@vzn/vx 0.0.114 → 0.0.116

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.114",
+  "version": "0.0.116",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.114",
-    "@vzn/vx-linux-arm64": "0.0.114",
-    "@vzn/vx-darwin-x64": "0.0.114",
-    "@vzn/vx-darwin-arm64": "0.0.114"
+    "@vzn/vx-linux-x64": "0.0.116",
+    "@vzn/vx-linux-arm64": "0.0.116",
+    "@vzn/vx-darwin-x64": "0.0.116",
+    "@vzn/vx-darwin-arm64": "0.0.116"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -478,7 +478,7 @@ export class Cache implements CacheLayer {
           } | null
         )?.value
       } finally {
-        db.close()
+        closeDb(db)
       }
     } catch {
       return null
@@ -545,13 +545,23 @@ export class Cache implements CacheLayer {
         return read()
       } catch (err) {
         if (!unreadableIndex(err)) throw err
-        this.db.close()
+        try {
+          closeDb(this.db)
+        } catch {
+          // The refusal below is the error worth reporting.
+        }
         throw unreadableIndexError(dbFile, err)
       }
     }
     readable(() => {
       this.db.exec('PRAGMA busy_timeout = 5000')
       this.db.exec('PRAGMA journal_mode = WAL')
+      // Keep `-wal` and `-shm` when the last connection closes. A closed
+      // index otherwise deletes them, and a cache directory this user may
+      // not write (a CI cache restored read-only) cannot make them again:
+      // every open there failed `attempt to write a readonly database`
+      // before the not-writable refusal could name the directory (O-10).
+      if (!absent) this.db.fileControl(SQLITE_FCNTL_PERSIST_WAL, 1)
       this.db.exec('PRAGMA synchronous = NORMAL')
       this.db.exec('PRAGMA foreign_keys = ON')
       this.db.exec(`
@@ -622,7 +632,11 @@ export class Cache implements CacheLayer {
           })
           .immediate()
       } catch (err) {
-        this.db.close()
+        try {
+          closeDb(this.db)
+        } catch {
+          // The migration's own error is the one worth reporting.
+        }
         throw err
       }
     }
@@ -1885,7 +1899,7 @@ export class Cache implements CacheLayer {
       // `rm -rf .vx/cache`): macOS answers SQLITE_IOERR_VNODE on a
       // write to an unlinked file where Linux happily writes on.
     }
-    this.db.close()
+    closeDb(this.db)
   }
 
   private tarPath(hash: string): string {
@@ -1893,6 +1907,25 @@ export class Cache implements CacheLayer {
   }
 }
 
+/**
+ * SQLite's file-control opcode (sqlite3.h). Spelled here, not imported from
+ * `bun:sqlite`'s `constants`: the playground bundles this file against a
+ * shim that exports only `Database`.
+ */
+const SQLITE_FCNTL_PERSIST_WAL = 10
+
+/**
+ * Close for real. A plain `close()` leaves the connection open while any
+ * statement from `db.prepare()` lives (bun:sqlite 1.4.2 defers it, as
+ * `sqlite3_close_v2` does), so `cache.db` and its `-wal` and `-shm` stayed
+ * open after `Cache.close()`: a leaked descriptor per run for an embedder,
+ * and on Windows a cache directory nothing could delete (O-10).
+ * `close(true)` finalizes them and closes.
+ */
+function closeDb(db: Database): void {
+  db.close(true)
+}
+
 /**
  * Refuse an artifact whose file names no restore can materialise as one
  * tree, or (given the task's declared outputs) that names a file outside

package/src/cli/completions.ts

@@ -101,7 +101,8 @@ export async function completionsCmd(
     return 1
   }
   const verbs = [...CORE_VERBS.filter((v) => v !== 'help' && v !== 'version'), 'help', 'version']
-  for (const v of pluginVerbs) if (!verbs.includes(v)) verbs.push(v)
+  // No overlap to skip: the workspace load refuses a plugin verb named like a core one.
+  verbs.push(...pluginVerbs)
   process.stdout.write(completionScript(shell as CompletionShell, verbs))
   return 0
 }

