@vzn/vx 0.0.101 → 0.0.103

package/src/exec/sandbox-runtime.ts

@@ -26,12 +26,16 @@
 import path from 'node:path'
 import os from 'node:os'
 import {
+  chmodSync,
   closeSync,
+  lstatSync,
+  existsSync,
   mkdirSync,
   openSync,
   readlinkSync,
   realpathSync,
   rmSync,
+  statSync,
   unlinkSync,
 } from 'node:fs'
 import { mkdir, unlink } from 'node:fs/promises'
@@ -354,6 +358,39 @@ function taskTmpRoot(): string {
   return path.join(sandboxTmpdir(), 'vx-tasks')
 }
 
+/**
+ * `taskTmpRoot()`, made or checked as this user's own before a task's
+ * directory goes in it. It sits in a shared temp dir: a user who made it
+ * first owned the parent of every task's TMPDIR and bridge socket, and
+ * renamed a running task's directory to plant their own under its name
+ * (probed, L-13) — the path the host bridge dials and the write grant is
+ * resolved from. A symlink, another owner, or a parent another user may
+ * rewrite is refused; one of ours left open to others is closed.
+ */
+function ownTaskTmpRoot(): string {
+  const root = taskTmpRoot()
+  mkdirSync(root, { recursive: true, mode: 0o700 })
+  const uid = process.getuid?.()
+  if (uid === undefined) return root
+  const st = lstatSync(root)
+  const parent = statSync(path.dirname(root))
+  // Group write is a umask-002 box's default; others' write is the hole,
+  // unless the sticky bit keeps them to their own entries (`/tmp`).
+  const parentShared = (parent.mode & 0o002) !== 0 && (parent.mode & 0o1000) === 0
+  if (
+    !st.isDirectory() ||
+    st.uid !== uid ||
+    (parent.uid !== uid && parent.uid !== 0) ||
+    parentShared
+  ) {
+    throw new UserError(
+      `sandbox: ${root} is not this user's own directory (a link, another owner, or a parent others may write); remove it, or point CLAUDE_CODE_TMPDIR at a private directory`,
+    )
+  }
+  if ((st.mode & 0o077) !== 0) chmodSync(root, 0o700)
+  return root
+}
+
 const liveTaskTmpdirs = new Set<string>()
 let tmpdirExitHooked = false
 function trackTaskTmpdir(dir: string): void {
@@ -400,6 +437,46 @@ async function unlinkStaleMuxSockets(): Promise<void> {
   }
 }
 
