@vzn/vx 0.0.215 → 0.0.217

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.215",
+  "version": "0.0.217",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.215",
-    "@vzn/vx-linux-arm64": "0.0.215",
-    "@vzn/vx-darwin-x64": "0.0.215",
-    "@vzn/vx-darwin-arm64": "0.0.215"
+    "@vzn/vx-linux-x64": "0.0.217",
+    "@vzn/vx-linux-arm64": "0.0.217",
+    "@vzn/vx-darwin-x64": "0.0.217",
+    "@vzn/vx-darwin-arm64": "0.0.217"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/inputs.ts

@@ -79,6 +79,10 @@ const ALWAYS_IGNORE = [
   // file that a CONCURRENT compile is mid-write, racing to EACCES/ENOENT. Always
   // exclude it (vx is Bun-native; compiling standalone binaries is a common task).
   '**/*.bun-build',
+  // …and, cross-compiling for a target its cache lacks, the directory it
+  // extracts the downloaded runtime into, `<cwd>/.<16 hex>-<8 hex>.tmp/`,
+  // 60 MB mid-write under the same race (2026-09-29).
+  '**/.????????????????-????????.tmp/**',
 ]
 
 const DEFAULT_FILE_GLOBS: readonly string[] = ['**/*']

package/src/exec/sandbox-binds.ts

@@ -5,7 +5,13 @@
 
 import { lstatSync, readdirSync, statSync } from 'node:fs'
 import path from 'node:path'
-import { isMountableLiteral, localBindingOn, unique } from './sandbox-paths.js'
+import {
+  atOrUnder,
+  isMountableLiteral,
+  localBindingOn,
+  MOUNT_WILDCARDS,
+  unique,
+} from './sandbox-paths.js'
 import type { SandboxedRunArgs } from './sandbox-runtime.js'
 
 type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
@@ -42,6 +48,37 @@ export function bindableWrites(paths: readonly string[]): string[] {
   )
 }
 
+/**
+ * The write globs that matched nothing when the task started, split by
+ * where the task's writes under them go. A glob no mount holds is not
+ * lost: a path in the workspace that no read or write bind covers is the
+ * deny anchor's scratch, and a task may create, write and remove there —
+ * nothing it leaves outlives the sandbox. That is a tool's temp directory:
+ * `bun build --compile` extracts a cross-compile runtime into
+ * `<cwd>/.<hash>-00000000.tmp/` and renames it into its cache, and no
+ * bind could name that directory before it existed (2026-09-29). Where a
+ * read grant mounts the glob's directory read-only, or it lies outside the
+ * workspace, a write under it fails (`mountless`, warned before the task).
+ */
+export function scratchWrites(
+  pending: readonly string[],
+  fs: {
+    readonly allowRead?: readonly string[] | undefined
+    readonly allowWrite?: readonly string[] | undefined
+  },
+  anchors: readonly string[],
+): { scratch: string[]; mountless: string[] } {
+  const binds = [...(fs.allowRead ?? []), ...(fs.allowWrite ?? [])]
+  const scratch: string[] = []
+  const mountless: string[] = []
+  for (const glob of pending) {
+    const dir = path.dirname(glob.slice(0, glob.search(MOUNT_WILDCARDS) + 1))
+    const free = anchors.some((a) => atOrUnder(dir, a)) && !binds.some((b) => atOrUnder(dir, b))
+    ;(free ? scratch : mountless).push(glob)
+  }
+  return { scratch, mountless }
+}
+
 /**
  * A read grant with the WALLS inside it cut out: the directories of the
  * projects nested in this one, the repository and vx's own directory. A