package/src/exec/runner.ts

@@ -6,7 +6,13 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
-import { shellArgv, isExecutableMissing, killGraceMs } from '../util/index.js'
+import {
+  shellArgv,
+  isExecutableMissing,
+  isOutOfFds,
+  killGraceMs,
+  OUT_OF_FDS_HINT,
+} from '../util/index.js'
 import {
   closeSignalChannel,
   holdGroups,
@@ -40,6 +46,9 @@ export interface RunResult {
   cpuMs?: number
   /** Peak resident set size for the child, in bytes. */
   peakRssBytes?: number
+  /** `Bun.spawn` threw: no shell ran, so its 127 is vx's and says nothing
+   *  about the command (A-41). */
+  spawnFailed?: true
 }
 
 /**
@@ -664,7 +673,8 @@ export function spawnFailureText(err: unknown, cwd: string, what = 'task'): stri
     return `\n[vx] vx runs each task with sh -c: failed to spawn 'sh' (working dir: ${cwd}). Install a POSIX sh and re-run.\n`
   }
   const message = err instanceof Error ? err.message : String(err)
-  return `\n[vx] failed to spawn ${what}: ${message}\n`
+  const hint = isOutOfFds(err) ? ` — ${OUT_OF_FDS_HINT}` : ''
+  return `\n[vx] failed to spawn ${what}: ${message}${hint}\n`
 }
 
 export async function runCommand(opts: RunOptions): Promise<RunResult> {
@@ -689,7 +699,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   } catch (err) {
     const stderr = spawnFailureText(err, opts.cwd)
     opts.onStderr?.(stderr)
-    return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr }
+    return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr, spawnFailed: true }
   }
 
   opts.liveChildren?.add(proc)

package/src/exec/sandbox-runtime.ts

@@ -446,6 +446,28 @@ async function unlinkStaleMuxSockets(): Promise<void> {
  * B-19). A tool vx cannot find is left to SRT's own dependency check,
  * whose refusal names it.
  */
+let javaAgent: { javaAgentJarPath?: string } | undefined
+
+/**
+ * The JVM proxy agent SRT ships, named so SRT need not look for it. SRT's
+ * search lists `npm root -g` among its candidates before trying any, so it
+ * spawned npm on every init (~110 ms, the bulk of `vx info`'s sandbox
+ * probe) even though the jar sits beside it. Absent (a compiled vx), SRT
+ * searches as before.
+ */
+function bundledJavaAgent(): { javaAgentJarPath?: string } {
+  if (javaAgent) return javaAgent
+  javaAgent = {}
+  try {
+    const dist = path.dirname(require.resolve('@anthropic-ai/sandbox-runtime'))
+    const jar = path.join(dist, '..', 'vendor', 'java-proxy-agent', 'srt-proxy-agent.jar')
+    if (existsSync(jar)) javaAgent = { javaAgentJarPath: jar }
+  } catch {
+    // unresolvable: SRT searches
+  }
+  return javaAgent
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -526,6 +548,7 @@ export async function initSandbox(opts?: {
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
     ignoreViolations: DEFAULT_IGNORE_VIOLATIONS,
     ...linuxToolPaths(),
+    ...bundledJavaAgent(),
   }
   if (!srtUp) await unlinkStaleMuxSockets()
   await SandboxManager.initialize(
@@ -1341,6 +1364,7 @@ async function runSandboxedOnce(
       durationMs: Date.now() - start,
       stdout: '',
       stderr,
+      spawnFailed: true,
       violations: [],
       tracerFailed: false,
     }

package/src/orchestrator/execute-task.ts

@@ -852,8 +852,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // The shell's 127 and 126 name the word and nothing about why — the
     // PATH vx built, or a `#!` line the file itself carries (items 257,
     // 258) — and an exit above 128 is a signal's number and nothing
-    // about what sent it (259). One frame line names the rule.
-    if (!res.timedOut) {
+    // about what sent it (259). One frame line names the rule. A spawn that
+    // threw ran no shell: its 127 is vx's, and the line would send the
+    // reader after a command that exists (A-41).
+    if (!res.timedOut && res.spawnFailed !== true) {
       const verdict = shellVerdict({
         code,
         command: step.command,

