@vzn/vx 0.0.652 → 0.0.653

package/src/cli/upgrade.ts

@@ -104,33 +104,50 @@ export function versionSpec(tag: string | undefined): string {
   const v = tag.startsWith('v') ? tag.slice(1) : tag
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(v)) {
     throw new UserError(
-      `vx upgrade: ${tag} is not a version (expected v<major>.<minor>.<patch>)`,
+      `vx upgrade: ${JSON.stringify(tag)} is not a version (expected v<major>.<minor>.<patch>)`,
       'VX_E_USAGE',
     )
   }
   return v
 }
 
+/**
+ * How long a registry may stay silent, before its headers or between two
+ * chunks of a body, before vx gives up: one that took the connection and
+ * never answered hung `vx upgrade` and `vx init` with no output. A slow
+ * download that keeps moving is never cut.
+ */
+const SILENCE_MS = 30_000
+
+const silence = (ms: number): Error => new Error(`no answer in ${ms / 1000} s`)
+
 /**
  * `fetch` on a box that cannot reach the host rejects with Bun's own
  * `TypeError` ("Unable to connect. Is the computer able to access the
  * url?", "Was there a typo in the url or port?"), which the CLI printed
  * as an internal error with a stack (a network namespace without a
- * route, 2026-09-16). One line, the host and the reason.
+ * route, 2026-09-16). One line, the host and the reason. `quiet` aborts
+ * the request after `silenceMs` without headers; the body read
+ * (`bodyOrRefuse`) aborts it too.
  */
 async function fetchOrRefuse(
   url: string,
   init: RequestInit,
   what: string,
-  verb = 'vx upgrade',
+  verb: string,
+  quiet: AbortController,
+  silenceMs: number,
 ): Promise<Response> {
+  const timer = setTimeout(() => quiet.abort(silence(silenceMs)), silenceMs)
   try {
-    return await fetch(url, init)
+    return await fetch(url, { ...init, signal: quiet.signal })
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
     throw new UserError(
       `${verb}: could not reach ${new URL(url).host} to ${what} (${message}) — check the network or the proxy and re-run`,
     )
+  } finally {
+    clearTimeout(timer)
   }
 }
 
@@ -139,17 +156,36 @@ async function fetchOrRefuse(
  * connection drop before the body does (a proxy that cuts a transfer):
  * Bun rejects the read with its own `TypeError` (`ECONNRESET`, "The socket
  * connection was closed unexpectedly"), which `fetchOrRefuse` never sees
- * and the CLI printed as an internal error with a stack.
+ * and the CLI printed as an internal error with a stack. A body silent for
+ * `silenceMs` between chunks is the same refusal, and its request aborted.
  */
-async function readOrRefuse<T>(
-  read: () => Promise<T>,
+async function bodyOrRefuse<T>(
+  res: Response,
+  parse: (bytes: Uint8Array) => T,
   url: string,
   what: string,
-  verb = 'vx upgrade',
+  verb: string,
+  quiet: AbortController,
+  silenceMs: number,
 ): Promise<T> {
   try {
-    return await read()
+    const parts: Uint8Array[] = []
+    const reader = res.body?.getReader()
+    for (;;) {
+      if (reader === undefined) break
+      let timer: Timer | undefined
+      const next = await Promise.race([
+        reader.read(),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => reject(silence(silenceMs)), silenceMs)
+        }),
+      ]).finally(() => clearTimeout(timer))
+      if (next.done) break
+      parts.push(next.value)
+    }
+    return parse(new Uint8Array(Bun.concatArrayBuffers(parts)))
   } catch (err) {
+    quiet.abort()
     const message = err instanceof Error ? err.message : String(err)
     throw new UserError(
       `${verb}: could not ${what} from ${new URL(url).host} (${message}) — nothing replaced; check the network or the proxy and re-run`,
@@ -163,8 +199,10 @@ export async function fetchManifest(
   spec: string,
   verb = 'vx upgrade',
   registry: Registry = resolveRegistry(pkg.split('/')[0]!),
+  silenceMs = SILENCE_MS,
 ): Promise<unknown> {
   const url = `${registry.url}${pkg}/${spec}`
+  const quiet = new AbortController()
   const res = await fetchOrRefuse(
     url,
     {
@@ -177,15 +215,19 @@ export async function fetchManifest(
     },
     'read the release',
     verb,
+    quiet,
+    silenceMs,
   )
   if (!res.ok) {
+    quiet.abort()
     throw new UserError(
       `${verb}: could not read ${pkg}@${spec} from ${new URL(url).host} (${res.status})${res.status === 404 && spec !== 'latest' ? ` — is ${spec} a published version?` : ''}${res.status === 401 || res.status === 403 ? ' — check the registry credentials in .npmrc or bunfig.toml' : ''}`,
     )
   }
   // A body that is not JSON (a captive portal's page, a proxy's error
   // page served with a 200) is the same refusal as a cut one.
-  return await readOrRefuse(() => res.json(), url, 'read the release', verb)
+  const json = (bytes: Uint8Array): unknown => JSON.parse(new TextDecoder().decode(bytes))
+  return await bodyOrRefuse(res, json, url, 'read the release', verb, quiet, silenceMs)
 }
 
