@vzn/vx 0.0.198 → 0.0.200

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.198",
+  "version": "0.0.200",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.198",
-    "@vzn/vx-linux-arm64": "0.0.198",
-    "@vzn/vx-darwin-x64": "0.0.198",
-    "@vzn/vx-darwin-arm64": "0.0.198"
+    "@vzn/vx-linux-x64": "0.0.200",
+    "@vzn/vx-linux-arm64": "0.0.200",
+    "@vzn/vx-darwin-x64": "0.0.200",
+    "@vzn/vx-darwin-arm64": "0.0.200"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/run.ts

@@ -16,7 +16,7 @@ import {
 import type { ContinueMode } from '../graph/index.js'
 import { type CachePolicy, FULL_CACHE_POLICY, parseCachePolicy } from '../cache/index.js'
 import { findCwdProject, pickTask, resolveFilters } from './select.js'
-import { nxTargetHint } from './task-verb.js'
+import { nxTargetHint, taskNamesHere } from './task-verb.js'
 import { MAX_TIMEOUT_MS, isUserError, parseDecimalInt, machineParallelism } from '../util/index.js'
 import { formatGraphDot, formatPlanJson, formatPlanText } from './plan-format.js'
 
@@ -555,6 +555,9 @@ export async function resolveRunOptions(
   return opts
 }
 
+/** How many task names a run with no task names before `and N more`. */
+const TASKS_SHOWN = 12
+
 export async function runCmd(args: readonly string[]): Promise<number> {
   const parsed = parseRunArgs(args)
   if (parsed.error) {
@@ -570,8 +573,15 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   // explicit anchored positional.
   if (tasks.length === 0) {
     if (!process.stdin.isTTY) {
+      const names = await taskNamesHere(cwd)
+      const shown = (names ?? []).slice(0, TASKS_SHOWN)
+      const more = (names?.length ?? 0) - shown.length
+      const tasksHere =
+        shown.length === 0
+          ? 'vx run <task>, e.g. vx run build'
+          : `tasks here: ${shown.join(', ')}${more > 0 ? ` and ${more} more` : ''}`
       process.stderr.write(
-        `vx run: missing task name (stdin is not a TTY, so no picker; vx run <task>, e.g. vx run build)${seeHelp('run')}\n`,
+        `vx run: missing task name (stdin is not a TTY, so no picker; ${tasksHere})${seeHelp('run')}\n`,
       )
       return 1
     }

package/src/cli/task-verb.ts

@@ -43,6 +43,22 @@ export async function nxTargetHint(tasks: readonly string[], cwd: string): Promi
   return `\`${tasks.join(' ')}\` is Nx's project:target: vx run ${specs.join(' ')}`
 }
 
+/**
+ * The task names `vx run <task>` can take here: the cwd project's, else
+ * every project's, sorted; null when no workspace loads. What a run with
+ * no task and no terminal for the picker names instead of a guess.
+ */
+export async function taskNamesHere(cwd: string): Promise<string[] | null> {
+  const projects = await workspaceProjects(cwd)
+  if (projects === null) return null
+  const own = await findCwdProject(cwd)
+  const names = new Set<string>()
+  for (const p of projects.values())
+    if (own === null || p.name === own)
+      for (const t of Object.keys(p.config.tasks ?? {})) names.add(t)
+  return [...names].sort()
+}
+
 async function workspaceProjects(
   cwd: string,
 ): Promise<Awaited<ReturnType<typeof loadCliProjects>> | null> {

package/src/exec/sandbox-deny-scan.ts

@@ -52,7 +52,7 @@ export function srtDefaultWritePaths(): string[] {
 const lower = (s: string): string => s.toLowerCase()
 
 /** Whether `rel` (from the scan root, `/`-separated) is one of rg's hits for SRT's patterns. */
-function isHit(rel: string): boolean {
+function isHit(rel: string, gitConfig: boolean): boolean {
   const segs = rel.split('/').map(lower)
   if (DANGEROUS_FILES.has(segs[segs.length - 1]!)) return true
   const inside = (dir: string): boolean => {
@@ -63,9 +63,13 @@ function isHit(rel: string): boolean {
     return false
   }
   if (DANGEROUS_DIRS.some(inside) || inside('.git/hooks')) return true
-  // `**/.git/config`, and only while `allowGitConfig` is off: vx never
-  // turns it on in the run's config, which is the one SRT's scan reads.
-  return segs.length >= 2 && segs[segs.length - 2] === '.git' && segs[segs.length - 1] === 'config'
+  // `**/.git/config`, unless the task grants `gitConfig` (B-41).
+  return (
+    !gitConfig &&
+    segs.length >= 2 &&
+    segs[segs.length - 2] === '.git' &&
+    segs[segs.length - 1] === 'config'
+  )
 }
 
