@vzn/vx 0.0.115 → 0.0.116

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.115",
+  "version": "0.0.116",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.115",
-    "@vzn/vx-linux-arm64": "0.0.115",
-    "@vzn/vx-darwin-x64": "0.0.115",
-    "@vzn/vx-darwin-arm64": "0.0.115"
+    "@vzn/vx-linux-x64": "0.0.116",
+    "@vzn/vx-linux-arm64": "0.0.116",
+    "@vzn/vx-darwin-x64": "0.0.116",
+    "@vzn/vx-darwin-arm64": "0.0.116"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -478,7 +478,7 @@ export class Cache implements CacheLayer {
           } | null
         )?.value
       } finally {
-        db.close()
+        closeDb(db)
       }
     } catch {
       return null
@@ -545,13 +545,23 @@ export class Cache implements CacheLayer {
         return read()
       } catch (err) {
         if (!unreadableIndex(err)) throw err
-        this.db.close()
+        try {
+          closeDb(this.db)
+        } catch {
+          // The refusal below is the error worth reporting.
+        }
         throw unreadableIndexError(dbFile, err)
       }
     }
     readable(() => {
       this.db.exec('PRAGMA busy_timeout = 5000')
       this.db.exec('PRAGMA journal_mode = WAL')
+      // Keep `-wal` and `-shm` when the last connection closes. A closed
+      // index otherwise deletes them, and a cache directory this user may
+      // not write (a CI cache restored read-only) cannot make them again:
+      // every open there failed `attempt to write a readonly database`
+      // before the not-writable refusal could name the directory (O-10).
+      if (!absent) this.db.fileControl(SQLITE_FCNTL_PERSIST_WAL, 1)
       this.db.exec('PRAGMA synchronous = NORMAL')
       this.db.exec('PRAGMA foreign_keys = ON')
       this.db.exec(`
@@ -622,7 +632,11 @@ export class Cache implements CacheLayer {
           })
           .immediate()
       } catch (err) {
-        this.db.close()
+        try {
+          closeDb(this.db)
+        } catch {
+          // The migration's own error is the one worth reporting.
+        }
         throw err
       }
     }
@@ -1885,7 +1899,7 @@ export class Cache implements CacheLayer {
       // `rm -rf .vx/cache`): macOS answers SQLITE_IOERR_VNODE on a
       // write to an unlinked file where Linux happily writes on.
     }
-    this.db.close()
+    closeDb(this.db)
   }
 
   private tarPath(hash: string): string {
@@ -1893,6 +1907,25 @@ export class Cache implements CacheLayer {
   }
 }
 
+/**
+ * SQLite's file-control opcode (sqlite3.h). Spelled here, not imported from
+ * `bun:sqlite`'s `constants`: the playground bundles this file against a
+ * shim that exports only `Database`.
+ */
+const SQLITE_FCNTL_PERSIST_WAL = 10
+
+/**
+ * Close for real. A plain `close()` leaves the connection open while any
+ * statement from `db.prepare()` lives (bun:sqlite 1.4.2 defers it, as
+ * `sqlite3_close_v2` does), so `cache.db` and its `-wal` and `-shm` stayed
+ * open after `Cache.close()`: a leaked descriptor per run for an embedder,
+ * and on Windows a cache directory nothing could delete (O-10).
+ * `close(true)` finalizes them and closes.
+ */
+function closeDb(db: Database): void {
+  db.close(true)
+}
+
 /**
  * Refuse an artifact whose file names no restore can materialise as one
  * tree, or (given the task's declared outputs) that names a file outside

package/src/exec/runner.ts

@@ -6,7 +6,13 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
-import { shellArgv, isExecutableMissing, killGraceMs } from '../util/index.js'
+import {
+  shellArgv,
+  isExecutableMissing,
+  isOutOfFds,
+  killGraceMs,
+  OUT_OF_FDS_HINT,
+} from '../util/index.js'
 import {
   closeSignalChannel,
   holdGroups,
@@ -40,6 +46,9 @@ export interface RunResult {
   cpuMs?: number
   /** Peak resident set size for the child, in bytes. */
   peakRssBytes?: number
+  /** `Bun.spawn` threw: no shell ran, so its 127 is vx's and says nothing
+   *  about the command (A-41). */
+  spawnFailed?: true
 }
 
