@vzn/vx 0.0.21 → 0.0.23

package/src/cli/why.ts

@@ -11,6 +11,7 @@ import { splitTaskId } from '../graph/index.js'
 import {
   cacheKeyDiff,
   explainCacheKeyQuery as explainCacheKey,
+  latestRunId,
   whyDidThisRerunQuery as whyDidThisRerun,
 } from '../orchestrator/index.js'
 import { nearMatches, UserError } from '../util/index.js'
@@ -124,19 +125,6 @@ function resolveTarget(cache: Cache, target: string): string {
   throw new UserError(`vx why: no recorded runs for task "${target}"${suggest(target, ids)}`)
 }
 
-/** The latest recorded run of a task (run_id may be NULL on very old rows). */
-function latestRunId(cache: Cache, taskId: string): string | null {
-  const [project, task] = splitTaskId(taskId)
-  const row = cache
-    .dbHandle()
-    .query(
-      `SELECT run_id AS runId FROM runs WHERE project = ? AND task = ?
-       ORDER BY started_at DESC LIMIT 1`,
-    )
-    .get(project, task) as { runId: string | null } | undefined
-  return row?.runId ?? null
-}
-
 const fmtWhen = (ms: number): string => new Date(ms).toISOString()
 
 export async function whyCmd(args: readonly string[]): Promise<number> {
@@ -147,12 +135,12 @@ export async function whyCmd(args: readonly string[]): Promise<number> {
   }
 
   const root = await findWorkspaceRoot(process.cwd())
-  const cache = new Cache(await cliCacheDir(root, parsed.cacheDir))
+  const cache = Cache.inspect(await cliCacheDir(root, parsed.cacheDir))
   noteSchemaReset(cache, warnToStderr)
   try {
     const db = cache.dbHandle()
     const taskId = resolveTarget(cache, parsed.target)
-    const runId = parsed.runId ?? latestRunId(cache, taskId)
+    const runId = parsed.runId ?? latestRunId(cache.dbHandle(), taskId)
 
     if (runId === null) {
       // Runs exist (resolveTarget passed) but predate run ids — fall back to
@@ -185,9 +173,13 @@ export async function whyCmd(args: readonly string[]): Promise<number> {
     const lines: string[] = []
     const t = why.thisRun!
     lines.push(`${taskId} — run ${runId}`)
+    // A hit's status (`cache-hit`, `cache-hit-remote`) already names it and
+    // its tier; only an executed run needs the word. A skipped task never
+    // ran and has no key: it read `skipped · executed · key ` (item 898).
+    const ran = t.cacheHit === false && t.status !== 'skipped'
     lines.push(
       `  this run   ${fmtWhen(t.startedAt)} · ${t.status}` +
-        `${t.cacheHit === true ? ' · cache hit' : t.cacheHit === false ? ' · executed' : ''} · key ${t.hash}`,
+        `${ran ? ' · executed' : ''}${t.hash === '' ? ' · no key' : ` · key ${t.hash}`}`,
     )
     if (why.previousRun == null) {
       lines.push('  previous   (none — first recorded run of this task)')

package/src/cli/workspace-config.ts

@@ -4,6 +4,7 @@
 // a directory the run never used — `vx last` found no runs, `vx cache
 // prune` pruned nothing, `vx watch` ignored the wrong path.
 
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 import type { WorkspaceConfig } from '../config.js'
 import { UserError } from '../util/index.js'
@@ -35,13 +36,6 @@ export async function loadCliWorkspace(workspaceRoot: string): Promise<CliWorksp
   return { workspaceConfig, plugins, cacheDir: resolveCacheDir(workspaceRoot, workspaceConfig) }
 }
 
-/**
- * The run path's project-config load (`loadProjects`) for a verb that only
- * reads: the plugin `project` stage applies, and the local cache opens only
- * to serve cached evaluations — a pure config costs a stat, not an
- * evaluation. `scope` is every project or a list of names; no closure, no
- * lock (a verb reads live, as a default run does).
- */
 /**
  * `--cache-dir <path>` / `--cache-dir=<path>` for a verb that reads the
  * cache a run wrote — `why`, `last`, `info`, `cache prune`. Same rules as
@@ -64,6 +58,17 @@ export function parseCacheDirFlag(
   return { cacheDir: v, next: a === '--cache-dir' ? i + 1 : i }
 }
 
