@vzn/vx 0.0.641 → 0.0.643

package/src/orchestrator/prepare.ts

@@ -7,9 +7,10 @@
 // closes at the bottom of execution, `planRun()` does so via
 // try/finally around its plan() call.
 
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 import type { WorkspaceConfig } from '../config.js'
-import { beginRun, mark, nearest, UserError } from '../util/index.js'
+import { beginRun, mark, nearest, relPosix, type SecretBroker, UserError } from '../util/index.js'
 import {
   Cache,
   type CacheLayer,
@@ -25,7 +26,7 @@ import {
   writesRunStore,
   type PluginCache,
   type ResolvedRemote,
-  ScopedCache,
+  BranchScope,
   applyGitEnumeration,
   gitPathspecs,
   MAX_SCOPED_PATHSPECS,
@@ -37,9 +38,11 @@ import {
   buildPackageGraph,
   computeNestedProjectDirs,
   findWorkspaceRoot,
-  cacheScopeEnvError,
-  isCacheScope,
+  type AffectedChanges,
+  branchChanges,
+  configuredBaseBranch,
   type LoadReads,
+  PROJECT_CONFIG_FILENAMES,
   readClaimedFiles,
   resolveCacheDir,
   resolveStoreRoot,
@@ -76,13 +79,13 @@ import {
   lockReader,
   type LoadedProjects,
 } from './projects.js'
-import { keptByAffected } from './affected-tasks.js'
+import { keptByAffected, keyedByChange } from './affected-tasks.js'
 import { applyGraphStage } from './graph-stage.js'
 import { keyExcludedDependencies } from './excluded-keys.js'
 import { FingerprintWatch } from './fingerprint-watch.js'
 import type { VxPlugin } from './plugin.js'
 import { askIgnoredOutputs, gatedOutputs } from './stable-keys.js'
-import { currentBranch } from './run-context.js'
+import { currentBranch, resolveCacheScope } from './run-context.js'
 import { createHashCache, type HashCache } from './task-hash.js'
 import { type Logger, warnOf } from '../report/index.js'
 import type { RunOptions } from './options.js'
@@ -111,6 +114,10 @@ export interface PreparedRun {
   hasRemoteLayer: boolean
   /** `--cache-policy` with the workspace's `cacheScope` applied: what the layers were built under. */
   cachePolicy: CachePolicy
+  /** The scope this run's cache reads and writes, when one is set; named on the summary's `info` row. */
+  cacheScope: string | undefined
+  /** The run's remotes in declared order, as the policy gates each; `openRemotes` turns one off. */
+  remotes: ResolvedRemote[]
   /**
    * Scheduling priorities from plugins' `schedule` stage (task id → weight,
    * merged over the structural baseline by the scheduler). Empty when no
@@ -245,8 +252,21 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     (reused !== undefined ? gitOfDiscovery(reused.projects) : undefined) ??
     lazyGitEnumeration(workspaceRoot)
   if (wholeTree) void git.start()
-  const { workspaceConfig, plugins } = await loadWorkspacePlugins(workspaceRoot, warnOf(log))
+  const {
+    workspaceConfig,
+    plugins,
+    branch: branchFacts,
+  } = await loadWorkspacePlugins(workspaceRoot, warnOf(log))
   mark('workspace config')
+  const baseBranch = configuredBaseBranch(workspaceConfig)
+  const cacheScope =
+    options.cacheScope ??
+    resolveCacheScope(
+      workspaceRoot,
+      branchFacts.scope,
+      plugins.some((p) => p.cache !== undefined),
+      baseBranch,
+    )
   let learnedBranch: string | null | undefined
   const branch = (): string | null =>
     learnedBranch === undefined
@@ -265,10 +285,38 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // Asked now, read when the cache opens: a repository with no remote is
   // named by its root commit, a git spawn the discovery below overlaps.
   const storeRoot = options.cacheDir ? null : resolveStoreRoot(workspaceRoot, workspaceConfig)
-  const projectMetas =
+  const discovering =
     reused !== undefined
-      ? reused.projects
-      : await discoverProjects(workspaceRoot, readLock, plugins, cacheDir, warnOf(log), git)
+      ? Promise.resolve(reused.projects)
+      : discoverProjects(workspaceRoot, readLock, plugins, cacheDir, warnOf(log), git)
+  // What the branch changed decides which tasks read the scope (owner,
+  // 2026-10-17). Only a scoped run's first remote call asks git: a run the
+  // local cache answers makes no remote call, and diffing beside discovery
+  // cost it 20-60 ms at 1k-5k projects.
+  const scopeChanges: (() => Promise<AffectedChanges>) | undefined =
+    cacheScope === undefined
+      ? undefined
+      : options.scopeChanges !== undefined
+        ? async () => options.scopeChanges!
+        : () =>
+            branchChanges(
+              workspaceRoot,
+              options.scopeBase ?? branchFacts.base,
+              baseBranch,
+              discovering,
+              {
+                untracked: async () => (await git.start()).untracked,
+                // A scoped enumeration lists only its projects: null asks git.
+                links: async () => {
+                  const g = await git.start()
+                  if (!g.scopes.includes('.')) return null
+                  const out: string[] = []
+                  for (const [rel, oid] of g.trusted) if (oid.startsWith('120000:')) out.push(rel)
+                  return out
+                },
+              },
+            )
+  const projectMetas = await discovering
   mark('discover projects')
 