 function authHeader(registry: Registry, url: string): Record<string, string> {
@@ -219,11 +261,16 @@ export function verifiedRelease(
   const version = typeof m.version === 'string' ? m.version : ''
   const tarball = m.dist?.tarball
   const integrity = m.dist?.integrity
-  if (version === '' || typeof tarball !== 'string' || !tarball.startsWith('https://')) {
+  if (version === '' || typeof tarball !== 'string') {
     throw new UserError(
       `vx upgrade: the npm registry published no tarball for ${pkg}${version === '' ? '' : `@${version}`} — nothing replaced`,
     )
   }
+  if (!tarball.startsWith('https://')) {
+    throw new UserError(
+      `vx upgrade: the npm registry's tarball for ${pkg}@${version} is not https (${tarball}) — nothing replaced; serve the mirror's tarballs over https`,
+    )
+  }
   if (typeof integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]+=*$/.test(integrity)) {
     throw new UserError(
       `vx upgrade: the npm registry published no SHA-512 integrity for ${pkg}@${version} — nothing to verify the download against, so it is not attempted`,
@@ -271,20 +318,35 @@ export function verifiedRelease(
 }
 
 /** Download `release.tarball` and check its bytes against the signed SHA-512. */
-async function downloadVerified(release: SignedRelease, registry: Registry): Promise<Uint8Array> {
+async function downloadVerified(
+  release: SignedRelease,
+  registry: Registry,
+  silenceMs: number,
+): Promise<Uint8Array> {
   const url = release.tarball
+  const quiet = new AbortController()
   const res = await fetchOrRefuse(
     url,
     { redirect: 'follow', headers: authHeader(registry, url) },
     'download the release',
+    'vx upgrade',
+    quiet,
+    silenceMs,
   )
   if (!res.ok) {
+    quiet.abort()
     throw new UserError(
       `vx upgrade: download failed (${res.status}) — ${url} — nothing replaced; re-run`,
     )
   }
-  const bytes = new Uint8Array(
-    await readOrRefuse(() => res.arrayBuffer(), url, 'download the release'),
+  const bytes = await bodyOrRefuse(
+    res,
+    (b) => b,
+    url,
+    'download the release',
+    'vx upgrade',
+    quiet,
+    silenceMs,
   )
   const got = `sha512-${new Bun.CryptoHasher('sha512').update(bytes).digest('base64')}`
   if (got !== release.integrity) {
@@ -328,22 +390,25 @@ export function binaryFromTarball(tgz: Uint8Array): Uint8Array {
 }
 
