@vzn/vx 0.0.646 → 0.0.648

package/src/orchestrator/remote-prefetch.ts

@@ -14,7 +14,7 @@
 // HARD SCOPE: this runs ONLY when a remote layer is configured. It
 // asks the local index only which keys it holds (no local get / no
 // isOutputsCurrent), and probes the remote for the rest: a run the local
-// cache answers makes no remote call (M, 2026-10-15). Local-only
+// cache answers makes no remote call (2026-10-15). Local-only
 // runs are byte-identical to before; the caller gates on the layer's
 // own `hasRemote`, so a third-party remote layer gets the overlap too.
 // The two batch-probe hooks are OPTIONAL on the contract: a remote layer
@@ -24,7 +24,7 @@ import type { TaskNode } from '../graph/index.js'
 import { maskedCommand } from '../util/index.js'
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
 import type { HashCache } from './task-hash.js'
-import { deriveStableKeys } from './stable-keys.js'
+import { deriveStableKeys, type StableKey } from './stable-keys.js'
 
 export interface PrefetchArgs {
   nodes: Map<string, TaskNode>
@@ -46,6 +46,27 @@ export interface PrefetchArgs {
    * `probeBeforeUpload` instead, so a key a remote holds is not re-sent.
    */
   remoteWrite: boolean
+  /**
+   * Told once, after the probe, the stable tasks a store holds, local or
+   * remote, and those every store answered it does not: they run.
+   */
+  held?: ((ids: readonly string[], missed: readonly string[]) => void) | undefined
+  /** `--profile`'s run events: the keys' derivation and the batch probe, `ts` on `performance.now()`. */
+  spans?: Record<string, unknown>[] | undefined
+}
+
+function span(spans: PrefetchArgs['spans'], name: string, start: number, args: object): void {
+  const end = performance.now()
+  spans?.push({
+    name,
+    cat: 'cache',
+    ph: 'X',
+    ts: start * 1000,
+    dur: (end - start) * 1000,
+    pid: 1,
+    tid: 0,
+    args,
+  })
 }
 
 /**
@@ -75,16 +96,24 @@ export function startRemotePrefetch(args: PrefetchArgs): Promise<void> {
   // a still-in-flight prefetch can never ingest into a closed DB. Errors
   // degrade inside LayeredCache.prefetch; the catch keeps the handle
   // from ever rejecting.
-  const started = Promise.withResolvers<void>()
-  args.cache.probeFirst?.(started.promise)
-  return runPrefetch(args, started.resolve)
-    .catch(() => {})
-    .finally(started.resolve)
+  return runPrefetch(args).catch(() => {})
 }
 
-async function runPrefetch(args: PrefetchArgs, probing: () => void): Promise<void> {
+async function runPrefetch(args: PrefetchArgs): Promise<void> {
+  const keysAt = performance.now()
   const stableKeys = await deriveStableKeys(args)
-  if (stableKeys.length === 0) return
+  span(args.spans, 'stable keys', keysAt, { keys: stableKeys.length })
+  // `complete`: every store asked answered for every key, so one it does
+  // not hold is a miss; else only its hits are known.
+  const tell = (holds: (hash: string) => boolean, complete: boolean): void =>
+    args.held?.(
+      stableKeys.filter((k) => holds(k.hash)).map((k) => k.node.id),
+      complete ? stableKeys.filter((k) => !holds(k.hash)).map((k) => k.node.id) : [],
+    )
+  if (stableKeys.length === 0) {
+    tell(() => false, true)
+    return
+  }
 