   // SCOPED config loading: configs are programs, and evaluating 1090
@@ -310,12 +358,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // so a reader profiling that stage was sent to the wrong code.
   mark('package graph')
 
-  // `--cache-scope`, then `VX_CACHE_SCOPE`, win over the workspace (and `github()`'s guess):
-  // a CI job that knows its trust level says so without editing config.
-  const envScope = process.env['VX_CACHE_SCOPE'] || undefined
-  if (envScope !== undefined && !isCacheScope(envScope)) throw cacheScopeEnvError()
   const workspacePolicy = workspaceCachePolicy(workspaceConfig)
-  const cacheScope = options.cacheScope ?? envScope ?? workspaceConfig?.cache?.scope
   const asked =
     options.cache ?? applyCacheFlags(workspacePolicy ?? FULL_CACHE_POLICY, options.cacheFlags)
   // A laptop reads the shared cache and does not write it unless a policy
@@ -325,16 +368,18 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   const readOnly =
     options.remoteReadOnlyByDefault === true &&
     !(options.cache === undefined && namesRemote(workspaceConfig?.cache?.policy))
-  const policy: CachePolicy = readOnly ? { ...asked, remoteWrite: false } : asked
+  const wanted: CachePolicy = readOnly ? { ...asked, remoteWrite: false } : asked
   const localCache = new Cache(
     cacheDir,
-    { read: policy.localRead, write: policy.localWrite },
+    { read: wanted.localRead, write: wanted.localWrite },
     workspaceRoot,
     options.artifactCeiling,
     'open',
     await storeRoot,
   )
-  localCache.assertWritable()
+  const unwritable = localCache.readOnlyNotice()
+  if (unwritable !== null) warnOf(log)(`[vx] ${unwritable}`)
+  const policy: CachePolicy = unwritable === null ? wanted : { ...wanted, localWrite: false }
   // The root files the plugins claim (`VxPlugin.fingerprint`), whose bytes
   // their claimants fold: read now so a task that rewrites one is caught.
   const fingerprintsAt = Date.now()
@@ -405,6 +450,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // A dependant's `^build` still reaches it, and `lib#build` names it.
   const requested = expandRequested(tasks, candidateProjects, projects, isDefaultBuild)
   let unresolvedTasks = unresolvedRequests(tasks, candidateProjects, projects, isDefaultBuild)
+  refuseUnlockedConfig(tasks, projects, projectMetas, workspaceRoot)
   if (options.selectedByDiff === true && unresolvedTasks.some((t) => !t.includes('#'))) {
     // A name a loaded project declares is no typo, whether or not the load
     // was whole: an unaffected dependency loaded for the closure declared
@@ -463,6 +509,9 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // cache plugin.
   let cache: CacheLayer
   const remotes: ResolvedRemote[] = []
+  // A scope only picks remote keys (owner, 2026-10-17): the local store
+  // keeps every branch's entries under the task keys.
+  const branchScope = cacheScope === undefined ? undefined : new BranchScope(cacheScope)
   if (options.remoteCache) {
     remotes.push({
       remote: options.remoteCache,
@@ -473,7 +522,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   }
   try {
     cache = options.remoteCache
-      ? new LayeredCache(localCache, remotes)
+      ? new LayeredCache(localCache, remotes, branchScope)
       : await resolveCache(plugins, {
           workspaceRoot,
           cacheDir,
@@ -482,6 +531,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
           localCache,
           policy,
           remotes,
+          ...(branchScope !== undefined ? { branch: branchScope } : {}),
         })
   } catch (err) {
     // A cache plugin that throws or returns something off-contract is
@@ -492,8 +542,6 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     localCache.close()
     throw err
   }
-  // One scoping rule above every layer, local and remote alike.
-  if (cacheScope !== undefined) cache = new ScopedCache(cache, cacheScope)
   // Ask the LAYER, don't infer. Identity against `localCache` answers a
   // DIFFERENT question — "did the plugin hand back something other than the