 /**
- * The binary of `pkg@spec`, verified: the registry document's signature,
- * then the tarball's integrity, then the extraction, each refusing before
- * the next step runs. A signed version other than the one asked, or as
+ * The release of `pkg@spec`, its registry document verified, nothing
+ * downloaded yet: `download` fetches the tarball, checks its integrity and
+ * extracts the binary. A signed version other than the one asked, or as
  * `latest` one below `current`, is refused. Null when the release is
- * `current`, the version of the vx being replaced; `announce` hears the
- * version before the download starts.
+ * `current`, the version of the vx being replaced.
  */
-export async function releaseBinary(
+async function signedRelease(
   pkg: string,
   spec: string,
-  announce: (version: string) => void,
-  key: SigningKey = NPM_SIGNING_KEY,
-  current = VERSION,
-): Promise<Uint8Array | null> {
+  key: SigningKey,
+  current: string,
+  silenceMs = SILENCE_MS,
+): Promise<{ version: string; download: () => Promise<Uint8Array> } | null> {
   const registry = resolveRegistry(pkg.split('/')[0]!)
-  const release = verifiedRelease(await fetchManifest(pkg, spec, undefined, registry), pkg, key)
+  const release = verifiedRelease(
+    await fetchManifest(pkg, spec, undefined, registry, silenceMs),
+    pkg,
+    key,
+  )
   // npm signs every version it published: the signature proves the bytes,
   // not that they are the version asked for, so a mirror could hand back an
   // older one.
@@ -353,13 +418,48 @@ export async function releaseBinary(
     )
   }
   if (release.version === current) return null
-  if (spec === 'latest' && Bun.semver.order(release.version, current) < 0) {
-    throw new UserError(
-      `vx upgrade: the registry's latest ${pkg} is ${release.version}, below this vx's ${current} — nothing replaced; to go back, ask for it: vx upgrade v${release.version}`,
-    )
+  if (spec === 'latest') refuseOlderLatest(release.version, current, pkg)
+  return {
+    version: release.version,
+    download: async () => binaryFromTarball(await downloadVerified(release, registry, silenceMs)),
   }
+}
+
+/**
+ * The binary of `pkg@spec`, verified: the registry document's signature,
+ * then the tarball's integrity, then the extraction, each refusing before
+ * the next step runs. A signed version other than the one asked, or as
+ * `latest` one below `current`, is refused. Null when the release is
+ * `current`, the version of the vx being replaced; `announce` hears the
+ * version before the download starts. `silenceMs` bounds each wait on the
+ * registry (`SILENCE_MS`).
+ */
+export async function releaseBinary(
+  pkg: string,
+  spec: string,
+  announce: (version: string) => void,
+  key: SigningKey = NPM_SIGNING_KEY,
+  current = VERSION,
+  silenceMs = SILENCE_MS,
+): Promise<Uint8Array | null> {
+  const release = await signedRelease(pkg, spec, key, current, silenceMs)
+  if (release === null) return null
   announce(release.version)
-  return binaryFromTarball(await downloadVerified(release, registry))
+  return await release.download()
+}
+
+/**
+ * Refuses `latest` below `current`, the vx it would replace: a mirror
+ * behind, or a release pulled back, is no upgrade. One rule for every
+ * install kind — a binary, a package manager's, the global a run moves
+ * too; a package-manager install went down to it with exit 0. A version
+ * asked for by name goes back on purpose and is never refused here.
+ */
+function refuseOlderLatest(latest: string, current: string, pkg = PACKAGE): void {
+  if (Bun.semver.order(latest, current) >= 0) return
+  throw new UserError(
+    `vx upgrade: the registry's latest ${pkg} is ${latest}, below this vx's ${current} — nothing replaced; to go back, ask for it: vx upgrade v${latest}`,
+  )
 }
 
