@vzn/vx 0.0.651 → 0.0.653

package/src/orchestrator/keyed-projects.ts

@@ -63,3 +63,56 @@ export function keyedProjects(
     return below.get(root.id)!
   }
 }
+
+/**
+ * A run's lookup of the exec tasks whose outputs a sandboxed task may read:
+ * those its key folds, through a group to its members, never past an exec
+ * task. Their outputs are what their keys answer for, and this key folds
+ * those keys, so a read of them can never replay stale (the toolchain
+ * rule: a `tools` project builds Node, every dependant runs it). A
+ * dependency `inputs.tasks` leaves out is ordered, not read.
+ */
+export function readableDeps(
+  nodes: ReadonlyMap<string, TaskNode>,
+  keyOnly: ReadonlyMap<string, TaskNode> = new Map(),
+): (node: TaskNode) => readonly TaskNode[] {
+  const nodeOf = (id: string): TaskNode => nodes.get(id) ?? keyOnly.get(id)!
+  return (root) => {
+    const out = new Map<string, TaskNode>()
+    const seen = new Set<string>()
+    const stack = foldedDeps(root, nodeOf).map((c) => c.node)
+    while (stack.length > 0) {
+      const dep = stack.pop()!
+      if (seen.has(dep.id)) continue
+      seen.add(dep.id)
+      if (!isGroupTask(dep)) out.set(dep.id, dep)
+      else for (const { node } of foldedDeps(dep, nodeOf)) stack.push(node)
+    }
+    return [...out.values()]
+  }
+}
+
+/**
+ * A run's lookup of the projects nested in a keyed one, by its directory.
+ * A sandboxed task granted a linked package is walled from them: that
+ * package's key stops at a nested project (sandbox-request.ts). Built on
+ * the first ask, from every node the walk can reach.
+ */
+export function nestedDirsOf(
+  nodes: ReadonlyMap<string, TaskNode>,
+  keyOnly: ReadonlyMap<string, TaskNode>,
+  nestedDirsByProject: ReadonlyMap<string, readonly string[]>,
+): (projectDir: string) => readonly string[] {
+  let byDir: Map<string, readonly string[]> | undefined
+  return (dir) => {
+    if (byDir === undefined) {
+      byDir = new Map()
+      for (const map of [nodes, keyOnly]) {
+        for (const n of map.values()) {
+          byDir.set(n.projectDir, nestedDirsByProject.get(n.projectName) ?? [])
+        }
+      }
+    }
+    return byDir.get(dir) ?? []
+  }
+}

package/src/orchestrator/local-floor.ts

@@ -2,8 +2,8 @@
 // workers, which run tasks another machine placed. A run arms the sandbox
 // runtime before it builds a sandboxed request; a worker is no run, so it
 // arms here. It starts a request's servers (`ExecuteRequest.servers`) once
-// each, before the task, each inside its own sandbox, and stops them when
-// it closes.
+// each, before the task, each inside its own sandbox, and stops each when
+// the run says no task needs it, or when it closes.
 
 import type { ExecConfig } from '../config.js'
 import {
@@ -18,6 +18,7 @@ import {
   type ServerSpec,
   wrapSandboxedCommand,
 } from '../exec/index.js'
+import { stopServer } from './persistent.js'
 import { placeholderSweeper, prepareSandbox, sandboxRequestFor } from './sandbox-request.js'
 import { forwardedSignal, terminateChildren } from './signals.js'
 