+/**
+ * The sandbox's own tools, by the paths vx resolves on its own PATH. SRT
+ * writes a bare `bwrap` (and, in the network bridge, a bare `socat`) into
+ * the command the task's shell runs, with the TASK's environment: a
+ * dependency's `node_modules/.bin/bwrap`, first on that PATH, ran in
+ * bwrap's place and the task ran unsandboxed with exit 0 (J-33's lead,
+ * B-19). A tool vx cannot find is left to SRT's own dependency check,
+ * whose refusal names it.
+ */
+function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
+  if (process.platform !== 'linux') return {}
+  const paths: { bwrapPath?: string; socatPath?: string } = {}
+  try {
+    paths.bwrapPath = executablePath('bwrap')
+  } catch {
+    // SRT's dependency check says so
+  }
+  try {
+    paths.socatPath = executablePath('socat')
+  } catch {
+    // SRT's dependency check says so
+  }
+  return paths
+}
+
+/**
+ * Whether this Linux host speaks IPv6. SRT's in-sandbox network bridge is
+ * `socat TCP-LISTEN:3128`, and socat 1.8 opens that as an IPv6 socket: on
+ * a host without IPv6 it failed ("Address family not supported by
+ * protocol"), its error went to /dev/null, and every networked task met
+ * only "connection refused" on the proxy (J-33's lead, B-22). Without
+ * IPv6 the wrapped command sets `SOCAT_DEFAULT_LISTEN_IP=4`, socat's own
+ * switch for the listen family; with it nothing changes. Asked once.
+ */
+let hasIpv6: boolean | undefined
+function hostHasIpv6(): boolean {
+  hasIpv6 ??= existsSync('/proc/net/if_inet6')
+  return hasIpv6
+}
+
 /**
  * One-time SRT initialization per orchestrator run. Starts the proxy
  * servers + (on macOS) the violation log monitor. Safe to call repeatedly
@@ -417,6 +494,13 @@ async function unlinkStaleMuxSockets(): Promise<void> {
  */
 export async function initSandbox(opts?: {
   allowedDomains?: readonly string[]
+  /**
+   * Every domain any sandboxed task of the run denies. The proxy is the
+   * run's, so a deny refuses it for every task, as the allowlist is the
+   * union's; before B-21 the list was always empty and a `deny.network`
+   * refused nothing.
+   */
+  deniedDomains?: readonly string[]
   /**
    * Whether any task of the run lifts SRT's seccomp block on
    * `socket(AF_UNIX)`: one that declares `unixSockets` or a `localBinding`
@@ -436,11 +520,12 @@ export async function initSandbox(opts?: {
   const config: Parameters<typeof SandboxManager.initialize>[0] = {
     network: {
       allowedDomains: [...(opts?.allowedDomains ?? [])],
-      deniedDomains: [],
+      deniedDomains: [...(opts?.deniedDomains ?? [])],
       ...(opts?.allowAllUnixSockets === true ? { allowAllUnixSockets: true } : {}),
     },
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
     ignoreViolations: DEFAULT_IGNORE_VIOLATIONS,
+    ...linuxToolPaths(),
   }
   if (!srtUp) await unlinkStaleMuxSockets()
   await SandboxManager.initialize(
@@ -728,6 +813,12 @@ export interface SandboxViolation {
    * `openat(../x) = -1 ENOENT  [/x]` say the same thing.
    */
   target?: string
+  /**
+   * vx's own note beside a failure (the cwd it cannot read, a placeholder
+   * the task never wrote, a withheld link), not a denial: shown with the
+   * denials, never counted as one (B-20).
+   */
+  hint?: true
   /** Absolute, when `target` is a path at all. */
   path?: string
   ignorable?: readonly ('read' | 'write' | 'network' | 'systemInfo')[]
@@ -798,8 +889,9 @@ export async function wrapSandboxedCommand(
   const userCommand = withForwardArgs(args.command, args.forwardArgs)
 
   const tag = xxh3hex(`${args.cwd}|${userCommand}|${process.hrtime.bigint()}`).slice(0, 16)
+  ownTaskTmpRoot()
   const tmp = taskTmpdir(tag)
-  mkdirSync(tmp, { recursive: true })
+  mkdirSync(tmp, { mode: 0o700 })
   trackTaskTmpdir(tmp)
   // After the tag: SRT keys violations by the command's first 100 chars.
   const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${javaToolOptionsFix(
@@ -845,7 +937,9 @@ export async function wrapSandboxedCommand(
   // sandboxed server and all it forked outlived vx (turborepo#9666). Now
   // the namespace goes with vx, a `setsid` daemon inside included, a
   // traced one-shot task too: its strace runs inside (B-11).
-  if (process.platform === 'linux' && wrapped.startsWith('bwrap ')) wrapped = `exec ${wrapped}`
+  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped)) wrapped = `exec ${wrapped}`
+  if (process.platform === 'linux' && !hostHasIpv6())
+    wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) spawnHostBridges(ports, tag)
   return {
@@ -1394,6 +1488,7 @@ async function runSandboxedOnce(
   if (exitCode !== 0 && violations.length === 0 && !readableUnder(args.cwd, grantedRead)) {
     violations.push({
       timestamp: new Date(),
+      hint: true,
       line:
         `vx: this sandbox grants no read access to the task's own working directory ` +
         `(${args.cwd}), so a command that reads or lists it fails with whatever error it ` +
@@ -1438,9 +1533,16 @@ async function runSandboxedOnce(
  */
 function readableUnder(dir: string, granted: readonly string[]): boolean {
   const target = toRealPath(dir)
+  const under = (a: string, b: string): boolean =>
+    a === b || a.startsWith(b.endsWith(path.sep) ? b : b + path.sep)
   return granted.some((p) => {
     const g = toRealPath(p)
-    return target === g || target.startsWith(g.endsWith(path.sep) ? g : g + path.sep)
+    // On Linux a grant INSIDE the cwd makes the cwd listable too: bwrap
+    // builds the path to the bind. A root's `read: ['.']` is bound as its
+    // children around the walls (`wallOff`), so every failing root task
+    // was told its cwd was unreadable while it listed it (B-20). Seatbelt
+    // grants no parent, so on macOS the cwd itself must be covered.
+    return under(target, g) || (process.platform === 'linux' && under(g, target))
   })
 }
 
