@vzn/vx 0.0.650 → 0.0.652

package/src/workspace/affected.ts

@@ -18,8 +18,16 @@ import {
   notAWorkTree,
   relPosix,
   UserError,
+  xxh3hex,
 } from '../util/index.js'
-import { LOCKFILE_NAME, lockKey } from './lockfile.js'
+import { LOCKFILE_NAME, lockEntries, lockKey } from './lockfile.js'
+import {
+  DEPENDENCIES_LOCK_NAME,
+  type DependenciesLock,
+  dependantsOf,
+  recordedDigests,
+  parseDependenciesLock,
+} from './dependencies-lock.js'
 import { configImportOwners, realpathOr } from './config-imports.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { bunPatchFiles } from './fingerprint.js'
@@ -143,6 +151,10 @@ export interface FingerprintClaims {
   }): Promise<ReadonlySet<string> | undefined>
   /** The files a claimed file names that its claimant keys too; absent = it reads none. */
   extraFiles?(file: string, bytes: Uint8Array): Promise<readonly string[] | undefined>
+  /** Each project's digest of a claimed file now (`FingerprintClaim.digests`); absent or undefined = none. */
+  digests?(
+    file: string,
+  ): Promise<{ hash: string; projects: Readonly<Record<string, string>> } | undefined>
 }
 
