@vzn/vx 0.0.129 → 0.0.131

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.129",
+  "version": "0.0.131",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.129",
-    "@vzn/vx-linux-arm64": "0.0.129",
-    "@vzn/vx-darwin-x64": "0.0.129",
-    "@vzn/vx-darwin-arm64": "0.0.129"
+    "@vzn/vx-linux-x64": "0.0.131",
+    "@vzn/vx-linux-arm64": "0.0.131",
+    "@vzn/vx-darwin-x64": "0.0.131",
+    "@vzn/vx-darwin-arm64": "0.0.131"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/index.ts

@@ -28,7 +28,7 @@ export {
   thrownReason,
 } from './sandbox-runtime.js'
 export { type DeniedCall } from './sandbox-violations.js'
-export { isMountableLiteral, MOUNT_WILDCARDS, toRealPath } from './sandbox-paths.js'
+export { atOrUnder, isMountableLiteral, MOUNT_WILDCARDS, toRealPath } from './sandbox-paths.js'
 export { bindableWrites, punchWalls } from './sandbox-binds.js'
 export { isLocalExecutor, localExecutor } from './local-executor.js'
 export { holdGroups, killTree, untilGroupsGone } from './kill-tree.js'

package/src/exec/sandbox-paths.ts

@@ -52,10 +52,18 @@ export function absolutize(p: string, cwd?: string): string {
   return path.resolve(cwd ?? process.cwd(), p)
 }
 
+/**
+ * `p` is `dir` or below it, by path: a sibling sharing `dir`'s name prefix
+ * is not, and `/` already ends in the separator.
+ */
+export function atOrUnder(p: string, dir: string): boolean {
+  return p === dir || p.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)
+}
+
 export function isUnderAny(abs: string, allow: Set<string>): boolean {
   if (allow.has(abs)) return true
   for (const a of allow) {
-    if (abs === a || abs.startsWith(a + path.sep)) return true
+    if (atOrUnder(abs, a)) return true
   }
   return false
 }

package/src/exec/sandbox-runtime.ts

@@ -64,6 +64,7 @@ import {
 } from '../util/index.js'
 import { bindableWrites, buildCustomConfig } from './sandbox-binds.js'
 import {
+  atOrUnder,
   isMountableLiteral,
   localBindingOn,
   MOUNT_WILDCARDS,
@@ -719,16 +720,14 @@ function canonicalBaselines(
 function assertWriteStaysHome(grant: string, real: string, projectDir: string): void {
   if (grant.startsWith('~') || path.isAbsolute(grant)) return
   const lexical = path.resolve(projectDir, grant)
-  const inside = (p: string, dir: string): boolean =>
-    p === dir || p.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)
-  if (!inside(lexical, projectDir)) return
+  if (!atOrUnder(lexical, projectDir)) return
   const home = toRealPath(projectDir)
   // `toRealPath` stops at a DANGLING link and keeps its own path, which is
   // inside; the link's target is where a write through it would land.
   const target = throughLinks(real)
-  if (inside(real, home) && inside(target, home)) return
+  if (atOrUnder(real, home) && atOrUnder(target, home)) return
   throw new UserError(
-    `exec.sandbox.allow.write: "${grant}" resolves through a symlink to ${inside(real, home) ? target : real}, outside the ` +
+    `exec.sandbox.allow.write: "${grant}" resolves through a symlink to ${atOrUnder(real, home) ? target : real}, outside the ` +
       `project — a write grant binds the path it names in the project, and vx does not follow a ` +
       `link out of it. Remove the link, or grant the target by its own path.`,
   )
@@ -1557,8 +1556,6 @@ async function runSandboxedOnce(
  */
 function readableUnder(dir: string, granted: readonly string[]): boolean {
   const target = toRealPath(dir)
-  const under = (a: string, b: string): boolean =>
-    a === b || a.startsWith(b.endsWith(path.sep) ? b : b + path.sep)
   return granted.some((p) => {
     const g = toRealPath(p)
     // On Linux a grant INSIDE the cwd makes the cwd listable too: bwrap
@@ -1566,7 +1563,7 @@ function readableUnder(dir: string, granted: readonly string[]): boolean {
     // children around the walls (`wallOff`), so every failing root task
     // was told its cwd was unreadable while it listed it (B-20). Seatbelt
     // grants no parent, so on macOS the cwd itself must be covered.
-    return under(target, g) || (process.platform === 'linux' && under(g, target))
+    return atOrUnder(target, g) || (process.platform === 'linux' && atOrUnder(g, target))
   })
 }
 