@@ -1606,7 +1708,7 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  * literal head. On Linux `expandGrants` drops such a hit before the bind
  * (B-1); seatbelt matches a glob as a path regex, with no hit to drop.
  */
-function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
+export function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
   const heads = grants
     .filter((g) => !isMountableLiteral(g))
     .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
@@ -1776,10 +1878,51 @@ async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
     else {
       const m = /version (\d+)\.(\d+)/.exec(out)
       const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
-      straceAvailableCache = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+      const form = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+      straceAvailableCache = (await traceAttaches(form)) ? form : false
     }
   } catch {
     straceAvailableCache = false
   }
   return straceAvailableCache
 }
+
+/**
+ * Whether strace may attach here, asked once with the flags a task's trace
+ * uses (`ownGroupCommand`). `--version` answers on a host that refuses
+ * ptrace (Yama's `ptrace_scope` 2 or 3, a container's seccomp profile),
+ * and there every sandboxed task failed twice, the retry included, on
+ * `attach: ptrace(PTRACE_SEIZE…): Operation not permitted`. Refused, the
+ * run goes untraced, as without strace: bwrap still enforces, and only the
+ * read-violation report is lost, which is said once.
+ */
+async function traceAttaches(form: 'plain' | 'seccomp'): Promise<boolean> {
+  const p = Bun.spawn(
+    [
+      executablePath('strace'),
+      '-DD',
+      '-f',
+      ...(form === 'seccomp' ? ['--seccomp-bpf'] : []),
+      '-qq',
+      '-e',
+      'trace=openat',
+      '-o',
+      '/dev/null',
+      '--',
+      executablePath('true'),
+    ],
+    { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe' },
+  )
+  const err = await new Response(p.stderr).text()
+  if ((await p.exited) === 0) return true
+  if (!warnedNoTrace) {
+    warnedNoTrace = true
+    process.stderr.write(
+      `[vx] sandbox: strace cannot trace here (${err.trim().split('\n')[0] ?? `exit ${p.exitCode}`}), ` +
+        `so sandboxed tasks run without the report of the reads the sandbox denied; ` +
+        `the sandbox still enforces\n`,
+    )
+  }
+  return false
+}
+let warnedNoTrace = false

package/src/orchestrator/events.ts

@@ -9,6 +9,7 @@
 import { exitSignal } from '../exec/index.js'
 import type { TaskNode, TaskOutcome } from '../graph/index.js'
 import { isGroupTask } from '../graph/index.js'
+import { maskedCommand } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { RunContext } from './summary.js'
 
@@ -340,7 +341,8 @@ export function projectNode(node: TaskNode): TaskView {
     surfaced: node.surfaced === true,
     persistent: node.config.exec?.persistent !== undefined,
   }
-  if (node.config.exec?.command !== undefined) view.command = node.config.exec.command
+  if (node.config.exec?.command !== undefined)
+    view.command = maskedCommand(node.config.exec.command, node.config.exec.env?.define)
   return view
 }
 

