@vzn/vx 0.0.651 → 0.0.653

package/src/cache/inputs.ts

@@ -17,12 +17,24 @@
 // be a git work tree; non-git environments are not supported.
 
 import path from 'node:path'
-import { lstatSync, readdirSync, realpathSync, rmdirSync, rmSync, statSync } from 'node:fs'
+import {
+  chmodSync,
+  type Dirent,
+  lstatSync,
+  readdirSync,
+  realpathSync,
+  rmdirSync,
+  rmSync,
+  statSync,
+} from 'node:fs'
 import { rm, rmdir } from 'node:fs/promises'
 import type { InputsConfig, TaskConfig } from '../config.js'
 import {
+  appendTail,
+  createTail,
   literalPath,
   anyTaskGlob,
+  tailText,
   asTrees,
   isExecutableMissing,
   isInstalledPath,
@@ -37,6 +49,7 @@ import {
   slashBraceExpansions,
   braceAlternatives,
   ESSENTIAL_ENV,
+  POST_EXIT_DRAIN_MS,
   splitNegations,
   staticPrefix,
   stripTrailingSlash,
@@ -45,7 +58,7 @@ import {
   writableUnder,
   withoutWorkspaceBins,
 } from '../util/index.js'
-import { GitFilesCache, listingEnv, runGitLsFiles } from './git-inputs.js'
+import { GitFilesCache, listingEnv, newFilesIgnoredIn, runGitLsFiles } from './git-inputs.js'
 import { FILE_HASH_RACY_MS, racyWindowMs } from './layer.js'
 
 // The git side lives in git-inputs.ts; its whole public surface is
@@ -106,13 +119,18 @@ const ALWAYS_IGNORE = [
   '.vx/dependencies.lock.json',
   // Where restores stage (archive.ts): vx's own, never an input.
   '.vx/tmp/**',
+  // The temps the locks and review copies are written to and renamed from
+  // (`writeAllOrNone`, `writeNoFollow`): a killed write leaves one.
+  '.vx/projects.lock.json.tmp-*',
+  '.vx/dependencies.lock.json.tmp-*',
+  'vx.lock.json.tmp-*',
 ]
 
 /**
  * `ALWAYS_IGNORE` relative to the workspace root, for `inputs.workspaceFiles`:
  * those globs cross into other projects, and each one's `vx.lock.json` is vx's.
  */
-const WORKSPACE_ALWAYS_IGNORE = [...ALWAYS_IGNORE, '**/vx.lock.json']
+const WORKSPACE_ALWAYS_IGNORE = [...ALWAYS_IGNORE, '**/vx.lock.json', '**/vx.lock.json.tmp-*']
 
 const DEFAULT_FILE_GLOBS: readonly string[] = ['**/*']
 
@@ -214,7 +232,18 @@ export type ProjectFilesCache = Map<
  * relative to it) and everything `resolveFiles` keys its memo on.
  * Undefined when only resolving the files can say.
  */
-export function filesToken(args: ResolveInputsArgs): string | undefined {
+export function filesToken(
+  args: Pick<
+    ResolveInputsArgs,
+    | 'projectDir'
+    | 'workspaceRoot'
+    | 'inputs'
+    | 'ownOutputs'
+    | 'ownWorkspaceOutputs'
+    | 'nestedProjectDirs'
+    | 'gitFilesCache'
+  >,
+): string | undefined {
   if ((args.inputs?.workspaceFiles?.length ?? 0) > 0) return undefined
   const plan = filesPlan(args.inputs?.files, args.ownOutputs)
   const cache = args.gitFilesCache
@@ -299,6 +328,7 @@ export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedIn
             args.runtimeScope === undefined
               ? `${args.projectDir}\0`
               : `${args.projectDir}\0${args.runtimeScope}\0`,
+            'runtime',
           ),
           resolveRuntimeValues(
             wsRuntimeDecl,
@@ -307,6 +337,7 @@ export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedIn
             args.workspaceRoot,
             args.workspaceRuntimeCache,
             args.runtimeScope === undefined ? '' : `\0${args.runtimeScope}\0`,
+            'workspaceRuntime',
           ),
         ])
   return {
@@ -579,6 +610,7 @@ export function answerRuntime(
         [path.join(workspaceRoot, 'node_modules', '.bin')],
         workspaceRoot,
         undefined,
+        'workspaceRuntime',
       )
     : runRuntimeCommand(
         command,
@@ -586,6 +618,7 @@ export function answerRuntime(
         projectBinDirs(projectDir, workspaceRoot),
         workspaceRoot,
         undefined,
+        'runtime',
       )
 }
 
@@ -593,7 +626,21 @@ function resolveEnvValues(
   names: readonly string[],
   source: NodeJS.ProcessEnv,
 ): Array<[string, string | undefined]> {
-  return [...names].sort().map((name) => [name, source[name]])
+  return [...names].sort().map((name) => {
+    const value = source[name]
+    // Bun decodes the environment lossily and offers no raw bytes on every
+    // platform (Linux's /proc/self/environ misses what vx sets itself), so
+    // Latin-1 é and è both read as U+FFFD and replayed each other's build.
+    // A value that truly holds U+FFFD is refused with them: the two read
+    // alike. The value is never shown; it may be a secret.
+    if (value?.includes('�') === true) {
+      throw new UserError(
+        `inputs.env ${name} holds U+FFFD: its value is not UTF-8, or holds that character, ` +
+          `and a lossy decode keys every invalid byte alike. Set it as UTF-8.`,
+      )
+    }
+    return [name, value]
+  })
 }
 
