@vzn/vx 0.0.192 → 0.0.193

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.192",
+  "version": "0.0.193",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.192",
-    "@vzn/vx-linux-arm64": "0.0.192",
-    "@vzn/vx-darwin-x64": "0.0.192",
-    "@vzn/vx-darwin-arm64": "0.0.192"
+    "@vzn/vx-linux-x64": "0.0.193",
+    "@vzn/vx-linux-arm64": "0.0.193",
+    "@vzn/vx-darwin-x64": "0.0.193",
+    "@vzn/vx-darwin-arm64": "0.0.193"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/index.ts

@@ -28,7 +28,7 @@ export {
   type SchemaReset,
   SCHEMA_VERSION,
 } from './cache.js'
-export { CACHE_VERSION } from './key-fold.js'
+export { ABSENT_INPUT, absentOr, CACHE_VERSION } from './key-fold.js'
 export {
   cleanOutputs,
   cleanWorkspaceOutputs,

package/src/cache/key-fold.ts

@@ -89,6 +89,22 @@ import type { CacheKeyInput } from './layer.js'
 // after the sibling changes (probed: the old output replayed).
 export const CACHE_VERSION = 'vx-cache-v36'
 
+/**
+ * The digest a key folds for an input gone between its enumeration and its
+ * hash: an upstream task that deletes a file its dependant's globs matched
+ * (a `clean` ahead of a `build`) failed the dependant as an internal error on
+ * every run (A-55). Not an identity any file has, so a run that finds the
+ * file keys apart from one that does not.
+ */
+export const ABSENT_INPUT = 'absent'
+
+/** `ABSENT_INPUT` for a file that is not there to read; any other error rethrown. */
+export function absentOr(err: unknown): string {
+  const code = (err as NodeJS.ErrnoException | null)?.code
+  if (code === 'ENOENT' || code === 'ENOTDIR') return ABSENT_INPUT
+  throw err
+}
+
 /**
  * Fold one task's key inputs into its 16-hex cache key. `hashFile` answers
  * for an input file the caller's `fileHashes` map does not cover (the git
@@ -226,7 +242,9 @@ export async function foldKey(
     }
     if (out.length === sortedInputs.length) fileHashes = out
   }
-  fileHashes ??= await Promise.all(sortedInputs.map((f) => provided?.get(f) ?? hashFile(f)))
+  fileHashes ??= await Promise.all(
+    sortedInputs.map((f) => provided?.get(f) ?? hashFile(f).catch(absentOr)),
+  )
   for (let i = 0; i < sortedInputs.length; i++) {
     const file = sortedInputs[i]!
     const rel = relOf(file)

