@vzn/vx 0.0.18 → 0.0.22

package/src/exec/sandbox-violations.ts

@@ -0,0 +1,293 @@
+// What a sandboxed task was denied, as a report: the Linux strace pass
+// (paired by pid, because a forking task interleaves its lines), the
+// seatbelt record description, and the filters that keep only what the
+// task's owner can act on — inside the project, minus the loopback denial
+// no grant can avoid, minus what the task chose to ignore.
+
+import path from 'node:path'
+import { absolutize, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
+import type {
+  ResolvedSandboxConfig,
+  SandboxedRunArgs,
+  SandboxViolation,
+} from './sandbox-runtime.js'
+
+/**
+ * Parse a strace log for denied filesystem syscalls and convert each
+ * one inside the workspace deny anchor (and not in allowRead) into a
+ * SandboxViolation. Dedups by (syscall, abs-path) so a tool that
+ * statx's the same missing path 10 times in a row produces one line.
+ *
+ * strace line shape (with -f):
+ *   <pid> openat(AT_FDCWD, "<path>", <flags>) = -1 ENOENT (...)
+ *   <pid> access("<path>", <mode>) = -1 EACCES (...)
+ *   <pid> statx(AT_FDCWD, "<path>", <flags>, <mask>, ...) = -1 ENOENT (...)
+ *
+ * …but ONLY when the syscall completes without another traced process
+ * interleaving. Under `-f` strace splits an interrupted call across two
+ * lines and the result never appears next to the path:
+ *   <pid> openat(AT_FDCWD, "<path>", <flags> <unfinished ...>
+ *   <pid> <... openat resumed>)             = -1 ENOENT (...)
+ * A single-line regex silently drops every one of those, so a task that
+ * forks concurrent children reading undeclared files reported an
+ * INCOMPLETE violation list — a sandboxed task that tripped would look
+ * clean. We pair them by pid instead (a process has at most
+ * one syscall in flight, so the pid is a sufficient key).
+ *
+ * We capture the first quoted-string argument as the path. paths that
+ * are relative resolve against the task's cwd (set by Bun.spawn).
+ */
+const SYSCALLS = 'openat|access|statx|newfstatat'
+const STRACE_DONE_RE = new RegExp(
+  `^(\\d+)\\s+(${SYSCALLS})\\([^"]*"([^"]+)"[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+)
+const STRACE_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+(${SYSCALLS})\\([^"]*"([^"]+)"[^)]*<unfinished`)
+const STRACE_RESUMED_RE = new RegExp(
+  `^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+)
+/** A resumed call that SUCCEEDED — clears the pending entry, emits nothing. */
+const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>`)
+
+/** One denied syscall, however strace chose to lay it out. */
+export interface DeniedCall {
+  syscall: string
+  rawPath: string
+  errno: string
+}
+
+/**
+ * Walk the trace, pairing `<unfinished ...>` with its `<... resumed>` line.
+ *
+ * Exported for testing: this is the security-relevant half of the Linux
+ * detector, and a synthetic trace pins the split-line shapes deterministically
+ * where an end-to-end run only produces them when strace happens to interleave.
+ */
+export function deniedCalls(text: string): DeniedCall[] {
+  const pending = new Map<string, { syscall: string; rawPath: string }>()
+  const out: DeniedCall[] = []
+  for (const line of text.split('\n')) {
+    const done = STRACE_DONE_RE.exec(line)
+    if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
+      out.push({ syscall: done[2], rawPath: done[3], errno: done[4] })
+      continue
+    }
+    const unfinished = STRACE_UNFINISHED_RE.exec(line)
+    if (
+      unfinished?.[1] !== undefined &&
+      unfinished[2] !== undefined &&
+      unfinished[3] !== undefined
+    ) {
+      pending.set(unfinished[1], { syscall: unfinished[2], rawPath: unfinished[3] })
+      continue
+    }
+    const resumedOk = STRACE_RESUMED_OK_RE.exec(line)
+    if (resumedOk?.[1] === undefined) continue
+    const held = pending.get(resumedOk[1])
+    pending.delete(resumedOk[1])
+    const resumed = STRACE_RESUMED_RE.exec(line)
+    // Only a resume that carries a DENIAL is a violation; a successful
+    // resume just retires the pending entry.
+    if (held !== undefined && resumed?.[3] !== undefined) {
+      out.push({ syscall: held.syscall, rawPath: held.rawPath, errno: resumed[3] })