 /**
@@ -620,7 +667,9 @@ async function runRuntimeCommand(
   binDirs: readonly string[],
   workspaceRoot: string,
   owner: RuntimeMemo | undefined,
+  field: RuntimeField,
 ): Promise<string> {
+  const probe = `inputs.${field} probe`
   // As a task's (exec/env.ts): no member's bin inherited from `npm run`.
   const ambient = withoutWorkspaceBins(process.env['PATH'] ?? '', workspaceRoot)
   // As the task's PATH does (exec/env.ts): a dir holding the delimiter
@@ -648,10 +697,10 @@ async function runRuntimeCommand(
     // the shell, not the command (item 244).
     if (isExecutableMissing(err)) {
       throw new UserError(
-        `inputs runtime command could not run: vx runs it with sh -c and 'sh' is not on PATH (command: ${command}, cwd: ${cwd}). Install a POSIX sh and re-run.`,
+        `${probe} could not run: vx runs it with sh -c and 'sh' is not on PATH (command: ${command}, cwd: ${cwd}). Install a POSIX sh and re-run.`,
       )
     }
-    throw new UserError(`inputs runtime command failed to spawn: ${command} (cwd: ${cwd})`)
+    throw new UserError(`${probe} failed to spawn: ${command} (cwd: ${cwd})`)
   }
   liveProbes.add(proc)
   let mine: Set<ReturnType<typeof Bun.spawn>> | undefined
@@ -662,22 +711,41 @@ async function runRuntimeCommand(
   }
   killProbesOnExit()
   let stdout, stderr, exitCode
+  const ac = new AbortController()
   try {
-    ;[stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).bytes(),
-      new Response(proc.stderr).bytes(),
-      proc.exited,
+    const streams = Promise.all([
+      probeBytes(proc.stdout, ac.signal),
+      probeBytes(proc.stderr, ac.signal),
     ])
+    exitCode = await proc.exited
+    // A child the shell left holding the pipes (`sleep 6 & echo x`) kept
+    // them open past the shell's exit, and the run waited for the child. As
+    // a task's (exec/runner.ts): a short drain, then the reads stop and the
+    // group goes. What was read is what the shell printed, so the key folds
+    // it; what the child prints later is no part of the answer.
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const cut = new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, POST_EXIT_DRAIN_MS)
+    })
+    await Promise.race([streams, cut])
+    clearTimeout(timer)
+    ac.abort()
+    killGroup(proc.pid)
+    ;[stdout, stderr] = await streams
   } finally {
     liveProbes.delete(proc)
     mine?.delete(proc)
   }
   if (exitCode !== 0) {
     const lossy = new TextDecoder()
-    const shown = `${lossy.decode(stdout)}${lossy.decode(stderr)}`.trim()
+    // Capped as a persistent task's log is: a chatty probe put megabytes
+    // into one error line. The tail is kept; the failure is usually last.
+    const tail = createTail()
+    appendTail(tail, `${lossy.decode(stdout)}${lossy.decode(stderr)}`.trim())
+    const shown = tailText(tail)
+    const lost = tail.dropped === 0 ? '' : `… ${tail.dropped} earlier characters dropped\n`
     throw new UserError(
-      `inputs runtime command exited ${exitCode}: ${command} (cwd: ${cwd})` +
-        (shown ? `\n${shown}` : ''),
+      `${probe} exited ${exitCode}: ${command} (cwd: ${cwd})` + (shown ? `\n${lost}${shown}` : ''),
     )
   }
   let out: string
@@ -689,7 +757,7 @@ async function runRuntimeCommand(
     // A lossy decode keys every invalid byte as U+FFFD: Latin-1 é and è
     // folded the same output and replayed each other's build.
     throw new UserError(
-      `inputs runtime command printed bytes that are not UTF-8: ${command} (cwd: ${cwd}). ` +
+      `${probe} printed bytes that are not UTF-8: ${command} (cwd: ${cwd}). ` +
         `Pipe it through a hash or od.`,
     )
   }
@@ -722,6 +790,8 @@ const liveProbes = new Set<ReturnType<typeof Bun.spawn>>()
 let probeExitHooked = false
 
 type RuntimeMemo = Map<string, Promise<string>>
+/** The field a probe is declared under, as its errors name it. */
+type RuntimeField = 'runtime' | 'workspaceRuntime'
 /** The probes each run started, by the run's memo: one run's stop is not another's. */
 const probesOf = new WeakMap<RuntimeMemo, Set<ReturnType<typeof Bun.spawn>>>()
 
@@ -736,24 +806,51 @@ const probesOf = new WeakMap<RuntimeMemo, Set<ReturnType<typeof Bun.spawn>>>()
 export function stopRuntimeProbes(...memos: readonly RuntimeMemo[]): void {
   for (const memo of memos) {
     for (const p of probesOf.get(memo) ?? []) {
-      try {
-        process.kill(-p.pid, 'SIGKILL')
-      } catch {
-        // the group is gone
-      }
+      killGroup(p.pid)
+    }
+  }
+}
+/** SIGKILL a probe's group, its own since the spawn (`detached`). */
+function killGroup(pid: number): void {
+  try {
+    process.kill(-pid, 'SIGKILL')
+  } catch {
+    // the group is gone
+  }
+}
+
+/**
+ * A probe's stream, read to its end or until `signal`: then the pending
+ * read is cancelled and what was read is returned. `new Response().bytes()`
+ * offers no way out while a leftover child holds the pipe.
+ */
+async function probeBytes(
+  stream: ReadableStream<Uint8Array>,
+  signal: AbortSignal,
+): Promise<Uint8Array> {
+  const reader = stream.getReader()
+  const onAbort = (): void => void reader.cancel().catch(() => {})
+  signal.addEventListener('abort', onAbort, { once: true })
+  const parts: Uint8Array[] = []
+  try {
+    while (true) {
+      const { value, done } = await reader.read()
+      if (done) break
+      parts.push(value)
     }
+  } finally {
+    signal.removeEventListener('abort', onAbort)
+    reader.releaseLock()
   }
+  return Buffer.concat(parts)
 }
+
 function killProbesOnExit(): void {
   if (probeExitHooked) return
   probeExitHooked = true
   process.on('exit', () => {
     for (const p of liveProbes) {
-      try {
-        process.kill(-p.pid, 'SIGKILL')
-      } catch {
-        // the group is gone
-      }
+      killGroup(p.pid)
     }
   })
 }
@@ -774,6 +871,7 @@ async function resolveRuntimeValues(
   workspaceRoot: string,
   memo: Map<string, Promise<string>> | undefined,
   memoKeyPrefix: string,
+  field: RuntimeField,
 ): Promise<Array<[string, string]>> {
   if (commands.length === 0) return []
   const unique = [...new Set(commands)].sort()
@@ -782,7 +880,7 @@ async function resolveRuntimeValues(
       const key = `${memoKeyPrefix}${cmd}`
       let p = memo?.get(key)
       if (p === undefined) {
-        p = runRuntimeCommand(cmd, cwd, binDirs, workspaceRoot, memo)
+        p = runRuntimeCommand(cmd, cwd, binDirs, workspaceRoot, memo, field)
         memo?.set(key, p)
       }
       return [cmd, await p] as [string, string]
@@ -800,6 +898,13 @@ function outputExcludes(outputs: readonly string[], scope: 'project' | 'workspac
   return outputNever(outputs, scope).map(globFor)
 }
 