package/src/orchestrator/execute-task.ts

@@ -33,7 +33,7 @@ import {
   PersistentReadyError,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { killGraceMs, relPosix, span } from '../util/index.js'
+import { killGraceMs, maskedEmitter, relPosix, secretMask, span } from '../util/index.js'
 import { SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
 import { executorLabel } from './plugin-host.js'
 import {
@@ -323,12 +323,18 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     bridgeTag = wrapped.tag
     signalChannel = wrapped.forwardsSignals
   }
+  // A server's output masked as a one-shot task's is (L-11); `readyWhen`
+  // is matched on the raw chunks, before this. Its held tail is flushed by
+  // the idle timer: a server never ends on the way to a flush.
+  const serverSecrets = secretMask(process.env, env, step.env?.define)
+  const serverOut = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStdout(node, t))
+  const serverErr = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStderr(node, t))
   const persistentOpts: Parameters<typeof runPersistent>[0] = {
     command,
     cwd: node.projectDir,
     env,
-    onStdout: (chunk) => log.taskStdout(node, chunk),
-    onStderr: (chunk) => log.taskStderr(node, chunk),
+    onStdout: serverOut ? (chunk) => serverOut.push(chunk) : (chunk) => log.taskStdout(node, chunk),
+    onStderr: serverErr ? (chunk) => serverErr.push(chunk) : (chunk) => log.taskStderr(node, chunk),
     ...(args.liveChildren !== undefined ? { liveChildren: args.liveChildren } : {}),
     ...(signalChannel ? { signalChannel } : {}),
   }
@@ -779,8 +785,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         await sweepPlaceholders(placeholders)
         throw err
       })
-      .finally(() => clearTimeout(timeoutTimer))
+      .finally(() => {
+        clearTimeout(timeoutTimer)
+        flushMasked()
+      })
     endExec()
+    if (secrets !== null)
+      res = { ...res, stdout: secrets.mask(res.stdout), stderr: secrets.mask(res.stderr) }
     // An executor that stopped on the timeout's abort exits non-zero; say
     // why, so the frame, the retry line and `timedOut` read as a timeout.
     if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
@@ -791,7 +802,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // ENOENT; the line beside it names the package and how to key it. Only
     // with a denial there, so it never reddens a pass.
     for (const w of reachedWithheld(withheld, violations)) {
-      violations.push({ timestamp: new Date(), line: withheldLinkLine(node.id, w) })
+      violations.push({ timestamp: new Date(), hint: true, line: withheldLinkLine(node.id, w) })
     }
     // A placeholder the task never wrote is not its output: take it back
     // before the outputs are collected. On a failure it is also the one
@@ -801,6 +812,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       for (const p of untouched) {
         violations.push({
           timestamp: new Date(),
+          hint: true,
           line: untouchedPlaceholderLine(node.projectDir, p),
         })
       }
@@ -818,7 +830,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // the cache key never folded is not a safe thing to replay. A task that
     // survives the denial is the dangerous case, not the harmless one:
     // that is precisely the run that succeeds and caches a wrong result.
-    if (userSandbox && violations.length > 0 && code === 0) code = 1
+    if (userSandbox && violations.some((v) => v.hint !== true) && code === 0) code = 1
     // A declared sandbox fails the task on any violation — that is its
     // whole contract. `userSandbox` is the only way a task is sandboxed,
     // so this reads as "sandboxed and it tripped".
@@ -878,6 +890,14 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
   }
 
+  // The values of secret-named variables, masked in what the task prints
+  // and what the cache keeps of it (L-11); null when there are none.
+  const secrets = secretMask(process.env, env, step.env?.define)
+  let flushMasked = (): void => {}
+  // The entry's command is shown by `vx why` and sent with the entry to a
+  // remote cache: a value a config interpolated stays out of both.
+  const storedCommand = secrets?.mask(step.command) ?? step.command
+
   // Pass or fail, the command may have written where its project's
   // run-start facts describe; a remote executor wrote on its own disk.
   const writeReach =
@@ -935,6 +955,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   }
 
   async function buildRequest(): Promise<ExecuteRequest> {
+    const out = secrets && maskedEmitter(secrets, (t) => log.taskStdout(node, t))
+    const err = secrets && maskedEmitter(secrets, (t) => log.taskStderr(node, t))
+    flushMasked = () => {
+      out?.end()
+      err?.end()
+    }
     const base: ExecuteRequest = {
       taskId: node.id,
       workspaceRoot: args.workspaceRoot,
@@ -944,8 +970,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       env,
       envDefine: step.env?.define ?? {},
       capture,
-      onStdout: (chunk) => log.taskStdout(node, chunk),
-      onStderr: (chunk) => log.taskStderr(node, chunk),
+      onStdout: out ? (chunk) => out.push(chunk) : (chunk) => log.taskStdout(node, chunk),
+      onStderr: err ? (chunk) => err.push(chunk) : (chunk) => log.taskStderr(node, chunk),
       ...(args.liveChildren !== undefined ? { liveChildren: args.liveChildren } : {}),
       signal: requestSignal(),
       ...(effectiveTimeout !== undefined ? { timeoutMs: effectiveTimeout } : {}),
@@ -987,7 +1013,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         hash,
         entry: {
           taskId: node.id,
-          command: step.command,
+          command: storedCommand,
           durationMs: result.durationMs,
           stdout: result.stdout,
           ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),
@@ -1012,7 +1038,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs,
       wsOutputs,
       captured,
-      command: step.command,
+      command: storedCommand,
       durationMs: result.durationMs,
       stdout: result.stdout,
       ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),
@@ -1125,7 +1151,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     wallclockEndNs,
     ...(finalViolations.length > 0
       ? {
-          sandboxViolations: finalViolations.length,
+          // vx's own notes ride with the lines and are no denial (B-20).
+          sandboxViolations: finalViolations.filter((v) => v.hint !== true).length,
           sandboxViolationLines: finalViolations.map((v) => v.line),
         }
       : {}),