   // Batch existence probe FIRST (when the remote supports it): one round-trip
   // tells us which of the N stable hashes exist remotely, so we GET only the
@@ -96,12 +125,58 @@ async function runPrefetch(args: PrefetchArgs, probing: () => void): Promise<voi
   const held =
     (await args.cache.localHasMany?.([...new Set(stableKeys.map((k) => k.hash))])) ?? null
   let toPrefetch = held === null ? stableKeys : stableKeys.filter((k) => !held.has(k.hash))
-  if (toPrefetch.length === 0) return
+  if (toPrefetch.length === 0) {
+    tell(() => true, true)
+    return
+  }
   const uniqueHashes = [...new Set(toPrefetch.map((k) => k.hash))]
+  const pool = fetchPool(args.concurrency, (k) =>
+    args.cache.prefetch(k.hash, getContext(k.node, k.node.config.exec?.command ?? '')),
+  )
+  // Trusted at once: a key the index says a remote holds is a hit and its
+  // pull starts now, before any remote answers (2026-10-23). The probe
+  // below still asks for all of them.
+  // One that knows none of them says nothing: a fresh CI runner's empty
+  // index called every key a miss, and main asked 15 workers for 16 misses
+  // (75f58f9, 2026-10-23). The probe answers them.
+  const kept = args.cache.remoteKnown?.(uniqueHashes)
+  const known = kept === undefined || kept.size === 0 ? undefined : kept
+  if (known !== undefined) pool.push(toPrefetch.filter((k) => known.has(k.hash)))
+  const probeAt = performance.now()
   const asked = args.cache.remoteHasMany?.(uniqueHashes)
-  // Every lookup that waited on the probe now finds its hash in it.
-  probing()
-  const present = (await asked) ?? null
+  // The first keys in graph order are pulled now too, the probe unanswered:
+  // on CI it answered ~490 ms in, after a GET did (~250 ms), and a hit's
+  // dependant waited on its own GET once its upstream hit landed
+  // (2026-10-24). At most one pool's worth of these can 404.
+  const eager = toPrefetch.filter((k) => known?.has(k.hash) !== true).slice(0, args.concurrency)
+  if (asked !== undefined) pool.push(eager)
+  // Demand hears the index only when no probe will answer: a key the
+  // index lacks may still be held (a PR's CI stored main's next tree), and
+  // calling it a miss asked 14 workers for 71 tasks, 17 of which ran
+  // (main 7391c93, 2026-10-23). The probe is one round-trip.
+  const early = known !== undefined && asked === undefined
+  if (early) tell((h) => held?.has(h) === true || known.has(h), true)
+
+  // Batch existence probe (when the remote supports it): one round-trip
+  // tells us which of the N stable hashes exist remotely, so we GET only the
+  // hits and pre-mark the misses — their lazy `get` then short-circuits with
+  // no network. This collapses N probe waves into 1 and skips every GET that
+  // would 404. When the remote can't batch (`null` — an older remote, reads
+  // disabled, or a layer that doesn't implement the hook at all), fall back to
+  // prefetching every stable key, exactly as before.
+  // A remote that answered no batch query is asked key by key when demand
+  // plans on the answer: main f71b377 asked 15 workers for 116 tasks, 107
+  // restored, and small#1 joined to nothing (2026-10-23). A run that plans
+  // nothing pulls instead, as before.
+  let present = (await asked) ?? null
+  if (asked !== undefined)
+    span(args.spans, 'remote probe', probeAt, {
+      keys: uniqueHashes.length,
+      held: present?.size ?? null,
+    })
+  if (present === null && args.held !== undefined && asked !== undefined)
+    present = (await args.cache.remoteHasEach?.(uniqueHashes, args.concurrency)) ?? null
+  if (!early) tell((h) => held?.has(h) === true || present?.has(h) === true, present !== null)
   if (present !== null) {
     args.cache.markRemoteAbsent?.(uniqueHashes.filter((h) => !present.has(h)))
     // The pre-mark above already answers a pull for an absent hash from
@@ -110,24 +185,43 @@ async function runPrefetch(args: PrefetchArgs, probing: () => void): Promise<voi
     // every absent key. What it decides is which hashes the pump asks
     // the layer for, and that is what the row pins (item 643, 645).
     toPrefetch = toPrefetch.filter((k) => present.has(k.hash))
-    if (toPrefetch.length === 0) return
   }
+  const pulled = new Set(asked === undefined ? [] : eager)
+  pool.push(toPrefetch.filter((k) => known?.has(k.hash) !== true && !pulled.has(k)))
+  await pool.settled()
+}
 