 /** The deny path SRT derives from a hit (`linuxGetMandatoryDenyPaths`), or none. */
@@ -93,7 +97,11 @@ function denyOf(cwd: string, rel: string): string | undefined {
  * path with a glob character is dropped from `denyWrite` on Linux, and
  * the write it guards must not be left open.
  */
-export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]): string[] {
+export function scopedMandatoryDenies(
+  cwd: string,
+  writePaths: readonly string[],
+  gitConfig = false,
+): string[] {
   const roots = new Set<string>()
   for (const raw of writePaths) {
     const w = raw.replace(/\/+$/, '') || '/'
@@ -112,7 +120,7 @@ export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]
       const childRel = rel === '' ? e.name : `${rel}/${e.name}`
       if (e.isDirectory()) {
         if (depth + 1 < SEARCH_DEPTH) visit(path.join(abs, e.name), childRel, depth + 1)
-      } else if (isHit(childRel)) {
+      } else if (isHit(childRel, gitConfig)) {
         const d = denyOf(cwd, childRel)
         if (d !== undefined) denies.add(d)
       }
@@ -130,7 +138,7 @@ export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]
     }
     if (dir) {
       if (depth < SEARCH_DEPTH) visit(root, rel, depth)
-    } else if (depth > 0 && isHit(rel)) {
+    } else if (depth > 0 && isHit(rel, gitConfig)) {
       const d = denyOf(cwd, rel)
       if (d !== undefined) denies.add(d)
     }

package/src/exec/sandbox-runtime.ts

@@ -412,14 +412,16 @@ function trackTaskTmpdir(dir: string): void {
 let srtUp = false
 /**
  * The run's config while one of its tasks lifts SRT's `socket(AF_UNIX)`
- * block, else undefined. SRT reads the lift from its run-wide config, so
- * one task's `unixSockets` or port list lifted it for every sandboxed task
- * of the run, and a task that asked for neither reached the host's docker
- * or ssh-agent socket (L-6). Such a run sets the lift per task, for the
- * span of its wrap, which is when SRT reads it.
+ * block or grants `gitConfig`, else undefined. SRT reads both from its
+ * run-wide config, so one task's `unixSockets` or port list lifted the
+ * block for every sandboxed task of the run, and a task that asked for
+ * neither reached the host's docker or ssh-agent socket (L-6); the
+ * per-task `allowGitConfig` vx passed was never read at all (B-41). Such a
+ * run sets both per task, for the span of its wrap, which is when SRT
+ * reads them.
  */
-let socketRun: Parameters<SrtModule['SandboxManager']['updateConfig']>[0] | undefined
-/** Wraps of a `socketRun`, one at a time: each holds SRT's config for its task. */
+let perTaskRun: Parameters<SrtModule['SandboxManager']['updateConfig']>[0] | undefined
+/** Wraps of a `perTaskRun`, one at a time: each holds SRT's config for its task. */
 let wrapTurn: Promise<unknown> = Promise.resolve()
 