@@ -28,6 +29,8 @@ export interface LocalFloor {
   execute(req: ExecuteRequest): Promise<ExecuteResult>
   /** Arms the sandbox runtime for `sandboxes` from the next sandboxed task on; its servers keep running. */
   rearm(sandboxes: readonly NonNullable<ExecConfig['sandbox']>[]): Promise<void>
+  /** Stops server `taskId` if this started it: no task left needs it. A later task that needs it starts it again. */
+  stop(taskId: string): Promise<void>
   /** Stops the servers this started and the sandbox runtime this armed. */
   close(): Promise<void>
 }
@@ -38,10 +41,13 @@ export interface LocalFloor {
  * unix-socket filter are one per process, set from their union before the
  * first sandboxed task (`prepareSandbox`). A request that carries a
  * `signal` but no `liveChildren` has its children stopped here when it
- * aborts, the way a run's stop ends its own.
+ * aborts, the way a run's stop ends its own. `onServer` hears each
+ * server's pid as it spawns, and `undefined` as `stop` ends it: a worker
+ * meters what its servers use.
  */
 export function localFloor(
   sandboxes: readonly NonNullable<ExecConfig['sandbox']>[] = [],
+  onServer?: (taskId: string, pid: number | undefined) => void,
 ): LocalFloor {
   const local = localExecutor()
   const prepare = (list: typeof sandboxes) =>
@@ -103,6 +109,7 @@ export function localFloor(
     if (spawn.child === undefined) void gone()
     else {
       children.push(spawn.child)
+      onServer?.(spec.taskId, spawn.child.pid)
       void spawn.child.exited.then(gone, gone)
     }
     try {
@@ -190,6 +197,17 @@ export function localFloor(
       if (armer?.armed === true) await resetSandbox()
       armer = prepare(list)
     },
+    async stop(taskId) {
+      const up = servers.get(taskId)
+      if (up === undefined) return
+      servers.delete(taskId)
+      const child = await up.catch(() => undefined)
+      if (child === undefined) return
+      const i = children.indexOf(child)
+      if (i >= 0) children.splice(i, 1)
+      onServer?.(taskId, undefined)
+      await stopServer(child)
+    },
     async close() {
       if (children.length > 0) await terminateChildren(() => children)
       if (armer?.armed === true) await resetSandbox()

package/src/orchestrator/local-shortcircuit.ts

@@ -32,7 +32,7 @@
 //   - Only STABLE-key, cacheable, local-read tasks are classified. A
 //     stable miss stays in the normal (dep-gated) schedule; an unstable
 //     task is never probed here.
-//   - A task that declares `cache.outputs.workspaceFiles` (the
+//   - A task that declares `outputs.workspaceFiles` (the
 //     boundary-ignoring escape hatch) can write where a restore touches,
 //     so every task whose project directory a workspace-output glob's
 //     static prefix REACHES stays out of the restore tier, and so does
@@ -261,7 +261,7 @@ export function restoreTierExclusions(
   const prefixes: string[] = []
   let everything = false
   for (const node of nodes.values()) {
-    for (const raw of node.config.cache?.outputs.workspaceFiles ?? []) {
+    for (const raw of node.config.outputs?.workspaceFiles ?? []) {
       // A `!` entry needs no skip: its prefix (`!gen`) names no directory,
       // so it excludes nothing (A-44; the `continue` that stood here was
       // dropped in item 640).

package/src/orchestrator/lockfile-claim.ts

@@ -21,7 +21,7 @@
 // `vx lock` adds them to the memo.
 
 import path from 'node:path'
-import { stat } from 'node:fs/promises'
+import { readdir, realpath, stat } from 'node:fs/promises'
 import { type LockfileMemo, readLockfileMemo, writeLockfileMemo } from '../cache/index.js'
 import { relPosix, UserError, xxh3, xxh3hex } from '../util/index.js'
 import type { TaskNode } from '../graph/index.js'
@@ -88,6 +88,11 @@ export interface LockfileImporter {
   readonly deps: Readonly<Record<string, string>>
   /** Its peers that resolve to an importer, each with no installed entry of the same name. */
   readonly peers: Readonly<Record<string, string>>
+  /**
+   * The importers it reaches only through installed packages, sorted: a
+   * registry package's dependency the install resolved to a workspace.
+   */
+  readonly transitive?: readonly string[]
 }
 
