fix(cache): stop skipping dist in directory listings - #919

…gs (#941)

## Motivation

An exclusion in a task's `input`, like `"!build/**"`, leaves out only
the paths the task reads. When the task lists a folder, every entry
still counts, so an excluded folder appearing there is a cache miss: a
lint task listing the package root misses once another task's build
output appears in it. That is the case the hard-coded `dist` skip was
added for (#181). #919 removes the skip, so users need a setting to get
it back, and today `"!dist/**"`, which `docs/inputs.md` recommends,
doesn't help.

## Changes

Listings leave out what the input config excludes, after the entries the
task can rebuild (#915):
- An entry whose path the input negative globs match. A folder entry is
matched by its own path; wax's `**` matches zero or more components, so
`build/**` leaves out `build`, while `build/*` keeps it. The globs are
part of the cache key, so validation applies the same ones to the
current listing, and an entry that appears after the run is left out
too.
- An entry that a tool-reported `ignoreInput` path names. Those paths
are known only after the run, so the names are recorded in the listing's
`ignored_entries`, including entries that aren't there yet.

The cache schema version is bumped. `docs/inputs.md` now says negatives
also keep entries out of listings.

E2E cases: `negative_glob_hides_listing_entry` (synthetic, `vtt
list-dir` with `"!out/**"`; an unrelated new file still misses) and
`oxlint_negative_build` (`oxlint -D no-debugger` with a gitignored
`build/` and `"!build/**"`). Both miss today and hit after. A unit test
covers `ignoreInput`.

Part of a stack that lets automatic tracking cache tasks which read
their own outputs and list the folders holding them, so they also hit on
a clean checkout.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes post-run fingerprint semantics and cache validation for any
task that lists directories with input negatives or ignoreInput;
incorrect glob matching could cause stale cache hits, mitigated by
schema bump and targeted tests.
> 
> **Overview**
> **Input exclusions now apply to directory listings**, not only to
paths the task reads. Tasks that list a folder (e.g. a linter scanning
the package root) no longer miss the cache when an excluded entry
appears—such as another task’s `build/` folder after `"!build/**"`—as
long as nothing else in the listing changed.
> 
> Post-run fingerprints **omit listing entries** matched by the task’s
input negative globs (same rules as reads: `build/**` drops the `build`
folder entry; `build/*` does not) and by tool **`ignoreInput`** paths
(names recorded in `ignored_entries` for validation). Cache hits
recompile those globs from the entry key and apply the same filters when
comparing listings.
> 
> **Cache schema version is bumped to v22** (fresh cache). Docs and
changelog describe the behavior; e2e covers `!out/**` with `list-dir`
and an oxlint + `!build/**` scenario, plus a unit test for globs and
`ignoreInput`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0655edb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

The entries of #913-#919 and #941 describe one feature, rebuildable
inputs for tasks whose reads overlap their writes, so they are one
entry now, with every PR linked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The `dist` listing change (#919) and input exclusions applying to
listings (#941) are their own items; the rebuildable inputs item covers
#913-#918 without mentioning listings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

## Motivation

Follow-ups to the rebuildable-inputs stack (#913–#919, #940, #941), now
merged:

- The real-world case for files renamed into place (#916) used Vitest's
`fsModuleCache`, which renames cache entries rather than outputs.
- #919's e2e cases test a listing entry like any other, so they add no
coverage of their own.
- The stack added eight changelog entries, most of them for what users
see as one feature.
- Socket flagged Astro 6.4.8, which #917 added for its real-world case:
critical advisory GHSA-26w7-cxv4-gfx2 (remote code execution through
AVIF image optimization), fixed in Astro 7.2.8.

## Changes

- New case `next_build_moved_pages`: Next.js 15's `next build` renders
each static page (`index.html`, `404.html`, `500.html`) into
`.next/export` and renames it into `.next/server/pages`. After `.next`
is removed, the next run is a cache hit that restores the pages. The
build log is redacted, since its progress lines, sizes and chunk hashes
vary. It replaces `vitest_fs_module_cache`, along with the SHA-1
redaction only that case used. `next`, `react` and `react-dom` join
`packages/tools`.
- `dist_appears_in_listed_folder` and `oxlint_dist` are removed.
- The changelog entries of #913–#918 are combined into one **Added**
item for rebuildable inputs; #919 (`dist` in listings) and #941 (input
exclusions apply to listings) stay their own short items, and so does
#940's fix.
- On Windows CI, the e2e harness stages fixtures in `RUNNER_TEMP`, on
the checkout's drive: the staged workspaces resolve `node_modules` into
the checkout, and Next.js builds its client entry from a path relative
to the project, which can't cross drives.
- Astro 6.4.8 → 7.3.8, the newest release that still supports the repo's
Node 22.19. Astro 7 needs upstream Vite 8, so its scoped override now
points at Vite 8.3.2. `astro_empty_collections` passes unchanged; its
comment now says Astro 7 stats the project root rather than listing it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Test harness, changelog, and dependency catalog changes only; no
changes to task caching or file-tracking behavior in this diff.
> 
> **Overview**
> Follow-up after the rebuildable-inputs stack lands: **no runtime cache
logic changes**—mostly release notes, snapshot tests, and toolchain
bumps.
> 
> The **changelog** folds the former #913–#918 narrative into one
**Added** “rebuildable inputs” entry and shortens the #919 / #941
**Changed** bullets; #940 stays separate.
> 
> **E2E snapshots** swap coverage: **`next_build_moved_pages`** (Next.js
15 renaming `.next/export` → `.next/server/pages`, cache hit after
deleting `.next`) replaces **`vitest_fs_module_cache`**;
**`dist_appears_in_listed_folder`** and **`oxlint_dist`** are dropped as
redundant with listing behavior elsewhere. Snapshot **redaction** drops
SHA-1 normalization (Vitest-only). On **Windows CI**, fixtures stage
under **`RUNNER_TEMP`** so Next’s client entry paths stay on the
checkout drive.
> 
> **Deps**: catalog adds **Next 15**, **React 19**, bumps **Astro 6 →
7.3.8** (security advisory), and scopes **`astro>vite`** to upstream
**Vite 8.3.2**. The Astro empty-collections fixture comment reflects
Astro 7 **stat**-ing the project root instead of listing it.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4c8f40c. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>