 /**
@@ -540,6 +542,8 @@ export async function initSandbox(opts?: {
    * sets it for each task's own wrap (L-6).
    */
   allowAllUnixSockets?: boolean
+  /** Whether any task of the run grants `gitConfig`: SRT reads it run-wide, so it is set per wrap (B-41). */
+  gitConfig?: boolean
 }): Promise<void> {
   // A reset a server's exit started unawaited: a watch cycle stops its
   // server and starts its run at once, and an init under that reset
@@ -571,7 +575,7 @@ export async function initSandbox(opts?: {
     true,
   )
   srtUp = true
-  socketRun = opts?.allowAllUnixSockets === true ? config : undefined
+  perTaskRun = opts?.allowAllUnixSockets === true || opts?.gitConfig === true ? config : undefined
   // `initialize()` returns early once SRT is up, and on Linux the
   // availability probe brought it up with an EMPTY config before the run's
   // own call — so the run's allowlist and unix-socket allowance never
@@ -607,7 +611,7 @@ export async function resetSandbox(): Promise<void> {
     const { SandboxManager } = await loadSrt()
     await SandboxManager.reset()
     srtUp = false
-    socketRun = undefined
+    perTaskRun = undefined
     availabilityCache.clear()
     straceAvailableCache = undefined
   })()
@@ -942,10 +946,11 @@ export async function wrapSandboxedCommand(
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(
-      ...scopedMandatoryDenies(process.cwd(), [
-        ...srtDefaultWritePaths(),
-        ...customConfig!.filesystem!.allowWrite!,
-      ]),
+      ...scopedMandatoryDenies(
+        process.cwd(),
+        [...srtDefaultWritePaths(), ...customConfig!.filesystem!.allowWrite!],
+        args.config.gitConfig === true,
+      ),
     )
   }
   // Seatbelt re-allows a read inside a denied region only by name; on Linux
@@ -967,6 +972,7 @@ export async function wrapSandboxedCommand(
     inner,
     customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
+    args.config.gitConfig === true,
   )
   if (process.platform === 'darwin') {
     const rules = [
@@ -1099,19 +1105,21 @@ function asksUnixSockets(c: Pick<ResolvedSandboxConfig, 'unixSockets'>): boolean
   return c.unixSockets === true || (c.unixSockets !== undefined && c.unixSockets.length > 0)
 }
 
-/** SRT's wrap, with the socket lift this task asked for or none (L-6). */
+/** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],
   command: string,
   customConfig: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
   sockets: boolean,
+  gitConfig: boolean,
 ): Promise<string> {
-  const run = socketRun
+  const run = perTaskRun
   if (run === undefined) return SandboxManager.wrapWithSandbox(command, undefined, customConfig)
   const turn = wrapTurn.then(() => {
     SandboxManager.updateConfig({
       ...run,
       network: { ...run.network, allowAllUnixSockets: sockets },
+      filesystem: { ...run.filesystem, allowGitConfig: gitConfig },
     })
     return SandboxManager.wrapWithSandbox(command, undefined, customConfig)
   })

package/src/orchestrator/sandbox-request.ts

@@ -64,6 +64,8 @@ export interface SandboxRunUnion {
   deniedDomains: string[]
   /** Whether SRT's all-or-nothing `socket(AF_UNIX)` filter is lifted for the run. */
   unixSockets: boolean
+  /** Whether any task grants `gitConfig`, which SRT reads run-wide and vx sets per wrap (B-41). */
+  gitConfig: boolean
   /** Whether EVERY sandboxed task accepts the weaker nested profile. */
   weakerNested: boolean
 }
@@ -75,6 +77,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
   const domains = new Set<string>()
   const denied = new Set<string>()
   let unixSockets = false
+  let gitConfig = false
   for (const n of sandboxed) {
     const allow = n.config.exec?.sandbox?.allow
     const net = allow?.network
@@ -87,8 +90,9 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
     if (sockets === true || (Array.isArray(sockets) && sockets.length > 0)) unixSockets = true
     const lb = allow?.localBinding
     if (Array.isArray(lb) && lb.length > 0 && process.platform === 'linux') unixSockets = true
+    if (allow?.gitConfig === true) gitConfig = true
   }
-  return { domains: [...domains], deniedDomains: [...denied], unixSockets, weakerNested }
+  return { domains: [...domains], deniedDomains: [...denied], unixSockets, gitConfig, weakerNested }
 }
 
 /**
@@ -115,7 +119,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
 export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
   const union = sandboxRunUnion(nodes)
   if (union === null) return null
-  const { domains, deniedDomains, unixSockets, weakerNested } = union
+  const { domains, deniedDomains, unixSockets, gitConfig, weakerNested } = union
   let pending: Promise<void> | undefined
   let armed = false
   return {
@@ -131,6 +135,7 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
             allowedDomains: domains,
             deniedDomains,
             ...(unixSockets ? { allowAllUnixSockets: true } : {}),
+            ...(gitConfig ? { gitConfig: true } : {}),
           })
         } catch (err) {
           // A throw from the runtime itself (its bridge needs socat, which