   // handle I passed in?" — which an ordinary pass-through decorator (a
@@ -508,7 +556,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // cycle under `vx watch` (item 1029). run() owns both only once this
   // returns.
   try {
-    const hashCache = createHashCache()
+    const hashCache = createHashCache(localCache.foldMemo())
     const fingerprintWatch = new FingerprintWatch(
       workspaceRoot,
       claimed,
@@ -527,6 +575,8 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       localCache,
       hasRemoteLayer,
       cachePolicy: policy,
+      cacheScope,
+      remotes,
       keepRunEntry: undefined,
       priorities: () => Promise.resolve(new Map()),
       branch,
@@ -713,6 +763,13 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     if (hasHook(plugins, 'key')) {
       await applyKeyHooks(plugins, nodes, { workspaceRoot, cacheDir, warn: warnOf(log) })
     }
+    // The final inputs decide which tasks the branch changed: they read
+    // the scope, every other task the default key.
+    if (branchScope !== undefined && scopeChanges !== undefined) {
+      branchScope.routeTasks(async () =>
+        keyedByChange(nodes, await scopeChanges(), projects, packageGraph),
+      )
+    }
     refuseFiltersThroughGroups(nodes)
     const exclude = options.excludeDependencies
     let keyOnly: ReadonlyMap<string, TaskNode> = new Map()
@@ -775,6 +832,8 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       localCache,
       hasRemoteLayer,
       cachePolicy: policy,
+      cacheScope,
+      remotes,
       priorities,
       branch,
       cacheFor,
@@ -906,3 +965,63 @@ function workspaceCachePolicy(config: WorkspaceConfig | null | undefined): Cache
     )
   }
 }
+
+/**
+ * A `project#build` naming the default `build` of a project the lock holds
+ * no config for, while its directory holds one, asks for that config's task, not
+ * one that runs nothing: ran, `c#build` was 0 tasks, exit 0, where a
+ * renamed task gets "run `vx lock`" (Growth, lock drift).
+ */
+function refuseUnlockedConfig(
+  tasks: readonly string[],
+  projects: ReadonlyMap<string, ProjectEntry>,
+  metas: ReadonlyArray<{ name: string; configPath?: string | null }>,
+  workspaceRoot: string,
+): void {
+  for (const spec of tasks) {
+    const at = spec.indexOf('#')
+    if (at < 0) continue
+    const name = spec.slice(0, at)
+    const entry = projects.get(name)
+    if (entry === undefined || !isDefaultBuild(entry.config.tasks?.[spec.slice(at + 1)])) continue
+    const locked = metas.find((m) => m.name === name)?.configPath
+    if (typeof locked === 'string' && locked !== '') continue
+    const config = PROJECT_CONFIG_FILENAMES.find((n) => existsSync(path.join(entry.dir, n)))
+    if (config === undefined) continue
+    throw new UserError(
+      `${spec}: ${relPosix(workspaceRoot, path.join(entry.dir, config))} is not in the lock yet — run \`vx lock\``,
+    )
+  }
+}
+
+/**
+ * Each remote's `open`, in declared order, for the ones the policy lets read
+ * or write. One at a time: two that ask on the terminal must not interleave.
+ * A throw warns through the remote's `onError` (naming its plugin) and
+ * turns that remote off; the run goes on, as after any remote failure.
+ * True when that left the run no remote at all.
+ */
+export async function openRemotes(
+  remotes: readonly ResolvedRemote[],
+  ci: boolean,
+  secrets: SecretBroker,
+): Promise<boolean> {
+  let closed = false
+  for (const entry of remotes) {
+    if (entry.remote.open === undefined || !(entry.read || entry.write)) continue
+    try {
+      await entry.remote.open({
+        ci,
+        warn: (message) => entry.onError?.(new Error(message)),
+        ...secrets.for(entry.plugin ?? 'vx'),
+      })
+    } catch (err) {
+      entry.read = false
+      entry.write = false
+      const e = err instanceof Error ? err : new Error(String(err))
+      entry.onError?.(e)
+      closed = true
+    }
+  }
+  return closed && !remotes.some((r) => r.read || r.write)
+}