+    }
+  }
+  return out
+}
+
+export async function parseStraceViolations(
+  logPath: string,
+  args: SandboxedRunArgs,
+  baselines: { allowRead: readonly string[]; denyRead: readonly string[]; cwd: string },
+): Promise<SandboxViolation[]> {
+  const text = await Bun.file(logPath).text()
+  if (text.length === 0) return []
+
+  // Treat every baseAllow + sandbox.allowRead path as "this was
+  // explicitly permitted; any -ENOENT here is the user's own missing
+  // file, not a sandbox-induced denial". Same for absolute denyRead
+  // checks below. Canonical on BOTH sides — the policy is expressed in
+  // real paths (see `canonicalBaselines`), so comparing a link-path here
+  // would report an explicitly-allowed read as a violation.
+  const allowAbs = new Set<string>(
+    [...baselines.allowRead, ...args.config.allowRead].map((p) => toRealPath(absolutize(p))),
+  )
+  const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
+
+  const seen = new Set<string>()
+  const out: SandboxViolation[] = []
+  for (const { syscall, rawPath, errno } of deniedCalls(text)) {
+    const abs = toRealPath(absolutize(rawPath, baselines.cwd))
+    // Only report paths under the workspace-root deny anchor — system
+    // libs / /proc / /sys / etc. probes are not interesting violations.
+    if (!denyAnchors.some((root) => abs === root || abs.startsWith(root + path.sep))) continue
+    // Skip paths the user explicitly allowed (and their descendants).
+    if (isUnderAny(abs, allowAbs)) continue
+    const key = `${syscall}|${abs}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push({
+      line: `${syscall}(${rawPath}) = -1 ${errno}  [${abs}]`,
+      timestamp: new Date(),
+      target: abs,
+      path: abs,
+      // The trace is `-e trace=openat`, and an openat is a read or a
+      // write depending on flags the trace does not carry — so either
+      // list can silence it.
+      ignorable: ['read', 'write'],
+    })
+  }
+  return out
+}
+
+/**
+ * Does a violation line match something the task said to ignore?
+ *
+ * The line names an operation and a target — `deny(1) file-write-create
+ * /path/x`, `deny(1) system-info vfs.disk-space` — so the operation picks
+ * the list and the target is matched against its patterns. Anything
+ * unparseable is NOT ignored: a record we cannot classify is exactly the
+ * one worth seeing.
+ */
+function matchesIgnore(
+  v: SandboxViolation,
+  ignore: NonNullable<ResolvedSandboxConfig['ignore']>,
+): boolean {
+  if (v.target === undefined || v.ignorable === undefined) return false
+  for (const which of v.ignorable) {
+    const patterns = ignore[which]
+    if (patterns === undefined) continue
+    if (patterns.some((pat) => pat === v.target || new Bun.Glob(pat).match(v.target!))) return true
+  }
+  return false
+}
+
+/**
+ * Split a seatbelt record into the pieces the filters need. A record with
+ * no path (a `system-info` probe) keeps its target — it is not a boundary
+ * crossing, and the task can grant it.
+ */
+function describeMacViolation(line: string): Partial<SandboxViolation> {
+  const m = /deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/.exec(line)
+  if (m === null) return {}
+  const [op, target] = [m[1]!, m[2]!]
+  const which = op.startsWith('file-read')
+    ? 'read'
+    : op.startsWith('file-write')
+      ? 'write'
+      : op === 'system-info' || op === 'sysctl-read'
+        ? 'systemInfo'
+        : op.startsWith('network')
+          ? 'network'
+          : undefined
+  return {
+    target,
+    ...(target.startsWith('/') ? { path: toRealPath(target) } : {}),
+    ...(which !== undefined ? { ignorable: [which] } : {}),
+  }
+}
+
+/**
+ * The violations a task's report should carry: inside the project or
+ * under a withheld dependency (`linked`), minus the loopback denial no
+ * config can avoid, minus what the task chose to ignore. Exported so a
+ * test can drive it with either platform's line shape without needing
+ * that platform.
+ */
+export function reportableViolations(
+  violations: readonly SandboxViolation[],
+  opts: { within: string; linked?: readonly string[]; config: ResolvedSandboxConfig },
+): SandboxViolation[] {