+/**
+ * A reading verb's `--cache-dir`, resolved against the working directory.
+ * Named explicitly, a directory that is not there is a typo to report, not
+ * an empty cache to read (item 900).
+ */
+export function namedCacheDir(override: string): string {
+  const dir = path.resolve(process.cwd(), override)
+  if (!existsSync(dir)) throw new UserError(`--cache-dir ${override}: no such directory (${dir})`)
+  return dir
+}
+
 /**
  * The cache directory a reading verb opens: `--cache-dir` resolved against
  * cwd exactly as `vx run` resolves it (prepare.ts), else the workspace's —
@@ -73,7 +78,7 @@ export async function cliCacheDir(
   workspaceRoot: string,
   override: string | undefined,
 ): Promise<string> {
-  if (override !== undefined) return path.resolve(process.cwd(), override)
+  if (override !== undefined) return namedCacheDir(override)
   return (await loadCliWorkspace(workspaceRoot)).cacheDir
 }
 
@@ -85,6 +90,13 @@ export interface CliLoadOptions {
   frozen?: boolean
 }
 
+/**
+ * The run path's project-config load (`loadProjects`) for a verb that only
+ * reads: the plugin `project` stage applies, and the local cache opens only
+ * to serve cached evaluations — a pure config costs a stat, not an
+ * evaluation. `scope` is every project or a list of names; no closure, no
+ * lock (a verb reads live, as a default run does).
+ */
 export async function loadCliProjects(
   workspaceRoot: string,
   metas: readonly ProjectMeta[],
@@ -101,7 +113,7 @@ export async function loadCliProjects(
   // glob could select live what the run then treats otherwise.
   const lock = opts.frozen === true ? await readLockfile(workspaceRoot) : null
   if (opts.frozen === true && lock === null) throw new UserError(FROZEN_WITHOUT_LOCK)
-  const cache = new Cache(cacheDir)
+  const cache = new Cache(cacheDir, { read: true, write: true }, workspaceRoot)
   noteSchemaReset(cache, warnToStderr)
   try {
     const loaded = await loadProjects({

package/src/config.ts

@@ -13,6 +13,15 @@ export interface WorkspaceConfig {
    * key (a timed-out task fails and is never cached). Omitted → no default.
    */
   timeout?: number
+  /**
+   * Evict from the local cache at the end of every run that writes to it,
+   * by the same policy `vx cache prune` takes as flags: entries not used
+   * for `olderThan` (`30d`, `12h`), then least-recently-used entries
+   * until the cache is under `maxSize` (`10G`, `500MB`). Either or both.
+   * Omitted → nothing is evicted unless you run `vx cache prune`. Never
+   * folded into a cache key.
+   */
+  cacheRetention?: { olderThan?: string; maxSize?: string }
   /**
    * Plugins registered for this workspace, consulted in this order once
    * per `vx run`: each fills any of the pipeline stages and capabilities
@@ -157,10 +166,29 @@ export interface TaskConfig {
  * cannot express is an error rather than a silent no-op. None of that
  * reaches the config.
  *
- * The baseline is always the task's own declarations: it may read its
- * resolved `cache.inputs.files`, write the prefixes of its
- * `cache.outputs.files`, and reach nothing else. Everything here is on top
- * of that.
+ * The baseline (`sandbox: {}`) grants almost nothing: the task reads
+ * nothing, writes nothing and reaches no network — NOT EVEN ITS OWN
+ * PROJECT DIRECTORY, which is why `allow: { read: ['.'] }` opens almost
+ * every real block. The one grant vx makes for you is dependencies:
+ * `node_modules`, and through it the real path of every workspace
+ * package linked there.
+ *
+ * `cache` grants no access in either direction: `cache.inputs` says what
+ * INVALIDATES a task, `allow` says what it may TOUCH, and deriving one
+ * from the other coupled them both ways — a declaration added for
+ * caching silently widened the sandbox, and a path the task needed had
+ * to be laundered through the cache key to get it (owner, 2026-09-05).
+ * A declared `cache.outputs` is NOT a write grant; the request
+ * `sandbox-request.ts` builds carries no write of its own and binds
+ * `allow.write` alone. This comment claimed the opposite — here and on
+ * both grant fields — while the file beside it and `schema.md` both said
+ * the truth, and no test read the bare baseline it described (item 443).
+ * That case has a test of its own now.
+ *
+ * Enforcement anchors at the WORKSPACE ROOT, so a task cannot leave its
+ * project whatever it declares here. The full account, including what a
+ * write grant costs on Linux, is in `docs/schema.md` under
+ * `exec.sandbox`.
  *
  * Paths are project-relative, absolute, or `~`-expanded — and are path
  * PREFIXES, never globs (a glob cannot be enforced by a mount).
@@ -204,9 +232,18 @@ export interface SandboxConfig {
 }
 