 /**
@@ -388,6 +400,12 @@ export async function affectedChanges(
   if (wsConfig !== undefined) return everything(wsConfig)
   // The workspace file is loaded once, for the extra files below and the
   // changed root names after them.
+  // The base commit's `vx lock` record, read once and only when asked.
+  let baseDeps: Promise<DependenciesLock | null> | undefined
+  const baseDependencies = (): Promise<DependenciesLock | null> =>
+    (baseDeps ??= gitBytesAt(args.workspaceRoot, base, DEPENDENCIES_LOCK_NAME).then(
+      parseDependenciesLock,
+    ))
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
@@ -446,6 +464,32 @@ export async function affectedChanges(
       if (patch !== undefined) return everything(patch)
     }
   }
+  // The projects whose digest of `file` moved, from the base's recorded
+  // digests and the claimant's now: the base side is never parsed. Null
+  // when the base recorded none for these bytes (no lock, or another
+  // hash) or the claimant gives none now: `affected` answers then.
+  const recordedMoves = async (
+    asked: FingerprintClaims,
+    file: string,
+    before: Uint8Array | null,
+    after: Uint8Array | null,
+  ): Promise<ReadonlySet<string> | null> => {
+    if (before === null || after === null || asked.digests === undefined) return null
+    const base = await baseDependencies()
+    const was = base === null ? undefined : recordedDigests(base, file)
+    // Base digests that read another file are that file's at the base,
+    // which the record does not prove.
+    if (was === undefined || was.hash !== xxh3hex(before) || Object.keys(was.extras).length > 0)
+      return null
+    const now = await asked.digests(file)
+    if (now === undefined) return null
+    const moved = new Set<string>()
+    for (const p of projects) {
+      const d = was.of(lockKey(rootDir, p.dir))
+      if (d === undefined || d !== now.projects[p.name]) moved.add(p.name)
+    }
+    return moved
+  }
   const claimedOwned = new Map<string, string>()
   const rootNamesChanged = changed.filter((p) => !p.includes('/'))
   for (const file of extrasBy.keys()) {
@@ -455,12 +499,11 @@ export async function affectedChanges(
   for (const file of rootNamesChanged) {
     if (claimed === undefined || !claimed.files.has(file)) continue
     const extras = extrasBy.get(file)
-    const answer = await claimed.affected({
-      file,
-      before: await gitBytesAt(args.workspaceRoot, base, file),
-      after: await bytesOrNull(path.join(args.workspaceRoot, file)),
-      ...(extras !== undefined ? { extras } : {}),
-    })
+    const before = await gitBytesAt(args.workspaceRoot, base, file)
+    const after = await bytesOrNull(path.join(args.workspaceRoot, file))
+    const answer =
+      (extras === undefined ? await recordedMoves(claimed, file, before, after) : undefined) ??
+      (await claimed.affected({ file, before, after, ...(extras !== undefined ? { extras } : {}) }))
     const why =
       extras === undefined || changed.includes(file)
         ? file
@@ -505,20 +548,8 @@ export async function affectedChanges(
   if (diffed.paths.includes(LOCKFILE_NAME) || untracked.includes(LOCKFILE_NAME)) {
     // A side with no lock (or one that will not parse) ran nothing from
     // it: the paths of the configs say what changed, as before the lock.
-    const entries = (bytes: Uint8Array | null): Record<string, unknown> | null => {
-      if (bytes === null) return null
-      try {
-        const locked = (JSON.parse(new TextDecoder().decode(bytes)) as { projects?: unknown })
-          .projects
-        return typeof locked === 'object' && locked !== null
-          ? (locked as Record<string, unknown>)
-          : null
-      } catch {
-        return null
-      }
-    }
-    const before = entries(await gitBytesAt(args.workspaceRoot, base, LOCKFILE_NAME))
-    const after = entries(await bytesOrNull(path.join(args.workspaceRoot, LOCKFILE_NAME)))
+    const before = lockEntries(await gitBytesAt(args.workspaceRoot, base, LOCKFILE_NAME))
+    const after = lockEntries(await bytesOrNull(path.join(args.workspaceRoot, LOCKFILE_NAME)))
     const same = (dir: string): boolean =>
       before === null ||
       after === null ||
@@ -538,9 +569,23 @@ export async function affectedChanges(
     const atBase = await gitBlobsAt(args.workspaceRoot, base, markers)
     // A config the base had in a directory that is no project now: the
     // project is gone, and with it the edge naming who depended on it,
-    // while their keys lost an upstream. Today's graph cannot say who.
-    const gone = await removedProjectConfig(args.workspaceRoot, atBase, projects)
-    if (gone !== undefined) return everything(gone)
+    // while their keys lost an upstream. Today's graph cannot say who; the
+    // base's dependencies lock can. Without one, every project.
+    // A config that moved, the same bytes under a new project, is no
+    // loss: its files select it where it lives.
+    const nameAt = new Map(projects.map((p) => [lockKey(rootDir, p.dir), p.name]))
+    for (const gone of await removedProjectConfigs(args.workspaceRoot, atBase, projects)) {
+      const recorded = await baseDependencies()
+      if (recorded === null) return everything(gone)
+      const held = dependantsOf(recorded, path.posix.dirname(gone)).flatMap(
+        (d) => nameAt.get(d) ?? [],
+      )
+      for (const name of held) {
+        owned.add(name)
+        whole.add(name)
+        if (!claimedOwned.has(name)) claimedOwned.set(name, gone)
+      }
+    }
     for (const name of parentsOfNewNested(args.workspaceRoot, atBase, projects)) {
       owned.add(name)
       whole.add(name)
@@ -587,7 +632,12 @@ export async function affectedChanges(
 }
 
 /** What vx writes under `.vx`, which no key reads (cache/inputs.ts `ALWAYS_IGNORE`). */
-const VX_OWN: ReadonlySet<string> = new Set([LOCKFILE_NAME, '.vx/.gitattributes', '.vx/.gitignore'])
+const VX_OWN: ReadonlySet<string> = new Set([
+  LOCKFILE_NAME,
+  DEPENDENCIES_LOCK_NAME,
+  '.vx/.gitattributes',
+  '.vx/.gitignore',
+])
 
 const CONFIG_NAMES: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
 /**
@@ -632,22 +682,31 @@ function parentsOfNewNested(
   return out
 }
 
