@vzn/vx 0.0.21 → 0.0.22

package/src/exec/sandbox-violations.ts

@@ -139,18 +139,6 @@ export async function parseStraceViolations(
   return out
 }
 
-/**
- * Apply the task's user-provided `sandbox.ignore` grants on top
- * of whatever the macOS log monitor + Linux strace pass produced.
- * Mirrors SRT's own substring-match semantics:
- *   - `'*'` entries match every command
- *   - other keys match commands whose userCommand string CONTAINS the key
- *   - the array of strings under each key is substring-matched against
- *     the violation line
- *
- * The defaults installed in `initSandbox` already filter on the macOS
- * side; this pass catches per-task additions + Linux strace results.
- */
 /**
  * Does a violation line match something the task said to ignore?
  *
@@ -199,14 +187,15 @@ function describeMacViolation(line: string): Partial<SandboxViolation> {
 }
 
 /**
- * The violations a task's report should carry: inside the project,
- * minus the loopback denial no config can avoid, minus what the task
- * chose to ignore. Exported so a test can drive it with either
- * platform's line shape without needing that platform.
+ * The violations a task's report should carry: inside the project or
+ * under a withheld dependency (`linked`), minus the loopback denial no
+ * config can avoid, minus what the task chose to ignore. Exported so a
+ * test can drive it with either platform's line shape without needing
+ * that platform.
  */
 export function reportableViolations(
   violations: readonly SandboxViolation[],
-  opts: { within: string; config: ResolvedSandboxConfig },
+  opts: { within: string; linked?: readonly string[]; config: ResolvedSandboxConfig },
 ): SandboxViolation[] {
   // A record the producer did not describe is a seatbelt one, straight
   // from SRT's store — parse it here so the filters below never see a
@@ -215,7 +204,7 @@ export function reportableViolations(
     v.target === undefined ? { ...v, ...describeMacViolation(v.line) } : v,
   )
   return filterIgnored(
-    loopbackNoise(withinReported(described, opts.within), opts.config),
+    loopbackNoise(withinReported(described, opts.within, opts.linked ?? []), opts.config),
     opts.config.ignore,
   )
 }
@@ -247,7 +236,7 @@ function loopbackNoise(
 }
 
 /**
- * Keep only denials on a path inside `within`.
+ * Keep only denials on a path inside `within`, or inside one of `linked`.
  *
  * A task may not leave its project — that is enforced by the deny anchor at
  * the workspace root — but being STOPPED at the wall is the sandbox
@@ -260,17 +249,41 @@ function loopbackNoise(
  * that makes a cached artifact wrong. A record with no path at all — a
  * `system-info` probe — is kept, since it is not a boundary crossing and
  * the task can grant it.
+ *
+ * `linked` are the workspace packages core withheld from a cached task's
+ * `node_modules` grant because its key does not answer for them. A denial
+ * there is the task reaching for a dependency through its own link — the
+ * read that would have been a stale hit, a finding and not the wall.
+ * Canonical already: sandbox-request.ts takes them from link targets.
  */
-function withinReported(violations: SandboxViolation[], within: string): SandboxViolation[] {
-  const root = toRealPath(within)
+function withinReported(
+  violations: SandboxViolation[],
+  within: string,
+  linked: readonly string[],
+): SandboxViolation[] {
+  const roots = [toRealPath(within), ...linked]
   // `root === '/'` would otherwise compare against `'//'` and drop
   // everything — the one prefix that needs no separator appended.
-  const prefix = root.endsWith(path.sep) ? root : root + path.sep
+  const prefixes = roots.map((root) => (root.endsWith(path.sep) ? root : root + path.sep))
   return violations.filter(
-    (v) => v.path === undefined || v.path === root || v.path.startsWith(prefix),
+    (v) =>
+      v.path === undefined ||
+      roots.some((root, i) => v.path === root || v.path!.startsWith(prefixes[i]!)),
   )
 }
 