-  // Bounded worker pool over the keys to fetch. Each prefetch is
-  // self-contained (LayeredCache owns the in-flight map + ingest); we
-  // cap concurrency so a 1000-task run doesn't open 1000 sockets at
-  // once. The pumps race alongside execution.
+/**
+ * Bounded worker pool over the keys to fetch, fed as they are known. Each
+ * prefetch is self-contained (LayeredCache owns the in-flight map +
+ * ingest); the cap keeps a 1000-task run from opening 1000 sockets at
+ * once. The pumps race alongside execution.
+ */
+function fetchPool(
+  concurrency: number,
+  fetch: (k: StableKey) => Promise<boolean>,
+): { push(keys: readonly StableKey[]): void; settled(): Promise<unknown> } {
+  const cap = Math.max(1, concurrency)
+  const queue: StableKey[] = []
+  const pumps: Promise<void>[] = []
   let next = 0
-  const workers = Math.max(1, Math.min(args.concurrency, toPrefetch.length))
+  let active = 0
   const pump = async (): Promise<void> => {
-    while (next < toPrefetch.length) {
-      const { hash, node } = toPrefetch[next++]!
-      await args.cache
-        .prefetch(hash, getContext(node, node.config.exec?.command ?? ''))
-        .catch(() => false)
+    active++
+    try {
+      while (next < queue.length) await fetch(queue[next++]!).catch(() => false)
+    } finally {
+      active--
     }
   }
-  await Promise.all(Array.from({ length: workers }, () => pump()))
+  return {
+    push(keys) {
+      queue.push(...keys)
+      const room = Math.min(cap - active, queue.length - next)
+      for (let i = 0; i < room; i++) pumps.push(pump())
+    },
+    settled: () => Promise.all(pumps),
+  }
 }
 
 /**

package/src/orchestrator/run-artifacts.ts

@@ -10,6 +10,42 @@ export interface ProfileArgs {
   target: string
   cwd: string
   outcomes: readonly TaskOutcome[]
+  /** `process.hrtime.bigint()` at the run's start: a task's span is taken from it. */
+  runStartNs: bigint
+  /** Each executor's own events (`TaskExecutor.profile`), `ts` on `performance.now()`. */
+  executors?: readonly (readonly Record<string, unknown>[])[]
+  /** The run's own events beside its tasks (the cache probe), `ts` on `performance.now()`. */
+  spans?: readonly Record<string, unknown>[]
+}
+
+// ns → us; bigint arithmetic to avoid precision loss before converting to
+// a JSON-safe number.
+function spanUs(o: TaskOutcome): { startUs: number; durUs: number } {
+  return {
+    startUs: Number(o.wallclockStartNs! / 1000n),
+    durUs: Number((o.wallclockEndNs! - o.wallclockStartNs!) / 1000n),
+  }
+}
+
+/**
+ * Each task's `tid`: its project's lane, or the project's next lane when it
+ * overlaps a task already there. Slices on one thread must nest, and two
+ * tasks of one project running side by side do not: Perfetto drops one.
+ */
+function lanes(timed: readonly TaskOutcome[]): Map<TaskOutcome, number> {
+  const ends = new Map<string, { tid: number; endUs: number }[]>()
+  const tidOf = new Map<TaskOutcome, number>()
+  let tids = 0
+  const byStart = timed.map((o) => ({ o, ...spanUs(o) })).sort((a, b) => a.startUs - b.startUs)
+  for (const { o, startUs, durUs } of byStart) {
+    let own = ends.get(o.node.projectName)
+    if (own === undefined) ends.set(o.node.projectName, (own = []))
+    let lane = own.find((l) => l.endUs <= startUs)
+    if (lane === undefined) own.push((lane = { tid: ++tids, endUs: 0 }))
+    lane.endUs = startUs + durUs
+    tidOf.set(o, lane.tid)
+  }
+  return tidOf
 }
 
