feat(ipc): add fetchEnvs(glob) with match-set fingerprinting

Extends the runner-aware-tools IPC with a glob-pattern env query
alongside the existing single-name `getEnv`. The pattern plus the
match-set observed at execution time enter the post-run fingerprint,
so any add / remove / change to a matching env invalidates the cache,
while non-matching envs are ignored.

- `Request::GetEnvs` + `GetEnvsResponse` carrying a sorted
  `BTreeMap<NativeStr, NativeStr>`; `NativeStr` now derives `Ord`.
- `Recorder::get_envs` resolves the glob via `vite_glob`, snapshots
  the match-set, and records `{pattern, tracked, matches}`.
- `fetchEnvs(pattern, { tracked })` in the JS wrapper always
  round-trips (the client can't know in advance which names match,
  so `process.env` short-circuit doesn't apply) and writes the
  returned values into `process.env` for names that aren't set.
- `PostRunFingerprint.tracked_env_globs` + `EnvGlobDiff`
  (added / removed / changed), validated at lookup by re-enumerating
  `vars_os()` against the stored pattern and diffing the match-set;
  names already declared under the task's `env` config are dropped
  from the stored set to avoid double-counting.
- `patches/vite.patch`: drop `fetchEnv("NODE_ENV")` in `resolveConfig`,
  call `fetchEnvs(`${prefix}*`, { tracked: true })` per configured
  `envPrefix` inside `loadEnv` — `envPrefix`-matching envs drive
  `import.meta.env.*` substitution, so the runner now tracks whatever
  vite actually reads from its own config.
- E2E: new `fetch_envs_tracks_glob_match_set` fixture covers the five
  diff scenarios (unchanged / changed / added / removed / non-matching
  noise); `vite_build_cache`'s NODE_ENV case becomes `VITE_MODE`-driven
  to exercise the new glob path through a real `vite build`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: branchseer

Cargo.lock

@@ -37,7 +37,7 @@ use wincode::{
 /// **Not portable across platforms.** The binary representation is platform-specific.
 /// Deserializing a `NativeStr` serialized on a different platform leads to unspecified
 /// behavior (garbage data), but is not unsafe. Designed for same-platform IPC only.
-#[derive(TransparentWrapper, PartialEq, Eq)]
+#[derive(TransparentWrapper, PartialEq, Eq, PartialOrd, Ord)]
 #[repr(transparent)]
 pub struct NativeStr {
     // On unix, this is the raw bytes of the OsStr.

crates/native_str/src/lib.rs

@@ -37,6 +37,7 @@ tracing = { workspace = true }
 twox-hash = { workspace = true }
 materialized_artifact = { workspace = true }
 uuid = { workspace = true, features = ["v4"] }
+vite_glob = { workspace = true }
 vite_path = { workspace = true }
 vite_select = { workspace = true }
 vite_str = { workspace = true }

crates/vite_task/Cargo.toml

@@ -184,6 +184,11 @@ pub fn format_cache_status_inline(cache_status: &CacheStatus) -> Option<Str> {
                         "○ cache miss: tracked env '{name}' changed, executing"
                     ));
                 }
+                FingerprintMismatch::TrackedEnvGlobChanged { pattern, .. } => {
+                    return Some(vite_str::format!(
+                        "○ cache miss: tracked env glob '{pattern}' changed, executing"
+                    ));
+                }
             };
             Some(vite_str::format!("○ cache miss: {reason}, executing"))
         }

crates/vite_task/src/session/cache/display.rs

@@ -164,6 +164,11 @@ pub enum FingerprintMismatch {
         old: Option<Str>,
         new: Option<Str>,
     },
+    /// A tool-tracked env glob's match-set changed between runs.
+    TrackedEnvGlobChanged {
+        pattern: Str,
+        diff: crate::session::execute::fingerprint::EnvGlobDiff,
+    },
 }
 