-/** The first config in `atBase` the base had whose file and project are both gone now. */
-async function removedProjectConfig(
+/** Each config in `atBase` the base had whose file and project are both gone now. */
+async function removedProjectConfigs(
   workspaceRoot: string,
   atBase: ReadonlyMap<string, Uint8Array | null>,
   projects: readonly ProjectMeta[],
-): Promise<string | undefined> {
+): Promise<string[]> {
   const dirs = new Set(projects.map((p) => p.dir.normalize('NFC')))
+  const gone: string[] = []
+  let added: Uint8Array[] | undefined
   for (const [rel, bytes] of atBase) {
     // A manifest's directory may never have been a project; a config's was.
     if (bytes === null || !CONFIG_NAMES.has(path.posix.basename(rel))) continue
     const dir = path.resolve(workspaceRoot, path.posix.dirname(rel)).normalize('NFC')
     if (dirs.has(dir)) continue
     if (await Bun.file(path.join(workspaceRoot, rel)).exists()) continue
-    return rel
+    // Each config the base lacked, read once, only when one went.
+    added ??= await Promise.all(
+      [...atBase]
+        .filter(([r, b]) => b === null && CONFIG_NAMES.has(path.posix.basename(r)))
+        .map(([r]) => bytesOrNull(path.join(workspaceRoot, r))),
+    ).then((all) => all.filter((b): b is Uint8Array => b !== null))
+    if (added!.some((b) => Buffer.from(b).equals(bytes))) continue
+    gone.push(rel)
   }
-  return undefined
+  return gone
 }
 
 /**

package/src/workspace/bracket-literal.ts

@@ -65,8 +65,8 @@ export function checkBracketLiterals(root: string, projects: Iterable<ProjectEnt
       const lists: [string, readonly string[] | undefined, string][] = [
         ['inputs.files', t.inputs?.files, p.dir],
         ['inputs.workspaceFiles', t.inputs?.workspaceFiles, root],
-        ['cache.outputs.files', t.cache?.outputs?.files, p.dir],
-        ['cache.outputs.workspaceFiles', t.cache?.outputs?.workspaceFiles, root],
+        ['outputs.files', t.outputs?.files, p.dir],
+        ['outputs.workspaceFiles', t.outputs?.workspaceFiles, root],
       ]
       for (const [field, globs, base] of lists) {
         for (const glob of globs ?? []) {

package/src/workspace/config-schema.ts

@@ -115,7 +115,7 @@ const oneOf = (values: readonly string[]): string =>
 
 function validateInputStability(stability: unknown, at: string): void {
   if (typeof stability !== 'object' || stability === null || Array.isArray(stability)) {
-    throw new UserError(`${at} must be an object — \`inputStability: { strategy: 'mutable' }\``)
+    throw new UserError(`${at} must be an object — \`stability: { strategy: 'mutable' }\``)
   }
   assertKnownFields(stability, INPUT_STABILITY_FIELDS, at)
   const { strategy, severity } = stability as Record<string, unknown>
@@ -128,13 +128,13 @@ function validateInputStability(stability: unknown, at: string): void {
 }
 
