputs: '`cache.inputs.files`',
       outputs: '`cache.outputs.files`',
-      env: '`cache.inputs.env` (to key the task on a variable) or `exec.env` (to pass one)',
+      env: '`inputs.env` (to key the task on a variable) or `exec.env` (to pass one)',
       passThroughEnv: '`exec.env.passThrough`',
       command: '`exec.command`',
       cmd: '`exec.command`',
@@ -1027,15 +1027,15 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
   [
     CACHE_FIELDS,
     {
-      files: '`inputs.files`',
+      files: "the task's `inputs.files`",
       output: '`outputs.files`',
-      env: '`inputs.env`',
+      env: "the task's `inputs.env`",
       dependencies: "the task's `dependsOn` (an upstream's key folds into this one)",
       enabled: 'no field: a task with a `cache` block caches, one without runs every time',
     },
   ],
   [
-    CACHE_INPUT_FIELDS,
+    INPUT_FIELDS,
     {
       globs: '`files`',
       include: '`files`',
@@ -1065,19 +1065,18 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       scripts:
         "`tasks` (a script is a task's `exec.command`; `vx init` writes them from package.json)",
       pipeline: '`tasks` (`bunx @vzn/vx-migrate` writes them from turbo.json)',
-      namedInputs: 'a module the vx.config imports, spread into `cache.inputs.files`',
+      namedInputs: 'a module the vx.config imports, spread into `inputs.files`',
       root: "no field: a project's directory is where its vx.config sits",
-      sourceRoot: "a task's `cache.inputs.files`",
+      sourceRoot: "a task's `inputs.files`",
       projectType: 'no field: vx runs every project alike',
       ...Object.fromEntries(
-        ['dependsOn', 'cache', 'exec', 'description'].map((k) => [
+        ['dependsOn', 'inputs', 'cache', 'exec', 'description'].map((k) => [
           k,
           `\`tasks.<name>.${k}\`: a project holds tasks, and each task its own \`${k}\``,
         ]),
       ),
-      inputs: '`tasks.<name>.cache.inputs.files`',
       outputs: '`tasks.<name>.cache.outputs.files`',
-      env: '`tasks.<name>.cache.inputs.env` (to key a task on it) or `tasks.<name>.exec.env`',
+      env: '`tasks.<name>.inputs.env` (to key a task on it) or `tasks.<name>.exec.env`',
     },
   ],
   // Turbo's turbo.json and Nx's nx.json keys, written into .vx/workspace
@@ -1091,9 +1090,9 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         "each package's `vx.config` `tasks` (`bunx @vzn/vx-migrate` writes them from turbo.json)",
       targetDefaults:
         "each package's `vx.config` `tasks`, sharing defaults through an imported module",
-      namedInputs: 'a module each `vx.config` imports, spread into `cache.inputs.files`',
-      globalEnv: '`cache.inputs.env` on the tasks it keys',
-      globalDependencies: '`cache.inputs.workspaceFiles` on the tasks it keys',
+      namedInputs: 'a module each `vx.config` imports, spread into `inputs.files`',
+      globalEnv: '`inputs.env` on the tasks it keys',
+      globalDependencies: '`inputs.workspaceFiles` on the tasks it keys',
       remoteCache:
         'a cache plugin in `plugins` (`turboCache()` or `nxCache()` from `@vzn/vx-migrate`)',
       parallel: '`run.concurrency`',
@@ -1113,7 +1112,7 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         "pnpm-workspace.yaml's or package.json's `catalog`, where the package manager reads it",
       npmClient: "no field: a task's command runs as written, with no package manager in between",
       remote: 'a cache plugin in `plugins`',
-      env: '`cache.inputs.env` on the tasks it keys, or `exec.env` on the tasks it passes to',
+      env: '`inputs.env` on the tasks it keys, or `exec.env` on the tasks it passes to',
     },
   ],
 ])
@@ -1367,7 +1366,7 @@ function assertNotDoubleNegated(glob: string, where: string): void {
 }
 
 /**
- * An exact `cache.inputs.tasks` entry that no `dependsOn` entry names would
+ * An exact `inputs.tasks` entry that no `dependsOn` entry names would
  * match nothing at hash time and fold no upstream hash — the task silently
  * decoupled from its dependencies, which is a stale hit waiting for the
  * next upstream change. `['buidl']` for `['build']` is the shape. Patterns,
@@ -1407,7 +1406,7 @@ function assertFilterNamesDeclaredDeps(
     // `where` opens with the config's path; the message names it once.
     const task = where.slice(where.lastIndexOf(': tasks.') + 2)
     throw new UserError(
-      `${where}.cache.inputs.tasks: "${raw}" names no task in ${task}.dependsOn ` +
+      `${where}.inputs.tasks: "${raw}" names no task in ${task}.dependsOn ` +
         `(${declared.length === 0 ? 'none declared' : dependsOn!.map((d) => `'${d}'`).join(', ')}) — ` +
         `it would match nothing and fold no upstream hash, decoupling the task from its ` +
         `dependencies. \`name\` is this project's task, \`^name\` its dependencies', ` +
@@ -1450,7 +1449,7 @@ function isEnvName(name: unknown): name is string {
 }
 
 /**
- * A task name `dependsOn`, `cache.inputs.tasks` and the CLI can name. Each
+ * A task name `dependsOn`, `inputs.tasks` and the CLI can name. Each
  * refused shape loaded and could not be referenced: `x#y` read as project
  * `x`, `^gen` as every dependency's `gen`, a `*` as a pattern, `''` ran
  * under `--all` as `a#` and `vx run a#` refused it, and a padded name was
@@ -1460,7 +1459,7 @@ function assertTaskName(name: string, configPath: string): void {
   const why = taskNameProblem(name)
   if (why === null) return
   throw new UserError(
-    `${configPath}: task name ${JSON.stringify(name)} ${why} — dependsOn, cache.inputs.tasks and ` +
+    `${configPath}: task name ${JSON.stringify(name)} ${why} — dependsOn, inputs.tasks and ` +
       `the CLI could not name it. Rename the task.`,
   )
 }

package/src/workspace/lockfile.ts

@@ -21,7 +21,7 @@ import { validateProjectConfig } from './config-schema.js'
 import { PROJECT_CONFIG_FILENAMES } from './workspace.js'
 
 export const LOCKFILE_NAME = '.vx/projects.lock.json'
-export const LOCKFILE_VERSION = 3
+export const LOCKFILE_VERSION = 4
 
 /** One project as the lock holds it. */
 export interface LockedProject {