 /**
@@ -18,40 +54,67 @@ export interface ProfileArgs {
  *
  * One complete event (`ph: 'X'`) per task with `ts` and `dur` in
  * microseconds (Chrome's unit; we have ns from hrtime, divide by 1000).
- * Each project gets its own `tid` so concurrent tasks render on
- * distinct rows in chrome://tracing or perfetto.
+ * Each project gets its own `tid`, and one more for each task it runs
+ * beside another, so concurrent tasks render on distinct rows.
  */
 export async function writeRunProfile(args: ProfileArgs): Promise<string> {
   const outPath = path.resolve(args.cwd, args.target)
-  const tidByProject = new Map<string, number>()
-  const traceEvents = args.outcomes
-    .filter((o) => o.wallclockStartNs !== undefined && o.wallclockEndNs !== undefined)
-    .map((o) => {
-      let tid = tidByProject.get(o.node.projectName)
-      if (tid === undefined) {
-        tid = tidByProject.size + 1
-        tidByProject.set(o.node.projectName, tid)
-      }
-      // ns → us; bigint arithmetic to avoid precision loss before
-      // converting to a JSON-safe number.
-      const startUs = Number((o.wallclockStartNs ?? 0n) / 1000n)
-      const durUs = Number(((o.wallclockEndNs ?? 0n) - (o.wallclockStartNs ?? 0n)) / 1000n)
-      return {
-        name: o.node.id,
-        cat: o.status,
-        ph: 'X',
-        ts: startUs,
-        dur: durUs,
-        pid: 1,
-        tid,
-        args: {
-          exitCode: o.exitCode,
-          hash: o.hash ?? null,
-          ...(o.cpuMs !== undefined ? { cpuMs: o.cpuMs } : {}),
-          ...(o.peakRssBytes !== undefined ? { peakRssBytes: o.peakRssBytes } : {}),
-        },
-      }
-    })
-  await Bun.write(outPath, JSON.stringify({ traceEvents }, null, 2))
+  const timed = args.outcomes.filter(
+    (o) => o.wallclockStartNs !== undefined && o.wallclockEndNs !== undefined,
+  )
+  const tidOf = lanes(timed)
+  const traceEvents = timed.map((o) => {
+    const tid = tidOf.get(o)!
+    const { startUs, durUs } = spanUs(o)
+    return {
+      name: o.node.id,
+      cat: o.status,
+      ph: 'X',
+      ts: startUs,
+      dur: durUs,
+      pid: 1,
+      tid,
+      args: {
+        exitCode: o.exitCode,
+        hash: o.hash ?? null,
+        ...(o.cpuMs !== undefined ? { cpuMs: o.cpuMs } : {}),
+        ...(o.peakRssBytes !== undefined ? { peakRssBytes: o.peakRssBytes } : {}),
+        // A remote hit's download and ingest: the rest of its span is vx's.
+        ...(o.fetchMs !== undefined ? { fetchMs: o.fetchMs } : {}),
+      },
+    }
+  })
+  // An executor's processes follow the run's own, each executor's after
+  // the last; its times move onto the tasks' clock, the run's start on
+  // hrtime. Without the start, a DTE mark sat ~the run's setup late.
+  const shiftUs =
+    Number((process.hrtime.bigint() - args.runStartNs) / 1000n) - performance.now() * 1000
+  let next = 2
+  const theirs: Record<string, unknown>[] = []
+  for (const events of args.executors ?? []) {
+    let top = 0
+    for (const e of events) {
+      const pid = typeof e['pid'] === 'number' ? e['pid'] : 1
+      top = Math.max(top, pid)
+      theirs.push({
+        ...e,
+        pid: next - 1 + pid,
+        ...(typeof e['ts'] === 'number' ? { ts: Math.round(e['ts'] + shiftUs) } : {}),
+      })
+    }
+    next += top
+  }
+  const own = (args.spans ?? []).map((e) => ({
+    ...e,
+    ...(typeof e['ts'] === 'number' ? { ts: Math.round(e['ts'] + shiftUs) } : {}),
+  }))
+  const named =
+    theirs.length === 0
+      ? []
+      : [{ ph: 'M', name: 'process_name', pid: 1, tid: 0, args: { name: 'run' } }]
+  await Bun.write(
+    outPath,
+    JSON.stringify({ traceEvents: [...named, ...traceEvents, ...own, ...theirs] }, null, 2),
+  )
   return outPath
 }