package/src/orchestrator/projects.ts

@@ -25,6 +25,8 @@ import type { WorkspaceConfig } from '../config.js'
 import { lazyGitEnumeration, type LazyGitEnumeration } from '../cache/index.js'
 import { relPosix, UserError } from '../util/index.js'
 import {
+  cacheScopeError,
+  isCacheScope,
   loadWorkspaceConfig,
   discoveredProject,
   linkDiscoveredEdges,
@@ -33,7 +35,7 @@ import {
 } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
 import { applyConfigHooks, applyDiscoverHooks, applyProjectHooks, hasHook } from './plugin-host.js'
-import type { VxPlugin } from './plugin.js'
+import type { BranchFacts, VxPlugin } from './plugin.js'
 
 /**
  * The workspace config with the plugin `config` stage applied — the first
@@ -43,10 +45,16 @@ import type { VxPlugin } from './plugin.js'
 export async function loadWorkspacePlugins(
   workspaceRoot: string,
   warn: (message: string) => void,
-): Promise<{ workspaceConfig: WorkspaceConfig | null; plugins: readonly VxPlugin[] }> {
+): Promise<{
+  workspaceConfig: WorkspaceConfig | null
+  plugins: readonly VxPlugin[]
+  branch: BranchFacts
+}> {
   const loaded = await loadWorkspaceConfig(workspaceRoot)
   const plugins = (loaded?.plugins ?? []) as readonly VxPlugin[]
-  if (loaded === null || !hasHook(plugins, 'config')) return { workspaceConfig: loaded, plugins }
+  const branch: BranchFacts = {}
+  if (loaded === null || !hasHook(plugins, 'config'))
+    return { workspaceConfig: loaded, plugins, branch }
   // Bun keeps one module per specifier, so the file's export is one object
   // per process: the CLI's selection pass, the run and each `vx watch`
   // cycle handed the hooks what the last load's hooks had edited
@@ -60,10 +68,16 @@ export async function loadWorkspacePlugins(
   // Re-validated after each plugin, as the `project` stage is: an edit
   // the loader would refuse from a user (`concurrency: -3`) hung the run,
   // and `cacheDir: 42` reached `path.resolve` as a TypeError.
-  await applyConfigHooks(plugins, workspaceConfig, { workspaceRoot, warn }, (plugin) =>
+  const setBranch = (facts: BranchFacts): void => {
+    if (facts.scope !== undefined && !isCacheScope(facts.scope))
+      throw new UserError(`setBranch: ${cacheScopeError('scope')}`)
+    if (facts.scope !== undefined) branch.scope = facts.scope
+    if (facts.base !== undefined) branch.base = facts.base
+  }
+  await applyConfigHooks(plugins, workspaceConfig, { workspaceRoot, warn, setBranch }, (plugin) =>
     validateWorkspace(workspaceConfig, `.vx/workspace (after plugin '${plugin.name}')`),
   )
-  return { workspaceConfig, plugins }
+  return { workspaceConfig, plugins, branch }
 }
 
 /**
@@ -127,11 +141,16 @@ export async function discoverProjects(
       (e) => e.changed,
       () => null,
     )
+  const byDir = new Map(projects.map((p) => [p.dir, p]))
   const edges = await applyDiscoverHooks(
     plugins,
     projects,
     { workspaceRoot, cacheDir, warn, worktreeChanges },
-    (entry, plugin) => discoveredProject(workspaceRoot, projects, entry, plugin.name),
+    async (entry, plugin) => {
+      const found = await discoveredProject(workspaceRoot, byDir, entry, plugin.name)
+      if (found.added) byDir.set(found.meta.dir, found.meta)
+      return found
+    },
   )
   checkProjectNames(workspaceRoot, projects)
   linkDiscoveredEdges(workspaceRoot, projects, edges)

package/src/orchestrator/run-context.ts

@@ -15,6 +15,7 @@ import os from 'node:os'
 import path from 'node:path'
 import { executablePath, gitEnv, relPosix, ulid, xxh3hex } from '../util/index.js'
 import { resolveSetting } from '../settings.js'
+import { branchCacheScope, cacheScopeEnvError, isCacheScope } from '../workspace/index.js'
 import { VERSION } from '../version.js'
 import type { RunContextRecord } from './telemetry.js'
 
