@vzn/vx 0.0.640 → 0.0.642

package/src/report/summary.ts

@@ -81,9 +81,9 @@ export interface SummaryStats {
   /** Ended OK — executed successes AND cache hits. */
   successful: number
   skipped: number
-  /** Killed by a shutdown signal (final summary only). Not in `total`. */
+  /** Killed by a shutdown signal, shown as `aborted`. Not in `total`. */
   aborted?: number
-  /** Reached by the stop before they ran (final summary only). Not in `total`. */
+  /** Reached by the stop before they ran. Not in `total`. */
   notRun?: number
   total: number
   upToDate: number
@@ -110,7 +110,7 @@ export interface SummaryStats {
   savedMs?: number
   /** A run of groups only: their names, so `0 tasks` says why. */
   emptyGroups?: readonly string[]
-  /** Each finished task's cache bucket by its key, so its remote traffic can move it. */
+  /** Each finished task's cache bucket by its key and its id (its run bytes), so its remote traffic can move it. */
   buckets?: ReadonlyMap<string, CacheBucket>
 }
 
@@ -183,6 +183,8 @@ export interface RunContext {
   version: string
   /** Projects with a real task in the graph — the "affected" half of the bar. */
   packageCount: number
+  /** The run's whole id, as `vx last` takes it; shown on the `info` row. */
+  runId?: string | undefined
   /** Worker-pool size for this run; shown on the `info` row. */
   concurrency?: number
   remoteCacheEnabled: boolean
@@ -415,6 +417,7 @@ export function formatSummarySection(
         `admit held ${stats.held.count} task${stats.held.count === 1 ? '' : 's'}, ${formatElapsed(stats.held.sumMs)} in all`,
       )
     }
+    if (context.runId !== undefined) info.push(`run ${context.runId}`)
     lines.push('', row('info', join(info)), timeRow)
   } else {
     lines.push('', timeRow)
@@ -536,12 +539,14 @@ export function formatRunSummary(
   )
 }
 
-/** Each finished task's cache bucket by its key. */
+/** Each finished task's cache bucket by its key and by its id. */
 function bucketsOf(outcomes: readonly TaskOutcome[]): Map<string, CacheBucket> {
   const out = new Map<string, CacheBucket>()
   for (const o of outcomes) {
-    const bucket = o.hash === undefined ? undefined : cacheBucketOf(o)
-    if (bucket !== undefined) out.set(o.hash!, bucket)
+    const bucket = cacheBucketOf(o)
+    if (bucket === undefined) continue
+    if (o.hash !== undefined) out.set(o.hash, bucket)
+    out.set(o.node.id, bucket)
   }
   return out
 }

package/src/util/errors.ts

@@ -97,7 +97,7 @@ export function wantsJson(argv: readonly string[]): boolean {
 /**
  * The JSON a verb that answers JSON prints for a refusal: one line. A
  * core code (`VX_E_…`) links its section of cli.md, which says the fix;
- * `vx docs <code>` prints the same section offline. A plugin's code has none.
+ * `vx docs <code>` prints the same section. A plugin's code has none.
  */
 export function errorDocument(code: string, message: string): string {
   const docs = code.startsWith('VX_E_')

