@vzn/vx 0.0.199 → 0.0.200

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.199",
+  "version": "0.0.200",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.199",
-    "@vzn/vx-linux-arm64": "0.0.199",
-    "@vzn/vx-darwin-x64": "0.0.199",
-    "@vzn/vx-darwin-arm64": "0.0.199"
+    "@vzn/vx-linux-x64": "0.0.200",
+    "@vzn/vx-linux-arm64": "0.0.200",
+    "@vzn/vx-darwin-x64": "0.0.200",
+    "@vzn/vx-darwin-arm64": "0.0.200"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-deny-scan.ts

@@ -52,7 +52,7 @@ export function srtDefaultWritePaths(): string[] {
 const lower = (s: string): string => s.toLowerCase()
 
 /** Whether `rel` (from the scan root, `/`-separated) is one of rg's hits for SRT's patterns. */
-function isHit(rel: string): boolean {
+function isHit(rel: string, gitConfig: boolean): boolean {
   const segs = rel.split('/').map(lower)
   if (DANGEROUS_FILES.has(segs[segs.length - 1]!)) return true
   const inside = (dir: string): boolean => {
@@ -63,9 +63,13 @@ function isHit(rel: string): boolean {
     return false
   }
   if (DANGEROUS_DIRS.some(inside) || inside('.git/hooks')) return true
-  // `**/.git/config`, and only while `allowGitConfig` is off: vx never
-  // turns it on in the run's config, which is the one SRT's scan reads.
-  return segs.length >= 2 && segs[segs.length - 2] === '.git' && segs[segs.length - 1] === 'config'
+  // `**/.git/config`, unless the task grants `gitConfig` (B-41).
+  return (
+    !gitConfig &&
+    segs.length >= 2 &&
+    segs[segs.length - 2] === '.git' &&
+    segs[segs.length - 1] === 'config'
+  )
 }
 
 /** The deny path SRT derives from a hit (`linuxGetMandatoryDenyPaths`), or none. */
@@ -93,7 +97,11 @@ function denyOf(cwd: string, rel: string): string | undefined {
  * path with a glob character is dropped from `denyWrite` on Linux, and
  * the write it guards must not be left open.
  */
-export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]): string[] {
+export function scopedMandatoryDenies(
+  cwd: string,
+  writePaths: readonly string[],
+  gitConfig = false,
+): string[] {
   const roots = new Set<string>()
   for (const raw of writePaths) {
     const w = raw.replace(/\/+$/, '') || '/'
@@ -112,7 +120,7 @@ export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]
       const childRel = rel === '' ? e.name : `${rel}/${e.name}`
       if (e.isDirectory()) {
         if (depth + 1 < SEARCH_DEPTH) visit(path.join(abs, e.name), childRel, depth + 1)
-      } else if (isHit(childRel)) {
+      } else if (isHit(childRel, gitConfig)) {
         const d = denyOf(cwd, childRel)
         if (d !== undefined) denies.add(d)
       }
@@ -130,7 +138,7 @@ export function scopedMandatoryDenies(cwd: string, writePaths: readonly string[]
     }
     if (dir) {
       if (depth < SEARCH_DEPTH) visit(root, rel, depth)
-    } else if (depth > 0 && isHit(rel)) {
+    } else if (depth > 0 && isHit(rel, gitConfig)) {
       const d = denyOf(cwd, rel)
       if (d !== undefined) denies.add(d)
     }

package/src/exec/sandbox-runtime.ts

@@ -412,14 +412,16 @@ function trackTaskTmpdir(dir: string): void {
 let srtUp = false
 /**
  * The run's config while one of its tasks lifts SRT's `socket(AF_UNIX)`
- * block, else undefined. SRT reads the lift from its run-wide config, so
- * one task's `unixSockets` or port list lifted it for every sandboxed task
- * of the run, and a task that asked for neither reached the host's docker
- * or ssh-agent socket (L-6). Such a run sets the lift per task, for the
- * span of its wrap, which is when SRT reads it.
+ * block or grants `gitConfig`, else undefined. SRT reads both from its
+ * run-wide config, so one task's `unixSockets` or port list lifted the
+ * block for every sandboxed task of the run, and a task that asked for
+ * neither reached the host's docker or ssh-agent socket (L-6); the
+ * per-task `allowGitConfig` vx passed was never read at all (B-41). Such a
+ * run sets both per task, for the span of its wrap, which is when SRT
+ * reads them.
  */
-let socketRun: Parameters<SrtModule['SandboxManager']['updateConfig']>[0] | undefined
-/** Wraps of a `socketRun`, one at a time: each holds SRT's config for its task. */
+let perTaskRun: Parameters<SrtModule['SandboxManager']['updateConfig']>[0] | undefined
+/** Wraps of a `perTaskRun`, one at a time: each holds SRT's config for its task. */
 let wrapTurn: Promise<unknown> = Promise.resolve()
 
