feat: skip caching tasks that modify their inputs and deduplicate postrun fingerprint

Two changes to improve cache correctness and performance:

1. If fspy detects a task both read and wrote the same file, skip cache
   storage (InputModified). Caching such tasks is unsound because the
   prerun glob hashes become stale.

2. Skip paths already in globbed_inputs when building the postrun
   fingerprint. This avoids redundant storage and double-validation on
   cache hit checks. Safe because rule 1 guarantees no input was modified.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: branchseer

crates/vite_task/src/session/event.rs

@@ -57,6 +57,9 @@ pub enum CacheNotUpdatedReason {
     CacheDisabled,
     /// Execution exited with non-zero status
     NonZeroExitStatus,
+    /// Task modified files it read during execution (read-write overlap detected by fspy).
+    /// Caching such tasks is unsound because the prerun input hashes become stale.
+    InputModified,
 }
 
 #[derive(Debug)]

crates/vite_task/src/session/execute/fingerprint.rs

@@ -55,19 +55,24 @@ impl PostRunFingerprint {
     /// Creates a new fingerprint from path accesses after task execution.
     ///
     /// Negative glob filtering is done upstream in `spawn_with_tracking`.
-    /// Paths may contain `..` components from fspy, so this method cleans them
-    /// before fingerprinting.
+    /// Paths already present in `globbed_inputs` are skipped — they are
+    /// already tracked by the prerun glob fingerprint, and the read-write
+    /// overlap check in `execute_spawn` guarantees the task did not modify
+    /// them, so the prerun hash is still correct.
     ///
     /// # Arguments
     /// * `inferred_path_reads` - Map of paths that were read during execution (from fspy)
     /// * `base_dir` - Workspace root for resolving relative paths
+    /// * `globbed_inputs` - Prerun glob fingerprint; paths here are skipped
     #[tracing::instrument(level = "debug", skip_all, name = "create_post_run_fingerprint")]
     pub fn create(
         inferred_path_reads: &HashMap<RelativePathBuf, PathRead>,
         base_dir: &AbsolutePath,
+        globbed_inputs: &BTreeMap<RelativePathBuf, u64>,
     ) -> anyhow::Result<Self> {
         let inferred_inputs = inferred_path_reads
             .par_iter()
+            .filter(|(path, _)| !globbed_inputs.contains_key(*path))
             .map(|(relative_path, path_read)| {
                 let full_path = Arc::<AbsolutePath>::from(base_dir.join(relative_path));
                 let fingerprint = fingerprint_path(&full_path, *path_read)?;

crates/vite_task/src/session/execute/mod.rs

@@ -397,34 +397,50 @@ pub async fn execute_spawn(
         cache_metadata_and_inputs
     {
         if result.exit_status.success() {
-            // path_reads is empty when inference is disabled (path_accesses is None)
-            let empty_path_reads = HashMap::default();
-            let path_reads = path_accesses.as_ref().map_or(&empty_path_reads, |pa| &pa.path_reads);
-
-            // Execution succeeded — attempt to create fingerprint and update cache
-            match PostRunFingerprint::create(path_reads, cache_base_path) {
-                Ok(post_run_fingerprint) => {
-                    let new_cache_value = CacheEntryValue {
-                        post_run_fingerprint,
-                        std_outputs: std_outputs.unwrap_or_default().into(),
-                        duration: result.duration,
-                        globbed_inputs,
-                    };
-                    match cache.update(cache_metadata, new_cache_value).await {
-                        Ok(()) => (CacheUpdateStatus::Updated, None),
-                        Err(err) => (
-                            CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::CacheDisabled),
-                            Some(ExecutionError::Cache {
-                                kind: CacheErrorKind::Update,
-                                source: err,
-                            }),
-                        ),
+            // Check for read-write overlap: if the task wrote to any file it also
+            // read, the inputs were modified during execution — don't cache.
+            // Note: this only checks fspy-inferred reads, not globbed_inputs keys.
+            // A task that writes to a glob-matched file without reading it causes
+            // perpetual cache misses (glob detects the hash change) but not a
+            // correctness bug, so we don't handle that case here.
+            if path_accesses
+                .as_ref()
+                .is_some_and(|pa| pa.path_reads.keys().any(|p| pa.path_writes.contains(p)))
+            {
+                (CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::InputModified), None)
+            } else {
+                // path_reads is empty when inference is disabled (path_accesses is None)
+                let empty_path_reads = HashMap::default();
+                let path_reads =
+                    path_accesses.as_ref().map_or(&empty_path_reads, |pa| &pa.path_reads);
+
+                // Execution succeeded — attempt to create fingerprint and update cache.
+                // Paths already in globbed_inputs are skipped: Rule 1 (above) guarantees
+                // no input modification, so the prerun hash is the correct post-exec hash.
+                match PostRunFingerprint::create(path_reads, cache_base_path, &globbed_inputs) {
+                    Ok(post_run_fingerprint) => {
+                        let new_cache_value = CacheEntryValue {
+                            post_run_fingerprint,
+                            std_outputs: std_outputs.unwrap_or_default().into(),
+                            duration: result.duration,
+                            globbed_inputs,
+                        };
+                        match cache.update(cache_metadata, new_cache_value).await {
+                            Ok(()) => (CacheUpdateStatus::Updated, None),
+                            Err(err) => (
+                                CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::CacheDisabled),
+                                Some(ExecutionError::Cache {
+                                    kind: CacheErrorKind::Update,
+                                    source: err,
+                                }),
+                            ),
+                        }
                     }
+                    Err(err) => (
+                        CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::CacheDisabled),
+                        Some(ExecutionError::PostRunFingerprint(err)),
+                    ),
                 }
-                Err(err) => (
-                    CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::CacheDisabled),
-                    Some(ExecutionError::PostRunFingerprint(err)),
-                ),
             }
         } else {
             // Execution failed with non-zero exit status — don't update cache

crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "input-read-write-not-cached",
+  "private": true
+}

crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml

@@ -0,0 +1,12 @@
+# Test that tasks modifying their own inputs (read-write overlap) are not cached.
+# replace-file-content reads then writes the same file — fspy detects both.
+# Without this behavior, the second run would be a cache hit.
+
+[[e2e]]
+name = "read-write task is not cached"
+steps = [
+  # First run - executes, but cache NOT stored (read-write overlap detected)
+  "vt run rw-task",
+  # Second run - still miss (no cache was stored on first run)
+  "vt run rw-task",
+]

crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots/read-write task is not cached.snap

@@ -0,0 +1,8 @@
+---
+source: crates/vite_task_bin/tests/e2e_snapshots/main.rs
+expression: e2e_outputs
+---
+> vt run rw-task
+$ replace-file-content src/data.txt original modified
+> vt run rw-task
+$ replace-file-content src/data.txt original modified

crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/src/data.txt

@@ -0,0 +1 @@
+original

crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/vite-task.json

@@ -0,0 +1,9 @@
+{
+  "tasks": {
+    "rw-task": {
+      "command": "replace-file-content src/data.txt original modified",
+      "input": [{ "auto": true }],
+      "cache": true
+    }
+  }
+}