An input edited while a cached task runs is fingerprinted after the run, so the next run replays output built from the old content #905

If a cached task's input is edited after the task has read it but before the task exits, the next run is a cache hit that replays output built from the old content. The input is fingerprinted when the run ends, so the cache entry pairs the new content's hash with output built from the old content.

The hashing happens in PostRunFingerprint::create (crates/vt/src/session/execute/fingerprint.rs), which calls fingerprint_path on each tracked read once the task has exited. vite-plus#39 described this race and was closed in March, but it reproduces on vite-plus 1.4.0 (vite-task 40cb9ca).

Repro with vite-plus 1.4.0, Node 24.18.1, pnpm 12.16.1 on macOS: https://gist.github.com/birbprophet/2fa1f32a846c2cd1cc251175fdb6d45d (git clone it, then bash repro.sh)

1. A build task with cache: true and automatic input tracking runs node build.mjs. The script reads input.txt, prints read: <content>, waits 5 s, then writes the content to out.txt.
2. With input.txt = v1, start vp run build. Once it prints read: v1, write v2 to input.txt. The run finishes and writes out.txt = v1.
3. Run vp run build again. It reports cache hit, 5.17s saved, and out.txt is still v1 while input.txt is v2. Every later run hits the same entry until the input changes again.

Expected: the second run misses with 'input.txt' modified and writes v2.

We hit this with a 90 s message compile. A key added during the compile was missing from the output, and every later run replayed that output from the cache.

A fix could hash each input when it's read, or keep the post-run hash but also hash (or stat) inputs as they are read and refuse to store the entry when the two disagree. Either way the edited run should not be stored, so the next run re-executes.