fix(cache): apply input negatives to reads only, not writes

Output writes were being dropped before archiving when paths matched
an input-side negative glob. `TrackedPathAccesses::from_raw` applied one
shared negatives list to both reads and writes, so a common config like
`input: [{auto:true}, "!dist/**"]` with default auto output left
`dist/**` out of the archive and the cache-hit replay failed to restore
output files.

Move user-configured negative filtering out of `from_raw` (which now
only normalises paths and skips `.git`). Reads are filtered by input
negatives inside the cache-update path; writes are filtered by output
negatives inside `collect_and_archive_outputs` as before. Adds an e2e
test `input_negative_does_not_drop_output_writes` to cover the regression.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: branchseer

crates/vite_task/src/session/execute/mod.rs

@@ -290,10 +290,11 @@ struct CacheState<'a> {
     /// Captured stdout/stderr for cache replay. Written in place during drain;
     /// always present (possibly empty) once we reach the cache-update phase.
     std_outputs: Vec<StdOutput>,
-    /// `Some` iff fspy is enabled (`includes_auto`). Holds the resolved
-    /// negative globs used by [`TrackedPathAccesses::from_raw`] to filter
-    /// tracked accesses. `None` means fspy tracking is off for this task.
-    fspy_negatives: Option<Vec<wax::Glob<'static>>>,
+    /// Fspy tracking status and pre-resolved input negative globs.
+    /// `None` means fspy tracking is off for this task. `Some(globs)` means
+    /// fspy is on; the globs are used to filter inferred input reads (not
+    /// writes — output negatives are applied separately during archiving).
+    fspy_input_negatives: Option<Vec<wax::Glob<'static>>>,
 }
 
 /// Execute a spawned process with cache-aware lifecycle.
@@ -460,7 +461,7 @@ pub async fn execute_spawn(
                     metadata,
                     globbed_inputs,
                     std_outputs: Vec::new(),
-                    fspy_negatives: fspy,
+                    fspy_input_negatives: fspy,
                 },
             }
         }
@@ -472,7 +473,9 @@ pub async fn execute_spawn(
 
     // 5. Derive the arguments for `spawn()` from the mode without consuming it.
     let (spawn_stdio, fspy_enabled) = match &mode {
-        ExecutionMode::Cached { state, .. } => (SpawnStdio::Piped, state.fspy_negatives.is_some()),
+        ExecutionMode::Cached { state, .. } => {
+            (SpawnStdio::Piped, state.fspy_input_negatives.is_some())
+        }
         ExecutionMode::Uncached { pipe_writers: Some(_) } => (SpawnStdio::Piped, false),
         ExecutionMode::Uncached { pipe_writers: None } => (SpawnStdio::Inherited, false),
     };
@@ -558,30 +561,49 @@ pub async fn execute_spawn(
     //    update are reported but do not affect the exit status we return.
     let (cache_update_status, cache_error) = 'cache_update: {
         if let ExecutionMode::Cached { state, .. } = mode {
-            let CacheState { metadata, globbed_inputs, std_outputs, fspy_negatives } = state;
+            let CacheState { metadata, globbed_inputs, std_outputs, fspy_input_negatives } = state;
 
-            // Normalize fspy accesses. `zip` gives `Some` iff fspy was enabled
-            // (both outcome.path_accesses and fspy_negatives are Some together).
+            // Normalize fspy accesses. `Some` iff fspy was enabled at spawn time.
+            // User-configured negatives are applied below, separately for reads
+            // (input negatives) and writes (output negatives, inside
+            // `collect_and_archive_outputs`).
             let path_accesses = outcome
                 .path_accesses
                 .as_ref()
-                .zip(fspy_negatives.as_deref())
-                .map(|(raw, negs)| TrackedPathAccesses::from_raw(raw, cache_base_path, negs));
+                .map(|raw| TrackedPathAccesses::from_raw(raw, cache_base_path));
+
+            // Inferred input reads: filter path_reads by input negatives.
+            // Separate from write filtering (which uses output negatives inside
+            // `collect_and_archive_outputs`) so users can set `!dist/**` on
+            // input without accidentally dropping writes to `dist`.
+            let empty_reads = HashMap::default();
+            let inferred_reads: HashMap<RelativePathBuf, tracked_accesses::PathRead> =
+                if let Some(pa) = path_accesses.as_ref()
+                    && let Some(negatives) = fspy_input_negatives.as_deref()
+                {
+                    pa.path_reads
+                        .iter()
+                        .filter(|(path, _)| {
+                            !negatives.iter().any(|neg| wax::Program::is_match(neg, path.as_str()))
+                        })
+                        .map(|(path, read)| (path.clone(), *read))
+                        .collect()
+                } else {
+                    empty_reads
+                };
 