 /**
@@ -540,6 +542,8 @@ export async function initSandbox(opts?: {
    * sets it for each task's own wrap (L-6).
    */
   allowAllUnixSockets?: boolean
+  /** Whether any task of the run grants `gitConfig`: SRT reads it run-wide, so it is set per wrap (B-41). */
+  gitConfig?: boolean
 }): Promise<void> {
   // A reset a server's exit started unawaited: a watch cycle stops its
   // server and starts its run at once, and an init under that reset
@@ -571,7 +575,7 @@ export async function initSandbox(opts?: {
     true,
   )
   srtUp = true
-  socketRun = opts?.allowAllUnixSockets === true ? config : undefined
+  perTaskRun = opts?.allowAllUnixSockets === true || opts?.gitConfig === true ? config : undefined
   // `initialize()` returns early once SRT is up, and on Linux the
   // availability probe brought it up with an EMPTY config before the run's
   // own call — so the run's allowlist and unix-socket allowance never
@@ -607,7 +611,7 @@ export async function resetSandbox(): Promise<void> {
     const { SandboxManager } = await loadSrt()
     await SandboxManager.reset()
     srtUp = false
-    socketRun = undefined
+    perTaskRun = undefined
     availabilityCache.clear()
     straceAvailableCache = undefined
   })()
@@ -942,10 +946,11 @@ export async function wrapSandboxedCommand(
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(
-      ...scopedMandatoryDenies(process.cwd(), [
-        ...srtDefaultWritePaths(),
-        ...customConfig!.filesystem!.allowWrite!,
-      ]),
+      ...scopedMandatoryDenies(
+        process.cwd(),
+        [...srtDefaultWritePaths(), ...customConfig!.filesystem!.allowWrite!],
+        args.config.gitConfig === true,
+      ),
     )
   }
   // Seatbelt re-allows a read inside a denied region only by name; on Linux
@@ -967,6 +972,7 @@ export async function wrapSandboxedCommand(
     inner,
     customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
+    args.config.gitConfig === true,
   )
   if (process.platform === 'darwin') {
     const rules = [
@@ -1099,19 +1105,21 @@ function asksUnixSockets(c: Pick<ResolvedSandboxConfig, 'unixSockets'>): boolean
   return c.unixSockets === true || (c.unixSockets !== undefined && c.unixSockets.length > 0)
 }
 
-/** SRT's wrap, with the socket lift this task asked for or none (L-6). */
+/** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],
   command: string,
   customConfig: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
   sockets: boolean,
+  gitConfig: boolean,
 ): Promise<string> {
-  const run = socketRun
+  const run = perTaskRun
   if (run === undefined) return SandboxManager.wrapWithSandbox(command, undefined, customConfig)
   const turn = wrapTurn.then(() => {
     SandboxManager.updateConfig({
       ...run,
       network: { ...run.network, allowAllUnixSockets: sockets },
+      filesystem: { ...run.filesystem, allowGitConfig: gitConfig },
     })
     return SandboxManager.wrapWithSandbox(command, undefined, customConfig)
   })

package/src/orchestrator/sandbox-request.ts

@@ -64,6 +64,8 @@ export interface SandboxRunUnion {
   deniedDomains: string[]
   /** Whether SRT's all-or-nothing `socket(AF_UNIX)` filter is lifted for the run. */
   unixSockets: boolean
+  /** Whether any task grants `gitConfig`, which SRT reads run-wide and vx sets per wrap (B-41). */
+  gitConfig: boolean
   /** Whether EVERY sandboxed task accepts the weaker nested profile. */
   weakerNested: boolean
 }
@@ -75,6 +77,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
   const domains = new Set<string>()
   const denied = new Set<string>()
   let unixSockets = false
+  let gitConfig = false
   for (const n of sandboxed) {
     const allow = n.config.exec?.sandbox?.allow
     const net = allow?.network
@@ -87,8 +90,9 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
     if (sockets === true || (Array.isArray(sockets) && sockets.length > 0)) unixSockets = true
     const lb = allow?.localBinding
     if (Array.isArray(lb) && lb.length > 0 && process.platform === 'linux') unixSockets = true
+    if (allow?.gitConfig === true) gitConfig = true
   }
-  return { domains: [...domains], deniedDomains: [...denied], unixSockets, weakerNested }
+  return { domains: [...domains], deniedDomains: [...denied], unixSockets, gitConfig, weakerNested }
 }
 
 /**
@@ -115,7 +119,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
 export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
   const union = sandboxRunUnion(nodes)
   if (union === null) return null
-  const { domains, deniedDomains, unixSockets, weakerNested } = union
+  const { domains, deniedDomains, unixSockets, gitConfig, weakerNested } = union
   let pending: Promise<void> | undefined
   let armed = false
   return {
@@ -131,6 +135,7 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
             allowedDomains: domains,
             deniedDomains,
             ...(unixSockets ? { allowAllUnixSockets: true } : {}),
+            ...(gitConfig ? { gitConfig: true } : {}),
           })
         } catch (err) {
           // A throw from the runtime itself (its bridge needs socat, which