+  // A record the producer did not describe is a seatbelt one, straight
+  // from SRT's store — parse it here so the filters below never see a
+  // platform's line format.
+  const described = violations.map((v) =>
+    v.target === undefined ? { ...v, ...describeMacViolation(v.line) } : v,
+  )
+  return filterIgnored(
+    loopbackNoise(withinReported(described, opts.within, opts.linked ?? []), opts.config),
+    opts.config.ignore,
+  )
+}
+
+/**
+ * Drop the loopback denial no grant can avoid.
+ *
+ * A runtime that opens a dual-stack socket reaches 127.0.0.1 as
+ * ::ffff:127.0.0.1, and seatbelt's only host tokens are `localhost` and
+ * `*` — no rule vx or SRT can write names that form. The first connect is
+ * denied, the runtime retries on AF_INET and succeeds (measured
+ * 2026-09-05: `fetch` to its own `Bun.serve` port returns 200 with one
+ * `deny(1) network-outbound` logged). It happens for a task's own server
+ * under `localBinding`, and again for SRT's filtering proxy whenever the
+ * task declared any network at all. The record has no address and no
+ * config can silence it, so under either grant it is noise.
+ *
+ * It is not a hole for the traffic that matters: a connection that tried
+ * to leave the machine goes through that proxy, which reports it WITH its
+ * host and port — a line this keeps.
+ */
+function loopbackNoise(
+  violations: SandboxViolation[],
+  config: ResolvedSandboxConfig,
+): SandboxViolation[] {
+  const loopbackGranted = localBindingOn(config) || config.network !== undefined
+  if (!loopbackGranted) return violations
+  return violations.filter((v) => !/deny\(\d+\)\s+network-outbound\s*$/.test(v.line))
+}
+
+/**
+ * Keep only denials on a path inside `within`, or inside one of `linked`.
+ *
+ * A task may not leave its project — that is enforced by the deny anchor at
+ * the workspace root — but being STOPPED at the wall is the sandbox
+ * working, not a finding. Every process walks from `/` down to its own cwd
+ * (`bun build --compile` lists each directory on the way; traced
+ * 2026-09-05), and no configuration can declare that away.
+ *
+ * What is worth reporting is an undeclared touch of the project's OWN
+ * files: the cache key folds this project's inputs, so that is the read
+ * that makes a cached artifact wrong. A record with no path at all — a
+ * `system-info` probe — is kept, since it is not a boundary crossing and
+ * the task can grant it.
+ *
+ * `linked` are the workspace packages core withheld from a cached task's
+ * `node_modules` grant because its key does not answer for them. A denial
+ * there is the task reaching for a dependency through its own link — the
+ * read that would have been a stale hit, a finding and not the wall.
+ * Canonical already: sandbox-request.ts takes them from link targets.
+ */
+function withinReported(
+  violations: SandboxViolation[],
+  within: string,
+  linked: readonly string[],
+): SandboxViolation[] {
+  const roots = [toRealPath(within), ...linked]
+  // `root === '/'` would otherwise compare against `'//'` and drop
+  // everything — the one prefix that needs no separator appended.
+  const prefixes = roots.map((root) => (root.endsWith(path.sep) ? root : root + path.sep))
+  return violations.filter(
+    (v) =>
+      v.path === undefined ||
+      roots.some((root, i) => v.path === root || v.path!.startsWith(prefixes[i]!)),
+  )
+}
+
+/**
+ * Apply the task's user-provided `sandbox.ignore` grants on top
+ * of whatever the macOS log monitor + Linux strace pass produced.
+ * Mirrors SRT's own substring-match semantics:
+ *   - `'*'` entries match every command
+ *   - other keys match commands whose userCommand string CONTAINS the key
+ *   - the array of strings under each key is substring-matched against
+ *     the violation line
+ *
+ * The defaults installed in `initSandbox` already filter on the macOS
+ * side; this pass catches per-task additions + Linux strace results.
+ */
+function filterIgnored(
+  violations: SandboxViolation[],
+  ignore: ResolvedSandboxConfig['ignore'],
+): SandboxViolation[] {
+  if (ignore === undefined) return violations
+  return violations.filter((v) => !matchesIgnore(v, ignore))
+}