             let cancelled = fast_fail_token.is_cancelled() || interrupt_token.is_cancelled();
             if cancelled {
                 // Cancelled (Ctrl-C or sibling failure) — result is untrustworthy
                 (CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::Cancelled), None)
             } else if outcome.exit_status.success() {
                 // Check for read-write overlap: if the task wrote to any file it also
-                // read, the inputs were modified during execution — don't cache.
-                // Note: this only checks fspy-inferred reads, not globbed_inputs keys.
-                // A task that writes to a glob-matched file without reading it causes
-                // perpetual cache misses (glob detects the hash change) but not a
-                // correctness bug, so we don't handle that case here.
+                // read (as an inferred input), the inputs were modified during
+                // execution — don't cache. Reads excluded by input negatives (or
+                // when input auto is off) don't count.
                 if let Some(path) = path_accesses
                     .as_ref()
-                    .and_then(|pa| pa.path_reads.keys().find(|p| pa.path_writes.contains(*p)))
+                    .and_then(|pa| inferred_reads.keys().find(|p| pa.path_writes.contains(*p)))
                 {
                     (
                         CacheUpdateStatus::NotUpdated(CacheNotUpdatedReason::InputModified {
@@ -590,15 +612,14 @@ pub async fn execute_spawn(
                         None,
                     )
                 } else {
-                    // path_reads is empty when inference is disabled (path_accesses is None)
-                    let empty_path_reads = HashMap::default();
-                    let path_reads =
-                        path_accesses.as_ref().map_or(&empty_path_reads, |pa| &pa.path_reads);
-
                     // Execution succeeded — attempt to create fingerprint and update cache.
                     // Paths already in globbed_inputs are skipped: Rule 1 (above) guarantees
                     // no input modification, so the prerun hash is the correct post-exec hash.
-                    match PostRunFingerprint::create(path_reads, cache_base_path, &globbed_inputs) {
+                    match PostRunFingerprint::create(
+                        &inferred_reads,
+                        cache_base_path,
+                        &globbed_inputs,
+                    ) {
                         Ok(post_run_fingerprint) => {
                             // Collect output files and create archive
                             let output_archive = match collect_and_archive_outputs(

crates/vite_task/src/session/execute/tracked_accesses.rs

@@ -8,6 +8,10 @@ use vite_path::{AbsolutePath, RelativePathBuf};
 
 use crate::collections::HashMap;
 
+/// User-configured negative globs are NOT applied here. They are applied later,
+/// separately for reads (input config) and writes (output config), since those
+/// two configs are independent.
+
 /// Path read access info
 #[derive(Debug, Clone, Copy)]
 pub struct PathRead {
@@ -25,22 +29,19 @@ pub struct TrackedPathAccesses {
 }
 
 impl TrackedPathAccesses {
-    /// Build from fspy's raw iterable by stripping the workspace prefix,
-    /// normalizing `..` components, and filtering against the negative globs.
-    pub fn from_raw(
-        raw: &PathAccessIterable,
-        workspace_root: &AbsolutePath,
-        resolved_negatives: &[wax::Glob<'static>],
-    ) -> Self {
+    /// Build from fspy's raw iterable by stripping the workspace prefix and
+    /// normalizing `..` components. `.git/*` paths are skipped. User-configured
+    /// negatives are applied by the caller (see module docs).
+    pub fn from_raw(raw: &PathAccessIterable, workspace_root: &AbsolutePath) -> Self {
         let mut accesses = Self::default();
         for access in raw.iter() {
-            // Strip workspace root, clean `..` components, and filter in one pass.
+            // Strip workspace root and clean `..` components in one pass.
             // fspy may report paths like `packages/sub-pkg/../shared/dist/output.js`.
             let relative_path = access.path.strip_path_prefix(workspace_root, |strip_result| {
                 let Ok(stripped_path) = strip_result else {
                     return None;
                 };
-                normalize_tracked_workspace_path(stripped_path, resolved_negatives)
+                normalize_tracked_workspace_path(stripped_path)
             });
 