package/src/orchestrator/run-context.ts

@@ -13,7 +13,15 @@
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { executablePath, gitEnv, relPosix, ulid, xxh3hex } from '../util/index.js'
+import {
+  envFlagOn,
+  executablePath,
+  gitEnv,
+  ignoreDir,
+  relPosix,
+  ulid,
+  xxh3hex,
+} from '../util/index.js'
 import { resolveSetting } from '../settings.js'
 import { branchCacheScope, cacheScopeEnvError, isCacheScope } from '../workspace/index.js'
 import { VERSION } from '../version.js'
@@ -234,7 +242,7 @@ function ciBranch(env: NodeJS.ProcessEnv | Record<string, string | undefined>):
  * The repository's DEFAULT (trunk) branch — the axis that separates a
  * mainline run from a PR / feature-branch experiment. A run whose `branch`
  * equals this is a trunk run; everything else is branch work whose timings
- * must NOT pollute the shared scheduling baseline (owner 2026-07-14: "I can
+ * must NOT pollute the shared scheduling baseline (2026-07-14: "I can
  * be experimenting on a branch increasing task time for all later on… don't
  * count their times into main"). Resolution ladder, most-reliable first:
  *   1. GitLab: `CI_DEFAULT_BRANCH` (the project's configured default).
@@ -312,10 +320,6 @@ const CI_PROVIDERS: ReadonlyArray<[envVar: string, provider: string]> = [
   ['CI', 'generic'],
 ]
 
-function isTruthy(v: string | undefined): boolean {
-  return v !== undefined && v !== '' && v !== '0' && v.toLowerCase() !== 'false'
-}
-
 /**
  * Detect a CI environment + which provider. `ci=true` if any recognized
  * var is truthy; `provider` names the most-specific match (a specific
@@ -323,7 +327,7 @@ function isTruthy(v: string | undefined): boolean {
  */
 export function detectCi(env: NodeJS.ProcessEnv | Record<string, string | undefined>): CiContext {
   for (const [varName, provider] of CI_PROVIDERS) {
-    if (isTruthy(env[varName])) return { ci: true, provider, ...ciLinks(provider, env) }
+    if (envFlagOn(env[varName])) return { ci: true, provider, ...ciLinks(provider, env) }
   }
   return { ci: false, provider: null }
 }
@@ -345,8 +349,12 @@ function ciLinks(provider: string, env: Record<string, string | undefined>): CiL
       const id = v('GITHUB_RUN_ID')
       links = {
         runUrl: repo && id ? `${server}/${repo}/actions/runs/${id}` : undefined,
-        // `refs/pull/<n>/merge` on a pull_request event.
-        change: /^refs\/pull\/(\d+)\//.exec(v('GITHUB_REF') ?? '')?.[1],
+        // `refs/pull/<n>/merge` on a pull_request event; a merge queue's
+        // run, `refs/heads/gh-readonly-queue/<base>/pr-<n>-<sha>`.
+        change: /^refs\/(?:pull\/(\d+)\/|heads\/gh-readonly-queue\/.+\/pr-(\d+)-[0-9a-f]+$)/
+          .exec(v('GITHUB_REF') ?? '')
+          ?.slice(1)
+          .find((x) => x !== undefined),
         pipeline: v('GITHUB_WORKFLOW'),
         job: v('GITHUB_JOB'),
         attempt: n(v('GITHUB_RUN_ATTEMPT')),
@@ -505,6 +513,12 @@ export function captureWorkspaceIdentity(
       fs.mkdirSync(path.dirname(saltPath), { recursive: true })
       fs.writeFileSync(saltPath, salt + '\n')
     }
+    try {
+      // On every capture: a salt an older vx wrote may sit unignored.
+      ignoreDir(path.dirname(saltPath))
+    } catch {
+      // read-only: the salt is still the identity
+    }
     return { id: xxh3hex(salt), name: base, ...where }
   } catch {
     return { id: xxh3hex(workspaceRoot), name: base, ...where }
@@ -528,7 +542,7 @@ export function currentBranch(
 