 /**
@@ -661,14 +761,17 @@ export async function targetVersion(tag: string | undefined, verb = 'vx upgrade'
 /**
  * Run the package manager that owns a vx at `current` to bring it to
  * `version`; vx never installs one. `step` names the install when a run
- * moves two (`project `, `global `).
+ * moves two (`project `, `global `). `latest`: `version` is the
+ * registry's latest, not one the user named (`refuseOlderLatest`).
  */
 export async function upgradeManaged(
   install: ManagedInstall,
   version: string,
   current = VERSION,
   step = '',
+  latest = false,
 ): Promise<boolean> {
+  if (latest) refuseOlderLatest(version, current)
   const plugins = install.plugins ?? []
   if (version === current && plugins.every((p) => installedVersion(install.cwd, p) === version)) {
     ui.print('out', ui.status('info', 'vx upgrade', `${step}already at ${current}`))
@@ -713,32 +816,42 @@ export async function upgradeManaged(
 
 /**
  * Replace the binary at `dest`, at `current`, with the verified release
- * `spec` names (`latest` or a version). `step` as in `upgradeManaged`.
+ * `spec` names (`latest` or a version). `step` and `latest` as in
+ * `upgradeManaged`.
  */
-async function upgradeBinary(
+export async function upgradeBinary(
   dest: string,
   spec: string,
   current = VERSION,
   step = '',
   key: SigningKey = NPM_SIGNING_KEY,
+  latest = false,
 ): Promise<boolean> {
-  const pkg = platformPackage()
+  // The version it already is needs no registry: it fetched and verified
+  // the release before saying so.
+  if (spec === current) {
+    ui.print('out', ui.status('info', 'vx upgrade', `${step}already at ${current}`))
+    return false
+  }
+  if (latest) refuseOlderLatest(spec, current)
+  // The registry document first, read-only: a binary already at `latest`
+  // in a directory this user cannot write was told to sudo, exit 1.
+  const release = await signedRelease(platformPackage(), spec, key, current)
+  if (release === null) {
+    ui.print('out', ui.status('info', 'vx upgrade', `${step}already at ${current}`))
+    return false
+  }
   let installed: string | undefined
-  const replaced = await replaceBinary(
+  await replaceBinary(
     dest,
-    () =>
-      releaseBinary(
-        pkg,
-        spec,
-        (version) =>
-          ui.print(
-            'out',
-            ui.status('info', 'vx upgrade', `${step}${current} → ${version}`),
-            ui.text(ui.dim(dest)),
-          ),
-        key,
-        current,
-      ),
+    () => {
+      ui.print(
+        'out',
+        ui.status('info', 'vx upgrade', `${step}${current} → ${release.version}`),
+        ui.text(ui.dim(dest)),
+      )
+      return release.download()
+    },
     // The replaced binary's own version: the new build speaks for itself
     // rather than this process guessing, and one that cannot is rolled back.
     (bin) => {
@@ -746,13 +859,8 @@ async function upgradeBinary(
       return installed !== undefined
     },
   )
-  ui.print(
-    'out',
-    replaced
-      ? ui.status('ok', 'vx upgrade', `${step}installed ${installed}`)
-      : ui.status('info', 'vx upgrade', `${step}already at ${current}`),
-  )
-  return replaced
+  ui.print('out', ui.status('ok', 'vx upgrade', `${step}installed ${installed}`))
+  return true
 }
 
 /** The version `bin --version` answers, without the hand-off note a handed-off run adds. */
@@ -770,6 +878,7 @@ export async function upgradeGlobal(
   from: string,
   version: string,
   key: SigningKey = NPM_SIGNING_KEY,
+  latest = false,
 ): Promise<void> {
   await named(`global vx ${from}`, async () => {
     const current = answeredVersion(from)
@@ -781,8 +890,8 @@ export async function upgradeGlobal(
       return
     }
     const install = managedInstall(from, path.dirname(from))
-    if (install === null) await upgradeBinary(from, version, current, 'global ', key)
-    else await upgradeManaged(install, version, current, 'global ')
+    if (install === null) await upgradeBinary(from, version, current, 'global ', key, latest)
+    else await upgradeManaged(install, version, current, 'global ', latest)
   })
 }
 