package/src/workspace/migrate-scripts.ts

@@ -23,7 +23,11 @@
 // hook is usually `rimraf dist`); and a script that is nothing but
 // `<pm> run <other>` becomes a GROUP over `<other>`, so the graph sees the
 // dependency instead of a package-manager subprocess it cannot cache.
+// Yarn 2+ runs no such hooks (probed: `yarn run build` printed BUILD alone),
+// so under it `prebuild` is a script like any other (D-31).
 
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
 import { taskNameProblem } from './config-schema.js'
 import type { ProjectMeta } from './workspace.js'
 import {
@@ -82,6 +86,40 @@ const OWN_COMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
   ),
 }
 
+/**
+ * Whether the package manager that owns `dir` is Yarn 2+: the nearest
+ * `packageManager: yarn@<2+>`, or the nearest lockfile being a Berry
+ * `yarn.lock` (it opens with `__metadata:`). Another lockfile, or none,
+ * is a manager that runs `pre` / `post` hooks.
+ */
+function isYarnBerry(dir: string, memo: Map<string, boolean>): boolean {
+  const known = memo.get(dir)
+  if (known !== undefined) return known
+  let answer: boolean | undefined
+  const manifest = path.join(dir, 'package.json')
+  try {
+    const pm = (JSON.parse(readFileSync(manifest, 'utf8')) as { packageManager?: unknown })
+      .packageManager
+    if (typeof pm === 'string') answer = /^yarn@([2-9]|\d{2,})/.test(pm)
+  } catch {}
+  if (answer === undefined) {
+    const lock = path.join(dir, 'yarn.lock')
+    if (existsSync(lock)) answer = readFileSync(lock, 'utf8').includes('\n__metadata:')
+    else if (
+      ['package-lock.json', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb'].some((f) =>
+        existsSync(path.join(dir, f)),
+      )
+    )
+      answer = false
+  }
+  if (answer === undefined) {
+    const up = path.dirname(dir)
+    answer = up === dir ? false : isYarnBerry(up, memo)
+  }
+  memo.set(dir, answer)
+  return answer
+}
+
 function scriptsOf(meta: ProjectMeta): Record<string, unknown> {
   // package.json is a boundary: `scripts` is whatever the file holds. A
   // string or an array would enumerate its indices as script names.
@@ -132,8 +170,10 @@ function upstreamBuildOnWorker(tasks: GeneratedTask[]): void {
 
 export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
   const projects: GeneratedProject[] = []
+  const berry = new Map<string, boolean>()
   for (const meta of metas) {
     const scripts = scriptsOf(meta)
+    const runsHooks = !isYarnBerry(meta.dir, berry)
     const runnable = Object.keys(scripts).filter(
       (n) => typeof scripts[n] === 'string' && scripts[n] !== '',
     )
@@ -153,7 +193,7 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
     // of a script that exists rides inside that script's command.
     const isTask = (n: string): boolean => {
       if (!has(n) || LIFECYCLE.test(n)) return false
-      const hookOf = /^(pre|post)(.+)$/.exec(n)
+      const hookOf = runsHooks ? /^(pre|post)(.+)$/.exec(n) : null
       return hookOf === null || !has(hookOf[2]!) || LIFECYCLE.test(hookOf[2]!)
     }
     const tasks: GeneratedTask[] = []
@@ -165,7 +205,7 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
       const delegate = delegatedScript(own)
       // npm lifecycle hooks (`prepack`, `prepublishOnly`, …) belong to the
       // package manager and never ride inside a task — `pack` stays alone.
-      const hook = (h: string): boolean => has(h) && !LIFECYCLE.test(h)
+      const hook = (h: string): boolean => runsHooks && has(h) && !LIFECYCLE.test(h)
       const hooks = [`pre${name}`, `post${name}`].filter(hook)
       // A group over a script that is no task (`setup: npm run prepare`)
       // named a task nothing defines, and the run `vx init` suggested