package/src/util/hidden-prompt.ts

@@ -0,0 +1,74 @@
+// A secret asked for on the terminal: hidden, one line, only where someone can answer.
+
+/** Where a missing secret is asked for. */
+export interface SecretTerminal {
+  /** stdin and stderr are both terminals: someone can answer. */
+  interactive(): boolean
+  /** Ask `question` on stderr with the answer hidden; resolves the line typed. */
+  ask(question: string): Promise<string>
+}
+
+interface HiddenInput {
+  isRaw?: boolean
+  setRawMode(mode: boolean): unknown
+  on(event: 'data', fn: (chunk: Buffer | string) => void): unknown
+  off(event: 'data', fn: (chunk: Buffer | string) => void): unknown
+  resume(): unknown
+  pause(): unknown
+}
+
+/**
+ * Read one line from a raw-mode terminal, echoing nothing; backspace edits.
+ * Ctrl-D answers nothing. Raw mode delivers no SIGINT, so Ctrl-C answers
+ * nothing and raises it: the run stops as it would at any other moment.
+ */
+function askHidden(
+  question: string,
+  input: HiddenInput,
+  output: { write(s: string): unknown },
+  interrupt: () => void,
+): Promise<string> {
+  output.write(question)
+  const wasRaw = input.isRaw === true
+  input.setRawMode(true)
+  input.resume()
+  return new Promise((resolve) => {
+    let line = ''
+    const done = () => {
+      input.off('data', onData)
+      input.setRawMode(wasRaw)
+      input.pause()
+      output.write('\n')
+    }
+    const onData = (chunk: Buffer | string) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n') {
+          done()
+          resolve(line)
+          return
+        }
+        if (ch === '\u0003' || ch === '\u0004') {
+          done()
+          resolve('')
+          if (ch === '\u0003') interrupt()
+          return
+        }
+        if (ch === '\u007f' || ch === '\b') line = line.replace(/.$/u, '')
+        else if (ch >= ' ') line += ch
+      }
+    }
+    input.on('data', onData)
+  })
+}
+
+/** A process's terminal: asked only when its stdin and stderr are both TTYs. */
+export function terminalOf(
+  stdin: HiddenInput & { isTTY?: boolean },
+  stderr: { isTTY?: boolean; write(s: string): unknown },
+  interrupt: () => void = () => process.kill(process.pid, 'SIGINT'),
+): SecretTerminal {
+  return {
+    interactive: () => stdin.isTTY === true && stderr.isTTY === true,
+    ask: (question) => askHidden(question, stdin, stderr, interrupt),
+  }
+}

package/src/util/index.ts

@@ -59,6 +59,8 @@ export {
   normalizeBunGlob,
   normalizeGlob,
   outputMatcher,
+  outputNever,
+  restorableOutput,
   printable,
   relPosix,
   DOT_VX_GITATTRIBUTES,
@@ -71,6 +73,7 @@ export {
   taskGlob,
   wholeSubtreePrefixes,
   slashBraceExpansions,
+  braceAlternatives,
 } from './paths.js'
 export {
   claimExitForSignal,
@@ -116,3 +119,13 @@ export {
   secretNamed,
   type SecretMask,
 } from './secret-mask.js'
+export {
+  isSecretUnavailable,
+  SecretBroker,
+  type PluginSecrets,
+  type SecretRequest,
+  type SecretStore,
+  type SecretUnavailable,
+  type SecretUnavailableReason,
+} from './secrets.js'
+export { terminalOf, type SecretTerminal } from './hidden-prompt.js'

package/src/util/paths.ts

@@ -12,11 +12,12 @@ export function toPosix(p: string): string {
 }
 
 /**
- * `.vx/.gitignore`: git ignores the machine-local `.vx/cache` and nothing
- * else in `.vx`, so the workspace config and the lock beside it are
- * committed. `vx init` and the cache write it when missing.
+ * `.vx/.gitignore`: git ignores the machine-local `.vx/cache`, `.vx/tmp`
+ * (where restores stage) and nothing else in `.vx`, so the workspace
+ * config and the lock beside it are committed. `vx init` and the cache
+ * write it when missing.
  */
-export const DOT_VX_GITIGNORE = '/cache\n'
+export const DOT_VX_GITIGNORE = '/cache\n/tmp\n'
 
 /** `.vx/.gitattributes`' text: GitHub collapses the machine lock in a diff. */
 export const DOT_VX_GITATTRIBUTES = 'projects.lock.json linguist-generated=true\n'
@@ -385,6 +386,58 @@ export function outputMatcher(globs: readonly string[]): (rel: string) => boolea
   return (rel) => pos(rel) && !neg(rel)
 }
 