@@ -795,20 +904,22 @@ export async function upgradeOnlyGlobal(
   self: string,
   version: string,
   current = VERSION,
+  latest = false,
 ): Promise<void> {
-  if (current === version) {
-    ui.print('out', ui.status('info', 'vx upgrade', `global already at ${current}`))
-    return
-  }
   // Read from the binary's own directory, not cwd: a project there is not this install's.
   const install = managedInstall(self, path.dirname(self))
+  // Before the version check: at the version, the project's own vx was called the global.
   if (install?.scope === 'project') {
     throw new UserError(
       `vx upgrade -g: no global vx ran — ${self} is the project's own. Install one (bun add -g ${PACKAGE}), or run \`vx upgrade\` to move the project's`,
     )
   }
-  if (install === null) await upgradeBinary(self, version, current, 'global ')
-  else await upgradeManaged(install, version, current, 'global ')
+  if (current === version) {
+    ui.print('out', ui.status('info', 'vx upgrade', `global already at ${current}`))
+    return
+  }
+  if (install === null) await upgradeBinary(self, version, current, 'global ', undefined, latest)
+  else await upgradeManaged(install, version, current, 'global ', latest)
 }
 
 /** `run`, its refusal naming `what` after the verb: a run that moves two installs says which failed. */
@@ -865,36 +976,56 @@ export async function upgradeCmd(argv: readonly string[]): Promise<number> {
   }
   const dest = process.execPath
   const handedOffFrom = process.env['VX_HANDED_OFF'] || undefined
+  const latest = tag === undefined
   if (global) {
     // A launcher from before -g handed the call over: the global is the one that did.
     const version = await targetVersion(tag)
-    if (handedOffFrom !== undefined) await upgradeGlobal(handedOffFrom, version)
-    else await upgradeOnlyGlobal(dest, version)
+    if (handedOffFrom !== undefined)
+      await upgradeGlobal(handedOffFrom, version, NPM_SIGNING_KEY, latest)
+    else await upgradeOnlyGlobal(dest, version, VERSION, latest)
     return 0
   }
   const install = managedInstall(dest, process.cwd())
   // A global vx handed this run to the project's own: both move, to one
   // version, the project first (2026-10-15).
-  const from = handedOffFrom
-  if (from !== undefined) {
-    const version = await targetVersion(tag)
-    const moved = await named('project vx', () =>
-      install === null
-        ? upgradeBinary(dest, version, VERSION, 'project ')
-        : upgradeManaged(install, version, VERSION, 'project '),
-    )
-    await upgradeGlobal(from, version)
-    if (moved) await relock(newVx(install, dest))
+  if (handedOffFrom !== undefined) {
+    await upgradeBoth(handedOffFrom, dest, install, await targetVersion(tag), latest)
     return 0
   }
   const moved =
     install !== null
-      ? await upgradeManaged(install, await targetVersion(tag))
+      ? await upgradeManaged(install, await targetVersion(tag), VERSION, '', latest)
       : await upgradeBinary(dest, versionSpec(tag))
   if (moved) await relock(newVx(install, dest))
   return 0
 }
 
+/**
+ * Move the project's vx at `dest` (`install`, null for a binary), then the
+ * global `from` that handed the run to it, to `version`. The project's
+ * move is locked even when the global's then fails: the lock was skipped.
+ */
+export async function upgradeBoth(
+  from: string,
+  dest: string,
+  install: ManagedInstall | null,
+  version: string,
+  latest: boolean,
+  key: SigningKey = NPM_SIGNING_KEY,
+  current = VERSION,
+): Promise<void> {
+  const moved = await named('project vx', () =>
+    install === null
+      ? upgradeBinary(dest, version, current, 'project ', key, latest)
+      : upgradeManaged(install, version, current, 'project ', latest),
+  )
+  try {
+    await upgradeGlobal(from, version, key, latest)
+  } finally {
+    if (moved) await relock(newVx(install, dest))
+  }
+}
+
 /**
  * The vx an upgrade just installed: the replaced binary, or the tree's
  * `node_modules/.bin/vx` (a manager's store path names the old version).
@@ -938,6 +1069,9 @@ export function startedVersion(bin: string, timeoutMs = 10_000): string | null {
   try {
     proc = Bun.spawnSync({
       cmd: [bin, '--version'],
+      // Not in a workspace: there a global vx hands `--version` to the
+      // project's and answers its version, not its own.
+      cwd: '/',
       stdin: 'ignore',
       stdout: 'pipe',
       stderr: 'pipe',