 /** What a lockfile plugin spreads into `definePlugin` (`fingerprint`, `key`), and `importers` for its own stages. */
@@ -152,13 +157,34 @@ function unreadable(rel: string, err: unknown): UserError {
  * Every file under `dir` but its `node_modules` and `.git`, as `rel\0hash`
  * lines in sorted order. Links are followed: a linked file is what a task
  * reads, and the scan skipped it, so an edit to its target moved no key.
+ * The walk never enters `node_modules` or `.git`: a glob of `**` that
+ * dropped them after listed every file under them (30k files there: a warm
+ * run 307 → 183 ms, min of 10). A linked directory that is one of its own
+ * ancestors is not entered again.
  */
 async function hashDir(dir: string): Promise<string> {
   const rels: string[] = []
-  const scan = { cwd: dir, dot: true, onlyFiles: true, followSymlinks: true }
-  for await (const rel of new Bun.Glob('**').scan(scan)) {
-    if (!rel.split('/').some((s) => s === 'node_modules' || s === '.git')) rels.push(rel)
+  const walk = async (rel: string, real: string, ancestors: readonly string[]): Promise<void> => {
+    const entries = await readdir(path.join(dir, rel), { withFileTypes: true })
+    await Promise.all(
+      entries.map(async (e) => {
+        if (e.name === 'node_modules' || e.name === '.git') return
+        const child = rel === '' ? e.name : `${rel}/${e.name}`
+        if (e.isFile()) return void rels.push(child)
+        if (e.isDirectory()) return walk(child, path.join(real, e.name), [...ancestors, real])
+        // A link, or an entry the filesystem gave no type: what it names decides.
+        const abs = path.join(dir, child)
+        const st = await stat(abs).catch(() => undefined)
+        if (st?.isFile()) rels.push(child)
+        else if (st?.isDirectory()) {
+          const target = await realpath(abs)
+          if (target !== real && !ancestors.includes(target))
+            await walk(child, target, [...ancestors, real])
+        }
+      }),
+    )
   }
+  await walk('', await realpath(dir), [])
   rels.sort()
   const lines = await Promise.all(
     rels.map(async (rel) => `${rel}\0${xxh3hex(await Bun.file(path.join(dir, rel)).bytes())}`),

package/src/orchestrator/miss-save.ts

@@ -7,7 +7,7 @@
 // a later run replays. Moved out of execute-task.ts 2026-09-09 as pure
 // code motion.
 