 /**
- * `VX_CACHE_INPUT_STABILITY_STRATEGY` and `_SEVERITY`, which override every
- * task's `cache.inputStability` for the run: each undefined when unset or
+ * `VX_INPUTS_STABILITY_STRATEGY` and `_SEVERITY`, which override every
+ * task's `inputs.stability` for the run: each undefined when unset or
  * empty, refused when it names no value.
  */
 export function inputStabilityEnv(): InputStability {
-  const strategy = settingEnv('cache.inputStability.strategy') as InputStability['strategy']
-  const severity = settingEnv('cache.inputStability.severity') as InputStability['severity']
+  const strategy = settingEnv('inputs.stability.strategy') as InputStability['strategy']
+  const severity = settingEnv('inputs.stability.severity') as InputStability['severity']
   return {
     ...(strategy !== undefined ? { strategy } : {}),
     ...(severity !== undefined ? { severity } : {}),
@@ -231,6 +231,8 @@ function ruleSelectorProblem(s: string): string | null {
   // The root's own name, which the filter reads as the root's directory.
   if (s === ROOT_NAME) return null
   if (s.startsWith('!')) return "starts with '!', which a filter reads as an exclusion"
+  // The filter parser refuses one, which the catch below would read as a walk.
+  if (hasControl(s)) return 'holds a control character'
   const walk = "starts or ends with '...', which a filter reads as a dependency walk"
   let f: ReturnType<typeof parseFilter>
   try {
@@ -440,6 +442,7 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
           files?: unknown
           affected?: unknown
           extraFiles?: unknown
+          digests?: unknown
         } | null
         if (
           claim === null ||
@@ -447,10 +450,11 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
           !Array.isArray(claim.files) ||
           claim.files.length === 0 ||
           typeof claim.affected !== 'function' ||
-          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function')
+          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function') ||
+          (claim.digests !== undefined && typeof claim.digests !== 'function')
         ) {
           throw new UserError(
-            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function }`,
+            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function, digests?: function }`,
           )
         }
         for (const file of claim.files as unknown[]) {
@@ -588,6 +592,9 @@ export function validateProjectConfig(
     const exec = (task as { exec?: unknown }).exec
     const dependsOn = (task as { dependsOn?: unknown }).dependsOn
     const cache = (task as { cache?: unknown }).cache
+    if (cache !== undefined && typeof cache !== 'boolean') {
+      throw new UserError(`${where}.cache must be true or false`)
+    }
     if (exec !== undefined) {
       if (typeof exec !== 'object' || exec === null) {
         throw new UserError(`${where}.exec must be an object with a \`command\` string`)
@@ -621,9 +628,9 @@ export function validateProjectConfig(
       // Documented and never held: an uncached 'only' task loaded, and the
       // REAPI executor refused it at run time for want of described inputs
       // (item 1001).
-      if (remote === 'only' && cache === undefined) {
+      if (remote === 'only' && cache !== true) {
         throw new UserError(
-          `${where}.exec.remote 'only' needs \`cache\`: its inputs are what a worker reproduces ` +
+          `${where}.exec.remote 'only' needs \`cache: true\`: its inputs are what a worker reproduces ` +
             `and its key is the address of its remote record`,
         )
       }
@@ -710,7 +717,7 @@ export function validateProjectConfig(
         throw new UserError(`${where}.exec.interactive must be a boolean (or omitted)`)
       }
       if (interactive === true) {
-        if (cache !== undefined) {
+        if (cache === true) {
           throw new UserError(
             `${where}: \`cache\` is not allowed on an interactive task — what it does ` +
               `depends on what is typed, which no key holds`,
@@ -763,7 +770,7 @@ export function validateProjectConfig(
             )
           }
         }
-        if (cache !== undefined) {