 export interface SandboxGrants {
-  /** Readable path prefixes, beyond the resolved `cache.inputs.files`. */
+  /**
+   * Readable path prefixes, added to the baseline — which is
+   * `node_modules`, NOT `cache.inputs.files`. A task that reads its own
+   * source in the sandbox says so here.
+   */
   read?: string[]
-  /** Writable path prefixes, beyond the `cache.outputs.files` prefixes. */
+  /**
+   * Writable path prefixes. The task can write NOTHING without these:
+   * declaring `cache.outputs.files` grants no write, and a task whose
+   * only declaration is its outputs writes into a tmpfs that evaporates
+   * (vx then warns that `cache.outputs` matched no files).
+   */
   write?: string[]
   /**
    * Reachable domains. `true` allows all, `['*.example.com']` a pattern.
@@ -305,9 +342,9 @@ export interface ExecConfig {
    * Confine this task's process: what it may read, write and reach.
    * Nothing is confined unless this is present.
    *
-   * It sits in `exec` because it constrains the same spawn `env` and
-   * `resources` do — the environment the child gets, the CPU and memory it
-   * gets, the filesystem and network it gets. A group task has no process,
+   * It sits in `exec` because it constrains the same spawn `env` does —
+   * the environment the child gets, the filesystem and network it gets.
+   * A group task has no process,
    * so the field cannot be reached from one.
    *
    * **Policy: fail on violation.** An undeclared touch of the project's own

package/src/exec/executor.ts

@@ -13,11 +13,11 @@
 
 import type { CaptureConfig, RunResult } from './runner.js'
 import type { ResolvedSandboxConfig, SandboxViolation } from './sandbox-runtime.js'
+import { UserError } from '../util/index.js'
 
 /** Sandbox baselines + the user's resolved sandbox block, when the task is sandboxed. */
 export interface ExecuteSandbox {
   readonly baseAllowRead: readonly string[]
-  readonly baseAllowWrite: readonly string[]
   readonly baseDenyRead: readonly string[]
   /**
    * Only denials on a path under this directory are reported. A denial
@@ -25,6 +25,13 @@ export interface ExecuteSandbox {
    * that is the wall doing its job, not a finding to fail a run over.
    */
   readonly reportWithin: string
+  /**
+   * Canonical directories of the workspace packages core withheld from
+   * this task's `node_modules` grant (its key does not answer for them).
+   * A denial under one is reported too: the task reached for a dependency,
+   * which is the finding, not the wall.
+   */
+  readonly reportLinked: readonly string[]
   readonly config: ResolvedSandboxConfig
 }
 