 impl Display for FingerprintMismatch {
@@ -193,6 +198,30 @@ impl Display for FingerprintMismatch {
                     None => write!(f, "(unset)"),
                 }
             }
+            Self::TrackedEnvGlobChanged { pattern, diff } => {
+                write!(f, "tracked env glob {:?}:", pattern.as_str())?;
+                let mut first = true;
+                for (name, value) in &diff.added {
+                    write!(f, "{} +{}={:?}", if first { "" } else { "," }, name, value.as_str())?;
+                    first = false;
+                }
+                for (name, value) in &diff.removed {
+                    write!(f, "{} -{}={:?}", if first { "" } else { "," }, name, value.as_str())?;
+                    first = false;
+                }
+                for (name, (old, new)) in &diff.changed {
+                    write!(
+                        f,
+                        "{} {}: {:?} → {:?}",
+                        if first { "" } else { "," },
+                        name,
+                        old.as_str(),
+                        new.as_str()
+                    )?;
+                    first = false;
+                }
+                Ok(())
+            }
         }
     }
 }
@@ -292,6 +321,10 @@ impl ExecutionCache {
                         old,
                         new,
                     } => FingerprintMismatch::TrackedEnvChanged { name, old, new },
+                    crate::session::execute::fingerprint::PostRunMismatch::TrackedEnvGlobChanged {
+                        pattern,
+                        diff,
+                    } => FingerprintMismatch::TrackedEnvGlobChanged { pattern, diff },
                 };
                 return Ok(Err(CacheMiss::FingerprintMismatch(fingerprint_mismatch)));
             }

crates/vite_task/src/session/cache/mod.rs

@@ -27,19 +27,52 @@ pub struct PostRunFingerprint {
     /// Only populated when `input_config.includes_auto` is true.
     pub inferred_inputs: HashMap<RelativePathBuf, PathFingerprint>,
 
-    /// Env vars observed via runner-aware IPC with `tracked: true`. Key is the
-    /// env name; value is the env value at execution time (or `None` if unset).
-    /// Validated at cache lookup by comparing against the current parent env.
+    /// Env vars observed via runner-aware IPC `getEnv` with `tracked: true`.
+    /// Key is the env name; value is the env value at execution time (or
+    /// `None` if unset). Validated at cache lookup by comparing against the
+    /// current parent env.
     pub tracked_envs: BTreeMap<Str, Option<Str>>,
+
+    /// Glob-pattern env queries (`getEnvs`) made with `tracked: true`.
+    /// Outer key is the glob pattern, inner map is the match-set at
+    /// execution time (name → value). Validated at cache lookup by
+    /// re-matching against the current parent env and comparing the
+    /// resulting set.
+    pub tracked_env_globs: BTreeMap<Str, BTreeMap<Str, Str>>,
 }
 
 /// A mismatch between the stored post-run fingerprint and the current state.
+#[expect(
+    clippy::enum_variant_names,
+    reason = "all three variants describe different kinds of post-run changes; \
+              dropping the `Changed` suffix on any one of them would be misleading"
+)]
 #[derive(Debug, Clone)]
 pub enum PostRunMismatch {
     /// An inferred input file or directory changed.
     InputChanged { kind: InputChangeKind, path: RelativePathBuf },
     /// A tool-tracked env var changed value (or was added/removed).
     TrackedEnvChanged { name: Str, old: Option<Str>, new: Option<Str> },
+    /// A tool-tracked env glob's match-set changed between runs. The glob
+    /// still matches the same pattern, but added/removed/mutated entries.
+    TrackedEnvGlobChanged { pattern: Str, diff: EnvGlobDiff },
+}
+
+/// Per-pattern diff between stored and current match-set. Each map is a
+/// subset of the symmetric difference keyed by env name. `changed` holds
+/// names present in both with differing values; `added` / `removed` are
+/// exclusive to one side.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct EnvGlobDiff {
+    pub added: BTreeMap<Str, Str>,
+    pub removed: BTreeMap<Str, Str>,
+    pub changed: BTreeMap<Str, (Str, Str)>,
+}
+
+impl EnvGlobDiff {
+    fn is_empty(&self) -> bool {
+        self.added.is_empty() && self.removed.is_empty() && self.changed.is_empty()
+    }
 }
 