package/src/orchestrator/framed-output.ts

@@ -26,6 +26,7 @@
 // `--ui=stream` mode.
 
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import { maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { formatDuration } from './summary.js'
 import { outcomeLabel, skippedReason } from './events.js'
@@ -104,7 +105,11 @@ export function formatTaskBlock(
   if (forceCommand || outcome.status === 'success' || outcome.status === 'failed') {
     // No section label for the command (owner cut it) — the dim `$ `
     // line under the header reads as the command on its own.
-    lines.push('', corner(`$ ${node.config.exec?.command ?? ''}`), '')
+    lines.push(
+      '',
+      corner(`$ ${maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env?.define)}`),
+      '',
+    )
   }
 
   pushStreamSection(lines, stdout, 'STDOUT', SUCCESS, body.droppedStdout ?? 0, colors)
@@ -386,7 +391,7 @@ export function formatTaskSkippedLine(
  */
 export function formatFrameOpen(node: TaskNode, colors: ColorSupport = NO_COLOR): string {
   const corner = (t: string) => paint('', t, colors, { dim: true })
-  const cmd = node.config.exec?.command ?? ''
+  const cmd = maskedCommand(node.config.exec?.command ?? '', node.config.exec?.env?.define)
   const mark = isPersistentNode(node) ? `${paint(ACCENT, '▸', colors)} ` : ''
   return `${corner('┌─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('>')} $ ${cmd}`
 }

package/src/orchestrator/hit-restore.ts

@@ -20,7 +20,7 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { TaskOutcome } from '../graph/index.js'
-import { asTrees, span, taskGlob, wholeSubtreePrefixes } from '../util/index.js'
+import { asTrees, secretMask, span, taskGlob, wholeSubtreePrefixes } from '../util/index.js'
 import type { ExecuteArgs } from './execute-task.js'
 import { entryHolds } from './miss-save.js'
 
@@ -263,7 +263,12 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
       ])
     }
   }
-  if (hit.stdout) log.taskStdout(node, hit.stdout)
+  if (hit.stdout) {
+    // An entry saved before masking, or by another machine, can hold a
+    // secret-named variable's value (L-11). Asked only of a hit that prints.
+    const secrets = secretMask(process.env, node.config.exec?.env?.define)
+    log.taskStdout(node, secrets === null ? hit.stdout : secrets.mask(hit.stdout))
+  }
   const status =
     hit.exitCode !== 0 ? 'failed' : hit.source === 'remote' ? 'cache-hit-remote' : 'cache-hit'
   // `restored` distinguishes "we just wrote files to disk" from

package/src/orchestrator/sandbox-request.ts

@@ -56,6 +56,11 @@ export interface SandboxArmer {
 export interface SandboxRunUnion {
   /** Domains the run's filtering proxy will accept, in declaration order. */
   domains: string[]
+  /**
+   * Domains the proxy refuses, whichever task asks: every task's
+   * `deny.network`. The proxy is the run's, so a deny is too (B-21).
+   */
+  deniedDomains: string[]
   /** Whether SRT's all-or-nothing `socket(AF_UNIX)` filter is lifted for the run. */
   unixSockets: boolean
   /** Whether EVERY sandboxed task accepts the weaker nested profile. */
@@ -67,6 +72,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
   if (sandboxed.length === 0) return null
   const weakerNested = sandboxed.every((n) => n.config.exec?.sandbox?.weakerWhenNested === true)
   const domains = new Set<string>()
+  const denied = new Set<string>()
   let unixSockets = false
   for (const n of sandboxed) {
     const allow = n.config.exec?.sandbox?.allow
@@ -75,12 +81,13 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
     // proxy rather than going through it, so folding it in as `*` would
     // widen the allowlist every OTHER task in the run is filtered against.
     if (Array.isArray(net)) for (const d of net) domains.add(d)
+    for (const d of n.config.exec?.sandbox?.deny?.network ?? []) denied.add(d)
     const sockets = allow?.unixSockets
     if (sockets === true || (Array.isArray(sockets) && sockets.length > 0)) unixSockets = true
     const lb = allow?.localBinding
     if (Array.isArray(lb) && lb.length > 0 && process.platform === 'linux') unixSockets = true
   }
-  return { domains: [...domains], unixSockets, weakerNested }
+  return { domains: [...domains], deniedDomains: [...denied], unixSockets, weakerNested }
 }
 