@@ -47,8 +54,8 @@ export interface InputFile {
 export interface TaskInputs {
   /** Declared `cache.inputs.files` + `workspaceFiles` (own outputs excluded), sorted by path. */
   readonly files: readonly InputFile[]
-  /** Declared `cache.inputs.env` names with their resolved values. */
-  readonly env: ReadonlyArray<{ readonly name: string; readonly value: string }>
+  /** Declared `cache.inputs.env` names with their resolved values; `undefined` when unset. */
+  readonly env: ReadonlyArray<{ readonly name: string; readonly value: string | undefined }>
   /** `cache.inputs.runtime` commands and the output that was folded — a toolchain expectation. */
   readonly runtime: ReadonlyArray<{ readonly command: string; readonly output: string }>
   /** `cache.inputs.workspaceRuntime`, same shape. */
@@ -166,8 +173,8 @@ export interface TaskPlacement {
   readonly command: string
   /**
    * Must run on this machine: the task is persistent, depends (transitively)
-   * on a persistent task, or declares `exec.remote: false`. A `remote`
-   * executor is never offered such a task.
+   * on a persistent or sandboxed task, is sandboxed itself, or declares
+   * `exec.remote: false`. A `remote` executor is never offered such a task.
    */
   readonly pinnedLocal: boolean
   /** Declares `cache` — the only tasks whose input set is described, and so the only ones that can ship. */
@@ -204,6 +211,45 @@ export interface TaskExecutor {
   execute(req: ExecuteRequest): Promise<ExecuteResult>
 }
 
+/**
+ * The result an executor resolves with is a plugin's, so its shape is a
+ * boundary: a plugin that resolved `{}` met `res.violations` in core and
+ * became "internal error in <task>: TypeError …" — vx's crash, the plugin's
+ * bug (2026-09-16). Name the executor and the field instead. The factory's
+ * output is checked the same way in `resolveExecutors`.
+ */
+export function assertExecuteResult(
+  executor: string,
+  taskId: string,
+  res: unknown,
+): asserts res is ExecuteResult {
+  const fail = (what: string): never => {
+    throw new UserError(
+      `executor '${executor}' returned an invalid result for ${taskId}: ${what} — a plugin bug, not a task failure`,
+    )
+  }
+  if (typeof res !== 'object' || res === null)
+    fail(`${res === null ? 'null' : typeof res} (expected an object)`)
+  const r = res as Record<string, unknown>
+  for (const key of ['exitCode', 'durationMs']) {
+    if (typeof r[key] !== 'number') fail(`${key} is ${typeof r[key]} (expected a number)`)
+  }
+  for (const key of ['stdout', 'stderr']) {
+    if (typeof r[key] !== 'string') fail(`${key} is ${typeof r[key]} (expected a string)`)
+  }
+  if (!Array.isArray(r['violations']))
+    fail(`violations is ${typeof r['violations']} (expected an array)`)
+  const outputs = r['outputs'] as { kind?: unknown; materialize?: unknown } | undefined
+  if (outputs !== undefined) {
+    if (typeof outputs !== 'object' || outputs === null) fail('outputs is not an object')
+    else if (outputs.kind === 'deferred') {
+      if (typeof outputs.materialize !== 'function')
+        fail('outputs.kind is deferred without a materialize()')
+    } else if (outputs.kind !== 'disk')
+      fail(`outputs.kind is ${String(outputs.kind)} (expected disk or deferred)`)
+  }
+}
+
 /**
  * Place one task: the first executor, in declaration order, that may take
  * it — a `remote` executor is skipped for a `pinnedLocal` task, then

package/src/exec/index.ts

@@ -5,9 +5,12 @@ export { buildIsolatedEnv, VX_RUN_TASK_ENV, VX_RUN_WORKSPACE_ENV } from './env.j
 export {
   runCommand,
   runPersistent,
+  PersistentReadyError,
   shellQuote,
   signalExitCode,
+  exitSignal,
   type CaptureConfig,
+  execWord,
 } from './runner.js'
 export {
   initSandbox,
@@ -20,10 +23,17 @@ export {
   wrapSandboxedCommand,
   type ResolvedSandboxConfig,
   type SandboxViolation,
+  dependencyReason,
+  socketPathRefusal,
+  thrownReason,
 } from './sandbox-runtime.js'
 export { type DeniedCall } from './sandbox-violations.js'
+export { isMountableLiteral, MOUNT_WILDCARDS, toRealPath } from './sandbox-paths.js'
+export { bindableWrites, punchWalls } from './sandbox-binds.js'
 export { localExecutor } from './local-executor.js'
+export { holdGroups, killTree, untilGroupsGone } from './kill-tree.js'
 export {
+  assertExecuteResult,
   selectExecutor,
   type ExecuteRequest,
   type ExecuteResult,