+        if (cache === true) {
           throw new UserError(
             `${where}: \`cache\` is not allowed on a persistent task — persistent tasks ` +
               `don't terminate, so there's no exit to cache`,
@@ -941,16 +948,8 @@ export function validateProjectConfig(
         validateWorkspaceGlobs(wsInputs, `${where}.inputs.workspaceFiles`, true)
       }
     }
-    if (cache !== undefined) {
-      if (typeof cache !== 'object' || cache === null) {
-        throw new UserError(
-          `${where}.cache must be an object when present — \`inputs: { files: [...] }, cache: { outputs: { files: [...] } }\`, or no \`cache\` for a task that never caches`,
-        )
-      }
-      assertKnownFields(cache, CACHE_FIELDS, `${where}.cache`)
-      const stability = (cache as { inputStability?: unknown }).inputStability
-      if (stability !== undefined)
-        validateInputStability(stability, `${where}.cache.inputStability`)
+    const outputs = (task as { outputs?: unknown }).outputs
+    if (cache === true) {
       // The key is the task's inputs, and a group runs nothing to cache.
       if (exec === undefined) {
         throw new UserError(
@@ -962,23 +961,38 @@ export function validateProjectConfig(
           `${where}: \`cache\` needs \`inputs\` — the key is the task's inputs, \`inputs: { files: [...] }\``,
         )
       }
-      const outputs = (cache as { outputs?: unknown }).outputs
-      if (outputs === undefined || outputs === null) {
-        throw new UserError(`${where}.cache.outputs is required when \`cache\` is set`)
+      if (outputs === undefined) {
+        throw new UserError(
+          `${where}: \`cache\` needs \`outputs\` — what the task produces, \`outputs: { files: [...] }\` (\`[]\` for none)`,
+        )
+      }
+    }
+    const stability = (inputs as { stability?: unknown } | undefined)?.stability
+    if (stability !== undefined) {
+      validateInputStability(stability, `${where}.inputs.stability`)
+      if (exec === undefined) {
+        throw new UserError(
+          `${where}.inputs.stability needs \`exec\` — a task with no command runs nothing that could write its inputs`,
+        )
+      }
+    }
+    if (outputs !== undefined) {
+      if (outputs === null || typeof outputs !== 'object') {
+        throw new UserError(`${where}.outputs must be an object — \`outputs: { files: [...] }\``)
       }
-      if (typeof outputs !== 'object') {
+      assertKnownFields(outputs, OUTPUT_FIELDS, `${where}.outputs`)
+      if (exec === undefined) {
         throw new UserError(
-          `${where}.cache.outputs must be an object — \`outputs: { files: [...] }\``,
+          `${where}.outputs needs \`exec\` — a task with no command writes nothing`,
         )
       }
-      assertKnownFields(outputs, CACHE_OUTPUT_FIELDS, `${where}.cache.outputs`)
       const clean = (outputs as { clean?: unknown }).clean
       if (clean !== undefined && typeof clean !== 'boolean') {
-        throw new UserError(`${where}.cache.outputs.clean must be true or false`)
+        throw new UserError(`${where}.outputs.clean must be true or false`)
       }
       const outFiles = (outputs as { files?: unknown }).files
       if (!Array.isArray(outFiles)) {
-        throw new UserError(`${where}.cache.outputs.files must be an array of glob strings`)
+        throw new UserError(`${where}.outputs.files must be an array of glob strings`)
       }
       // Reject zero-length strings and absolute paths up front.
       // Both reach `resolveOutputs` as undefined behavior; the error
@@ -986,26 +1000,26 @@ export function validateProjectConfig(
       // at the user's config. Fail loud at load time.
       for (const g of outFiles as unknown[]) {
         if (typeof g !== 'string' || g.length === 0) {
-          throw new UserError(`${where}.cache.outputs.files must be an array of non-empty strings`)
+          throw new UserError(`${where}.outputs.files must be an array of non-empty strings`)
         }
         if (isAbsoluteGlob(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: absolute paths are not allowed (got "${g}") — ` +
+            `${where}.outputs.files: absolute paths are not allowed (got "${g}") — ` +