+/**
+ * Apply the task's user-provided `sandbox.ignore` grants on top
+ * of whatever the macOS log monitor + Linux strace pass produced.
+ * Mirrors SRT's own substring-match semantics:
+ *   - `'*'` entries match every command
+ *   - other keys match commands whose userCommand string CONTAINS the key
+ *   - the array of strings under each key is substring-matched against
+ *     the violation line
+ *
+ * The defaults installed in `initSandbox` already filter on the macOS
+ * side; this pass catches per-task additions + Linux strace results.
+ */
 function filterIgnored(
   violations: SandboxViolation[],
   ignore: ResolvedSandboxConfig['ignore'],

package/src/graph/dependency-spec.ts

@@ -18,20 +18,6 @@ export class DependencySpecError extends Error {
   }
 }
 
-/**
- * Parse one `dependsOn` / `cache.inputs.tasks` entry.
- *
- *   `name`       → self.name
- *   `^name`      → every dep workspace's `name` task
- *   `pkg#name`   → specific package's `name` task (cross-edge)
- *   `*`          → all same-project upstream (filter-only)
- *   `^*`         → all dep upstream (filter-only)
- *   `!<form>`    → negation of any of the above (filter-only)
- *
- * Wildcards and negation are accepted everywhere — callers (the graph
- * builder vs the filter) decide which ones make semantic sense and
- * surface their own validation errors. This keeps the parser pure.
- */
 /** True when a task form is a `*` pattern (`build.*`) rather than an exact name. */
 export function isTaskPattern(task: string): boolean {
   return task.includes('*')
@@ -48,6 +34,20 @@ export function compileTaskPattern(pattern: string): RegExp {
   return new RegExp(`^${escaped}$`)
 }
 
+/**
+ * Parse one `dependsOn` / `cache.inputs.tasks` entry.
+ *
+ *   `name`       → self.name
+ *   `^name`      → every dep workspace's `name` task
+ *   `pkg#name`   → specific package's `name` task (cross-edge)
+ *   `*`          → all same-project upstream (filter-only)
+ *   `^*`         → all dep upstream (filter-only)
+ *   `!<form>`    → negation of any of the above (filter-only)
+ *
+ * Wildcards and negation are accepted everywhere — callers (the graph
+ * builder vs the filter) decide which ones make semantic sense and
+ * surface their own validation errors. This keeps the parser pure.
+ */
 export function parseDependencySpec(raw: string): DependencySpec {
   if (raw.length === 0) throw new DependencySpecError(raw, 'empty spec')
 

package/src/graph/index.ts

@@ -8,14 +8,24 @@ export {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
-export { type ContinueMode, runGraph, type TaskOutcome, type TaskStatus } from './scheduler.js'
+export {
+  type ContinueMode,
+  RestoreDemoted,
+  runGraph,
+  type TaskOutcome,
+  type TaskStatus,
+} from './scheduler.js'
 export {
   buildTaskGraph,
-  detectCycle,
+  checkGraph,
+  declaredTask,
+  excludeDependencies,
   expandRequested,
   isGroupTask,
   markSurfacedDeps,
+  outputsOverlap,
   splitTaskId,
   type TaskNode,
+  undeclaredDepsError,
   unresolvedRequests,
 } from './task-graph.js'