package/src/exec/kill-tree.ts

@@ -0,0 +1,281 @@
+// Signal a task and everything it forked. Every task child is spawned
+// `detached` — its own session and process group — so the group IS the
+// task's tree: the shell, what the shell backgrounded (`server &`), a
+// test runner's workers. Signalling the child alone left all of that
+// alive: a timed-out `sh -c "x & y"` killed the shell and orphaned `x`,
+// and a Ctrl-C did the same for every compound command (2026-09-16). A
+// group signal reaches a member whose parent already died, too — the
+// group outlives its leader — so the order of death does not matter.
+// What still escapes is a daemon that calls setsid itself (the residual
+// every non-cgroup runner shares); under a sandbox the pid namespace
+// takes even that.
+
+import { closeSync, readdirSync, readFileSync, writeSync } from 'node:fs'
+import { executablePath, procfsIsOwn } from '../util/index.js'
+
+export type Child = ReturnType<typeof Bun.spawn>
+
+/**
+ * A child whose polite signals go down a pipe instead of to its group: a
+ * Linux sandboxed task. The group there is bwrap's, whose monitor dies of
+ * a SIGTERM and takes the namespace down with SIGKILL (`--die-with-parent`),
+ * so the command's own cleanup never ran; a shell inside reads the
+ * signal's name off the pipe and signals the command's group (item 752).
+ * SIGKILL still goes to the group: bwrap's death is the hard stop.
+ */
+const channels = new Map<Child, number>()
+
+/** Route `child`'s SIGINT and SIGTERM through `fd`, an end vx owns. */
+export function signalThrough(child: Child, fd: number): void {
+  channels.set(child, fd)
+}
+
+/**
+ * Close `child`'s channel once it has exited. The entry goes before the
+ * descriptor, so a later kill never writes to a number the process has
+ * since reused.
+ */
+export function closeSignalChannel(child: Child): void {
+  const fd = channels.get(child)
+  if (fd === undefined) return
+  channels.delete(child)
+  try {
+    closeSync(fd)
+  } catch {
+    // already closed
+  }
+}
+
+/**
+ * The groups vx must take down if it dies without running a line: a
+ * `kill -9`, the OOM killer. Nothing in vx runs then, so the kill has to
+ * live outside it — one `sh` per vx process, its own group, reading a
+ * pipe only vx holds the write end of. `+<pgid>` and `-<pgid>` lines keep
+ * its list; when vx dies the kernel closes the pipe, the read hits EOF,
+ * and every group still listed is SIGKILLed — what bwrap's
+ * `--die-with-parent` does for a Linux sandboxed task, extended to the
+ * rest. A group signal reaches what the task forked, which
+ * `PR_SET_PDEATHSIG` never did (kill-tree.md). Started just before the
+ * first spawn, so a run that spawns nothing (a warm run) never starts
+ * it; a normal exit leaves the list empty, so the EOF then kills nothing.
+ * `undefined` until then, `null` once it could not start or write: the
+ * guard is best-effort, and its failure is the documented limit, never a
+ * failed task.
+ */
+let guardFd: number | null | undefined
+
+const GUARD_SCRIPT = [
+  "g=' '",
+  'while IFS= read -r l; do',
+  '  case $l in',
+  '    +*) g="$g${l#+} " ;;',
+  '    -*) p=${l#-}; case $g in *" $p "*) g="${g%% $p *} ${g#* $p }" ;; esac ;;',
+  '  esac',
+  'done <&3',
+  'for p in $g; do kill -s KILL -- "-$p"; done 2>/dev/null',
+].join('\n')
+
+function startGuard(): void {
+  if (guardFd !== undefined) return
+  guardFd = null
+  try {
+    const guard = Bun.spawn([executablePath('sh'), '-c', GUARD_SCRIPT], {
+      argv0: 'vx-group-guard',
+      stdio: ['ignore', 'ignore', 'ignore', 'pipe'],
+      // Out of vx's group, so a Ctrl-C at the terminal leaves it to the
+      // pipe; vx's own teardown owns that path.
+      detached: true,