 /**
  * The cache scope a checkout on a branch reads, from the `.git` files
- * alone (owner, 2026-10-17): `<owner>/<repo>:<branch>`, the branch it
+ * alone (2026-10-17): `<owner>/<repo>:<branch>`, the branch it
  * tracks (`branch.<name>.merge` on `branch.<name>.remote`), else its own
  * name on `origin`, the repository named by that remote's URL. None on
  * the default branch, on a detached HEAD, or with no remote URL. CI writes
@@ -554,41 +568,25 @@ export function localBranchScope(
 }
 
 /**
- * The refs a remote reads, in order (2026-10-20): the run's own branch,
- * then the branch it merges into, then the default branch, each once. On
- * CI from its env (a GitHub pull request's head branch, a merge queue's
- * queue ref, a GitLab pipeline's ref), else from git: the checked-out
- * branch, then the default (`origin/HEAD`). A remote plugin keys or scopes
- * its entries by them (`scope` on turboCache/nxCache); core keys nothing
- * by them.
+ * The refs a remote reads, in order: a plugin's (`setBranch`, `github()`
+ * and `gitlab()` on CI, 2026-10-25), else git's: the checked-out branch,
+ * then the default (`origin/HEAD`). A remote plugin keys or scopes its
+ * entries by them (`scope` on turboCache/nxCache); core keys nothing by them.
  */
 export function cacheRefs(
   workspaceRoot: string,
   baseBranch: string | undefined,
+  pluginRefs: readonly string[] | undefined,
   env: NodeJS.ProcessEnv = process.env,
 ): string[] {
-  const set = (v: string | undefined): string | undefined =>
-    v !== undefined && v.trim() !== '' ? v.trim() : undefined
-  const head = (b: string | undefined) => (b === undefined ? undefined : `refs/heads/${b}`)
-  let own: string | undefined
-  let base: string | undefined
-  if (env['GITHUB_ACTIONS'] === 'true') {
-    own = head(set(env['GITHUB_HEAD_REF'])) ?? set(env['GITHUB_REF'])
-    base = head(set(env['GITHUB_BASE_REF']))
-    const queue = /^refs\/heads\/gh-readonly-queue\/(.+)\/pr-\d+-[0-9a-f]+$/.exec(own ?? '')
-    if (queue !== null) base = head(queue[1])
-  } else if (env['GITLAB_CI'] === 'true') {
-    const tag = set(env['CI_COMMIT_TAG'])
-    own = tag !== undefined ? `refs/tags/${tag}` : head(set(env['CI_COMMIT_REF_NAME']))
-    base = head(set(env['CI_MERGE_REQUEST_TARGET_BRANCH_NAME']))
-  } else {
-    own = head(
-      (readHeadDirect(workspaceRoot) ?? captureGitContext(workspaceRoot, null, env)).branch ??
-        undefined,
-    )
-  }
-  const trunk = head(baseBranch ?? captureDefaultBranch(env, workspaceRoot) ?? undefined)
-  return [...new Set([own, base, trunk].filter((r): r is string => r !== undefined))]
+  if (pluginRefs !== undefined) return [...pluginRefs]
+  const head = (b: string | null | undefined) => (b == null ? undefined : `refs/heads/${b}`)
+  // `{}`: a detached HEAD names no branch here, not CI's (a plugin's job).
+  const own = head(
+    (readHeadDirect(workspaceRoot) ?? captureGitContext(workspaceRoot, null, {})).branch,
+  )
+  const trunk = head(baseBranch ?? captureDefaultBranch(env, workspaceRoot))
+  return [...new Set([own, trunk].filter((r): r is string => r !== undefined))]
 }
 
 /**
@@ -626,7 +624,7 @@ function gitConfigSections(workspaceRoot: string): Map<string, Map<string, strin
 }
 
