A negative `input` pattern can't be narrowed, so keeping one folder under `node_modules` tracked takes a sibling-name glob

Start with crates/vt_glob/src/path.rs and the filtering call sites in crates/vt/src/session/execute/mod.rs and cache_update.rs; then trace explicit glob handling around crates/vt/src/session/execute/glob.rs. Check how exceptions interact with auto-tracked reads and explicit globs, including whether walking can prune exception subtrees. Done means negative patterns can leave matching exception paths eligible without adding files to the cache key by themselves.

Written by an AI agent (Claude) on behalf of @jasonkuhrt.

Summary

A negative input pattern removes every file it matches, including files the task declares as inputs. The docs say so ("Negative Patterns Apply to Both Modes"), so this is a feature request, not a bug: a way to write "exclude this tree, except this part of it".

The case

Most of our tasks exclude installed dependencies from their inputs, so a reinstall alone doesn't miss the cache. A few still need a file that lives under node_modules: a dependency fingerprint a task declares as its key, TypeScript declarations a test reads through a project reference, a progress file a test runner resumes from. The config that says what we mean drops that file:

cache: {
  input: [
    { auto: true },
    { pattern: '!**/node_modules/**', base: 'workspace' },
    // declared, and removed by the negative above
    { pattern: 'node_modules/.cache/tool-state/fingerprint/dependencies/hash', base: 'workspace' },
  ],
}

The declared file never enters the key: the explicit globs are walked with walk.not(negation) (crates/vt/src/session/execute/glob.rs:38-43 at cb0bddc5), and auto-tracked reads go through the same negatives (crates/vt/src/session/execute/cache_update.rs:236). A change to that file can never miss the cache, so the result is a silent false hit, not a wasted run.

What we write instead is a negative that excludes every name except the kept one, character by character. This is one package's copy, keeping node_modules/.vpp-progress visible:

const otherRootDirectories =
  '{node_modules?*,[!n]*,n,n[!o]*,no,no[!d]*,nod,nod[!e]*,node,node[!_]*,node_,node_[!m]*,node_m,node_m[!o]*,node_mo,node_mo[!d]*,node_mod,node_mod[!u]*,node_modu,node_modu[!l]*,node_modul,node_modul[!e]*,node_module,node_module[!s]*}';
const otherInstalledTrees =
  '{.vpp-progress?*,[!.]*,.[!v]*,.v,.v[!p]*,.vp,.vp[!p]*,.vpp,.vpp[!\\-]*,.vpp-,.vpp-[!p]*,.vpp-p,.vpp-p[!r]*,.vpp-pr,.vpp-pr[!o]*,.vpp-pro,.vpp-pro[!g]*,.vpp-prog,.vpp-prog[!r]*,.vpp-progr,.vpp-progr[!e]*,.vpp-progre,.vpp-progre[!s]*,.vpp-progres,.vpp-progres[!s]*}';

input: [
  { auto: true },
  { pattern: `!${otherRootDirectories}/**/node_modules/**`, base: 'workspace' },
  { pattern: `!${otherRootDirectories}/**/node_modules`, base: 'workspace' },
  { pattern: '!node_modules', base: 'workspace' },
  { pattern: `!node_modules/${otherInstalledTrees}`, base: 'workspace' },
  { pattern: `!node_modules/${otherInstalledTrees}/**`, base: 'workspace' },
]

Our shared config helper builds these from a trie of the kept paths (three trees today). Because the failure is silent, we also check at config load that no negative hides the one input file we generate (a test runner's progress file).

Proposal

Let a negative carry exceptions: paths it leaves alone.

input: [
  { auto: true },
  {
    pattern: '!**/node_modules/**',
    base: 'workspace',
    except: ['node_modules/.cache/tool-state/**'],
  },
]

An exception only un-excludes. It adds nothing to the key by itself: a file under it counts when the task reads it (auto) or when another pattern declares it, as if the negative weren't there. That matters for us: the compiler tree holds every package's declarations, and a test should key on the ones it reads, not all of them.

It's opt-in, so no existing config changes meaning. The other shape we considered, ordered patterns where a later positive re-includes (as .gitignore's ! does), changes configs like ["!**/*.test.ts", "src/**"], and a positive also adds every file it matches to the key, so it can't express "track what's read under here".

Where it would go

• Auto-tracked reads: PathGlobSet already does last-match-wins when a pattern is negated (crates/vt_glob/src/path.rs:35-64). Built from each negative followed by its exceptions as ! patterns, the filter at crates/vt/src/session/execute/mod.rs:178 / cache_update.rs:236 would keep exception paths as is.
• Explicit globs: a negative with exceptions can't go into walk.not(negation) as is, or wax may prune the subtree an exception sits in. Filtering those files per path with the same set keeps the walk correct, at the cost of walking that subtree.

Related: #504 is the other direction, a negative that fails to exclude a directory listing's entries.

If the shape is agreed, we can send the PR.