 /**
@@ -664,7 +673,8 @@ export function spawnFailureText(err: unknown, cwd: string, what = 'task'): stri
     return `\n[vx] vx runs each task with sh -c: failed to spawn 'sh' (working dir: ${cwd}). Install a POSIX sh and re-run.\n`
   }
   const message = err instanceof Error ? err.message : String(err)
-  return `\n[vx] failed to spawn ${what}: ${message}\n`
+  const hint = isOutOfFds(err) ? ` — ${OUT_OF_FDS_HINT}` : ''
+  return `\n[vx] failed to spawn ${what}: ${message}${hint}\n`
 }
 
 export async function runCommand(opts: RunOptions): Promise<RunResult> {
@@ -689,7 +699,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   } catch (err) {
     const stderr = spawnFailureText(err, opts.cwd)
     opts.onStderr?.(stderr)
-    return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr }
+    return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr, spawnFailed: true }
   }
 
   opts.liveChildren?.add(proc)

package/src/exec/sandbox-runtime.ts

@@ -446,6 +446,28 @@ async function unlinkStaleMuxSockets(): Promise<void> {
  * B-19). A tool vx cannot find is left to SRT's own dependency check,
  * whose refusal names it.
  */
+let javaAgent: { javaAgentJarPath?: string } | undefined
+
+/**
+ * The JVM proxy agent SRT ships, named so SRT need not look for it. SRT's
+ * search lists `npm root -g` among its candidates before trying any, so it
+ * spawned npm on every init (~110 ms, the bulk of `vx info`'s sandbox
+ * probe) even though the jar sits beside it. Absent (a compiled vx), SRT
+ * searches as before.
+ */
+function bundledJavaAgent(): { javaAgentJarPath?: string } {
+  if (javaAgent) return javaAgent
+  javaAgent = {}
+  try {
+    const dist = path.dirname(require.resolve('@anthropic-ai/sandbox-runtime'))
+    const jar = path.join(dist, '..', 'vendor', 'java-proxy-agent', 'srt-proxy-agent.jar')
+    if (existsSync(jar)) javaAgent = { javaAgentJarPath: jar }
+  } catch {
+    // unresolvable: SRT searches
+  }
+  return javaAgent
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -526,6 +548,7 @@ export async function initSandbox(opts?: {
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
     ignoreViolations: DEFAULT_IGNORE_VIOLATIONS,
     ...linuxToolPaths(),
+    ...bundledJavaAgent(),
   }
   if (!srtUp) await unlinkStaleMuxSockets()
   await SandboxManager.initialize(
@@ -1341,6 +1364,7 @@ async function runSandboxedOnce(
       durationMs: Date.now() - start,
       stdout: '',
       stderr,
+      spawnFailed: true,
       violations: [],
       tracerFailed: false,
     }

package/src/orchestrator/execute-task.ts

@@ -852,8 +852,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // The shell's 127 and 126 name the word and nothing about why — the
     // PATH vx built, or a `#!` line the file itself carries (items 257,
     // 258) — and an exit above 128 is a signal's number and nothing
-    // about what sent it (259). One frame line names the rule.
-    if (!res.timedOut) {
+    // about what sent it (259). One frame line names the rule. A spawn that
+    // threw ran no shell: its 127 is vx's, and the line would send the
+    // reader after a command that exists (A-41).
+    if (!res.timedOut && res.spawnFailed !== true) {
       const verdict = shellVerdict({
         code,
         command: step.command,