-import { existsSync, lstatSync, realpathSync, statSync } from 'node:fs'
+import { existsSync, statSync } from 'node:fs'
 import path from 'node:path'
 import {
   type CacheLayer,
@@ -26,7 +26,6 @@ import {
   relPosix,
   span,
   splitNegations,
-  staticPrefix,
   taskGlob,
 } from '../util/index.js'
 import { type Logger, warnOf } from '../report/index.js'
@@ -109,7 +108,7 @@ export interface SaveMissArgs {
   workspaceRoot: string
   nestedProjectDirs: string[]
   gitFilesCache?: GitFilesCache | undefined
-  /** Declared `cache.outputs.files` / `.workspaceFiles`. */
+  /** Declared `outputs.files` / `.workspaceFiles`. */
   outputs: readonly string[]
   wsOutputs: readonly string[]
   /**
@@ -119,7 +118,7 @@ export interface SaveMissArgs {
    * would also take the upstream's files the task adds beside.
    */
   ownOutputFiles?: string[] | undefined
-  /** `ownOutputFiles` for `cache.outputs.workspaceFiles` (A-43). */
+  /** `ownOutputFiles` for `outputs.workspaceFiles` (A-43). */
   ownWsOutputFiles?: string[] | undefined
   /** The Tier-3 input fingerprint rows captured by the pre-exec describe. */
   captured: readonly TaskInputComponent[]
@@ -137,7 +136,7 @@ export interface SaveMissArgs {
    * (a same-project downstream task reads both), and the pack + write +
    * index go to the run's save lane (save-lane.ts).
    */
-  deferSave?: ((save: () => Promise<void>) => Promise<boolean>) | undefined
+  deferSave?: ((save: () => Promise<void>, taskId: string) => Promise<boolean>) | undefined
   /** Time the save and size its artifact, for a telemetry sink: one stat. */
   measure?: boolean | undefined
 }
@@ -162,19 +161,48 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
   // An additive task owns only the files it wrote (item 588), no directory.
   const tree =
     a.ownOutputFiles !== undefined
-      ? { files: a.ownOutputFiles, emptyDirs: [] }
+      ? { files: a.ownOutputFiles, emptyDirs: [], special: [] }
       : await resolveOutputTree({
           projectDir: node.projectDir,
           outputs: a.outputs,
           nestedProjectDirs: a.nestedProjectDirs,
+          inputs: {
+            projectDir: node.projectDir,
+            workspaceRoot: a.workspaceRoot,
+            declared: node.config.inputs,
+          },
+          special: true,
         })
   const outputFiles = tree.files
   const wsTree =
     a.ownWsOutputFiles !== undefined
-      ? { files: a.ownWsOutputFiles, emptyDirs: [] }
-      : await resolveWorkspaceOutputTree({ workspaceRoot: a.workspaceRoot, outputs: a.wsOutputs })
+      ? { files: a.ownWsOutputFiles, emptyDirs: [], special: [] }
+      : await resolveWorkspaceOutputTree({
+          workspaceRoot: a.workspaceRoot,
+          outputs: a.wsOutputs,
+          inputs: {
+            projectDir: node.projectDir,
+            workspaceRoot: a.workspaceRoot,
+            declared: node.config.inputs,
+          },
+          special: true,
+        })
   const wsOutputFiles = wsTree.files
   endResolve()
+  // A FIFO, socket or device holds no bytes to store (opening a FIFO waits
+  // for a writer, nx#35228), so it stays out of the entry; said, because a
+  // hit restores the tree without it.
+  const special = [
+    ...tree.special.map((p) => relPosix(node.projectDir, p)),
+    ...wsTree.special.map((p) => relPosix(a.workspaceRoot, p)),
+  ]
+  if (special.length > 0) {
+    warnOf(log)(
+      `[vx] ${node.id}: ${special.join(', ')} ${special.length === 1 ? 'is' : 'are'} not a regular file or symlink ` +
+        `(a FIFO, socket or device): vx does not cache ${special.length === 1 ? 'it' : 'them'}, so a hit restores the outputs without ${special.length === 1 ? 'it' : 'them'} ` +
+        `— emit a file there, or take ${special.length === 1 ? 'it' : 'them'} back with a '!' entry`,
+    )
+  }
   // The mirror of the input warning: declared outputs that resolve to
   // nothing save an empty artifact, and the next hit "restores" it —
   // the build that ran nowhere looks like a build that ran. `files: []`
@@ -191,20 +219,15 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     // (project dir === workspace root) the write SUCCEEDS into that
     // scratch and the task exits 0, so this warning is the only thing that
     // says the build produced nothing (item 444). A declared
-    // `cache.outputs` is not a write grant; `exec.sandbox.allow.write` is.
+    // `outputs` is not a write grant; `exec.sandbox.allow.write` is.
     const sandboxed = node.config.exec?.sandbox !== undefined
     const grantsWrite = (node.config.exec?.sandbox?.allow?.write?.length ?? 0) > 0
-    // A `workspaceFiles` directory linked out of the workspace drops every
-    // file (M-65); a project one is refused by the resolver (X-88).
-    const linkedOut = outputDirLinkedOut(a.workspaceRoot, a.wsOutputs)
     warnOf(log)(
-      `[vx] ${node.id}: cache.outputs matched no files (${[...a.outputs, ...a.wsOutputs].join(', ')}) — ` +
+      `[vx] ${node.id}: outputs matched no files (${[...a.outputs, ...a.wsOutputs].join(', ')}) — ` +
         `an empty artifact is saved; a later hit restores nothing` +
-        (linkedOut !== undefined
-          ? ` — ${linkedOut.dir} is a symlink to ${linkedOut.target}, outside ${linkedOut.base}, and vx keeps only outputs inside it: make ${linkedOut.dir} a directory`
-          : sandboxed && !grantsWrite
-            ? ` — the task is sandboxed and declares no exec.sandbox.allow.write, so its writes never reached disk`
-            : '') +
+        (sandboxed && !grantsWrite
+          ? ` — the task is sandboxed and declares no exec.sandbox.allow.write, so its writes never reached disk`
+          : '') +
         bracketLiteralHint([
           ...a.outputs.map((g) => [node.projectDir, g] as const),
           ...a.wsOutputs.map((g) => [a.workspaceRoot, g] as const),
@@ -212,6 +235,7 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     )
   }
   const facts: SaveFacts = {}
+  let kept = false
   const save = async (): Promise<void> => {
     const saveStart = a.measure === true ? performance.now() : 0
     const endSave = span('miss: save')
@@ -243,6 +267,9 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     endSave()
     const bytes = cache.outputBytes?.(a.hash)
     if (bytes !== undefined) facts.outputBytes = bytes
+    // A `--force` run that found the key stored kept that entry: the
+    // footer's `↑` counts saves, and this was none.
+    if (cache.kept?.(a.hash) === true) kept = true
     if (a.measure === true) {
       facts.saveMs = Math.round(performance.now() - saveStart)
       // No local artifact (local writes off): no size to say.
@@ -281,11 +308,13 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
   // the entry before the outcome.
   if (a.deferSave !== undefined) {
     return {
-      landed: a.deferSave(save).then((stored) => (stored ? { ...facts, saved: true } : facts)),
+      landed: a
+        .deferSave(save, node.id)
+        .then((stored) => (stored && !kept ? { ...facts, saved: true } : facts)),
     }
   }
   await save()
-  return { landed: Promise.resolve({ ...facts, saved: true }) }
+  return { landed: Promise.resolve(kept ? facts : { ...facts, saved: true }) }
 }
 