@@ -1736,9 +1733,7 @@ export function wallsGlobsReach(grants: readonly string[], walls: readonly strin
   const heads = grants
     .filter((g) => !isMountableLiteral(g))
     .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
-  return walls.filter((w) =>
-    heads.some((h) => w === h || w.startsWith(h === path.sep ? h : h + path.sep)),
-  )
+  return walls.filter((w) => heads.some((h) => atOrUnder(w, h)))
 }
 
 /**
@@ -1760,7 +1755,7 @@ export function darwinWallRules(
     for (const w of walls) {
       const at = `(subpath "${sbplResolvedPath(w, 'wall')}")`
       const kept = literals
-        .filter((l) => isMountableLiteral(l) && (l === w || l.startsWith(w + path.sep)))
+        .filter((l) => isMountableLiteral(l) && atOrUnder(l, w))
         .map((l) => `(require-not (subpath "${sbplResolvedPath(l, 'grant')}"))`)
       rules.push(
         kept.length === 0
@@ -1827,12 +1822,12 @@ function expandGrants(
     for (const hit of scanOrNothing(pattern, base)) {
       const abs = path.join(base, hit)
       const real = toRealPath(abs)
-      if (real !== home && !real.startsWith(home + path.sep)) continue
+      if (!atOrUnder(real, home)) continue
       // A hit that IS a wall, or lies inside one, was matched, not named:
       // `read: ['*']` in a root project bound `.git` and `.vx`, and
       // `packages/*` a nested project its key excludes (B-1). A grant that
       // names a wall literally never reaches this loop and stays.
-      if (walls.some((w) => real === w || real.startsWith(w + path.sep))) continue
+      if (walls.some((w) => atOrUnder(real, w))) continue
       out.push(abs)
       hits++
     }

package/src/exec/sandbox-violations.ts

@@ -5,7 +5,7 @@
 // no grant can avoid, minus what the task chose to ignore.
 
 import path from 'node:path'
-import { absolutize, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
+import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import type {
   ResolvedSandboxConfig,
   SandboxedRunArgs,
@@ -119,7 +119,7 @@ export async function parseStraceViolations(
     const abs = toRealPath(absolutize(rawPath, baselines.cwd))
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
-    if (!denyAnchors.some((root) => abs === root || abs.startsWith(root + path.sep))) continue
+    if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
     if (isUnderAny(abs, allowAbs)) continue
     const key = `${syscall}|${abs}`

package/src/orchestrator/sandbox-request.ts

@@ -18,6 +18,7 @@ import {
   toRealPath,
   type ExecuteRequest,
   isMountableLiteral,
+  atOrUnder,
   type SandboxViolation,
 } from '../exec/index.js'
 import type { TaskNode } from '../graph/index.js'
@@ -299,7 +300,11 @@ async function linkedDeps(
       const full = path.join(dir, e.name)
       if (e.isSymbolicLink()) {
         const target = await realpath(full).catch(() => undefined)
-        if (target !== undefined && !dirs.some((d) => within(target, d)) && !within(self, target)) {
+        if (
+          target !== undefined &&
+          !dirs.some((d) => atOrUnder(target, d)) &&
+          !atOrUnder(self, target)
+        ) {
           found.push([target, full, scope + e.name])
         }
       } else if (scope === '' && e.isDirectory() && e.name.startsWith('@')) {
@@ -321,7 +326,7 @@ async function linkedDeps(
   const granted: string[] = []
   const withheld: WithheldLink[] = []
   for (const [target, { link, name }] of targets) {
-    if (!within(target, root) || keyedDirs.has(target)) granted.push(target)
+    if (!atOrUnder(target, root) || keyedDirs.has(target)) granted.push(target)
     else
       withheld.push({
         dir: target,
@@ -355,7 +360,7 @@ export function reachedWithheld(
   violations: readonly SandboxViolation[],
 ): WithheldLink[] {
   return withheld.filter((w) =>
-    violations.some((v) => v.path !== undefined && within(v.path, w.dir)),
+    violations.some((v) => v.path !== undefined && atOrUnder(v.path, w.dir)),
   )
 }
 
@@ -364,15 +369,6 @@ function posixRel(from: string, p: string): string {
   return path.relative(from, p).split(path.sep).join('/')
 }
 