+/** A task's `inputs` and the directories they anchor at, for `refuseLinkedIntoInputs`. */
+export interface OwnInputs {
+  projectDir: string
+  workspaceRoot: string
+  declared: InputsConfig | undefined
+}
+
 /**
  * Resolve declared output globs (project-relative) to actual produced files.
  * An output directory linked out of the project is refused by name (X-88):
@@ -809,6 +914,7 @@ export async function resolveOutputs(args: {
   projectDir: string
   outputs: readonly string[]
   nestedProjectDirs: string[]
+  inputs?: OwnInputs | undefined
 }): Promise<string[]> {
   return (await scanOutputs(args)).files
 }
@@ -837,21 +943,66 @@ export async function resolveOutputTree(args: {
   projectDir: string
   outputs: readonly string[]
   nestedProjectDirs: string[]
-}): Promise<{ files: string[]; emptyDirs: string[] }> {
+  /** The task's own inputs: an output directory linked into them is refused. */
+  inputs?: OwnInputs | undefined
+  /**
+   * Also list the FIFOs, sockets and devices the globs name: a save refuses
+   * them, a clean removes them. `'later'` leaves `special` empty and hands
+   * `findSpecial` instead, for a walk that needs them only if it restores.
+   */
+  special?: boolean | 'later'
+  /** The walk feeds a clean or a restore (`refuseUndecodableOutput`). */
+  clearing?: boolean
+}): Promise<OutputTree> {
   const emptyDirs = new Set<string>()
-  const { files } = await scanOutputs(args, emptyDirs)
-  return { files, emptyDirs: containedIn(args.projectDir, [...emptyDirs]).sort() }
+  const probe: SpecialProbe | undefined =
+    args.special === undefined || args.special === false ? undefined : {}
+  const { files } = await scanOutputs(args, emptyDirs, probe)
+  return treeOf(args.projectDir, files, emptyDirs, args.special, probe)
+}
+
+/** What `resolveOutputTree` and its workspace twin return. */
+type OutputTree = {
+  files: string[]
+  emptyDirs: string[]
+  special: string[]
+  findSpecial?: () => string[]
+}
+
+function treeOf(
+  root: string,
+  files: string[],
+  emptyDirs: Set<string>,
+  asked: boolean | 'later' | undefined,
+  probe: SpecialProbe | undefined,
+): OutputTree {
+  const findSpecial = (): string[] =>
+    probe?.find === undefined ? [] : containedIn(root, probe.find()).sort()
+  const tree: OutputTree = {
+    files,
+    emptyDirs: containedIn(root, [...emptyDirs]).sort(),
+    special: asked === true ? findSpecial() : [],
+  }
+  if (asked === 'later') tree.findSpecial = findSpecial
+  return tree
 }
 
 async function scanOutputs(
-  args: { projectDir: string; outputs: readonly string[]; nestedProjectDirs: string[] },
+  args: {
+    projectDir: string
+    outputs: readonly string[]
+    nestedProjectDirs: string[]
+    inputs?: OwnInputs | undefined
+    clearing?: boolean
+  },
   emptyDirs?: Set<string>,
+  special?: SpecialProbe,
 ): Promise<{ files: string[] }> {
   const { positive, negative } = splitNegations(args.outputs)
   if (positive.length === 0) return { files: [] }
   const excludeGlobs = [...outputExcludes(positive, 'project'), ...asTrees(negative).map(globFor)]
   const trees = asTrees(positive)
-  refuseDirLinkedOut(args.projectDir, trees, 'project')
+  const absent = refuseDirLinkedOut(args.projectDir, trees, 'project', args.inputs)
   const scanned = [
     ...(await scanUnion(
       trees,
@@ -859,6 +1010,9 @@ async function scanOutputs(
       args.projectDir,
       inNestedProject(args.projectDir, args.nestedProjectDirs),
       emptyDirs,
+      special,
+      absent,
+      args.clearing,
     )),
   ]
   // Containment, enforced HERE and not only at the loader. `cleanOutputs`
@@ -892,14 +1046,22 @@ export function committedFiles(
  * below it is an output, kept as the link (`archive.ts`). One into `.git`
  * or `.vx` is refused in either scope: for the root project and for
  * workspace outputs those are inside, and the clean deleted the
- * repository through `dist -> .git`. One out of a workspace output's root
- * is left to `containedIn`.
+ * repository through `dist -> .git`. One out of the root is refused in
+ * either scope too: a workspace output's every file was dropped as outside
+ * and an empty entry saved, while the project twin refused the task (M-65).
+ * So is one holding an entry of the task's own `inputs`, in either scope:
+ * X-55 read through the link, as `dist -> src` under `src/**` had the
+ * clean delete every untracked source.
  */
 function refuseDirLinkedOut(
   root: string,
   trees: readonly string[],
   scope: 'project' | 'workspace',
-): void {
+  inputs?: OwnInputs,
+): Set<string> {
+  // The heads found absent: the scan that follows skips them without
+  // asking again (a restore after a clean asks of every one).
+  const absent = new Set<string>()
   let realRoot: string | undefined
   for (const tree of trees) {
     let at = root
@@ -913,7 +1075,10 @@ function refuseDirLinkedOut(
       } catch {
         break
       }
-      if (st === undefined) break
+      if (st === undefined) {
+        absent.add(at)
+        break
+      }
       if (!st.isSymbolicLink()) continue
       let real: string
       try {
@@ -924,10 +1089,9 @@ function refuseDirLinkedOut(
       }
       realRoot ??= realOr(root)
       if (!isInside(realRoot, real)) {
-        if (scope === 'workspace') break
         throw new UserError(
           `${at} is a symbolic link to ${real}, outside ${root} — vx never cleans, saves ` +
-            'or restores declared outputs through a link that leaves the project. Remove the ' +
+            `or restores declared outputs through a link that leaves the ${scope}. Remove the ` +
             'link and re-run, or stop declaring outputs under it.',
         )
       }
@@ -938,8 +1102,57 @@ function refuseDirLinkedOut(
             'link and re-run, or stop declaring outputs under it.',
         )
       }
+      if (inputs !== undefined) refuseLinkedIntoInputs(at, real, inputs)
     }
   }
+  return absent
+}
+
+/**
+ * Throws when an entry of `inputs` can match a path under the real
+ * directory `real`: `files` under the project, `workspaceFiles` under the
+ * workspace root. A link to an ancestor of the anchor holds every entry.
+ * Negations are not subtracted: a link onto files the task reads is wrong
+ * even where one excludes them.
+ */
+function refuseLinkedIntoInputs(at: string, real: string, inputs: OwnInputs): void {
+  const holds = (anchor: string, globs: readonly string[] | undefined): boolean => {
+    const { positive } = splitNegations(globs ?? [])
+    if (positive.length === 0) return false
+    const realAnchor = realOr(anchor)
+    const rel = relPosix(realAnchor, real)
+    if (rel === '..' || rel.startsWith('../')) return isInside(real, realAnchor)
+    const dir = rel === '' ? [] : rel.split('/')
+    return asTrees(positive).some((g) => reachesBelow(g.split('/'), dir))
+  }
+  if (
+    !holds(inputs.projectDir, inputs.declared?.files) &&
+    !holds(inputs.workspaceRoot, inputs.declared?.workspaceFiles)
+  )
+    return
+  throw new UserError(
+    `${at} is a symbolic link into ${real}, which the task's own inputs read — vx removes a ` +
+      `task's outputs before it runs, so the task would delete its own sources. Remove the ` +
+      'link and re-run, or stop declaring outputs under it.',
+    'VX_E_INPUT_IS_OUTPUT',
+  )
+}
+
+/**
+ * Whether the glob split into `segments` can match a path below the
+ * directory `dir` (split too): each of `dir`'s names matches its segment
+ * and the glob goes on past them, or a `**` comes first. `**\/*.ts` and
+ * `src/**` reach below `src/lib`; `src/**` and `*.json` do not reach below
+ * `build-out`.
+ */
+function reachesBelow(segments: readonly string[], dir: readonly string[]): boolean {
+  for (let i = 0; i < dir.length; i++) {
+    const seg = segments[i]
+    if (seg === undefined) return false
+    if (seg === '**') return true
+    if (!globFor(seg).match(dir[i]!)) return false
+  }
+  return segments.length > dir.length
 }
 