 /** What `markUnsaved` reads of a miss: where its declared outputs are. */
@@ -323,10 +352,20 @@ async function resolveUnsaved(
     projectDir: a.node.projectDir,
     outputs: a.outputs,
     nestedProjectDirs: a.nestedProjectDirs,
+    inputs: {
+      projectDir: a.node.projectDir,
+      workspaceRoot: a.workspaceRoot,
+      declared: a.node.config.inputs,
+    },
   })
   const wsOutputFiles = await resolveWorkspaceOutputs({
     workspaceRoot: a.workspaceRoot,
     outputs: a.wsOutputs,
+    inputs: {
+      projectDir: a.node.projectDir,
+      workspaceRoot: a.workspaceRoot,
+      declared: a.node.config.inputs,
+    },
   })
   endResolve()
   return { outputFiles, wsOutputFiles }
@@ -347,7 +386,7 @@ function sizeOf(base: string, files: readonly string[]): number {
  * these paths. On a 1000-package cold run this removes ~one synchronous
  * `git ls-files` spawn per project (the single largest cold-run cost —
  * 22% of CPU in profiling). Contract: outputs must be declared — an
- * executed task that writes files outside `cache.outputs.files` which a
+ * executed task that writes files outside `outputs.files` which a
  * same-project downstream task reads is undeclared behavior (the restore
  * path already assumes it).
  */
@@ -380,46 +419,6 @@ function markWritten(
   }
 }
 