package/src/graph/dependency-spec.ts

@@ -18,20 +18,6 @@ export class DependencySpecError extends Error {
   }
 }
 
-/**
- * Parse one `dependsOn` / `cache.inputs.tasks` entry.
- *
- *   `name`       → self.name
- *   `^name`      → every dep workspace's `name` task
- *   `pkg#name`   → specific package's `name` task (cross-edge)
- *   `*`          → all same-project upstream (filter-only)
- *   `^*`         → all dep upstream (filter-only)
- *   `!<form>`    → negation of any of the above (filter-only)
- *
- * Wildcards and negation are accepted everywhere — callers (the graph
- * builder vs the filter) decide which ones make semantic sense and
- * surface their own validation errors. This keeps the parser pure.
- */
 /** True when a task form is a `*` pattern (`build.*`) rather than an exact name. */
 export function isTaskPattern(task: string): boolean {
   return task.includes('*')
@@ -48,6 +34,20 @@ export function compileTaskPattern(pattern: string): RegExp {
   return new RegExp(`^${escaped}$`)
 }
 
+/**
+ * Parse one `dependsOn` / `cache.inputs.tasks` entry.
+ *
+ *   `name`       → self.name
+ *   `^name`      → every dep workspace's `name` task
+ *   `pkg#name`   → specific package's `name` task (cross-edge)
+ *   `*`          → all same-project upstream (filter-only)
+ *   `^*`         → all dep upstream (filter-only)
+ *   `!<form>`    → negation of any of the above (filter-only)
+ *
+ * Wildcards and negation are accepted everywhere — callers (the graph
+ * builder vs the filter) decide which ones make semantic sense and
+ * surface their own validation errors. This keeps the parser pure.
+ */
 export function parseDependencySpec(raw: string): DependencySpec {
   if (raw.length === 0) throw new DependencySpecError(raw, 'empty spec')
 

package/src/graph/index.ts

@@ -10,20 +10,22 @@ export {
 } from './dependency-spec.js'
 export {
   type ContinueMode,
-  type OutputFingerprint,
-  type ResourceCost,
+  RestoreDemoted,
   runGraph,
   type TaskOutcome,
   type TaskStatus,
-  type VerifyVerdict,
 } from './scheduler.js'
 export {
   buildTaskGraph,
-  detectCycle,
+  checkGraph,
+  declaredTask,
+  excludeDependencies,
   expandRequested,
   isGroupTask,
   markSurfacedDeps,
+  outputsOverlap,
   splitTaskId,
   type TaskNode,
+  undeclaredDepsError,
   unresolvedRequests,
 } from './task-graph.js'