+/**
+ * What no output glob reaches, relative to the project: its root's `.git`
+ * and `.vx`, and the `vx.lock.json` beside its config. An output is
+ * otherwise taken as written — `node_modules/**` IS an install task's
+ * output — but a root project declaring `**` would otherwise wipe its
+ * repository and the cache it is restoring from (2026-09-16), the clean
+ * deleted an uncommitted workspace config, and a hit restored a lock or
+ * ignore file the key does not see over the current one. Only where vx
+ * writes them: reserved at any depth, a hit dropped a build's own
+ * `dist/.git/**` and `dist/sub/vx.lock.json` (2026-10-17).
+ */
+const OUTPUT_NEVER = ['.git/**', '.vx/**', 'vx.lock.json']
+
+/**
+ * `OUTPUT_NEVER` relative to the workspace root, for `outputs.workspaceFiles`:
+ * those globs cross into other projects, and every project's `vx.lock.json`
+ * is vx's.
+ */
+const WORKSPACE_OUTPUT_NEVER = [...OUTPUT_NEVER, '**/vx.lock.json']
+
+/**
+ * What `globs` may not reach in `scope`: its never-list, and every
+ * `node_modules` unless a glob names one.
+ */
+export function outputNever(globs: readonly string[], scope: 'project' | 'workspace'): string[] {
+  const never = scope === 'project' ? OUTPUT_NEVER : WORKSPACE_OUTPUT_NEVER
+  return namesNodeModules(globs) ? never : [...never, '**/node_modules/**']
+}
+
+/** Whether a positive glob in `globs` names a `node_modules` directory. */
+function namesNodeModules(globs: readonly string[]): boolean {
+  return globs.some(
+    (g) => !g.startsWith('!') && normalizeGlob(g).split('/').includes('node_modules'),
+  )
+}
+
+/**
+ * Whether a restore may write `rel`: one of the outputs `globs` declare,
+ * never under `OUTPUT_NEVER`, and under `node_modules` only where a glob
+ * names it — what the save side could have packed (`resolveOutputs`). An
+ * artifact naming anything else was not written by this task's save, and
+ * none of it is restored (2026-10-16).
+ */
+export function restorableOutput(
+  globs: readonly string[],
+  scope: 'project' | 'workspace' = 'project',
+): (rel: string) => boolean {
+  const isOutput = outputMatcher(globs)
+  const never = anyTaskGlob(outputNever(globs, scope))
+  return (rel) => isOutput(rel) && !never(rel)
+}
+
 /**
  * `pattern` with its first brace group expanded, recursively, while that
  * group holds a `/`; any other pattern as itself, since `Bun.Glob`
@@ -396,7 +449,7 @@ export function slashBraceExpansions(pattern: string): string[] {
 }
 
 /** `pattern` with every brace group of two or more alternatives expanded. */
-function braceAlternatives(pattern: string): string[] {
+export function braceAlternatives(pattern: string): string[] {
   return expandBraces(pattern, false)
 }
 