-/**
- * The first `workspaceFiles` directory that is a symlink resolving outside
- * the workspace root: every file under it is dropped as outside, and the
- * empty-artifact warning blamed the glob (M-65).
- */
-function outputDirLinkedOut(
-  baseDir: string,
-  outputs: readonly string[],
-): { dir: string; target: string; base: string } | undefined {
-  const realProject = realpathOrNull(baseDir) ?? baseDir
-  // `dist` names the tree `dist/**`: the same reading the resolver gives.
-  for (const pattern of asTrees(outputs.filter((o) => !o.startsWith('!')))) {
-    const literal = staticPrefix(pattern)
-      .split('/')
-      .filter((p) => p !== '' && p !== '.')
-    for (let i = 1; i <= literal.length; i++) {
-      const dir = literal.slice(0, i).join('/')
-      const abs = path.join(baseDir, dir)
-      try {
-        if (!lstatSync(abs).isSymbolicLink()) continue
-      } catch {
-        break
-      }
-      const target = realpathOrNull(abs)
-      if (target !== null && target !== realProject && !target.startsWith(realProject + path.sep)) {
-        return { dir, target, base: 'the workspace' }
-      }
-    }
-  }
-  return undefined
-}
-
-function realpathOrNull(p: string): string | null {
-  try {
-    return realpathSync(p)
-  } catch {
-    return null
-  }
-}
-
 /**
  * The clause a "matched no files" warning gains when a glob holds an
  * unescaped `[` and, read as a literal path, names something on disk:

package/src/orchestrator/options.ts

@@ -8,6 +8,7 @@ import type { TaskOutcome } from '../graph/index.js'
 import type { AffectedReason } from './affected-tasks.js'
 import type { EventBus, Logger } from '../report/index.js'
 import type { TelemetrySink } from './telemetry.js'
+import type { CommandWindows } from './command-windows.js'
 import type { AffectedChanges, ProjectEntry, ProjectMeta } from '../workspace/index.js'
 import type { RunSettings } from '../config.js'
 
@@ -220,6 +221,11 @@ export interface RunOptions {
    * is replaced only when the next cycle starts.
    */
   holdPersistent?: boolean
+  /**
+   * The run is a `vx watch` cycle: an input edited while a task ran starts
+   * the next cycle, and the line withholding the task's save says so.
+   */
+  watch?: boolean
   /**
    * The servers an earlier `holdPersistent` run handed back. Each one still
    * up whose task this run would start again, with the same resolved
@@ -232,6 +238,13 @@ export interface RunOptions {
    * not take.
    */
   keep?: HeldPersistent
+  /**
+   * Where the run records when each command ran (and each restore or deferred fetch)
+   * and where it may write (command-windows.ts). The watch loop passes its
+   * own, so a write that lands during the cycle and no command of it may
+   * have made is the user's edit, whatever the file settles to.
+   */
+  commandWindows?: CommandWindows
   /**
    * Print the per-task table (`--verbosity 1`) just above the footer: the
    * footer is the run's last word, so the caller cannot print it after.

package/src/orchestrator/output-host.ts

@@ -3,9 +3,10 @@
 // and core's renderer is the run's, byte for byte.
 
 import { terminalSubscriber, type RunEventSubscriber } from '../report/index.js'
-import type { Logger } from '../report/index.js'
+import type { Logger, RunEvent } from '../report/index.js'
 import { settleWithin, teardownTimeoutMs, thrownMessage } from '../util/index.js'
 import type { OutputContext, VxPlugin } from './plugin.js'
+import { readOnlyEvents } from './read-only.js'
 