 /// Fingerprint for a single path (file or directory)
@@ -79,12 +112,14 @@ impl PostRunFingerprint {
     /// * `base_dir` - Workspace root for resolving relative paths
     /// * `globbed_inputs` - Prerun glob fingerprint; paths here are skipped
     /// * `tracked_envs` - Tool-requested env vars (name → value), validated on lookup
+    /// * `tracked_env_globs` - Tool-requested env globs (pattern → matches), validated on lookup
     #[tracing::instrument(level = "debug", skip_all, name = "create_post_run_fingerprint")]
     pub fn create(
         inferred_path_reads: &HashMap<RelativePathBuf, PathRead>,
         base_dir: &AbsolutePath,
         globbed_inputs: &BTreeMap<RelativePathBuf, u64>,
         tracked_envs: BTreeMap<Str, Option<Str>>,
+        tracked_env_globs: BTreeMap<Str, BTreeMap<Str, Str>>,
     ) -> anyhow::Result<Self> {
         let inferred_inputs = inferred_path_reads
             .par_iter()
@@ -96,7 +131,7 @@ impl PostRunFingerprint {
             })
             .collect::<anyhow::Result<HashMap<_, _>>>()?;
 
-        Ok(Self { inferred_inputs, tracked_envs })
+        Ok(Self { inferred_inputs, tracked_envs, tracked_env_globs })
     }
 
     /// Validates the fingerprint against current filesystem and env state.
@@ -148,10 +183,65 @@ impl PostRunFingerprint {
                 }));
             }
         }
+
+        // Validate tracked env globs: re-enumerate parent env for each
+        // pattern and diff against the stored match-set.
+        for (pattern, stored_matches) in &self.tracked_env_globs {
+            let current_matches = match_env_glob(pattern.as_str())?;
+            let diff = diff_env_glob(stored_matches, &current_matches);
+            if !diff.is_empty() {
+                return Ok(Some(PostRunMismatch::TrackedEnvGlobChanged {
+                    pattern: pattern.clone(),
+                    diff,
+                }));
+            }
+        }
+
         Ok(None)
     }
 }
 
+/// Build the current match-set for `pattern` by enumerating
+/// `std::env::vars_os()` and keeping UTF-8 names whose representation matches
+/// the glob. Mirrors the server-side match (see
+/// `vite_task_server::Recorder::get_envs`).
+fn match_env_glob(pattern: &str) -> anyhow::Result<BTreeMap<Str, Str>> {
+    let set = vite_glob::GlobPatternSet::new(std::iter::once(pattern))?;
+    Ok(std::env::vars_os()
+        .filter_map(|(name, value)| {
+            let name_str = name.to_str()?.to_owned();
+            let value_str = value.to_str()?.to_owned();
+            if set.is_match(&name_str) {
+                Some((Str::from(name_str.as_str()), Str::from(value_str.as_str())))
+            } else {
+                None
+            }
+        })
+        .collect())
+}
+
+/// Compute the diff of two match-sets for the same glob pattern.
+fn diff_env_glob(stored: &BTreeMap<Str, Str>, current: &BTreeMap<Str, Str>) -> EnvGlobDiff {
+    let mut diff = EnvGlobDiff::default();
+    for (name, stored_value) in stored {
+        match current.get(name) {
+            None => {
+                diff.removed.insert(name.clone(), stored_value.clone());
+            }
+            Some(current_value) if current_value != stored_value => {
+                diff.changed.insert(name.clone(), (stored_value.clone(), current_value.clone()));
+            }
+            Some(_) => {}
+        }
+    }
+    for (name, current_value) in current {
+        if !stored.contains_key(name) {
+            diff.added.insert(name.clone(), current_value.clone());
+        }
+    }
+    diff
+}
+
 /// Determine the kind of change between two differing path fingerprints.
 /// Caller guarantees `stored != current`.
 ///

crates/vite_task/src/session/execute/fingerprint.rs

@@ -765,6 +765,10 @@ pub async fn execute_spawn(
                         .as_ref()
                         .map(|r| collect_tracked_envs(r, metadata))
                         .unwrap_or_default();
+                    let tracked_env_globs = reports
+                        .as_ref()
+                        .map(|r| collect_tracked_env_globs(r, metadata))
+                        .unwrap_or_default();
 