package/src/exec/sandbox-deny-scan.ts

@@ -0,0 +1,152 @@
+// The sandbox runtime's mandatory-deny scan, scoped to what a task can
+// write (B-40). SRT walks `process.cwd()` (the workspace root) with
+// `rg --max-depth 3` on every wrap and keeps a hit only when it lies in
+// an allowed write path: anything else is already read-only under
+// `--ro-bind / /`. A deny is the hit or one of its ancestors, so every
+// hit that counts lies under a write path, and walking the write paths
+// finds them all. On 1,090 packages the whole-root walk was half of a
+// sandboxed run's wall time (25.5 s → 14.0 s without it). SRT keeps its
+// own scan at depth 1 for the root's entries; this supplies the rest,
+// per task and never from a memo (a refusal is decided by it).
+//
+// It is a superset of rg's hits, never a subset: it does not read
+// `.gitignore`, walks into `node_modules`, and counts a symlink by its
+// name. Each can only add a deny where rg would have skipped the path.
+
+import { lstatSync, readdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import path from 'node:path'
+import { UserError } from '../util/index.js'
+import { atOrUnder, MOUNT_WILDCARDS } from './sandbox-paths.js'
+
+/** SRT's `rg --max-depth` for the scan (`DEFAULT_MANDATORY_DENY_SEARCH_DEPTH`). */
+const SEARCH_DEPTH = 3
+
+/** SRT's `DANGEROUS_FILES`: matched by name, case-insensitively, at any depth. */
+const DANGEROUS_FILES = new Set([
+  '.gitconfig',
+  '.gitmodules',
+  '.bashrc',
+  '.bash_profile',
+  '.zshrc',
+  '.zprofile',
+  '.profile',
+  '.ripgreprc',
+  '.mcp.json',
+])
+
+/** SRT's `getDangerousDirectories()`: a hit is any file below one. */
+const DANGEROUS_DIRS = ['.vscode', '.idea', '.claude/commands', '.claude/agents']
+
+/** The write paths SRT adds to every wrap (`getDefaultWritePaths`); `/dev` never holds a hit. */
+export function srtDefaultWritePaths(): string[] {
+  const home = homedir()
+  return [
+    '/tmp/claude',
+    '/private/tmp/claude',
+    path.join(home, '.npm/_logs'),
+    path.join(home, '.claude/debug'),
+  ]
+}
+
+const lower = (s: string): string => s.toLowerCase()
+
+/** Whether `rel` (from the scan root, `/`-separated) is one of rg's hits for SRT's patterns. */
+function isHit(rel: string): boolean {
+  const segs = rel.split('/').map(lower)
+  if (DANGEROUS_FILES.has(segs[segs.length - 1]!)) return true
+  const inside = (dir: string): boolean => {
+    const d = dir.split('/')
+    for (let i = 0; i + d.length < segs.length; i++) {
+      if (d.every((s, j) => segs[i + j] === s)) return true
+    }
+    return false
+  }
+  if (DANGEROUS_DIRS.some(inside) || inside('.git/hooks')) return true
+  // `**/.git/config`, and only while `allowGitConfig` is off: vx never
+  // turns it on in the run's config, which is the one SRT's scan reads.
+  return segs.length >= 2 && segs[segs.length - 2] === '.git' && segs[segs.length - 1] === 'config'
+}
+
+/** The deny path SRT derives from a hit (`linuxGetMandatoryDenyPaths`), or none. */
+function denyOf(cwd: string, rel: string): string | undefined {
+  const absolute = path.resolve(cwd, rel)
+  const segments = absolute.split(path.sep)
+  // Two-segment names never equal one segment: their hits fall through to
+  // the file itself, as they do in SRT.
+  for (const dir of [...DANGEROUS_DIRS, '.git']) {
+    const i = segments.findIndex((s) => lower(s) === lower(dir))
+    if (i === -1) continue
+    if (dir !== '.git') return segments.slice(0, i + 1).join(path.sep)
+    const gitDir = segments.slice(0, i + 1).join(path.sep)
+    if (rel.includes('.git/hooks')) return path.join(gitDir, 'hooks')
+    if (rel.includes('.git/config')) return path.join(gitDir, 'config')
+    return undefined
+  }
+  return absolute
+}
+
+/**
+ * The mandatory write denies for a task whose write grants are
+ * `writePaths` (absolute), as SRT's whole-root scan of `cwd` would find
+ * them within those grants. Throws when a deny could not reach bwrap: a
+ * path with a glob character is dropped from `denyWrite` on Linux, and
+ * the write it guards must not be left open.
+ */
+export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]): string[] {
+  const roots = new Set<string>()
+  for (const raw of writePaths) {
+    const w = raw.replace(/\/+$/, '') || '/'
+    if (atOrUnder(cwd, w)) roots.add(cwd)
+    else if (atOrUnder(w, cwd)) roots.add(w)
+  }
+  const denies = new Set<string>()
+  const visit = (abs: string, rel: string, depth: number): void => {
+    let entries
+    try {
+      entries = readdirSync(abs, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const e of entries) {
+      const childRel = rel === '' ? e.name : `${rel}/${e.name}`
+      if (e.isDirectory()) {
+        if (depth + 1 < SEARCH_DEPTH) visit(path.join(abs, e.name), childRel, depth + 1)
+      } else if (isHit(childRel)) {
+        const d = denyOf(cwd, childRel)
+        if (d !== undefined) denies.add(d)
+      }
+    }
+  }
+  for (const root of roots) {
+    const rel = path.relative(cwd, root).split(path.sep).join('/')
+    const depth = rel === '' ? 0 : rel.split('/').length
+    if (depth > SEARCH_DEPTH) continue
+    let dir: boolean
+    try {
+      dir = lstatSync(root).isDirectory()
+    } catch {
+      continue
+    }
+    if (dir) {
+      if (depth < SEARCH_DEPTH) visit(root, rel, depth)
+    } else if (depth > 0 && isHit(rel)) {
+      const d = denyOf(cwd, rel)
+      if (d !== undefined) denies.add(d)
+    }
+  }
+  for (const d of denies) {
+    // SRT's `containsGlobChars` is this set: such a `denyWrite` entry is dropped on Linux.
+    if (MOUNT_WILDCARDS.test(d)) {
+      throw new UserError(
+        `the sandbox must keep ${d} read-only, and a path with a glob character (* ? [ ]) cannot reach it — rename the directory`,
+      )
+    }
+  }
+  return [...denies]
+}
+
+/** Whether the scan can be scoped here: a root with a glob character loses every supplied deny. */
+export function canScopeDenyScan(cwd: string): boolean {
+  return !MOUNT_WILDCARDS.test(cwd)
+}