 /**
@@ -107,7 +114,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
 export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
   const union = sandboxRunUnion(nodes)
   if (union === null) return null
-  const { domains, unixSockets, weakerNested } = union
+  const { domains, deniedDomains, unixSockets, weakerNested } = union
   let pending: Promise<void> | undefined
   let armed = false
   return {
@@ -121,6 +128,7 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
           if (!avail.available) throw new UserError(`sandbox not available: ${avail.reason}`)
           await initSandbox({
             allowedDomains: domains,
+            deniedDomains,
             ...(unixSockets ? { allowAllUnixSockets: true } : {}),
           })
         } catch (err) {

package/src/orchestrator/telemetry.ts

@@ -17,7 +17,7 @@
 // core calls INTO; those are the behavior capabilities, kept separate.
 
 import type { TaskOutcome, TaskStatus } from '../graph/index.js'
-import { settleWithin, teardownTimeoutMs } from '../util/index.js'
+import { maskedCommand, settleWithin, teardownTimeoutMs } from '../util/index.js'
 import type { RunEvent, RunEventSubscriber } from './events.js'
 
 /** Bumped when the record shape changes. Readers MUST check `v`. */
@@ -438,7 +438,8 @@ export function createTelemetrySource(args: {
           task: node.taskName,
           ts,
         }
-        if (node.config.exec.command !== undefined) rec.command = node.config.exec.command
+        if (node.config.exec.command !== undefined)
+          rec.command = maskedCommand(node.config.exec.command, node.config.exec.env?.define)
         deliver(rec)
         return
       }

package/src/util/errors.ts

@@ -49,6 +49,21 @@ export function isDiskFull(err: unknown): err is NodeJS.ErrnoException {
   return code === 'ENOSPC' || code === 'EDQUOT'
 }
 
+/**
+ * `EMFILE` or `ENFILE`: the process or the system is out of file
+ * descriptors. macOS starts a shell at 256, which a large workspace's
+ * config load and input walk can reach; the stack it printed named a file
+ * that was fine.
+ */
+export function isOutOfFds(err: unknown): err is NodeJS.ErrnoException {
+  if (!(err instanceof Error)) return false
+  const code = (err as NodeJS.ErrnoException).code
+  return code === 'EMFILE' || code === 'ENFILE'
+}
+
+export const OUT_OF_FDS_HINT =
+  'the process is out of file descriptors; raise the limit (ulimit -n 4096) and re-run'
+
 /** A file system refusing a write for a reason no code path caused: permission or space. */
 export function isFsRefusal(err: unknown): err is NodeJS.ErrnoException {
   return isPermissionError(err) || isDiskFull(err)

package/src/util/index.ts

@@ -14,6 +14,8 @@ export {
   UserError,
   gitSpawnRefusal,
   isExecutableMissing,
+  isOutOfFds,
+  OUT_OF_FDS_HINT,
 } from './errors.js'
 export { xxh3, xxh3hex } from './hash.js'
 export { mark, printTimings, span } from './timing.js'
@@ -47,5 +49,6 @@ export { splitTaskId } from './task-id.js'
 export { editDistance, nearMatches, nearest } from './edit-distance.js'
 export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
-export { executablePath } from './which.js'
+export { executablePath, shellArgv } from './which.js'
 export { procfsIsOwn } from './procfs.js'
+export { maskedCommand, maskedEmitter, MASKED, secretMask, type SecretMask } from './secret-mask.js'