-/**
- * `p` is `dir` or below it — by path, so a sibling sharing `dir`'s name
- * prefix is not. `/` already ends in the separator, and a link to it
- * holds every project.
- */
-function within(p: string, dir: string): boolean {
-  return p === dir || p.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)
-}
-
 /**
  * Ensure each declared write path exists on the host as either an empty
  * file (a literal path) or a directory (a glob's static prefix, or a
@@ -451,8 +447,8 @@ function wallOff(
   for (const bind of bindableWrites(config.allowWrite)) {
     // A bind outside the workspace is the user's own path (`/tmp/x`,
     // `~/.cache/y`), spelled there on purpose; only one inside is judged.
-    if (bind !== home && !bind.startsWith(home + path.sep)) continue
-    const wall = walls.find((w) => w === bind || w.startsWith(bind + path.sep))
+    if (!atOrUnder(bind, home)) continue
+    const wall = walls.find((w) => atOrUnder(w, bind))
     if (wall === undefined) continue
     throw new UserError(
       `exec.sandbox.allow.write: the grant binding ${bind} would make ${wall} writable — another ` +
@@ -558,8 +554,8 @@ export function commandWriteReach(node: TaskNode, workspaceRoot: string): WriteR
   let reach: 'none' | 'project' = 'none'
   for (const grant of exec.sandbox.allow?.write ?? []) {
     const abs = path.resolve(node.projectDir, expandHome(grantPrefix(grant)))
-    if (within(abs, node.projectDir)) reach = 'project'
-    else if (within(abs, workspaceRoot) || within(workspaceRoot, abs)) return 'workspace'
+    if (atOrUnder(abs, node.projectDir)) reach = 'project'
+    else if (atOrUnder(abs, workspaceRoot) || atOrUnder(workspaceRoot, abs)) return 'workspace'
   }
   return reach
 }
@@ -579,7 +575,7 @@ export function mayWriteFingerprint(node: TaskNode, workspaceRoot: string): bool
   for (const grant of exec.sandbox.allow?.write ?? []) {
     const abs = path.resolve(node.projectDir, expandHome(grantPrefix(grant)))
     for (const f of WORKSPACE_FINGERPRINT_FILES) {
-      if (within(path.join(workspaceRoot, f), abs)) return true
+      if (atOrUnder(path.join(workspaceRoot, f), abs)) return true
     }
   }
   return false

package/src/orchestrator/upstream.ts

@@ -18,7 +18,13 @@ import { UserError } from '../util/index.js'
  */
 export function keyUpstream(node: TaskNode, upstream: TaskOutcome[]): TaskOutcome[] {
   const order = node.orderOnly
-  const keyed = order === undefined ? upstream : upstream.filter((o) => !order.includes(o.node.id))
+  // A restore-tier hit dispatches before its dependencies settle, and the
+  // scheduler hands it their outcomes so far: a hole stays a hole, as it
+  // does with no order-only edge (reading `.node` of one threw).
+  const keyed =
+    order === undefined
+      ? upstream
+      : upstream.filter((o) => o === undefined || !order.includes(o.node.id))
   return node.excludedUpstream === undefined ? keyed : [...keyed, ...node.excludedUpstream]
 }
 

package/src/workspace/config-schema.ts

@@ -722,6 +722,26 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
     },
   ],
   [EXEC_FIELDS, { cmd: '`command`', script: '`command`' }],
+  // Turbo's turbo.json and Nx's nx.json keys, written into vx.workspace
+  // (D-38).
+  [
+    WORKSPACE_FIELDS,
+    {
+      pipeline:
+        "each package's `vx.config` `tasks` (`bunx @vzn/vx-migrate` writes them from turbo.json)",
+      tasks:
+        "each package's `vx.config` `tasks` (`bunx @vzn/vx-migrate` writes them from turbo.json)",
+      targetDefaults:
+        "each package's `vx.config` `tasks`, sharing defaults through an imported module",
+      namedInputs: 'a module each `vx.config` imports, spread into `cache.inputs.files`',
+      globalEnv: '`cache.inputs.env` on the tasks it keys',
+      globalDependencies: '`cache.inputs.workspaceFiles` on the tasks it keys',
+      remoteCache:
+        'a cache plugin in `plugins` (`turboCache()` or `nxCache()` from `@vzn/vx-migrate`)',
+      parallel: '`concurrency`',
+      cacheDirectory: '`cacheDir`',
+    },
+  ],
 ])
 
 function assertKnownFields(value: object, allowed: ReadonlySet<string>, where: string): void {