package/src/exec/sandbox-runtime.ts

@@ -71,6 +71,11 @@ import {
   toRealPath,
   unique,
 } from './sandbox-paths.js'
+import {
+  canScopeDenyScan,
+  scopedMandatoryDenies,
+  srtDefaultWritePaths,
+} from './sandbox-deny-scan.js'
 import { parseStraceViolations, refusedWrites, reportableViolations } from './sandbox-violations.js'
 import {
   closeSignalChannel,
@@ -469,6 +474,9 @@ function bundledJavaAgent(): { javaAgentJarPath?: string } {
   return javaAgent
 }
 
+/** Whether this run's SRT scans at depth 1 and vx supplies the task-scoped denies (B-40). */
+let scopedDenyScan = false
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -540,6 +548,7 @@ export async function initSandbox(opts?: {
   // Before SRT starts, so the very first task already has one.
   await mkdir(sandboxTmpdir(), { recursive: true })
   const { SandboxManager } = await loadSrt()
+  scopedDenyScan = process.platform === 'linux' && canScopeDenyScan(process.cwd())
   const config: Parameters<typeof SandboxManager.initialize>[0] = {
     network: {
       allowedDomains: [...(opts?.allowedDomains ?? [])],
@@ -549,6 +558,9 @@ export async function initSandbox(opts?: {
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
     ignoreViolations: DEFAULT_IGNORE_VIOLATIONS,
     ...linuxToolPaths(),
+    // SRT's own scan walks only the root's entries; `wrapSandboxedCommand`
+    // walks each task's write grants for the rest (B-40).
+    ...(scopedDenyScan ? { mandatoryDenySearchDepth: 1 } : {}),
     ...bundledJavaAgent(),
   }
   if (!srtUp) await unlinkStaleMuxSockets()
@@ -928,6 +940,14 @@ export async function wrapSandboxedCommand(
   const customConfig = buildCustomConfig(args, baselines)
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
+  if (scopedDenyScan) {
+    customConfig!.filesystem!.denyWrite!.push(
+      ...scopedMandatoryDenies(process.cwd(), [
+        ...srtDefaultWritePaths(),
+        ...customConfig!.filesystem!.allowWrite!,
+      ]),
+    )
+  }
   // Seatbelt re-allows a read inside a denied region only by name; on Linux
   // a read grant over a write path would remount it read-only.
   if (process.platform === 'darwin') customConfig!.filesystem!.allowRead!.push(toRealPath(tmp))

package/src/orchestrator/task-hash.ts

@@ -3,6 +3,8 @@ import path from 'node:path'
 import type { TaskConfig, CacheConfig } from '../config.js'
 import type { ProjectFilesCache, WorkspaceFilesCache } from '../cache/index.js'
 import {
+  ABSENT_INPUT,
+  absentOr,
   type CacheKeyInput,
   type CacheLayer,
   FILE_HASH_RACY_MS,
@@ -138,12 +140,14 @@ export async function describeTaskInputs(
   const hash = await args.cache.key(input)
   const sorted = [...input.inputFiles].sort()
   const digests = await Promise.all(
-    sorted.map((f) => input.fileHashes?.get(f) ?? args.cache.hashFile(f)),
+    sorted.map((f) => input.fileHashes?.get(f) ?? args.cache.hashFile(f).catch(absentOr)),
+  )
+  // A file gone since the enumeration is no input: the task will not read it.
+  const files: InputFile[] = sorted.flatMap((f, i) =>
+    digests[i] === ABSENT_INPUT
+      ? []
+      : [{ path: relPosix(input.workspaceRoot, f), digest: digests[i]! }],
   )
-  const files: InputFile[] = sorted.map((f, i) => ({
-    path: relPosix(input.workspaceRoot, f),
-    digest: digests[i]!,
-  }))
   // The package.json digest is a per-run memo that may predate this
   // describe, so it is dated from the enumeration, the earliest a run
   // learns anything.
@@ -221,8 +225,12 @@ export async function movedInput(
     try {
       ctimeMs = lstatSync(f.path).ctimeMs
     } catch {
+      // Gone, as the key folded it (`ABSENT_INPUT`): unmoved.
+      if (f.digest === ABSENT_INPUT) continue
       return f.path
     }
+    // Back since the key folded it gone.
+    if (f.digest === ABSENT_INPUT) return f.path
     // A whole-second stamp may stand for any write in its second (two for
     // an even one, FAT's tick), one during the command included
     // (`racyWindowMs`).