             let Some(relative_path) = relative_path else {
@@ -75,10 +76,7 @@ impl TrackedPathAccesses {
     clippy::disallowed_types,
     reason = "fspy strip_path_prefix exposes std::path::Path; convert to RelativePathBuf immediately"
 )]
-fn normalize_tracked_workspace_path(
-    stripped_path: &std::path::Path,
-    resolved_negatives: &[wax::Glob<'static>],
-) -> Option<RelativePathBuf> {
+fn normalize_tracked_workspace_path(stripped_path: &std::path::Path) -> Option<RelativePathBuf> {
     // On Windows, paths are possible to be still absolute after stripping the workspace root.
     // For example: c:\workspace\subdir\c:\workspace\subdir
     // Just ignore those accesses.
@@ -94,12 +92,6 @@ fn normalize_tracked_workspace_path(
         return None;
     }
 
-    if !resolved_negatives.is_empty()
-        && resolved_negatives.iter().any(|neg| wax::Program::is_match(neg, relative.as_str()))
-    {
-        return None;
-    }
-
     Some(relative)
 }
 
@@ -115,8 +107,7 @@ mod tests {
             clippy::disallowed_types,
             reason = "normalize_tracked_workspace_path requires std::path::Path for fspy strip_path_prefix output"
         )]
-        let relative_path =
-            normalize_tracked_workspace_path(std::path::Path::new(r"foo\C:\bar"), &[]);
+        let relative_path = normalize_tracked_workspace_path(std::path::Path::new(r"foo\C:\bar"));
         assert!(relative_path.is_none());
     }
 }

crates/vite_task_bin/tests/e2e_snapshots/fixtures/output_cache_test/snapshots.toml

@@ -114,3 +114,18 @@ steps = [
   # Should be a cache miss due to output config change
   { argv = ["vt", "run", "output-config-change"], comment = "cache miss: output config changed" },
 ]
+
+# 6. Input negative globs must not drop matching writes from the output archive.
+# Here the user excludes `dist/**` from inferred inputs (so rewriting dist/ won't
+# mark inputs as modified), but default auto output should still capture dist
+# writes and restore them on a cache hit.
+[[e2e]]
+name = "input_negative_does_not_drop_output_writes"
+steps = [
+  ["vt", "run", "input-neg-dist-auto-output"],
+  ["vtt", "rm", "dist/out.txt"],
+  # Cache hit should restore dist/out.txt
+  ["vt", "run", "input-neg-dist-auto-output"],
+  ["vtt", "print-file", "dist/out.txt"],
+]
+

crates/vite_task_bin/tests/e2e_snapshots/fixtures/output_cache_test/snapshots/input_negative_does_not_drop_output_writes.md

@@ -0,0 +1,36 @@
+# input_negative_does_not_drop_output_writes
+
+## `vt run input-neg-dist-auto-output`
+
+```
+$ vtt write-file dist/out.txt built
+
+$ vtt print done
+done
+
+---
+vt run: 0/2 cache hit (0%). (Run `vt run --last-details` for full details)
+```
+
+## `vtt rm dist/out.txt`
+
+```
+```
+
+## `vt run input-neg-dist-auto-output`
+
+```
+$ vtt write-file dist/out.txt built ◉ cache hit, replaying
+
+$ vtt print done ◉ cache hit, replaying
+done
+
+---
+vt run: 2/2 cache hit (100%). (Run `vt run --last-details` for full details)
+```
+
+## `vtt print-file dist/out.txt`
+
+```
+built
+```

crates/vite_task_bin/tests/e2e_snapshots/fixtures/output_cache_test/vite-task.json

@@ -23,6 +23,11 @@
       "command": "vtt write-file dist/out.txt built && vtt print done",
       "output": ["REPLACE_ME"],
       "cache": true
+    },
+    "input-neg-dist-auto-output": {
+      "command": "vtt write-file dist/out.txt built && vtt print done",
+      "input": [{ "auto": true }, "!dist/**"],
+      "cache": true
     }
   }
 }