package/src/cli/watch-filter.ts

@@ -6,6 +6,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import {
   executablePath,
+  gitCaseArgs,
   gitEnv,
   isLiteralPattern,
   normalizeGlob,
@@ -15,7 +16,12 @@ import {
   taskGlob,
 } from '../util/index.js'
 import { asTrees } from '../cache/index.js'
-import { PROJECT_CONFIG_FILENAMES, WORKSPACE_CONFIG_FILENAMES } from '../workspace/index.js'
+import {
+  DEPENDENCIES_LOCK_NAME,
+  parseDependenciesLock,
+  PROJECT_CONFIG_FILENAMES,
+  WORKSPACE_CONFIG_FILENAMES,
+} from '../workspace/index.js'
 import { isIgnoredDir } from './watch-fs.js'
 
 const IGNORED_SUFFIXES = ['~']
@@ -27,19 +33,31 @@ const IGNORED_SUFFIXES = ['~']
  * writes to `.vx/cache` again.
  *
  * Segment-wise, not prefix-wise: `node_modules` is ignored wherever it appears
- * in the path, not only at the root.
+ * in the path, not only at the root. `makeWatchIgnore` keeps a path there
+ * that an input names or git tracks.
  */
 export function isIgnoredWatchPath(rel: string): boolean {
+  return ignoredBy(rel) !== undefined
+}
+
+/** Why `isIgnoredWatchPath` drops `rel`: `'node_modules'` when only that segment does. */
+function ignoredBy(rel: string): 'always' | 'node_modules' | undefined {
   const segments = rel.split(path.sep)
-  for (let i = 1; i <= segments.length; i++) if (isIgnoredDir(segments.slice(0, i))) return true
-  if (IGNORED_SUFFIXES.some((suf) => rel.endsWith(suf))) return true
+  let why: 'node_modules' | undefined
+  for (let i = 1; i <= segments.length; i++) {
+    if (!isIgnoredDir(segments.slice(0, i))) continue
+    if (segments[i - 1] !== 'node_modules') return 'always'
+    why = 'node_modules'
+  }
+  if (IGNORED_SUFFIXES.some((suf) => rel.endsWith(suf))) return 'always'
   const last = segments.length - 1
   // The cache's first save writes `.vx/.gitignore`, which ignores only the
   // `.vx/cache` and `.vx/tmp` already skipped: a watched root project ran
   // one more cycle for it.
-  if (segments[last] === '.gitignore' && segments[last - 1] === '.vx') return true
+  if (segments[last] === '.gitignore' && segments[last - 1] === '.vx') return 'always'
   // `vx lock`'s review copy: no input, so a re-lock is no cycle.
-  return segments[last] === 'vx.lock.json'
+  if (segments[last] === 'vx.lock.json') return 'always'
+  return why
 }
 