 /**
@@ -1088,6 +1301,7 @@ export async function cleanOutputs(args: {
   projectDir: string
   outputs: readonly string[]
   nestedProjectDirs: string[]
+  inputs?: OwnInputs | undefined
   committed?: (abs: string) => boolean
   /**
    * What `resolveOutputs` returned for these same arguments, when the
@@ -1103,17 +1317,18 @@ export async function cleanOutputs(args: {
   )
   sweepRestoreTemps(args.projectDir, args.outputs, committed)
   // An empty directory under the outputs is one too (a save keeps it): one
-  // an older build left would otherwise be saved by this run.
+  // an older build left would otherwise be saved by this run. So is a FIFO,
+  // socket or device: a task writing a FIFO's path blocks on it forever.
   const tree =
     args.resolved === undefined
-      ? await resolveOutputTree(args)
-      : { files: args.resolved, emptyDirs: [] }
+      ? await resolveOutputTree({ ...args, special: true, clearing: true })
+      : { files: args.resolved, emptyDirs: [], special: [] }
   const matched = tree.files
   // `force: true` makes rm tolerate ENOENT (e.g. when two output
   // globs overlap and a sibling already deleted a path mid-iteration).
   // A symlink is unlinked, never followed.
   const removed = await removeAll(
-    matched.filter((f) => !committed(f)),
+    [...matched, ...tree.special].filter((f) => !committed(f)),
     args.projectDir,
   )
   await pruneEmptiedDirs(
@@ -1254,18 +1469,42 @@ export async function stampOutputs(args: {
   projectDir: string
   outputs: readonly string[]
   nestedProjectDirs: string[]
+  inputs?: OwnInputs | undefined
 }): Promise<Map<string, OutputStamp>> {
   return stampFiles(await resolveOutputs(args))
 }
 
-/** `stampOutputs` for root-anchored `cache.outputs.workspaceFiles` (A-43). */
+/** `stampOutputs` for root-anchored `outputs.workspaceFiles` (A-43). */
 export async function stampWorkspaceOutputs(args: {
   workspaceRoot: string
   outputs: readonly string[]
+  inputs?: OwnInputs | undefined
 }): Promise<Map<string, OutputStamp>> {
   return stampFiles(await resolveWorkspaceOutputs(args))
 }
 
+/**
+ * The stamps of the committed files among `files`, the outputs a clean
+ * found. No clean deletes one, so a failed attempt's change to it stays
+ * for the retry: `committedMoved` tells.
+ */
+export function stampCommitted(
+  files: readonly string[],
+  committed: (abs: string) => boolean,
+): Map<string, OutputStamp> {
+  return stampFiles(files.filter(committed))
+}
+
+/** Whether a committed file among `files` was added, removed or touched since `before` (`stampCommitted`). */
+export function committedMoved(
+  files: readonly string[],
+  committed: (abs: string) => boolean,
+  before: ReadonlyMap<string, OutputStamp>,
+): boolean {
+  const changed = changedSince(files.filter(committed), before)
+  return changed === undefined || changed.length > 0
+}
+
 function stampFiles(files: readonly string[]): Map<string, OutputStamp> {
   const out = new Map<string, OutputStamp>()
   for (const f of files) {
@@ -1292,15 +1531,20 @@ function stampFiles(files: readonly string[]): Map<string, OutputStamp> {
  * file back, so no entry reproduces that run and none is saved.
  */
 export async function ownOutputsSince(
-  args: { projectDir: string; outputs: readonly string[]; nestedProjectDirs: string[] },
+  args: {
+    projectDir: string
+    outputs: readonly string[]
+    nestedProjectDirs: string[]
+    inputs?: OwnInputs | undefined
+  },
   before: ReadonlyMap<string, OutputStamp>,
 ): Promise<string[] | undefined> {
   return changedSince(await resolveOutputs(args), before)
 }
 