@@ -525,6 +526,85 @@ export function currentBranch(
   return set ?? captureGitContext(workspaceRoot, null, env).branch
 }
 
+/**
+ * The cache scope a checkout on a branch reads, from the `.git` files
+ * alone (owner, 2026-10-17): `<owner>/<repo>:<branch>`, the branch it
+ * tracks (`branch.<name>.merge` on `branch.<name>.remote`), else its own
+ * name on `origin`, the repository named by that remote's URL. None on
+ * the default branch, on a detached HEAD, or with no remote URL. CI writes
+ * that scope for the same branch (`github()`), so a laptop reads what its
+ * branch's CI saved.
+ */
+export function localBranchScope(
+  workspaceRoot: string,
+  baseBranch: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  const head = readHeadDirect(workspaceRoot)
+  if (head === null || head.branch === null) return undefined
+  const config = gitConfigSections(workspaceRoot)
+  const own = config.get(`branch "${head.branch}"`)
+  const name = own?.get('merge')?.replace(/^refs\/heads\//, '') ?? head.branch
+  const url = config.get(`remote "${own?.get('remote') ?? 'origin'}"`)?.get('url')
+  const repo = url === undefined ? undefined : repoOfUrl(url)
+  if (repo === undefined) return undefined
+  const trunk = baseBranch ?? captureDefaultBranch(env, workspaceRoot)
+  if (trunk === null ? name === 'main' || name === 'master' : name === trunk) return undefined
+  return branchCacheScope(repo, name)
+}
+
+/** `owner/repo` from a remote URL (its last two path segments); undefined for a local path. */
+function repoOfUrl(url: string): string | undefined {
+  const parts = normalizeRemoteUrl(url).split('/')
+  return parts.length < 3 ? undefined : parts.slice(-2).join('/')
+}
+
+/** `.git/config`'s sections, each a key → value map (last wins); empty when it cannot be read. */
+function gitConfigSections(workspaceRoot: string): Map<string, Map<string, string>> {
+  const sections = new Map<string, Map<string, string>>()
+  try {
+    const dirs = refDirsOf(workspaceRoot)
+    if (dirs === null) return sections
+    let at: Map<string, string> | undefined
+    for (const raw of fs.readFileSync(path.join(dirs.commonDir, 'config'), 'utf8').split('\n')) {
+      const line = raw.trim()
+      const section = /^\[\s*(\w+)(?:\s+"(.*)")?\s*\]$/.exec(line)
+      if (section !== null) {
+        const key = section[2] === undefined ? section[1]! : `${section[1]} "${section[2]}"`
+        at = sections.get(key) ?? new Map()
+        sections.set(key, at)
+        continue
+      }
+      const kv = /^(\w+)\s*=\s*(.*)$/.exec(line)
+      if (kv !== null) at?.set(kv[1]!.toLowerCase(), kv[2]!.trim())
+    }
+  } catch {
+    // no config to read: no remote, so no scope.
+  }
+  return sections
+}
+
+/**
+ * The run's cache scope (owner, 2026-10-17): `VX_CACHE_SCOPE` (empty: none),
+ * else a plugin's (`setBranch`, `github()` on Actions), else, with a cache
+ * plugin to share it, the branch's from git. Undefined: the default keys.
+ */
+export function resolveCacheScope(
+  workspaceRoot: string,
+  pluginScope: string | undefined,
+  hasRemote: boolean,
+  baseBranch: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  const named = env['VX_CACHE_SCOPE']
+  if (named !== undefined) {
+    if (named === '') return undefined
+    if (!isCacheScope(named)) throw cacheScopeEnvError()
+    return named
+  }
+  return pluginScope ?? (hasRemote ? localBranchScope(workspaceRoot, baseBranch, env) : undefined)
+}
+
 export interface TelemetryRunContextArgs {
   runId: string
   /** The invocation, already masked. */