+    })
+    guard.unref()
+    guardFd = guard.stdio[3] as number
+  } catch {
+    // The limit as it was: nothing takes the groups down.
+  }
+}
+
+function guardWrite(line: string): void {
+  if (typeof guardFd !== 'number') return
+  try {
+    writeSync(guardFd, line)
+  } catch {
+    guardFd = null
+  }
+}
+
+/**
+ * Spawn a task child and list its group for the guard to kill if vx dies
+ * holding it. The guard starts BEFORE the spawn: started after it, the
+ * guard's own spawn was a window in which the task ran and a `kill -9`
+ * of vx found its group unlisted — under a traced sandbox, a third of
+ * the kills landed there. What is left is the step from the spawn's
+ * return to one pipe write.
+ */
+export function spawnGuarded(spawn: () => Child): Child {
+  startGuard()
+  const child = spawn()
+  if (child.pid > 0) guardWrite(`+${child.pid}\n`)
+  return child
+}
+
+/**
+ * Strike `child`'s group from the guard's list: vx is done with it. What
+ * it left running is left as before, and a pid the kernel reuses is
+ * never killed on the old task's account. A group a teardown holds is
+ * struck when the teardown lets it go.
+ */
+export function releaseGroup(child: Child): void {
+  if (!(child.pid > 0)) return
+  const hold = holds.get(child.pid)
+  if (hold !== undefined) hold.released = true
+  else guardWrite(`-${child.pid}\n`)
+}
+
+/** Groups a teardown is still taking down: how many hold each, and whether its runner let it go. */
+const holds = new Map<number, { count: number; released: boolean }>()
+
+/**
+ * Keep `children`'s groups on the guard's list until the returned
+ * function runs. A teardown signals a group and waits out a grace for it,
+ * and the runner lets a group go when its LEADER exits: a shell that died
+ * on the signal while a child that ignores it ran on released the group
+ * mid-grace, and a `kill -9` of vx there left that child to nobody (item
+ * 865). The caller lets go once its SIGKILL sweep has settled.
+ */
+export function holdGroups(children: readonly Child[]): () => void {
+  const pids = children.map((c) => c.pid).filter((pid) => pid > 0)
+  for (const pid of pids) {
+    const hold = holds.get(pid)
+    if (hold === undefined) holds.set(pid, { count: 1, released: false })
+    else hold.count++
+  }
+  return () => {
+    for (const pid of pids) {
+      const hold = holds.get(pid)
+      if (hold === undefined) continue
+      if (--hold.count > 0) continue
+      holds.delete(pid)
+      if (hold.released) guardWrite(`-${pid}\n`)
+    }
+  }
+}
+
+/**
+ * Children whose group was empty when their leader exited. Its number is
+ * free from then on, and the kernel hands it to the next process that
+ * needs it: a persistent server stays in the run's registry after it
+ * exits (keep-alive reports it), and a teardown that signalled `-pid`
+ * there could reach whatever group holds the number now (item 874). A
+ * group that still had a member keeps its number reserved, and is
+ * signalled as before.
+ */
+const goneGroups = new WeakSet<Child>()
+
+/** Note, as `child`'s leader exits, whether its group went with it. */
+export function markGroupIfGone(child: Child): void {
+  if (!groupAlive(child)) goneGroups.add(child)
+}
+
+export function killTree(child: Child, signal: 'SIGINT' | 'SIGTERM' | 'SIGKILL'): void {
+  // A pid of 0 would name OUR group (kill(0)): a child that never
+  // spawned has nothing to kill.
+  if (!(child.pid > 0) || goneGroups.has(child)) return
+  const fd = signal === 'SIGKILL' ? undefined : channels.get(child)
+  if (fd !== undefined) {
+    try {
+      writeSync(fd, `${signal.slice(3)}\n`)
+      return
+    } catch {
+      // The reader is gone (EPIPE): so is the command. The group signal