 const REQUIRED = ['status', 'taskStdout', 'taskStderr', 'taskComplete'] as const
 const OPTIONAL = [
@@ -87,24 +88,35 @@ export function guardedOutput(
   }
   // An `async` method's rejection reached no one: an unhandled rejection
   // ended the run with a stack, exit 1, after its tasks had passed. It
-  // fails the Logger as a throw does; the event it was handed stays its.
+  // fails the Logger as a throw does, and core draws the event it was
+  // handed, as after a throw: a rejected `taskComplete` lost its task's row.
+  let current: RunEvent | undefined
   const logger = Object.create(claimed.logger) as Logger
   for (const k of [...REQUIRED, ...OPTIONAL, 'warn'] as const) {
     const method = claimed.logger[k] as ((...args: unknown[]) => unknown) | undefined
     if (typeof method !== 'function') continue
     ;(logger as unknown as Record<string, unknown>)[k] = (...args: unknown[]): void => {
+      const event = current
       const ret = method.apply(claimed.logger, args)
-      if (ret instanceof Promise) ret.catch(fail)
+      if (ret instanceof Promise)
+        ret.catch((err: unknown) => {
+          fail(err)
+          if (event !== undefined) fallback(event)
+        })
     }
   }
   const render = terminalSubscriber(logger)
+  const viewOf = readOnlyEvents()
   return (event) => {
     if (failed) return fallback(event)
+    current = event
     try {
-      render(event)
+      render(viewOf(event))
     } catch (err) {
       fail(err)
       fallback(event)
+    } finally {
+      current = undefined
     }
   }
 }

package/src/orchestrator/output-log.ts

@@ -5,7 +5,7 @@
 // a literal RS doubled. Output that never touched stderr is its own text.
 
 import { type BoundedCapture, type CapturedChunk, isDroppedOutputChunk } from '../exec/index.js'
-import { MASKED, type SecretMask } from '../util/index.js'
+import { maskStreams, type SecretMask } from '../util/index.js'
 
 const RS = '\x1e'
 
@@ -43,59 +43,6 @@ export function maskedOutputLog(chunks: readonly CapturedChunk[], mask: SecretMa
   return h + back + chunks[at]!.text + lead + t
 }
 
-/**
- * Each stream's run of adjacent non-empty chunks joined, with `mask`
- * applied to each stream's text as a whole: a value is masked where it
- * starts and its rest dropped from the runs it reaches. The live stream
- * masks chunk by chunk and lets a held piece go after a pause, so a value
- * written in two pieces reached the capture in two chunks, and a write to
- * the other stream between them made them two runs. A hit replays each
- * stream to its own descriptor, so `vx run > log` joined them again.
- */
-export function maskStreams(
-  chunks: readonly CapturedChunk[],
-  mask: SecretMask | undefined,
-): CapturedChunk[] {
-  if (mask === undefined) return chunks.filter((c) => c.text.length > 0)
-  const runs: CapturedChunk[] = []
-  for (const c of chunks) {
-    if (c.text.length === 0) continue
-    const last = runs.at(-1)
-    if (last !== undefined && last.err === c.err) last.text += c.text
-    else runs.push({ text: c.text, err: c.err })
-  }
-  for (const err of [false, true]) {
-    const own = runs.filter((r) => r.err === err)
-    const spans = mask.spans(own.map((r) => r.text).join(''))
-    if (spans.length === 0) continue
-    let at = 0
-    let i = 0
-    for (const r of own) {
-      const end = at + r.text.length
-      let text = ''
-      let from = at
-      for (; i < spans.length && spans[i]![0] < end; i++) {
-        const [s, e] = spans[i]!
-        if (s >= from) text += r.text.slice(from - at, s - at) + MASKED
-        from = Math.max(from, Math.min(e, end))
-        // A value that runs past this run is cut from the next one too.
-        if (e > end) break
-      }
-      r.text = text + r.text.slice(from - at)
-      at = end
-    }
-  }
-  // A run emptied whole leaves its neighbours, the other stream, adjacent.
-  const kept: CapturedChunk[] = []
-  for (const r of runs) {
-    if (r.text.length === 0) continue
-    const last = kept.at(-1)
-    if (last !== undefined && last.err === r.err) last.text += r.text
-    else kept.push(r)
-  }
-  return kept
-}
-
 /** The chunks `encodeOutputLog` wrote, adjacent same-stream text joined. */
 export function decodeOutputLog(log: string): CapturedChunk[] {
   if (!log.includes(RS)) return log.length === 0 ? [] : [{ text: log, err: false }]