 /**
- * The run's cache scope (owner, 2026-10-17): `VX_CACHE_SCOPE` (empty: none),
+ * The run's cache scope (2026-10-17): `VX_CACHE_SCOPE` (empty: none),
  * else a plugin's (`setBranch`, `github()` on Actions; null: the plugin
  * named the run trusted), else, with a cache plugin to share it, the
  * branch's from git. Undefined: no scope. It keys plugin entries only.
@@ -641,7 +639,7 @@ export function resolveCacheScope(
   const named = env['VX_CACHE_SCOPE']
   if (named !== undefined) {
     if (named === '') return undefined
-    if (!isCacheScope(named)) throw cacheScopeEnvError()
+    if (!isCacheScope(named)) throw cacheScopeEnvError(named)
     return named
   }
   if (pluginScope === null) return undefined

package/src/orchestrator/run-failures.ts

@@ -9,7 +9,7 @@ import path from 'node:path'
 import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 import { decodeOutputLog } from './output-log.js'
 import { PASS_STATUSES } from '../history/index.js'
-import { isFsRefusal, splitTaskId } from '../util/index.js'
+import { isFsRefusal, maskedLine, splitTaskId } from '../util/index.js'
 import { fileLocations, fileMemo, type OutputLocation } from '../report/index.js'
 
 /** Failed runs whose output is kept; run ids are UUIDv7, so names sort by age. */
@@ -104,10 +104,24 @@ function keep(cacheDir: string, runId: string, tasks: TaskFailure[]): void {
   const tmp = `${file}.${process.pid}.tmp`
   writeFileSync(tmp, JSON.stringify({ runId, tasks }))
   renameSync(tmp, file)
-  const names = readdirSync(dir)
-    .filter((n) => n.endsWith('.json'))
-    .sort()
-  for (const n of names.slice(0, -KEPT)) rmSync(path.join(dir, n), { force: true })
+  trimKept(dir, KEPT)
+}
+
+/**
+ * Keep the newest `kept` runs' files in `dir`, and the temp files of runs
+ * no older: a writer that crashed between its write and its rename left
+ * `<runId>.json.<pid>.tmp`, which the trim of `.json` names never took. A
+ * live writer's temp is of a run newer than every kept one.
+ */
+export function trimKept(dir: string, kept: number): void {
+  const all = readdirSync(dir)
+  const names = all.filter((n) => n.endsWith('.json')).sort()
+  for (const n of names.slice(0, -kept)) rmSync(path.join(dir, n), { force: true })
+  if (names.length < kept) return
+  const oldest = names[names.length - kept]!
+  for (const n of all)
+    if (n.endsWith('.tmp') && n.slice(0, n.lastIndexOf('.json.') + 5) < oldest)
+      rmSync(path.join(dir, n), { force: true })
 }
 
 /**
@@ -124,16 +138,7 @@ export function runFailures(cacheDir: string, db: Database, runId?: string): Run
         .get() as { run_id: string } | null
     )?.run_id
   if (id === undefined) return null
-  const kept = new Map<string, StoredFailure>()
-  try {
-    const stored = JSON.parse(
-      readFileSync(path.join(dirOf(cacheDir), `${id}.json`), 'utf8'),
-    ) as RunFailures & { tasks: StoredFailure[] }
-    for (const t of stored.tasks) kept.set(t.taskId, t)
-  } catch (err) {
-    // No file: the run kept no output.
-    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err
-  }
+  const kept = storedFailures(cacheDir, id)
   const rows = db
     .query(
       `SELECT r.project, r.task, r.exit_code AS exitCode, r.timed_out AS timedOut,
@@ -168,6 +173,33 @@ export function runFailures(cacheDir: string, db: Database, runId?: string): Run
   }
 }
 