package/src/util/secrets.ts

@@ -0,0 +1,150 @@
+// A plugin's secrets, kept in the OS keychain (`Bun.secrets`) under the
+// plugin's own name, and asked for on the terminal when a plugin offers a
+// prompt and someone can answer (owner, 2026-10-17). Core reads no
+// environment here: a variable, an option or a config file is the
+// plugin's to check first, so the keychain is always the last source.
+
+import { type SecretTerminal, terminalOf } from './hidden-prompt.js'
+
+/** What `ctx.secret` is asked: the entry's name, and the question to ask on a terminal. */
+export interface SecretRequest {
+  /** The entry's name within the plugin's keychain service: one per remote, say. */
+  readonly key: string
+  /** Asked when the keychain lacks the entry. Omitted: never asked, a miss is `not-found`. */
+  readonly prompt?: string
+}
+
+/** A plugin's keychain, on the contexts of the hooks that run before the first task. */
+export interface PluginSecrets {
+  /**
+   * The entry, else the terminal's answer (then saved), else a rejection a
+   * `isSecretUnavailable` guard names. Once per run per key: concurrent asks
+   * share the answer.
+   */
+  secret(req: SecretRequest): Promise<string>
+  /** Delete the entry (a server refused it), so the next run asks again. Never throws. */
+  forgetSecret(req: { readonly key: string }): Promise<void>
+}
+
+/**
+ * Why `secret` had nothing: the keychain lacks it and no prompt was given
+ * (`not-found`), a prompt was given and nobody can answer — CI, no TTY, or
+ * the status line already up (`no-terminal`), the answer was empty
+ * (`declined`), or there is no keychain and no answer (`store-unavailable`).
+ */
+export type SecretUnavailableReason = 'not-found' | 'no-terminal' | 'declined' | 'store-unavailable'
+
+export interface SecretUnavailable extends Error {
+  readonly reason: SecretUnavailableReason
+}
+
+const NAME = 'SecretUnavailable'
+
+/** A `secret` rejection that is a missing secret, not a fault. By name: a plugin may load its own copy of core. */
+export function isSecretUnavailable(err: unknown): err is SecretUnavailable {
+  return err instanceof Error && err.name === NAME && 'reason' in err
+}
+
+function unavailable(key: string, reason: SecretUnavailableReason): SecretUnavailable {
+  return Object.assign(new Error(`secret '${key}' unavailable: ${reason}`), { name: NAME, reason })
+}
+
+/** The keychain as the broker reads and writes it: `Bun.secrets`, or a test's stand-in. */
+export interface SecretStore {
+  get(o: { service: string; name: string }): Promise<string | null>
+  set(o: { service: string; name: string; value: string }): Promise<void>
+  delete(o: { service: string; name: string }): Promise<boolean>
+}
+
+// Reached only when asked: touching `process.stdin` opens the stream.
+const processTerminal: SecretTerminal = {
+  interactive: () => terminalOf(process.stdin, process.stderr).interactive(),
+  ask: (question) => terminalOf(process.stdin, process.stderr).ask(question),
+}
+
+/**
+ * One run's secrets for every plugin. A prompt waits for the one before
+ * it, so two plugins never ask at once, and none is asked once
+ * `closePrompts` says the status line is up.
+ */
+export class SecretBroker {
+  private readonly memo = new Map<string, Promise<string>>()
+  private prompting: Promise<unknown> = Promise.resolve()
+  private closed = false
+
+  constructor(
+    private readonly ci: boolean,
+    private readonly warn: (message: string) => void,
+    private readonly store: SecretStore = Bun.secrets,
+    private readonly terminal: SecretTerminal = processTerminal,
+    /** Quiets the terminal's live region until the release it returns. */
+    private readonly quiet: () => () => void = () => () => undefined,
+  ) {}
+
+  /** `plugin`'s keychain: its entries live under its package name. */
+  for(plugin: string): PluginSecrets {
+    return {
+      secret: (req) => {
+        const memoKey = `${plugin}\0${req.key}`
+        let pending = this.memo.get(memoKey)
+        if (pending === undefined) {
+          pending = this.resolve(plugin, req)
+          this.memo.set(memoKey, pending)
+        }
+        return pending
+      },
+      forgetSecret: async ({ key }) => {
+        this.memo.delete(`${plugin}\0${key}`)
+        try {
+          await this.store.delete({ service: plugin, name: key })
+        } catch {
+          // no keychain to delete from
+        }
+      },
+    }
+  }
+
+  /** The status line is about to start: from here a prompt would be drawn over. */
+  closePrompts(): void {
+    this.closed = true
+  }
+
+  private async resolve(service: string, req: SecretRequest): Promise<string> {
+    const entry = { service, name: req.key }
+    let storeDown = false
+    try {
+      const stored = await this.store.get(entry)
+      if (stored) return stored
+    } catch {
+      // No keychain (headless Linux without libsecret).
+      storeDown = true
+    }
+    if (req.prompt === undefined)
+      throw unavailable(req.key, storeDown ? 'store-unavailable' : 'not-found')
+    const asked = this.prompting.then(() => this.ask(req.key, req.prompt!))
+    this.prompting = asked.catch(() => undefined)
+    const answer = await asked
+    try {
+      await this.store.set({ ...entry, value: answer })
+    } catch (err) {
+      this.warn(
+        `[vx] could not save '${req.key}' to the OS keychain (${err instanceof Error ? err.message : String(err)}); used for this run only`,
+      )
+    }
+    return answer
+  }
+
+  private async ask(key: string, prompt: string): Promise<string> {
+    if (this.ci || this.closed || !this.terminal.interactive())
+      throw unavailable(key, 'no-terminal')
+    const release = this.quiet()
+    let answer: string
+    try {
+      answer = (await this.terminal.ask(prompt)).trim()
+    } finally {
+      release()
+    }
+    if (answer === '') throw unavailable(key, 'declined')
+    return answer
+  }
+}