+      // below finds what is left, or nothing.
+    }
+  }
+  try {
+    process.kill(-child.pid, signal)
+  } catch (err) {
+    // ESRCH: the whole group is gone. Anything else (a group that is not
+    // ours to signal): the child itself, as before.
+    if ((err as NodeJS.ErrnoException).code === 'ESRCH') return
+    child.kill(signal)
+  }
+}
+
+/**
+ * How often a group whose leader has exited is asked again whether any
+ * member is left. Only a group that outlived its leader is polled.
+ */
+const GROUP_POLL_MS = 20
+
+/**
+ * Wait until every child's process group is gone, or `graceMs` passes.
+ * Resolves with the children whose group still has a live member: the
+ * ones to SIGKILL. The leader's exit is not the end of the tree — a
+ * `server & wait` shell dies on SIGTERM while a server that ignores it
+ * keeps the group, and the task's pipe, alive — so after the leaders the
+ * groups themselves are polled, and only while one is left.
+ */
+export async function untilGroupsGone(
+  children: readonly Child[],
+  graceMs: number,
+): Promise<Child[]> {
+  const deadline = Date.now() + graceMs
+  let timer: ReturnType<typeof setTimeout> | undefined
+  // Not unref'd: it is what guarantees progress when every other handle
+  // has drained, and the grace is bounded either way.
+  await Promise.race([
+    Promise.allSettled(children.map((c) => c.exited)),
+    new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, graceMs)
+    }),
+  ])
+  if (timer !== undefined) clearTimeout(timer)
+  let left = children.filter(groupAlive)
+  while (left.length > 0 && Date.now() < deadline) {
+    await Bun.sleep(Math.min(GROUP_POLL_MS, deadline - Date.now()))
+    left = left.filter(groupAlive)
+  }
+  return left
+}
+
+/**
+ * Does any process of the child's group still run? `kill(-pgid, 0)`
+ * answers for the group but counts a zombie, and an orphaned member that
+ * died on the SIGTERM waits as one until init reaps it — 1 to 2 s under a
+ * container's init (measured 2026-09-24) — so on Linux a group the kernel
+ * still knows is read from /proc, where a zombie says so — when /proc is
+ * this namespace's. One mounted for another reads as no member at all,
+ * and a group that ignored the SIGTERM went un-killed; there the group
+ * signal is the answer and the grace ends the wait.
+ */
+function groupAlive(child: Child): boolean {
+  if (!(child.pid > 0) || goneGroups.has(child)) return false
+  try {
+    process.kill(-child.pid, 0)
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === 'EPERM'
+  }
+  return !procfsIsOwn() || groupHasLiveMember(child.pid)
+}
+
+function groupHasLiveMember(pgid: number): boolean {
+  let entries: string[]
+  try {
+    entries = readdirSync('/proc')
+  } catch {
+    return true
+  }
+  for (const entry of entries) {
+    const first = entry.charCodeAt(0)
+    if (first < 48 || first > 57) continue
+    let stat: string
+    try {
+      stat = readFileSync(`/proc/${entry}/stat`, 'utf8')
+    } catch {
+      continue
+    }
+    // `<pid> (<comm>) <state> <ppid> <pgrp> …` — comm may hold spaces and
+    // parens, so the fields start after the LAST ')'.
+    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ', 3)
+    if (Number(fields[2]) === pgid && fields[0] !== 'Z' && fields[0] !== 'X') return true
+  }
+  return false
+}

package/src/exec/local-executor.ts

@@ -31,9 +31,9 @@ export function localExecutor(): TaskExecutor {
       return runSandboxed({
         ...common,
         baseAllowRead: req.sandbox.baseAllowRead,
-        baseAllowWrite: req.sandbox.baseAllowWrite,
         baseDenyRead: req.sandbox.baseDenyRead,
         reportWithin: req.sandbox.reportWithin,
+        reportLinked: req.sandbox.reportLinked,
         config: req.sandbox.config,
       })
     },