+/** What `runId`'s failures file holds, by task id; empty when the run kept none. */
+function storedFailures(cacheDir: string, runId: string): Map<string, StoredFailure> {
+  const kept = new Map<string, StoredFailure>()
+  // A run id the caller typed names a file in failures/ only.
+  if (path.basename(runId) !== runId || runId === '..') return kept
+  let text: string
+  try {
+    text = readFileSync(path.join(dirOf(cacheDir), `${runId}.json`), 'utf8')
+  } catch (err) {
+    // No file: the run kept no output.
+    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err
+    return kept
+  }
+  // A file the disk left torn (a rename that landed before its data, on
+  // power loss) is output the run did not keep: it threw on every `vx last`
+  // until 50 newer runs rotated it out.
+  let stored: unknown
+  try {
+    stored = JSON.parse(text)
+  } catch {
+    return kept
+  }
+  const tasks = (stored as { tasks?: unknown } | null)?.tasks
+  if (Array.isArray(tasks)) for (const t of tasks as StoredFailure[]) kept.set(t.taskId, t)
+  return kept
+}
+
 /** One task's output in a recorded run, as `vx last --log` and getTaskLog read it. */
 export interface TaskLog {
   runId: string
@@ -209,22 +241,32 @@ export function taskLog(
   if (row === null) return null
   const base = { runId: row.runId, taskId, status: row.status }
   if (row.status === 'failed') {
-    const kept = runFailures(cacheDir, db, row.runId)?.tasks.find((t) => t.taskId === taskId)
-    if (kept !== undefined && kept.output !== '') {
-      return { ...base, source: 'failure', output: kept.output }
-    }
+    // Only the file: runFailures reads `output: ''` for a task it lacks, as
+    // if the task printed nothing, when the run is past the newest 50.
+    const kept = storedFailures(cacheDir, row.runId).get(taskId)
+    if (kept !== undefined) return { ...base, source: 'failure', output: kept.output }
   } else if (row.hash !== '') {
     const stored = db.query('SELECT stdout FROM entry_stdout WHERE hash = ?').get(row.hash) as {
       stdout: string
     } | null
     if (stored !== null) {
-      const output = Bun.stripANSI(
-        decodeOutputLog(stored.stdout)
-          .map((c) => c.text)
-          .join(''),
+      // An entry saved before masking, or by another machine, can hold a
+      // secret-named variable's value: masked as a hit's replay masks it.
+      // This process's env only: `vx last` loads no config, so a task's
+      // `env.define` / `env.secret` values are not known here.
+      const output = maskedLine(
+        Bun.stripANSI(
+          decodeOutputLog(stored.stdout)
+            .map((c) => c.text)
+            .join(''),
+        ),
       )
       return { ...base, source: 'cache', output }
     }
+    // An entry that printed nothing stores no stdout row: kept, and empty.
+    if (db.query('SELECT 1 FROM entries WHERE hash = ?').get(row.hash) !== null) {
+      return { ...base, source: 'cache', output: '' }
+    }
   }
   return { ...base, source: null, output: '' }
 }

package/src/orchestrator/run-id.ts

@@ -10,18 +10,21 @@ import { UserError } from '../util/index.js'
  * is refused with those runs, since picking one would replay the wrong run.
  */
 export function resolveRunId(db: Database, raw: string, verb: string): string | null {
-  const exact = db.query('SELECT 1 FROM invocations WHERE run_id = ?').get(raw)
-  if (exact !== null) return raw
+  // Run ids are lower-case UUIDs; one typed or pasted in upper case is the same id.
+  const id = raw.toLowerCase()
+  const exact = db.query('SELECT 1 FROM invocations WHERE run_id = ?').get(id)
+  if (exact !== null) return id
   const rows = db
     .query(
       'SELECT run_id FROM invocations WHERE substr(run_id, 1, ?) = ? ORDER BY run_id DESC LIMIT 6',
     )
-    .all(raw.length, raw) as Array<{ run_id: string }>
+    .all(id.length, id) as Array<{ run_id: string }>
   if (rows.length === 0) return null
   if (rows.length === 1) return rows[0]!.run_id
   const shown = rows.slice(0, 5).map((r) => `  ${r.run_id}`)
   throw new UserError(
     `${verb}: run id ${raw} is the start of ${rows.length > 5 ? 'more than 5' : rows.length} runs — type more of it:\n${shown.join('\n')}`,
+    'VX_E_AMBIGUOUS',
   )
 }