package/src/workspace/affected.ts

@@ -122,7 +122,10 @@ export interface FingerprintClaims {
     file: string
     before: Uint8Array | null
     after: Uint8Array | null
+    extras?: ReadonlyMap<string, { before: Uint8Array | null; after: Uint8Array | null }>
   }): Promise<ReadonlySet<string> | undefined>
+  /** The files a claimed file names that its claimant keys too; absent = it reads none. */
+  extraFiles?(file: string, bytes: Uint8Array): readonly string[] | undefined
 }
 
 /**
@@ -303,32 +306,79 @@ export async function affectedChanges(
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
-  // A patch bun.lock names folds into the key of the plugin that claims
-  // bun.lock (`bun()`; the lockfile records no hash of it), so its edit
-  // widens as a lockfile edit does. A patch the lockfile no longer names
-  // moved bun.lock itself.
-  if (changed.length > 0) {
-    const lock = await bytesOrNull(path.join(args.workspaceRoot, 'bun.lock'))
-    if (lock !== null) {
-      const patches = new Set(bunPatchFiles(lock))
-      const patch = changed.find((p) => patches.has(p))
-      if (patch !== undefined && (await loadClaims())?.files.has('bun.lock')) {
-        return everything(patch)
+  // A file a claimed lockfile names that its claimant keys but the
+  // lockfile does not pin (`FingerprintClaim.extraFiles`: bun.lock's
+  // patches, a `file:`, `link:` or `portal:` directory
+  // a manager copies or links) is part of
+  // that lockfile: a change to one, or under one, is a lockfile change the
+  // claimant answers with it. Only a path no project below the root owns
+  // can be one, so a diff inside the projects never loads the claims.
+  const extrasBy = new Map<
+    string,
+    Map<string, { before: Uint8Array | null; after: Uint8Array | null }>
+  >()
+  const rootDir = path.resolve(args.workspaceRoot)
+  const loose = changed.filter((rel) => {
+    const abs = path.join(rootDir, rel)
+    return !args.projects.some((p) => p.dir !== rootDir && abs.startsWith(p.dir + path.sep))
+  })
+  const extraClaims = loose.length > 0 ? await loadClaims() : undefined
+  for (const file of extraClaims?.files ?? []) {
+    const after = await bytesOrNull(path.join(args.workspaceRoot, file))
+    const before = await gitBytesAt(args.workspaceRoot, base, file)
+    const namedAfter = after === null ? [] : extraClaims!.extraFiles?.(file, after)
+    const named = new Set([
+      ...(before === null ? [] : (extraClaims!.extraFiles?.(file, before) ?? [])),
+      ...(namedAfter ?? []),
+    ])
+    const extras = new Map<string, { before: Uint8Array | null; after: Uint8Array | null }>()
+    for (const rel of named) {
+      const at = path.posix.normalize(rel).replace(/\/+$/, '')
+      if (loose.includes(at)) {
+        extras.set(rel, {
+          before: await gitBytesAt(args.workspaceRoot, base, at),
+          after: await bytesOrNull(path.join(args.workspaceRoot, at)),
+        })
+        continue
+      }
+      // A directory's sides are not its bytes: a file under it changed,
+      // so they differ, and only the projects reaching it move.
+      const under = loose.filter((p) => p.startsWith(`${at}/`))
+      if (under.length > 0) {
+        extras.set(rel, { before: null, after: new TextEncoder().encode(under.join('\0')) })
       }
     }
+    if (extras.size > 0) extrasBy.set(file, extras)
+    else if (file === 'bun.lock' && after !== null && namedAfter === undefined) {
+      // A bun.lock claimant that names no file still folds the patches
+      // bun.lock names (the lockfile records no hash of them): it cannot
+      // say which projects one reaches, so its edit widens.
+      const patches = new Set(bunPatchFiles(after))
+      const patch = loose.find((p) => patches.has(p))
+      if (patch !== undefined) return everything(patch)
+    }
   }
   const claimedOwned = new Map<string, string>()
   const rootNamesChanged = changed.filter((p) => !p.includes('/'))
+  for (const file of extrasBy.keys()) {
+    if (!rootNamesChanged.includes(file)) rootNamesChanged.push(file)
+  }
   const claimed = rootNamesChanged.length > 0 ? await loadClaims() : undefined
   for (const file of rootNamesChanged) {
     if (claimed === undefined || !claimed.files.has(file)) continue
+    const extras = extrasBy.get(file)
     const answer = await claimed.affected({
       file,
       before: await gitBytesAt(args.workspaceRoot, base, file),
       after: await bytesOrNull(path.join(args.workspaceRoot, file)),
+      ...(extras !== undefined ? { extras } : {}),
     })
-    if (answer === undefined) return everything(file)
-    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, file)
+    const why =
+      extras === undefined || changed.includes(file)
+        ? file
+        : path.posix.normalize([...extras.keys()][0]!).replace(/\/+$/, '')
+    if (answer === undefined) return everything(why)
+    for (const name of answer) if (!claimedOwned.has(name)) claimedOwned.set(name, why)
   }
 