package/src/orchestrator/run.ts

@@ -49,6 +49,7 @@ import {
   isUserError,
   detectColors,
   type ColorSupport,
+  SecretBroker,
 } from '../util/index.js'
 import { keyedProjects } from './keyed-projects.js'
 import { isDefaultBuild } from './projects.js'
@@ -87,7 +88,7 @@ import { isPassStatus } from '../graph/index.js'
 import type { RunContextRecord } from './telemetry.js'
 import { plan, type RunPlan } from './plan.js'
 import type { AffectedReason } from './affected-tasks.js'
-import { prepareRun, type PreparedRun } from './prepare.js'
+import { openRemotes, prepareRun, type PreparedRun } from './prepare.js'
 import { acquireRunLock } from './run-lock.js'
 import { terminateChildren } from './signals.js'
 import { runStop } from './run-stop.js'
@@ -466,6 +467,15 @@ async function runOnBus(
           failures: keepRun.failures,
           traffic: prepared.localCache.traffic,
         })
+  // Before setup and the status line: a remote's `open` may ask on the terminal.
+  const secrets = new SecretBroker(
+    ciContext.ci,
+    warnOf(log),
+    undefined,
+    undefined,
+    terminal === null ? undefined : () => terminal.holdStatus(),
+  )
+  const remotesClosed = await openRemotes(prepared.remotes, ciContext.ci, secrets)
   try {
     disposePlugins = await installPlugins({
       plugins: prepared.plugins,
@@ -476,6 +486,7 @@ async function runOnBus(
       cache: prepared.cacheFor,
       ci: ciContext.ci,
       branch: prepared.branch(),
+      secrets,
       step,
     })
   } catch (err) {
@@ -592,6 +603,7 @@ async function runOnBus(
     handsTerminal: holders.size > 0,
     teardowns: prepared.plugins.filter((p) => p.teardown).length,
     onStop: () => {
+      log.runStop?.()
       stopRuntimeProbes(hashCache.runtime, hashCache.workspaceRuntime)
       cache.stopUploads?.()
       keeper?.stop()
@@ -634,13 +646,15 @@ async function runOnBus(
   try {
     const runStartHrTimeNs = process.hrtime.bigint()
     const endedAtMsAtStart = Date.now()
-    const remoteCacheEnabled = prepared.hasRemoteLayer
+    // Every remote turned off by its `open` is no remote: a task must not clean
+    // its outputs for a save that goes nowhere.
+    const remoteCacheEnabled = prepared.hasRemoteLayer && !remotesClosed
     // Normalised ONCE so every consumer — execute-task, the dedup
     // predicate, the recorded invocation row — reads the policy that
     // actually governed the run. Reading the raw request here made tasks
     // clean their outputs before every exec for a save that never
     // happened.
-    const policy: CachePolicy = effectiveCachePolicy(prepared.cachePolicy, prepared.hasRemoteLayer)
+    const policy: CachePolicy = effectiveCachePolicy(prepared.cachePolicy, remoteCacheEnabled)
     if (options.remoteRequested === true && !prepared.hasRemoteLayer) {
       warnOf(log)(
         'vx: --cache-policy named the remote cache, but no cache plugin in .vx/workspace.* supplies one — the remote axes are off for this run',
@@ -785,6 +799,7 @@ async function runOnBus(
       version: VERSION,
       packageCount: packagesInScope.size,
       remoteCacheEnabled,
+      cacheScope: prepared.cacheScope,
       cache: {
         local: policy.localRead || policy.localWrite,
         localWrite: policy.localWrite,
@@ -794,6 +809,7 @@ async function runOnBus(
       },
       concurrency,
       workspaceProjectCount,
+      runId: undefined as string | undefined,
     }
 
     // Asked only when a plugin declares `output`: a plain run pays nothing.
@@ -810,6 +826,8 @@ async function runOnBus(
 