                     // Execution succeeded — attempt to create fingerprint and update cache.
                     // Paths already in globbed_inputs are skipped: Rule 1 (above) guarantees
@@ -774,6 +778,7 @@ pub async fn execute_spawn(
                         cache_base_path,
                         &globbed_inputs,
                         tracked_envs,
+                        tracked_env_globs,
                     ) {
                         Ok(post_run_fingerprint) => {
                             // Collect output files and create archive. Tool-reported
@@ -885,6 +890,38 @@ fn collect_tracked_envs(reports: &Reports, metadata: &CacheMetadata) -> BTreeMap
         .collect()
 }
 
+/// Select tool-reported env-glob records to embed in the post-run
+/// fingerprint. Only `tracked: true` records are included, and within each
+/// matched set, names already covered by the user's declared `env` (via the
+/// spawn fingerprint) are skipped — they're redundant and could cause
+/// spurious cache misses if the user later changes their `env` config.
+fn collect_tracked_env_globs(
+    reports: &Reports,
+    metadata: &CacheMetadata,
+) -> BTreeMap<Str, BTreeMap<Str, Str>> {
+    let fingerprinted = &metadata.spawn_fingerprint.env_fingerprints().fingerprinted_envs;
+    reports
+        .env_glob_records
+        .iter()
+        .filter(|(_, record)| record.tracked)
+        .map(|(pattern, record)| {
+            let filtered: BTreeMap<Str, Str> = record
+                .matches
+                .iter()
+                .filter_map(|(name, value)| {
+                    let name_str = name.to_str()?;
+                    if fingerprinted.contains_key(name_str) {
+                        return None;
+                    }
+                    let value_str = value.to_str()?;
+                    Some((Str::from(name_str), Str::from(value_str)))
+                })
+                .collect();
+            (Str::from(pattern.as_ref()), filtered)
+        })
+        .collect()
+}
+
 /// Collect output files and create a tar.zst archive in the cache directory.
 ///
 /// Output files are determined by:

crates/vite_task/src/session/execute/mod.rs

@@ -132,6 +132,9 @@ pub enum SavedCacheMissReason {
     InputChanged { kind: InputChangeKind, path: Str },
     /// A runner-aware tool reported a tracked env var that changed between runs.
     TrackedEnvChanged { name: Str, old: Option<Str>, new: Option<Str> },
+    /// A runner-aware tool reported a tracked env glob whose match-set changed
+    /// between runs.
+    TrackedEnvGlobChanged { pattern: Str, diff: crate::session::execute::fingerprint::EnvGlobDiff },
 }
 
 /// An execution error, serializable for persistence.
@@ -280,6 +283,9 @@ impl SavedCacheMissReason {
                         new: new.clone(),
                     }
                 }
+                FingerprintMismatch::TrackedEnvGlobChanged { pattern, diff } => {
+                    Self::TrackedEnvGlobChanged { pattern: pattern.clone(), diff: diff.clone() }
+                }
             },
         }
     }
@@ -554,6 +560,9 @@ impl TaskResult {
                     SavedCacheMissReason::TrackedEnvChanged { name, .. } => {
                         vite_str::format!("→ Cache miss: tracked env '{name}' changed")
                     }
+                    SavedCacheMissReason::TrackedEnvGlobChanged { pattern, .. } => {
+                        vite_str::format!("→ Cache miss: tracked env glob '{pattern}' changed")
+                    }
                 },
             },
         }

crates/vite_task/src/session/reporter/summary.rs

@@ -0,0 +1,14 @@
+import { fetchEnvs } from '@voidzero-dev/vite-task-client';
+import { writeFileSync, mkdirSync } from 'node:fs';
+
+// fetchEnvs asks the runner for every env matching the glob. The glob (plus
+// its match-set) becomes part of the post-run fingerprint, so adding,
+// removing, or changing any matching env invalidates the cache on the next
+// run. The non-matching UNRELATED envs set by some test steps must not
+// contribute.
+const matches = fetchEnvs('PROBE_*', { tracked: true });
+
+mkdirSync('dist', { recursive: true });
+const sorted = Object.entries(matches).sort(([a], [b]) => a.localeCompare(b));
+const body = sorted.map(([k, v]) => `${k}=${v}`).join('\n');
+writeFileSync('dist/out.txt', body + '\n');