   const realDirs = new Map(

package/src/workspace/config-eval.ts

@@ -103,7 +103,7 @@ const nonJsonPaths = ${nonJsonPaths.toString()}
     throw new Error('process.exit(' + (code ?? '') + ') in a config: ' + ${JSON.stringify(CONFIG_EXIT)})
   }
 }
-// Bun's resolver reads \\ as a separator, so a config under a\\b is served
+// Bun's resolver reads \\ as a separator and ? as a query, so a config under a\\b or a?b is served
 // from the path as written (project-loader.ts's LITERAL_QUERY), read now.
 let literal = false
 const serveLiteral = () => {
@@ -172,7 +172,7 @@ self.onmessage = async (e) => {
     if (umaskIn !== null && globalThis.process.umask() !== umaskIn) globalThis.process.umask(umaskIn)
   }
   try {
-    const literalPath = path.includes('\\\\')
+    const literalPath = /[\\\\?]/.test(path)
     if (literalPath) serveLiteral()
     const ns = await import(literalPath ? path + '?vx-literal' : path)
     // Awaited as the in-process load's async return flattens it: a Promise

package/src/workspace/config-schema.ts

@@ -378,16 +378,21 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
         }
       }
       if (plug.fingerprint !== undefined) {
-        const claim = plug.fingerprint as { files?: unknown; affected?: unknown } | null
+        const claim = plug.fingerprint as {
+          files?: unknown
+          affected?: unknown
+          extraFiles?: unknown
+        } | null
         if (
           claim === null ||
           typeof claim !== 'object' ||
           !Array.isArray(claim.files) ||
           claim.files.length === 0 ||
-          typeof claim.affected !== 'function'
+          typeof claim.affected !== 'function' ||
+          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function')
         ) {
           throw new UserError(
-            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function }`,
+            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function }`,
           )
         }
         for (const file of claim.files as unknown[]) {
@@ -770,6 +775,7 @@ export function validateProjectConfig(
         }
         assertPosixGlob(g, `${where}.inputs.files`, 'project')
         assertNoForeignToken(g, `${where}.inputs.files`)
+        assertInputGlob(g, `${where}.inputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
             `${where}.inputs.files: "${g}" names the project directory itself and selects nothing — use "**" for everything under it`,
@@ -1333,6 +1339,33 @@ function assertPosixGlob(glob: string, where: string, base: string): void {
   )
 }
 