-/** `ownOutputsSince` for root-anchored `cache.outputs.workspaceFiles` (A-43). */
+/** `ownOutputsSince` for root-anchored `outputs.workspaceFiles` (A-43). */
 export async function ownWorkspaceOutputsSince(
-  args: { workspaceRoot: string; outputs: readonly string[] },
+  args: { workspaceRoot: string; outputs: readonly string[]; inputs?: OwnInputs | undefined },
   before: ReadonlyMap<string, OutputStamp>,
 ): Promise<string[] | undefined> {
   return changedSince(await resolveWorkspaceOutputs(args), before)
@@ -1348,9 +1592,18 @@ const SYNC_CLEAN_MAX = 128
  * wrote, a read-only checkout) is the environment's failure, not vx's:
  * the scheduler prints any other error as an "internal error", which
  * sends the reader to file a bug against a permission bit.
+ *
+ * A directory of this user's that withholds its own write (a task's
+ * `chmod 555 dist/ro`, which a hit restores too) gets owner write and
+ * search for the remove and its mode back after, as a restore's write
+ * into it does (archive.ts `reopen`): else that task could never run or
+ * restore again until someone chmodded the tree by hand. The prune after
+ * reopens the same way for the subdirectories it removes (`pruneEmptiedDirs`).
  */
 async function removeAll(all: readonly string[], root: string): Promise<string[]> {
   const files = insideRoot(all, root)
+  const reopened: Reopened = new Map()
+  const reopen = (dir: string): boolean => reopenDir(dir, reopened)
   const refused = (f: string, err: NodeJS.ErrnoException): UserError => {
     const rel = relPosix(root, f)
     return new UserError(
@@ -1359,24 +1612,64 @@ async function removeAll(all: readonly string[], root: string): Promise<string[]
         `by this user, or stop declaring it as an output`,
     )
   }
-  if (files.length <= SYNC_CLEAN_MAX) {
-    for (const f of files) {
-      try {
-        rmSync(f, { force: true })
-      } catch (err) {
-        throw refused(f, err as NodeJS.ErrnoException)
+  const denied = (err: unknown, f: string): boolean =>
+    (err as NodeJS.ErrnoException).code === 'EACCES' && reopen(path.dirname(f))
+  try {
+    if (files.length <= SYNC_CLEAN_MAX) {
+      for (const f of files) {
+        try {
+          rmSync(f, { force: true })
+        } catch (err) {
+          if (!denied(err, f)) throw refused(f, err as NodeJS.ErrnoException)
+          try {
+            rmSync(f, { force: true })
+          } catch (again) {
+            throw refused(f, again as NodeJS.ErrnoException)
+          }
+        }
       }
+      return files
     }
+    await Promise.all(
+      files.map((f) =>
+        rm(f, { force: true })
+          .catch((err: NodeJS.ErrnoException) => {
+            if (!denied(err, f)) throw err
+            return rm(f, { force: true })
+          })
+          .catch((err: NodeJS.ErrnoException) => {
+            throw refused(f, err)
+          }),
+      ),
+    )
     return files
+  } finally {
+    giveBack(reopened)
+  }
+}
+
+/** Directories given owner write and search for a remove, with the mode each had. */
+type Reopened = Map<string, number>
+
+/** Whether `dir` is now open to a remove: this user's, and its missing owner bits given. */
+function reopenDir(dir: string, reopened: Reopened): boolean {
+  if (reopened.has(dir)) return true
+  const st = lstatSync(dir, { throwIfNoEntry: false })
+  if (st?.isDirectory() !== true || st.uid !== process.getuid?.()) return false
+  if ((st.mode & 0o300) === 0o300) return false
+  reopened.set(dir, st.mode & 0o7777)
+  chmodSync(dir, (st.mode & 0o7777) | 0o300)
+  return true
+}
+
+function giveBack(reopened: Reopened): void {
+  for (const [dir, mode] of reopened) {
+    try {
+      chmodSync(dir, mode)
+    } catch {
+      // gone since (the prune removed it): nothing to give back
+    }
   }
-  await Promise.all(
-    files.map((f) =>
-      rm(f, { force: true }).catch((err: NodeJS.ErrnoException) => {
-        throw refused(f, err)
-      }),
-    ),
-  )
-  return files
 }
 
 /**
@@ -1444,33 +1737,53 @@ async function pruneEmptiedDirs(
   // the memo is correct and 60 ms, because every child re-attempts the
   // shared parent. This is correct at 44 ms.
   let level = new Set([...removed.map((f) => path.dirname(f)), ...emptyDirs])
-  while (level.size > 0) {
-    const parents = new Set<string>()
-    const dirs = [...level].filter(
-      (dir) =>
-        dir !== rootResolved &&
-        dir.startsWith(rootResolved + path.sep) &&
-        (scope === undefined || inScope(dir, scope)) &&
-        keep?.has(dir) !== true,
-    )
-    const gone = (err: NodeJS.ErrnoException): boolean => err.code === 'ENOENT'
-    if (dirs.length <= SYNC_CLEAN_MAX) {
-      for (const dir of dirs) {
-        try {
-          rmdirSync(dir)
-          parents.add(path.dirname(dir))
-        } catch (err) {
-          if (gone(err as NodeJS.ErrnoException)) parents.add(path.dirname(dir))
+  // A subdirectory of a read-only directory of this user's (`dist/x/s` under
+  // a `chmod 555 dist/x`) is removed as `removeAll` removes a file there.
+  const reopened: Reopened = new Map()
+  const gone = (err: NodeJS.ErrnoException): boolean => err.code === 'ENOENT'
+  const denied = (err: NodeJS.ErrnoException, dir: string): boolean =>
+    err.code === 'EACCES' && reopenDir(path.dirname(dir), reopened)
+  try {
+    while (level.size > 0) {
+      const parents = new Set<string>()
+      const dirs = [...level].filter(
+        (dir) =>
+          dir !== rootResolved &&
+          dir.startsWith(rootResolved + path.sep) &&
+          (scope === undefined || inScope(dir, scope)) &&
+          keep?.has(dir) !== true,
+      )
+      if (dirs.length <= SYNC_CLEAN_MAX) {
+        for (const dir of dirs) {
+          try {
+            try {
+              rmdirSync(dir)
+            } catch (err) {
+              if (!denied(err as NodeJS.ErrnoException, dir)) throw err
+              rmdirSync(dir)
+            }
+            parents.add(path.dirname(dir))
+          } catch (err) {
+            if (gone(err as NodeJS.ErrnoException)) parents.add(path.dirname(dir))
+          }
         }
+      } else {
+        await Promise.all(
+          dirs.map(async (dir) => {
+            const ok = await rmdir(dir)
+              .catch((err: NodeJS.ErrnoException) => {
+                if (!denied(err, dir)) throw err
+                return rmdir(dir)
+              })
+              .then(() => true, gone)
+            if (ok) parents.add(path.dirname(dir))
+          }),
+        )
       }
-    } else {
-      await Promise.all(
-        dirs.map(async (dir) => {
-          if (await rmdir(dir).then(() => true, gone)) parents.add(path.dirname(dir))
-        }),
-      )
+      level = parents
     }
-    level = parents
+  } finally {
+    giveBack(reopened)
   }
 }
 