package/src/graph/priorities.ts

@@ -0,0 +1,130 @@
+// The ready-queue ranking, apart from the scheduler that uses it. Nothing
+// here touches the platform: the Learn page's scheduler simulator
+// (packages/vx-docs, through packages/vx-bench/schedule-policy.ts) bundles
+// these two functions for the browser, and an import of the scheduler would
+// bring `util/` and its load-time `Bun` reads with them.
+
+import type { TaskNode } from './task-graph.js'
+
+/**
+ * `computeReverseDepCount` for a run with a restore tier (item 754). A
+ * restore-tier task is a confirmed hit that never waits on its deps, so it
+ * blocks only the exec-tier tasks that depend on it: an exec-tier task's
+ * count is taken over the exec tier alone, which is exact, and a restore's
+ * is the sum over its direct exec-tier dependents of one plus theirs, so a
+ * restore that feeds pending work still goes first. A warm run's exec tier
+ * is its group tasks with no edges among them, and the closure over the
+ * whole graph (476 packages: 1,428 nodes, 12.8k edges of 45-word bitsets)
+ * was 6 ms of the run-graph stage for a ranking the restores never needed.
+ */
+export function tieredReverseDepCount(
+  nodes: Map<string, TaskNode>,
+  restoreTier: ReadonlySet<string>,
+): Map<string, number> {
+  const exec = new Map<string, TaskNode>()
+  for (const [id, node] of nodes) if (!restoreTier.has(id)) exec.set(id, node)
+  const counts = computeReverseDepCount(exec)
+  for (const node of exec.values()) {
+    const weight = 1 + counts.get(node.id)!
+    for (const dep of node.deps) {
+      if (restoreTier.has(dep) && nodes.has(dep)) counts.set(dep, (counts.get(dep) ?? 0) + weight)
+    }
+  }
+  for (const id of restoreTier) if (nodes.has(id) && !counts.has(id)) counts.set(id, 0)
+  return counts
+}
+
+/**
+ * Compute, for each task in the graph, how many OTHER tasks are
+ * transitively blocked on it. Tasks with the highest count are the
+ * most valuable to schedule first — finishing them unlocks the most
+ * downstream work and minimizes worker idle time at the end of the
+ * run. Nx's schedule sort ranks by the same idea but counts DIRECT
+ * dependents only (`calculateReverseDeps` in
+ * `packages/nx/src/tasks-runner/utils.ts`, read 2026-09-24).
+ */
+export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string, number> {
+  // Exact transitive-dependent COUNTS need closure SETS (diamonds
+  // double-count under naive summing). Set-of-strings closures are
+  // O(N²) entries and took 8.5s on a 1090-package, 100-layer repo;
+  // bitsets make the same closure O(E·N/32) time and N²/8 bits of
+  // memory (3270 tasks ≈ 1.3 MB) — single-digit ms at that scale.
+  const ids = [...nodes.keys()]
+  const index = new Map<string, number>()
+  for (let i = 0; i < ids.length; i++) index.set(ids[i]!, i)
+  const n = ids.length
+  const words = (n + 31) >>> 5
+
+  // Direct dependents as index lists + in-degree for the topo pass.
+  const directReverse: number[][] = Array.from({ length: n }, () => [])
+  const indegree = new Uint32Array(n)
+  for (const node of nodes.values()) {
+    const ni = index.get(node.id)!
+    for (const dep of node.deps) {
+      const di = index.get(dep)
+      if (di === undefined) continue
+      directReverse[di]!.push(ni)
+      indegree[ni]!++
+    }
+  }
+
+  // Kahn topo order over dependency edges (deps before dependents).
+  // Insertion order is topo today, but the closure's correctness
+  // must not hinge on an unstated property of buildTaskGraph.
+  const topo = new Int32Array(n)
+  let head = 0
+  let tail = 0
+  for (let i = 0; i < n; i++) if (indegree[i] === 0) topo[tail++] = i
+  while (head < tail) {
+    const v = topo[head++]!
+    for (const r of directReverse[v]!) {
+      if (--indegree[r]! === 0) topo[tail++] = r
+    }
+  }
+
+  // Reverse-topo sweep: every direct dependent's closure is final
+  // before its dependency folds it in. closure[i] = bitset over node
+  // indices of i's transitive dependents.
+  const closure = new Uint32Array(n * words)
+  const counts = new Map<string, number>()
+  for (let t = tail - 1; t >= 0; t--) {
+    const i = topo[t]!
+    const base = i * words
+    for (const r of directReverse[i]!) {
+      closure[base + (r >>> 5)]! |= 1 << (r & 31)
+      const rbase = r * words
+      for (let w = 0; w < words; w++) closure[base + w]! |= closure[rbase + w]!
+    }
+    let count = 0
+    for (let w = 0; w < words; w++) {
+      let v = closure[base + w]!
+      v = v - ((v >>> 1) & 0x55555555)
+      v = (v & 0x33333333) + ((v >>> 2) & 0x33333333)
+      count += (((v + (v >>> 4)) & 0x0f0f0f0f) * 0x01010101) >>> 24
+    }
+    counts.set(ids[i]!, count)
+  }
+  // Cycle-stranded nodes (never topo-visited) can't occur — the graph
+  // builder rejects cycles — but a missing Map entry would silently
+  // sort as undefined, so default them defensively to 0.
+  for (const id of ids) if (!counts.has(id)) counts.set(id, 0)
+  return counts
+}
+
+export function mergePriorities(
+  baseline: ReadonlyMap<string, number>,
+  overrides: ReadonlyMap<string, number>,
+): ReadonlyMap<string, number> {
+  // The override caller scored "expected critical-path duration" in ms.
+  // Baseline reverse-deps counts are bounded by N; scale the override so
+  // it sorts above the baseline for any node it covers, and add the
+  // baseline as a tie-break for parity within the override set.
+  const SCALE = 1 << 20
+  const out = new Map<string, number>()
+  for (const [id, w] of baseline) out.set(id, w)
+  for (const [id, w] of overrides) {
+    const b = baseline.get(id) ?? 0
+    out.set(id, w * SCALE + b)
+  }
+  return out
+}