 /**
@@ -152,6 +170,44 @@ export function makeWatchIgnore(
     }
     return trackedDirs.has(abs)
   }
+  // Under `node_modules`, only what an input names through that segment
+  // (`node_modules/.prisma/client/**`): a broad glob (`**`, `src/**` over
+  // `src/node_modules`) never reached it, and walking every package to drop
+  // its events is the cost the skip spares.
+  const namesModules = (abs: string, dir: boolean): boolean =>
+    read.some(([base, globs, not, containers, reaches, trees]) => {
+      if (!abs.startsWith(base + path.sep)) return false
+      const rel = abs
+        .slice(base.length + 1)
+        .split(path.sep)
+        .join('/')
+      const segments = rel.split('/')
+      const through = segments.slice(0, segments.lastIndexOf('node_modules') + 1).join('/')
+      if (dir && trees.some((t) => rel === t || rel.startsWith(`${t}/`))) return false
+      return reaches.some(([p, max], i) => {
+        if (p !== through && !p.startsWith(`${through}/`)) return false
+        if (!dir)
+          return (
+            globs[i]!.match(rel) &&
+            !not.some((g) => g.match(rel)) &&
+            !containers.some((c) => c === rel || c.startsWith(`${rel}/`))
+          )
+        return (
+          segments.length < max && (p === rel || p.startsWith(`${rel}/`) || rel.startsWith(`${p}/`))
+        )
+      })
+    })
+  // Core never cleans or saves a file git tracks and keys it under the
+  // task's own output glob (2026-10-14); a submodule is listed as its
+  // gitlink alone, so a path under a tracked one counts.
+  const isTracked = (abs: string): boolean => {
+    if (tracked === undefined) return false
+    for (let p = abs; p.length > 1; p = path.dirname(p)) {
+      if (tracked.has(p)) return true
+      if (p === path.dirname(p)) break
+    }
+    return false
+  }
   const isInput = (abs: string): boolean =>
     read.some(([dir, globs, not, containers]) => {
       if (!abs.startsWith(dir + path.sep)) return false
@@ -164,19 +220,15 @@ export function makeWatchIgnore(
       return !containers.some((c) => c === rel || c.startsWith(`${rel}/`))
     })
   return (base, filename, dir = false) => {
-    if (isIgnoredWatchPath(filename)) return true
+    const why = ignoredBy(filename)
+    if (why === 'always') return true
     const abs = path.resolve(base, filename)
     if (abs === cacheAbs || abs.startsWith(cacheAbs + path.sep)) return true
+    if (why === 'node_modules')
+      return !(namesModules(abs, dir) || (dir ? holdsTracked(abs) : isTracked(abs)))
     if (isInput(abs)) return false
     if (dir && (mayHoldInput(abs) || holdsTracked(abs))) return false
-    // Core never cleans or saves a file git tracks and keys it under the
-    // task's own output glob (2026-10-14); a submodule is listed as its
-    // gitlink alone, so a path under a tracked one counts.
-    if (tracked !== undefined)
-      for (let p = abs; p.length > 1; p = path.dirname(p)) {
-        if (tracked.has(p)) return false
-        if (p === path.dirname(p)) break
-      }
+    if (isTracked(abs)) return false
     for (const [dir, isOutput, containers] of declared) {
       if (!abs.startsWith(dir + path.sep)) continue
       const rel = abs
@@ -398,6 +450,26 @@ export function isWorkspaceConfigFile(name: string): boolean {
   return WORKSPACE_CONFIGS.has(name)
 }
 
+/**
+ * The files the claimed files' recorded digests read besides them
+ * (`FingerprintDigests.extras`: a `file:` dependency's directory, a patch),
+ * absolute, from `.vx/dependencies.lock.json` as `vx lock` wrote it: a run
+ * keys them from there. Empty when there is no readable lock.
+ */
+export function lockedExtras(workspaceRoot: string): Set<string> {
+  let bytes: Uint8Array | null = null
+  try {
+    bytes = fs.readFileSync(path.join(workspaceRoot, DEPENDENCIES_LOCK_NAME))
+  } catch {
+    // No lock: no record, and a run refuses a claimant that asks for one.
+  }
+  const lock = parseDependenciesLock(bytes)
+  const out = new Set<string>()
+  for (const rec of Object.values(lock?.files ?? {}))
+    for (const rel of Object.keys(rec.extras ?? {})) out.add(path.resolve(workspaceRoot, rel))
+  return out
+}
+
 /**
  * Paths as git spells them under `root`: a project reached through a
  * symlink below the root (`packages/x -> ../shared/x`) is watched at the
@@ -446,6 +518,7 @@ export function gitFiles(
     proc = Bun.spawnSync({
       cmd: [
         executablePath('git'),
+        ...gitCaseArgs(workspaceRoot),
         'ls-files',
         '-z',
         '-t',