@@ -1525,16 +1838,28 @@ export async function resolveWorkspaceOutputs(
   args: {
     workspaceRoot: string
     outputs: readonly string[]
+    inputs?: OwnInputs | undefined
+    clearing?: boolean
   },
   emptyDirs?: Set<string>,
+  special?: SpecialProbe,
 ): Promise<string[]> {
   const { positive, negative } = splitNegations(args.outputs)
   if (positive.length === 0) return []
   const excludeGlobs = [...outputExcludes(positive, 'workspace'), ...asTrees(negative).map(globFor)]
   const trees = asTrees(positive)
-  refuseDirLinkedOut(args.workspaceRoot, trees, 'workspace')
+  const absent = refuseDirLinkedOut(args.workspaceRoot, trees, 'workspace', args.inputs)
   const scanned = [
-    ...(await scanUnion(trees, excludeGlobs, args.workspaceRoot, undefined, emptyDirs)),
+    ...(await scanUnion(
+      trees,
+      excludeGlobs,
+      args.workspaceRoot,
+      undefined,
+      emptyDirs,
+      special,
+      absent,
+      args.clearing,
+    )),
   ]
   // Same containment as the project twin, anchored one level out. These globs
   // deliberately ignore PROJECT boundaries — that is the escape hatch — but
@@ -1547,10 +1872,17 @@ export async function resolveWorkspaceOutputs(
 export async function resolveWorkspaceOutputTree(args: {
   workspaceRoot: string
   outputs: readonly string[]
-}): Promise<{ files: string[]; emptyDirs: string[] }> {
+  /** As `resolveOutputTree`'s. */
+  inputs?: OwnInputs | undefined
+  /** As `resolveOutputTree`'s. */
+  special?: boolean | 'later'
+  clearing?: boolean
+}): Promise<OutputTree> {
   const emptyDirs = new Set<string>()
-  const files = await resolveWorkspaceOutputs(args, emptyDirs)
-  return { files, emptyDirs: containedIn(args.workspaceRoot, [...emptyDirs]).sort() }
+  const probe: SpecialProbe | undefined =
+    args.special === undefined || args.special === false ? undefined : {}
+  const files = await resolveWorkspaceOutputs(args, emptyDirs, probe)
+  return treeOf(args.workspaceRoot, files, emptyDirs, args.special, probe)
 }
 
 /**
@@ -1564,6 +1896,7 @@ export async function resolveWorkspaceOutputTree(args: {
 export async function cleanWorkspaceOutputs(args: {
   workspaceRoot: string
   outputs: readonly string[]
+  inputs?: OwnInputs | undefined
   committed?: (abs: string) => boolean
   /** `cleanOutputs`'s `resolved`, from `resolveWorkspaceOutputs`. */
   resolved?: readonly string[] | undefined
@@ -1575,13 +1908,13 @@ export async function cleanWorkspaceOutputs(args: {
   sweepRestoreTemps(args.workspaceRoot, args.outputs, committed)
   const tree =
     args.resolved === undefined
-      ? await resolveWorkspaceOutputTree(args)
-      : { files: args.resolved, emptyDirs: [] }
+      ? await resolveWorkspaceOutputTree({ ...args, special: true, clearing: true })
+      : { files: args.resolved, emptyDirs: [], special: [] }
   const matched = tree.files
   await pruneEmptiedDirs(
     args.workspaceRoot,
     await removeAll(
-      matched.filter((f) => !committed(f)),
+      [...matched, ...tree.special].filter((f) => !committed(f)),
       args.workspaceRoot,
     ),
     pruneScope(args.workspaceRoot, args.outputs),
@@ -1619,16 +1952,61 @@ function unanswered(
   files: readonly string[],
   newIgnored?: (lit: string) => boolean,
 ): Set<string> {
-  const left = new Set<string>()
-  for (const lit of literals) {
-    const under = `${lit}/`
-    const answered =
-      files[lowerBound(files, lit)] === lit ||
-      files[lowerBound(files, under)]?.startsWith(under) === true ||
-      files.some((rel) => rel === lit || rel.startsWith(under))
-    if (!answered || newIgnored?.(lit) === true) left.add(lit)
-  }
-  return left
+  return new Set(
+    reachingIgnored(
+      literals,
+      (lit) => {
+        const under = `${lit}/`
+        return (
+          files[lowerBound(files, lit)] === lit ||
+          files[lowerBound(files, under)]?.startsWith(under) === true ||
+          files.some((rel) => rel === lit || rel.startsWith(under))
+        )
+      },
+      newIgnored,
+    ),
+  )
+}
+
+/**
+ * The rule a named entry reaches git-ignored files by: git lists nothing at
+ * or under it, or ignores a new file directly in it (a kept `gen/.gitkeep`).
+ * `src` of `src/**` over a listed `src` reaches none: an ignored `src/dev.log`
+ * is no input.
+ */
+function reachingIgnored(
+  named: readonly string[],
+  listed: (entry: string) => boolean,
+  newIgnored?: (entry: string) => boolean,
+): string[] {
+  return named.filter((n) => !listed(n) || newIgnored?.(n) === true)
+}
+
+/**
+ * The entries of `named` (absolute, from {@link namedOutright}) a
+ * git-ignored input can be at or under, by the rule a key reads them
+ * ({@link ignoredReach}): `listed` holds what git lists, absolute, with every
+ * directory above a listed file. Watch asks it, so an ignored file the key
+ * never reads starts no cycle.
+ */
+export function namedIgnoredReach(
+  root: string,
+  named: readonly string[],
+  listed: ReadonlySet<string>,
+): string[] {
+  const held = named.filter((n) => listed.has(n))
+  const fresh =
+    held.length === 0
+      ? new Set<string>()
+      : newFilesIgnoredIn(
+          root,
+          held.map((n) => relPosix(root, n)),
+        )
+  return reachingIgnored(
+    named,
+    (n) => listed.has(n),
+    (n) => fresh.has(relPosix(root, n)),
+  )
 }
 
 /** The first index whose path is not below `key`. */
@@ -1907,9 +2285,43 @@ function throughLinks(
  * read through it, and an edit there was a hit (2026-10-28). Such a path
  * that is a link to a directory is an input (`dirLinkInput`). Generous on
  * purpose: a wrong yes costs one lookup, and folds a linked directory.
+ *
+ * Asked of every path no glob takes, so the prefixes are a map walked by
+ * the path's own `/`s: a scan of every prefix per path was 8,000 globs ×
+ * 200,000 files, minutes per key.
  */
-function mayHoldMatch(positive: readonly string[]): (rel: string) => boolean {
-  const reach = asTrees(positive.flatMap(braceAlternatives)).map((g) => {
+export function mayHoldMatch(positive: readonly string[]): (rel: string) => boolean {
+  // A prefix ends in `/` (or is empty), so the ones a path starts with are
+  // its slices that end at one of its own `/`s.
+  const byPrefix = new Map<string, { deep: boolean; depth: number }>()
+  for (const r of holdReach(positive)) {
+    const seen = byPrefix.get(r.prefix)
+    if (seen === undefined) byPrefix.set(r.prefix, { deep: r.deep, depth: r.depth })
+    else {
+      seen.deep ||= r.deep
+      seen.depth = Math.max(seen.depth, r.depth)
+    }
+  }
+  if (byPrefix.size === 0) return () => false
+  return (rel) => {
+    let slashes = 0
+    for (let i = 0; i < rel.length; i++) if (rel.charCodeAt(i) === 47) slashes++
+    const depth = slashes + 1
+    let r = rel.length > 0 ? byPrefix.get('') : undefined
+    if (r !== undefined && (r.deep || depth < r.depth)) return true
+    for (let i = rel.indexOf('/'); i !== -1 && i < rel.length - 1; i = rel.indexOf('/', i + 1)) {
+      r = byPrefix.get(rel.slice(0, i + 1))
+      if (r !== undefined && (r.deep || depth < r.depth)) return true
+    }
+    return false
+  }
+}
+
+/** Each positive alternative's fixed prefix (`''` or ending in `/`), whether it has a `**`, and its depth. */
+export function holdReach(
+  positive: readonly string[],
+): { prefix: string; deep: boolean; depth: number }[] {
+  return asTrees(positive.flatMap(braceAlternatives)).map((g) => {
     const prefix = staticPrefix(g)
     return {
       prefix: prefix === '.' ? '' : `${prefix}/`,
@@ -1917,14 +2329,6 @@ function mayHoldMatch(positive: readonly string[]): (rel: string) => boolean {
       depth: g.split('/').length,
     }
   })
-  return (rel) => {
-    let depth: number | undefined
-    for (const r of reach) {
-      if (!rel.startsWith(r.prefix) || rel.length === r.prefix.length) continue
-      if (r.deep || (depth ??= rel.split('/').length) < r.depth) return true
-    }
-    return false
-  }
 }
 