     // Lifecycle hooks drive the default logger's dynamic status line
     // (TTY-only); custom loggers may ignore them.
+    // The status line starts here: a prompt now would be drawn over.
+    secrets.closePrompts()
     log.runStart?.({
       total: taskCount,
       concurrency,
@@ -817,18 +835,22 @@ async function runOnBus(
       context: runContext,
       startedAtMs: endedAtMsAtStart,
     })
-    // The live region's end-of-run forecast. The logger asks only if its
-    // region is still up a second in, so a warm run never reads history.
-    terminal?.forecast(async () => {
-      const ids: string[] = []
-      for (const n of nodes.values()) if (!isGroupTask(n)) ids.push(n.id)
-      const p50s = await new LocalHistoryProvider(
-        prepared.localCache.dbHandle(),
-        undefined,
-        prepared.branch(),
-      ).p50sFor(ids)
-      return createForecast(nodes, p50s, concurrency)
-    })
+    // The live region's forecast: the graph's from the first free row, and
+    // history's only if the region is still up a second in, so a warm run
+    // never reads history.
+    terminal?.forecast(
+      () => createForecast(nodes, new Map(), concurrency),
+      async () => {
+        const ids: string[] = []
+        for (const n of nodes.values()) if (!isGroupTask(n)) ids.push(n.id)
+        const p50s = await new LocalHistoryProvider(
+          prepared.localCache.dbHandle(),
+          undefined,
+          prepared.branch(),
+        ).p50sFor(ids)
+        return createForecast(nodes, p50s, concurrency)
+      },
+    )
 
     // Remote-only: kick off background prefetches so remote-GET latency
     // overlaps execution. Fire-and-forget — execution starts on the next
@@ -1269,6 +1291,7 @@ async function runOnBus(
       })
     }
     mark('record history')
+    runContext.runId = runId
     // Drain any still-in-flight background prefetches before closing the
     // cache handle — a prefetch ingesting into a closed SQLite DB would
     // throw. Tasks that resolved as local hits never awaited their

package/src/orchestrator/sandbox-request.ts

@@ -7,7 +7,7 @@ import { existsSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import type { ExecConfig, SandboxConfig } from '../config.js'
+import type { ExecConfig } from '../config.js'
 import {
   bindableWrites,
   initSandbox,
@@ -289,53 +289,6 @@ export async function sandboxRequestFor(
   return { sandbox: request, placeholders, withheld: links.withheld }
 }
 
-/**
- * Whether a sandboxed task could read `real` (a canonical path inside its
- * project): under one of its read or write grants or its `node_modules`,
- * and not behind a wall. vx packs a symlinked output as its target's
- * bytes, outside the sandbox, so a link the task planted to a file it was
- * denied (`dist/x -> ../.env` under `read: ['src/']`) packed that file
- * into the cache wherever creating the link went unseen: seatbelt, or
- * Linux untraced. The grants are matched as written, not expanded: a
- * glob's hit made by the task itself counts.
- */
-export function sandboxReadable(
-  node: TaskNode,
-  sandbox: SandboxConfig,
-  workspaceRoot: string,
-  nested: readonly string[] = [],
-): (real: string) => boolean {
-  const projectReal = toRealPath(node.projectDir)
-  const at = (p: string): string =>
-    p.startsWith('~')
-      ? path.join(homedir(), p.slice(1))
-      : path.isAbsolute(p)
-        ? p
-        : path.join(projectReal, p)
-  const grants = [...(sandbox.allow?.read ?? []), ...(sandbox.allow?.write ?? [])].map(at)
-  const literals = [
-    ...grants.filter(isMountableLiteral).map((g) => toRealPath(g.replace(/\/+$/, '') || '/')),
-    toRealPath(path.join(node.projectDir, 'node_modules')),
-    toRealPath(path.join(workspaceRoot, 'node_modules')),
-  ]
-  const globs = grants.filter((g) => !isMountableLiteral(g)).map((g) => new Bun.Glob(g))
-  const walls = [
-    ...nested,
-    path.join(workspaceRoot, '.git'),
-    path.join(workspaceRoot, '.vx', 'cache'),
-  ].map(toRealPath)
-  return (real) => {
-    if (walls.some((w) => atOrUnder(real, w))) return false
-    if (literals.some((l) => atOrUnder(real, l))) return true
-    // A directory a glob matches is granted whole.
-    for (let p = real; atOrUnder(p, projectReal); p = path.dirname(p)) {
-      if (globs.some((g) => g.match(p))) return true
-      if (p === projectReal) break
-    }
-    return false
-  }
-}
-
 /**
  * The sandbox half of the request, plus the empty files vx created so a
  * literal write grant had something to bind (`placeholders`). They are