package/src/workspace/project-loader.ts

@@ -386,6 +386,7 @@ export async function loadProjectConfigs(
     evaluated?: readonly [string, string]
     closure?: readonly [string, readonly string[]]
   }
+  const builtins = builtinSnapshot()
   const loadOne = async (entry: (typeof prepared)[number]): Promise<Loaded> => {
     const { configPath, cacheKey } = entry
     // A fast key that missed: the closure is stale or the file changed.
@@ -424,6 +425,10 @@ export async function loadProjectConfigs(
           throw configLoadError(err, configPath, 'Project') ?? err
         })
       : await loadDefaultExport(configPath, 'Project', bytes!)
+    // Before anything reads through them: a replaced `Array.prototype.includes`
+    // turned the JSON-data walk's own check into "a cyclic reference".
+    const changed = repeat ? [] : restoreBuiltins(builtins)
+    if (changed.length > 0) throw builtinsChanged(changed, configPath)
     assertDefaultObject(mod, 'Project', configPath)
     // Validation runs HERE, on whichever object we ended up with, so a
     // malformed config reports the identical UserError whether it was
@@ -480,7 +485,9 @@ export async function loadProjectConfigs(
         if (r.closure !== undefined) learnedClosures.push(r.closure)
       }
     }
+    const changed = restoreBuiltins(builtins)
     if (first !== undefined) throw first.failed
+    if (changed.length > 0) throw builtinsChanged(changed)
     return results.map((r) => (r as Loaded).config)
   } finally {
     endRound()
@@ -497,6 +504,70 @@ export async function loadProjectConfigs(
   }
 }
 
+/**
+ * The built-in prototypes a config's object is read through. A config that
+ * set `Object.prototype.exec` gave every other project's task that
+ * command, and the key, which folds each config's own JSON, never saw it:
+ * a hit replayed under a key that did not name what ran (D-74). A first
+ * load runs in this process, so the round compares them before and after,
+ * puts back what changed (a failed load too) and refuses.
+ */
+const WATCHED_BUILTINS: ReadonlyArray<readonly [string, object]> = [
+  ['Object.prototype', Object.prototype],
+  ['Array.prototype', Array.prototype],
+]
+
+type BuiltinSnapshot = ReadonlyArray<ReadonlyMap<PropertyKey, PropertyDescriptor>>
+
+function builtinSnapshot(): BuiltinSnapshot {
+  return WATCHED_BUILTINS.map(
+    ([, proto]) =>
+      new Map(Reflect.ownKeys(proto).map((k) => [k, Object.getOwnPropertyDescriptor(proto, k)!])),
+  )
+}
+
+/** Loads run together, so the config named is the one whose load saw the change. */
+function builtinsChanged(changed: readonly string[], configPath?: string): UserError {
+  const who = configPath === undefined ? 'a project config' : configPath
+  return new UserError(
+    `${who} changed ${changed.join(', ')} while it was evaluated — a config must not change the built-ins: every other config is read through them, and the cache key does not see what they add`,
+  )
+}
+
+/** Puts back what changed since `before`, naming each property it put back. */
+function restoreBuiltins(before: BuiltinSnapshot): string[] {
+  const changed: string[] = []
+  WATCHED_BUILTINS.forEach(([name, proto], i) => {
+    const was = before[i]!
+    for (const key of Reflect.ownKeys(proto)) {
+      const prior = was.get(key)
+      const now = Object.getOwnPropertyDescriptor(proto, key)!
+      if (prior !== undefined && sameDescriptor(prior, now)) continue
+      changed.push(`${name}.${String(key)}`)
+      if (prior === undefined) Reflect.deleteProperty(proto, key)
+      else Object.defineProperty(proto, key, prior)
+    }
+    for (const [key, prior] of was) {
+      if (!Object.hasOwn(proto, key)) {
+        changed.push(`${name}.${String(key)}`)
+        Object.defineProperty(proto, key, prior)
+      }
+    }
+  })
+  return changed
+}
+
+function sameDescriptor(a: PropertyDescriptor, b: PropertyDescriptor): boolean {
+  return (
+    a.value === b.value &&
+    a.get === b.get &&
+    a.set === b.set &&
+    a.writable === b.writable &&
+    a.enumerable === b.enumerable &&
+    a.configurable === b.configurable
+  )
+}
+
 export async function loadProjectConfig(
   configPath: string,
   opts?: LoadProjectConfigOptions,