 /**
@@ -1946,8 +2350,8 @@ function dirLinkInput(abs: string, oids: ReadonlyMap<string, string> | undefined
  * Whether a changed path is one of a task's declared file inputs:
  * `projectRel` (the path relative to the project that owns it) against
  * `files`, `workspaceRel` (relative to the workspace root) against
- * `workspaceFiles`; null skips that half, by the globs and `!` exclusions (a path under
- * the task's own outputs counts: a committed one is keyed). `--affected` seeds a task with it (2026-10-04).
+ * `workspaceFiles`; null skips that half, by the globs and `!` exclusions (a tracked path
+ * under the task's own outputs counts: a committed one is keyed). `--affected` seeds a task with it (2026-10-04).
  */
 export function declaresInput(
   task: TaskConfig,
@@ -1958,22 +2362,41 @@ export function declaresInput(
    * below it keys what is behind it, as `mayHoldMatch` says at key time.
    */
   dirLink = false,
+  /** Git does not track the path, so under the task's own outputs it is no input. */
+  untracked = false,
+  /**
+   * The task's project directory, workspace-relative: a `workspaceFiles`
+   * glob reaches its `outputs.files` too, which the key leaves out as it
+   * does `outputs.workspaceFiles` (`resolveWorkspaceFiles`).
+   */
+  projectDir?: string,
 ): boolean {
   const inputs = task.inputs
   if (inputs === undefined) return false
   if (projectRel !== null) {
-    // A changed path under the task's own outputs is a committed file
-    // (`git diff` lists only what git tracks) or a stray `git status`
-    // lists: either way it may be an input, so it counts.
-    const plan = filesPlan(inputs.files, task.cache?.outputs.files ?? [])
-    if (plan !== null && (inPlan(plan, projectRel) || ownOnly(plan, projectRel))) return true
+    // Under the task's own outputs the key folds only what git tracks
+    // (`committedFiles`); an untracked build output is not one.
+    const plan = filesPlan(inputs.files, task.outputs?.files ?? [])
+    if (plan !== null && (inPlan(plan, projectRel) || (!untracked && ownOnly(plan, projectRel)))) {
+      return true
+    }
     if (plan !== null && dirLink && plan.mayHold(projectRel) && !plan.isExcluded(projectRel)) {
       return true
     }
   }
   const ws = inputs.workspaceFiles
   if (workspaceRel === null || ws === undefined || ws.length === 0) return false
-  return workspaceMatcher(ws)(workspaceRel, dirLink)
+  if (!workspaceMatcher(ws)(workspaceRel, dirLink)) return false
+  // As for `files`: under its own outputs the key folds only a tracked path.
+  return !untracked || !ownWorkspaceOutput(task, workspaceRel, projectDir)
+}
+
+/** Asked only of an untracked path a `workspaceFiles` glob matched: rare, so not memoised. */
+function ownWorkspaceOutput(task: TaskConfig, rel: string, projectDir?: string): boolean {
+  const outputs = task.outputs
+  if (outputMatcher(outputs?.workspaceFiles ?? [])(rel)) return true
+  if (projectDir === undefined) return false
+  return underProject(projectDir, outputMatcher(outputs?.files ?? []))(rel)
 }
 
 /**
@@ -1995,8 +2418,7 @@ export function workspaceFilesReachInto(task: TaskConfig, dir: string): boolean
  */
 export function namedOutright(task: TaskConfig): { files: string[]; workspaceFiles: string[] } {
   const inputs = task.inputs
-  const plan =
-    inputs === undefined ? null : filesPlan(inputs.files, task.cache?.outputs.files ?? [])
+  const plan = inputs === undefined ? null : filesPlan(inputs.files, task.outputs?.files ?? [])
   const ws = inputs?.workspaceFiles ?? []
   return {
     files: plan === null ? [] : outright(plan),
@@ -2131,22 +2553,24 @@ async function resolveFiles(
   const verdicts = plan.verdicts
   const committed = committedFiles(args.gitFilesCache, args.projectDir)
   const oids = args.gitFilesCache?.oidsFor(args.projectDir)
-  for (const rel of gitFiles) {
+  const paths = base === undefined ? undefined : args.gitFilesCache?.absPaths(gitFiles)
+  for (let i = 0; i < gitFiles.length; i++) {
+    const rel = gitFiles[i]!
     let input = verdicts.get(rel)
     if (input === undefined) {
       input = isPositive(rel) && !isExcluded(rel) && !ownOutput(rel)
       verdicts.set(rel, input)
     }
     if (nested(rel) || ownWsOutput(rel)) continue
-    const abs = base === undefined ? path.resolve(args.projectDir, rel) : base + rel
+    const abs = base === undefined ? path.resolve(args.projectDir, rel) : (paths?.[i] ?? base + rel)
     if (!input && !ownOnly(plan, rel)) {
       if (plan.mayHold(rel) && !isExcluded(rel) && !ownOutput(rel) && dirLinkInput(abs, oids)) {
-        candidates.push(abs)
+        candidates.push(paths === undefined ? abs : (paths[i] = abs))
       }
       continue
     }
     if (!input && !committed(abs)) continue
-    candidates.push(abs)
+    candidates.push(paths === undefined ? abs : (paths[i] = abs))
   }
   const reach = ignoredReach(plan, gitFiles, { dir: args.projectDir, cache: args.gitFilesCache })
   refuseUndecodable(candidates, undecodable, args.projectDir, 'files')
@@ -2237,13 +2661,17 @@ function listingFor(
  * yields names no file and the output dropped out of the artifact without
  * a word: a hit then restored a tree without it (turborepo#9345's output
  * half). A `\ufffd` that does not stat is that case or a file that left
- * mid-scan; `undecodableOnDisk` tells them apart.
+ * mid-scan; `undecodableOnDisk` tells them apart. `clearing`: the walk
+ * feeds a clean or a restore, which nothing saves.
  */
-function refuseUndecodableOutput(abs: string): void {
+function refuseUndecodableOutput(abs: string, clearing: boolean): void {
   if (!undecodableOnDisk(abs)) return
+  const why = clearing
+    ? 'vx cannot clear a file by it before the task runs or a hit restores'
+    : 'vx cannot save a file by it'
   throw new UserError(
-    `cache.outputs matched ${JSON.stringify(abs)}: the name is not valid UTF-8 (shown with ` +
-      `\ufffd), and vx cannot save a file by it. Rename it, or keep it out of the outputs.`,
+    `outputs matched ${JSON.stringify(abs)}: the name is not valid UTF-8 (shown with ` +
+      `\ufffd), and ${why}. Rename it, or keep it out of the outputs.`,
   )
 }
 