package/src/graph/priorities.ts

@@ -0,0 +1,130 @@
+// The ready-queue ranking, apart from the scheduler that uses it. Nothing
+// here touches the platform: the Learn page's scheduler simulator
+// (packages/vx-docs, through packages/vx-bench/schedule-policy.ts) bundles
+// these two functions for the browser, and an import of the scheduler would
+// bring `util/` and its load-time `Bun` reads with them.
+
+import type { TaskNode } from './task-graph.js'
+
+/**
+ * `computeReverseDepCount` for a run with a restore tier (item 754). A
+ * restore-tier task is a confirmed hit that never waits on its deps, so it
+ * blocks only the exec-tier tasks that depend on it: an exec-tier task's
+ * count is taken over the exec tier alone, which is exact, and a restore's
+ * is the sum over its direct exec-tier dependents of one plus theirs, so a
+ * restore that feeds pending work still goes first. A warm run's exec tier
+ * is its group tasks with no edges among them, and the closure over the
+ * whole graph (476 packages: 1,428 nodes, 12.8k edges of 45-word bitsets)
+ * was 6 ms of the run-graph stage for a ranking the restores never needed.
+ */
+export function tieredReverseDepCount(
+  nodes: Map<string, TaskNode>,
+  restoreTier: ReadonlySet<string>,
+): Map<string, number> {
+  const exec = new Map<string, TaskNode>()
+  for (const [id, node] of nodes) if (!restoreTier.has(id)) exec.set(id, node)
+  const counts = computeReverseDepCount(exec)
+  for (const node of exec.values()) {
+    const weight = 1 + counts.get(node.id)!
+    for (const dep of node.deps) {
+      if (restoreTier.has(dep) && nodes.has(dep)) counts.set(dep, (counts.get(dep) ?? 0) + weight)
+    }
+  }
+  for (const id of restoreTier) if (nodes.has(id) && !counts.has(id)) counts.set(id, 0)
+  return counts
+}
+
+/**
+ * Compute, for each task in the graph, how many OTHER tasks are
+ * transitively blocked on it. Tasks with the highest count are the
+ * most valuable to schedule first — finishing them unlocks the most
+ * downstream work and minimizes worker idle time at the end of the
+ * run. Nx's schedule sort ranks by the same idea but counts DIRECT
+ * dependents only (`calculateReverseDeps` in
+ * `packages/nx/src/tasks-runner/utils.ts`, read 2026-09-24).
+ */
+export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string, number> {
+  // Exact transitive-dependent COUNTS need closure SETS (diamonds
+  // double-count under naive summing). Set-of-strings closures are
+  // O(N²) entries and took 8.5s on a 1090-package, 100-layer repo;
+  // bitsets make the same closure O(E·N/32) time and N²/8 bits of
+  // memory (3270 tasks ≈ 1.3 MB) — single-digit ms at that scale.
+  const ids = [...nodes.keys()]
+  const index = new Map<string, number>()
+  for (let i = 0; i < ids.length; i++) index.set(ids[i]!, i)
+  const n = ids.length
+  const words = (n + 31) >>> 5
+
+  // Direct dependents as index lists + in-degree for the topo pass.
+  const directReverse: number[][] = Array.from({ length: n }, () => [])
+  const indegree = new Uint32Array(n)
+  for (const node of nodes.values()) {
+    const ni = index.get(node.id)!
+    for (const dep of node.deps) {
+      const di = index.get(dep)
+      if (di === undefined) continue
+      directReverse[di]!.push(ni)
+      indegree[ni]!++
+    }
+  }
+
+  // Kahn topo order over dependency edges (deps before dependents).
+  // Insertion order is topo today, but the closure's correctness
+  // must not hinge on an unstated property of buildTaskGraph.
+  const topo = new Int32Array(n)
+  let head = 0
+  let tail = 0
+  for (let i = 0; i < n; i++) if (indegree[i] === 0) topo[tail++] = i
+  while (head < tail) {
+    const v = topo[head++]!
+    for (const r of directReverse[v]!) {
+      if (--indegree[r]! === 0) topo[tail++] = r
+    }
+  }
+
+  // Reverse-topo sweep: every direct dependent's closure is final
+  // before its dependency folds it in. closure[i] = bitset over node
+  // indices of i's transitive dependents.
+  const closure = new Uint32Array(n * words)
+  const counts = new Map<string, number>()
+  for (let t = tail - 1; t >= 0; t--) {
+    const i = topo[t]!
+    const base = i * words
+    for (const r of directReverse[i]!) {
+      closure[base + (r >>> 5)]! |= 1 << (r & 31)
+      const rbase = r * words
+      for (let w = 0; w < words; w++) closure[base + w]! |= closure[rbase + w]!
+    }
+    let count = 0
+    for (let w = 0; w < words; w++) {
+      let v = closure[base + w]!
+      v = v - ((v >>> 1) & 0x55555555)
+      v = (v & 0x33333333) + ((v >>> 2) & 0x33333333)
+      count += (((v + (v >>> 4)) & 0x0f0f0f0f) * 0x01010101) >>> 24
+    }
+    counts.set(ids[i]!, count)
+  }
+  // Cycle-stranded nodes (never topo-visited) can't occur — the graph
+  // builder rejects cycles — but a missing Map entry would silently
+  // sort as undefined, so default them defensively to 0.
+  for (const id of ids) if (!counts.has(id)) counts.set(id, 0)
+  return counts
+}
+
+export function mergePriorities(
+  baseline: ReadonlyMap<string, number>,
+  overrides: ReadonlyMap<string, number>,
+): ReadonlyMap<string, number> {
+  // The override caller scored "expected critical-path duration" in ms.
+  // Baseline reverse-deps counts are bounded by N; scale the override so
+  // it sorts above the baseline for any node it covers, and add the
+  // baseline as a tie-break for parity within the override set.
+  const SCALE = 1 << 20
+  const out = new Map<string, number>()
+  for (const [id, w] of baseline) out.set(id, w)
+  for (const [id, w] of overrides) {
+    const b = baseline.get(id) ?? 0
+    out.set(id, w * SCALE + b)
+  }
+  return out
+}