+const ONE_ALTERNATIVE_BRACE = /(?<!\\)\{[^{},]*\}/
+
+/**
+ * What every run would refuse, or silently key nothing for, refused at
+ * `vx lock` instead. `Bun.Glob` reads `{b}` as a brace of one alternative,
+ * so `src/{b}.ts` matches `src/b.ts` and never a file named `{b}.ts`:
+ * neither reading is sure to be the one meant, so both spellings are
+ * named. A path under `.git` is never listed by git, so it keyed nothing.
+ */
+function assertInputGlob(glob: string, where: string): void {
+  const m = ONE_ALTERNATIVE_BRACE.exec(glob)
+  if (m !== null) {
+    const inner = m[0].slice(1, -1)
+    throw new UserError(
+      `${where}: "${glob}" holds a brace with one alternative, which matches ` +
+        `"${inner}" and never a name holding "${m[0]}". Write "${glob.replace(m[0], inner)}", ` +
+        `or "${glob.replace(m[0], `\\{${inner}\\}`)}" for the braces themselves.`,
+    )
+  }
+  if (glob.replace(/^!/, '').split('/').includes('.git')) {
+    throw new UserError(
+      `${where}: "${glob}" names a path under .git, which git never lists, so it keys nothing — ` +
+        `inputs are the repository's files`,
+    )
+  }
+}
+
 /**
  * `!!x` INVERTS the input set instead of double-negating it.
  *
@@ -1565,6 +1598,7 @@ function validateWorkspaceGlobs(v: unknown, where: string, negation: boolean): v
     }
     assertPosixGlob(g, where, 'workspace-root')
     assertNoForeignToken(g, where)
+    if (negation) assertInputGlob(g, where)
     if (namesDirItself(g)) {
       throw new UserError(
         `${where}: "${g}" names the workspace root itself and selects nothing — use "**" for everything under it`,

package/src/workspace/project-loader.ts

@@ -75,8 +75,9 @@ let serving = false
 const HELD_QUERY = /\?vx-(?:held|literal)=([0-9a-f]+)$/
 
 // Bun's resolver reads `\` as a separator, even in a file: URL, so a
-// config under `a\b` was looked for under `a/b`. Resolving it here keeps
-// the path as written; only the served load can take it.
+// config under `a\b` was looked for under `a/b`, and `?` as a query, so
+// one under `a?b` was looked for under `a`. Resolving it here keeps the
+// path as written; only the served load can take it.
 const LITERAL_QUERY = /\?vx-literal=[0-9a-f]+$/
 
 function serveHeldSources(): void {
@@ -148,14 +149,14 @@ async function loadDefaultExport(
   // URL yet, and a repeat load (the one that could replay an evaluation
   // made under earlier env values) re-evaluates in a worker instead
   // (`loadedConfigs`, item 678).
-  const literal = configPath.includes('\\')
+  const literal = /[\\?]/.test(configPath)
   const source =
     kind === 'Project' || literal
       ? servableSource(bytes, /\.[cm]?ts$/.test(configPath) ? 'ts' : 'js')
       : null
   if (literal && source === null) {
     throw new UserError(
-      `${kind} config ${configPath} sits under a path that holds a backslash, which Bun loads only as an ES module in UTF-8`,
+      `${kind} config ${configPath} sits under a path that holds ${configPath.includes('\\') ? 'a backslash' : 'a question mark'}, which Bun loads only as an ES module in UTF-8`,
     )
   }
   const hash = xxh3hex(bytes)
@@ -639,6 +640,7 @@ const BUN_MEMBERS_VX_READS: readonly PropertyKey[] = [
   'plugin',
   'randomUUIDv7',
   'resolveSync',
+  'secrets',
   'serve',
   'sleep',
   'sleepSync',