@@ -2456,9 +2884,18 @@ async function scanUnion(
   cwd: string,
   nested: (rel: string) => boolean = () => false,
   emptyDirs?: Set<string>,
+  special?: SpecialProbe,
+  absent?: ReadonlySet<string>,
+  clearing = false,
 ): Promise<Set<string>> {
   const matches = new Set<string>()
   const links: string[] = []
+  // Bun's scan skips a FIFO, socket or device outright, so `special` is
+  // found by listing the directories the walk entered: its roots, the
+  // directories it took and the parents of what it took. Derived only when
+  // asked, so a walk that may never need them pays a set add per directory.
+  const roots = special === undefined ? undefined : new Set<string>()
+  const dirs = special === undefined ? undefined : new Set<string>()
   const take = (rel: string): void => {
     if (nested(rel) || excludeGlobs.some((g) => g.match(rel))) return
     const abs = path.resolve(cwd, rel)
@@ -2466,15 +2903,26 @@ async function scanUnion(
     if (st !== undefined && (st.isFile() || st.isSymbolicLink())) {
       matches.add(abs)
       if (st.isSymbolicLink()) links.push(abs)
-    } else if (emptyDirs !== undefined && st?.isDirectory() === true) {
-      if (readdirSync(abs).length === 0) emptyDirs.add(abs)
-    } else if (st === undefined && rel.includes('\ufffd')) refuseUndecodableOutput(abs)
+    } else if (st?.isDirectory() === true) {
+      dirs?.add(abs)
+      if (emptyDirs !== undefined && readdirSync(abs).length === 0) emptyDirs.add(abs)
+    } else if (st === undefined && rel.includes('\ufffd')) refuseUndecodableOutput(abs, clearing)
   }
   const opts = { cwd, onlyFiles: false, followSymlinks: false, dot: true }
   // `Bun.Glob`'s scan finds nothing for a brace whose alternatives hold a
   // `/`: `{dist,lib/esm}/**` saved an empty artifact, and a hit restored
   // nothing over a cleaned tree (A-10). Expanded here, as discovery does.
   const patterns = positive.flatMap(slashBraceExpansions)
+  if (special !== undefined) {
+    special.find = () => {
+      const walked = new Set(roots)
+      for (const f of [...matches, ...links]) walked.add(path.dirname(f))
+      for (const d of dirs!) walked.add(d).add(path.dirname(d))
+      const into = new Set<string>()
+      findSpecial(walked, cwd, anyTaskGlob(patterns), excludeGlobs, nested, into)
+      return [...into]
+    }
+  }
   // A leading `**` walks the whole project whatever else is listed, so the
   // list is one walk: Turbo's `dist/**`, `**/dist/**`, `**/dist` was three,
   // ~2 ms of a warm hit on solid.
@@ -2490,9 +2938,10 @@ async function scanUnion(
     return matches
   }
   for (const pattern of patterns) {
-    if (absentPrefix(cwd, pattern)) continue
+    if (absentPrefix(cwd, pattern, absent)) continue
     const from = scanRoot(cwd, pattern)
     if (from === null) continue
+    roots?.add(from === undefined ? cwd : from.dir)
     if (from === undefined) for (const rel of globFor(pattern).scanSync(opts)) take(rel)
     else
       for (const rel of globFor(from.rest).scanSync({ ...opts, cwd: from.dir }))
@@ -2513,6 +2962,36 @@ async function scanUnion(
   return matches
 }
 
+/** Filled by a walk asked for it: what lists the FIFOs, sockets and devices its globs name. */
+interface SpecialProbe {
+  find?: () => string[]
+}
+
+/** The FIFOs, sockets and devices in `dirs` that the output globs name. */
+function findSpecial(
+  dirs: ReadonlySet<string>,
+  cwd: string,
+  any: (rel: string) => boolean,
+  excludeGlobs: readonly Bun.Glob[],
+  nested: (rel: string) => boolean,
+  into: Set<string>,
+): void {
+  for (const dir of dirs) {
+    let entries: Dirent[]
+    try {
+      entries = readdirSync(dir, { withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const e of entries) {
+      if (e.isFile() || e.isDirectory() || e.isSymbolicLink()) continue
+      const abs = path.join(dir, e.name)
+      const rel = path.relative(cwd, abs).split(path.sep).join('/')
+      if (any(rel) && !nested(rel) && !excludeGlobs.some((g) => g.match(rel))) into.add(abs)
+    }
+  }
+}
+
 /** `pattern`'s static directory passes through a symlink under `cwd`. */
 function headLinked(cwd: string, pattern: string): boolean {
   const prefix = staticPrefix(pattern)
@@ -2562,11 +3041,13 @@ function scanRoot(
  * cost ~58 µs where the lstat costs a few. Anything this cannot read
  * plainly (no prefix, an escape, an absolute path, a refused stat) scans.
  */
-function absentPrefix(cwd: string, pattern: string): boolean {
+function absentPrefix(cwd: string, pattern: string, known?: ReadonlySet<string>): boolean {
   const prefix = staticPrefix(pattern)
   if (prefix === '.' || prefix.includes('\\') || path.isAbsolute(prefix)) return false
+  const at = path.join(cwd, prefix)
+  if (known?.has(at) === true) return true
   try {
-    return lstatSync(path.join(cwd, prefix), { throwIfNoEntry: false }) === undefined
+    return lstatSync(at, { throwIfNoEntry: false }) === undefined
   } catch {
     return false
   }