               `outputs must be project-relative globs`,
           )
         }
         if (hasParentSegment(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
+            `${where}.outputs.files: '..' path segments are not allowed (got "${g}") — ` +
               `outputs must stay within the project (vx clears a task's outputs before it runs, ` +
               `so a glob that escapes the project would delete files outside it)`,
           )
         }
-        assertPosixGlob(g, `${where}.cache.outputs.files`, 'project')
-        assertNoForeignToken(g, `${where}.cache.outputs.files`)
+        assertPosixGlob(g, `${where}.outputs.files`, 'project')
+        assertNoForeignToken(g, `${where}.outputs.files`)
         if (namesDirItself(g)) {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
+            `${where}.outputs.files: "${g}" names the project directory itself and selects nothing — ` +
               `name the directory the task writes, such as "dist/**"`,
           )
         }
@@ -1014,31 +1028,31 @@ export function validateProjectConfig(
         // a "corrupt artifact", dropped and run again.
         if (!g.startsWith('!') && normalizeGlob(g).split('/')[0] === 'workspace-outputs') {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
+            `${where}.outputs.files: "${g}" is under workspace-outputs/, a name vx's ` +
               `artifacts reserve for outputs.workspaceFiles — write the task's files to another directory`,
           )
         }
         // A `!` entry takes a path back from the outputs (A-44): it is not
         // cleaned, saved or restored, and it stays an input.
-        assertNotDoubleNegated(g, `${where}.cache.outputs.files`)
+        assertNotDoubleNegated(g, `${where}.outputs.files`)
         // Taken back by a `!`, the file is never cleaned or restored.
         const own = g.startsWith('!')
           ? undefined
           : ownFilesCovered(g, ownConfig).find((f) => !takenBack(outFiles as unknown[], f))
         if (own !== undefined) {
           throw new UserError(
-            `${where}.cache.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
+            `${where}.outputs.files: "${g}" covers the project's own ${own} — vx deletes a ` +
               `task's outputs before it runs and restores them on a hit, so the project would lose ` +
               `its config. Name the directory the task writes, such as "dist/**", ` +
               `or take the file back with "!${own}".`,
           )
         }
       }
-      assertOutputsNotNegationOnly(outFiles as string[], `${where}.cache.outputs.files`)
-      assertNoLiteralTakenBack(outFiles as string[], `${where}.cache.outputs.files`, OUTPUT_LOST)
+      assertOutputsNotNegationOnly(outFiles as string[], `${where}.outputs.files`)
+      assertNoLiteralTakenBack(outFiles as string[], `${where}.outputs.files`, OUTPUT_LOST)
       const wsOutputs = (outputs as { workspaceFiles?: unknown }).workspaceFiles
       if (wsOutputs !== undefined) {
-        validateWorkspaceGlobs(wsOutputs, `${where}.cache.outputs.workspaceFiles`, false)
+        validateWorkspaceGlobs(wsOutputs, `${where}.outputs.workspaceFiles`, false)
       }
     }
   }
@@ -1053,7 +1067,7 @@ export function validateProjectConfig(
 // `tasks` first: `nearest` breaks a tie by order, and `taks` is one edit
 // from both.
 const PROJECT_FIELDS = new Set(['name', 'tasks', 'tags'])
-const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'inputs', 'cache'])
+const TASK_FIELDS = new Set(['description', 'exec', 'dependsOn', 'inputs', 'outputs', 'cache'])
 const EXEC_FIELDS = new Set([
   'command',
   'env',
@@ -1067,7 +1081,6 @@ const EXEC_FIELDS = new Set([
 ])
 const PERSISTENT_FIELDS = new Set(['readyWhen'])
 const ENV_FIELDS = new Set(['passThrough', 'define', 'secret'])
-const CACHE_FIELDS = new Set(['outputs', 'inputStability'])
 const INPUT_FIELDS = new Set([
   'files',
   'workspaceFiles',
@@ -1075,8 +1088,9 @@ const INPUT_FIELDS = new Set([
   'tasks',
   'runtime',
   'workspaceRuntime',
+  'stability',
 ])
-const CACHE_OUTPUT_FIELDS = new Set(['files', 'workspaceFiles', 'clean'])
+const OUTPUT_FIELDS = new Set(['files', 'workspaceFiles', 'clean'])
 
 /**
  * Another runner's spelling of a field vx has under another name, by the
@@ -1088,8 +1102,10 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
   [
     TASK_FIELDS,
     {
-      outputs: '`cache.outputs.files`',
       env: '`inputs.env` (to key the task on a variable) or `exec.env` (to pass one)',
+      // wireit's script keys.
+      output: '`outputs.files`',
+      dependencies: "`dependsOn` (an upstream's key goes into this one)",
       passThroughEnv: '`exec.env.passThrough`',
       command: '`exec.command`',
       cmd: '`exec.command`',
@@ -1126,18 +1142,6 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       shell: 'no field: `command` always runs in a shell',
     },
   ],
-  // wireit's `files` / `output` and include-style spellings written into
-  // a cache block, refused with no word on where they go (D-118).
-  [
-    CACHE_FIELDS,
-    {
-      files: "the task's `inputs.files`",
-      output: '`outputs.files`',
-      env: "the task's `inputs.env`",
-      dependencies: "the task's `dependsOn` (an upstream's key goes into this one)",
-      enabled: 'no field: a task with a `cache` block caches, one without runs every time',
-    },
-  ],
   [
     INPUT_FIELDS,
     {
@@ -1149,7 +1153,7 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
     },
   ],
   [
-    CACHE_OUTPUT_FIELDS,
+    OUTPUT_FIELDS,
     {
       globs: '`files`',
       include: '`files`',
@@ -1174,12 +1178,11 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       sourceRoot: "a task's `inputs.files`",
       projectType: 'no field: vx runs every project alike',
       ...Object.fromEntries(
-        ['dependsOn', 'inputs', 'cache', 'exec', 'description'].map((k) => [
+        ['dependsOn', 'inputs', 'outputs', 'cache', 'exec', 'description'].map((k) => [
           k,
           `\`tasks.<name>.${k}\`: a project holds tasks, and each task its own \`${k}\``,
         ]),
       ),
-      outputs: '`tasks.<name>.cache.outputs.files`',
       env: '`tasks.<name>.inputs.env` (to key a task on it) or `tasks.<name>.exec.env`',
     },
   ],
@@ -1250,7 +1253,7 @@ function nestedHome(allowed: ReadonlySet<string>, key: string): string | undefin
   for (const [field, own] of [
     ['exec', EXEC_FIELDS],
     ['inputs', INPUT_FIELDS],
-    ['cache', CACHE_FIELDS],
+    ['outputs', OUTPUT_FIELDS],
   ] as const) {
     if (own.has(key)) return `\`${field}.${key}\``
   }
@@ -1536,7 +1539,7 @@ function assertInputGlob(glob: string, where: string): void {
   if (glob.replace(/^!/, '').split('/').includes('.git')) {
     throw new UserError(
       `${where}: "${glob}" names a path under .git, which git never lists, so it keys nothing — ` +
-        `inputs are the repository's files`,
+        `inputs are the workspace's files`,
     )
   }
 }
@@ -1697,6 +1700,9 @@ export function taskNameProblem(name: string): string | null {
 function tagProblem(tag: string): string | null {
   if (tag.trim() !== tag) return 'has surrounding whitespace'
   if (tag.includes('*')) return "holds '*', which makes it a pattern"
+  // Refused by the caller in its own words; the filter parser refuses one
+  // too, which the catch below would read as a walk.
+  if (hasControl(tag)) return null
   const walk = "ends in '...', which a filter reads as a dependency walk"
   let f: ReturnType<typeof parseFilter>
   try {
@@ -1826,6 +1832,7 @@ const SANDBOX_FIELDS = new Set([
   'ignore',
   'weakerWhenNested',
   'weakerNetworkIsolation',
+  'hermetic',
 ])
 const GRANT_PATH_FIELDS = ['read', 'write'] as const
 const GRANT_NAME_FIELDS = ['systemInfo', 'machLookup'] as const
@@ -1869,7 +1876,7 @@ function validateSandbox(sandbox: unknown, where: string): void {
   assertKnownFields(sandbox, SANDBOX_FIELDS, `${where}.sandbox`)
   const obj = sandbox as Record<string, unknown>
 
-  for (const flag of ['weakerWhenNested', 'weakerNetworkIsolation']) {
+  for (const flag of ['weakerWhenNested', 'weakerNetworkIsolation', 'hermetic']) {
     if (obj[flag] !== undefined && typeof obj[flag] !== 'boolean') {
       throw new UserError(`${where}.sandbox.${flag} must be a boolean`)
     }