package/src/exec/sandbox-runtime.ts

@@ -62,7 +62,7 @@ import {
   UserError,
   xxh3hex,
 } from '../util/index.js'
-import { bindableWrites, buildCustomConfig } from './sandbox-binds.js'
+import { bindableWrites, buildCustomConfig, scratchWrites } from './sandbox-binds.js'
 import {
   atOrUnder,
   isMountableLiteral,
@@ -76,7 +76,12 @@ import {
   scopedMandatoryDenies,
   srtDefaultWritePaths,
 } from './sandbox-deny-scan.js'
-import { parseStraceViolations, refusedWrites, reportableViolations } from './sandbox-violations.js'
+import {
+  parseStraceViolations,
+  refusedWrites,
+  refusedWritesOutside,
+  reportableViolations,
+} from './sandbox-violations.js'
 import {
   closeSignalChannel,
   killTree,
@@ -679,6 +684,11 @@ export interface ResolvedSandboxConfig {
   allowRead: readonly string[]
   /** Writable path prefixes, absolute. */
   allowWrite: readonly string[]
+  /**
+   * Linux: the write globs that matched nothing when the task started, so
+   * no mount holds them. `scratchWrites` decides which still cover a write.
+   */
+  pendingWrites?: readonly string[]
   network?: true | readonly string[]
   denyNetwork?: readonly string[]
   systemInfo?: readonly string[]
@@ -784,18 +794,20 @@ export function resolveSandboxConfig(
     return toRealPath(path.resolve(projectDir, p))
   }
   const a = cfg.allow ?? {}
+  const pending: string[] = []
   const r: ResolvedSandboxConfig = {
-    allowRead: expandGrants((a.read ?? []).map(resolve), 'read', walls),
+    allowRead: expandGrants((a.read ?? []).map(resolve), walls),
     allowWrite: expandGrants(
       (a.write ?? []).map((p) => {
         const real = resolve(p)
         assertWriteStaysHome(p, real, projectDir)
         return real
       }),
-      'write',
       walls,
+      pending,
     ),
   }
+  if (pending.length > 0) r.pendingWrites = pending
   if (process.platform === 'darwin') {
     const read = wallsGlobsReach(r.allowRead, walls)
     const write = wallsGlobsReach(r.allowWrite, walls)
@@ -920,6 +932,8 @@ export async function wrapSandboxedCommand(
   /** What SRT wrapped, and so what its store keys a record by (the group wrapper included on Linux). */
   srtCommand: string
   baselines: CanonicalBaselines
+  /** The pending write globs a write may still land under (`scratchWrites`). */
+  scratch: string[]
   /** The command reads its polite signals off fd 3: spawn it with one and `signalThrough` it. */
   forwardsSignals: boolean
   /** The command writes its trace to fd TRACE_FD: spawn it with the log there. */
@@ -942,6 +956,7 @@ export async function wrapSandboxedCommand(
 
   const baselines = canonicalBaselines(args)
   const customConfig = buildCustomConfig(args, baselines)
+  const scratch = pendingWriteGrants(args.config, customConfig!.filesystem!, baselines.denyRead)
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
   if (scopedDenyScan) {
@@ -998,6 +1013,7 @@ export async function wrapSandboxedCommand(
     taggedCommand,
     srtCommand: inner,
     baselines,
+    scratch,
     forwardsSignals: grouped.forwards,
     traced: grouped.traced,
   }
@@ -1353,7 +1369,7 @@ async function runSandboxedOnce(
   // kernel filter stops only on `openat`. strace ≥ 5.3 (2019); an older
   // one gets the slow form rather than no detection.
   const useStrace = await wantsStraceDetection()
-  const { wrapped, tag, srtCommand, baselines, forwardsSignals, traced } =
+  const { wrapped, tag, srtCommand, baselines, scratch, forwardsSignals, traced } =
     await wrapSandboxedCommand({ ...args, ...(useStrace ? { trace: useStrace } : {}) })
   const takeRecords = collectRecords(SandboxManager.getSandboxViolationStore(), srtCommand)
   // Beside the task directories, which every sandbox replaces with its own:
@@ -1511,6 +1527,7 @@ async function runSandboxedOnce(
             // included, not by the tagged command macOS is keyed by.
             records.map((v) => v.line),
             bindableWrites(args.config.allowWrite),
+            scratch,
           ),
         ]
       : []
@@ -1525,11 +1542,24 @@ async function runSandboxedOnce(
   // ignoreViolations through to the log monitor — that filter is set
   // once globally at initSandbox time. So per-task user overrides have
   // to be applied here, after read-back.
-  const violations = reportableViolations([...macViolations, ...linuxViolations], {
+  const recorded = [...macViolations, ...linuxViolations]
+  const violations = reportableViolations(recorded, {
     within: args.reportWithin,
     linked: args.reportLinked,
     config: args.config,
   })
+  // A write refused past the wall is not a violation (nothing a key reads),
+  // but it may be why the task failed: name it, never counted, and only on
+  // a failure, so it can never redden a pass.
+  if (exitCode !== 0) {
+    const outside = refusedWritesOutside(recorded, {
+      within: args.reportWithin,
+      linked: args.reportLinked,
+      config: args.config,
+      skip: [taskTmpRoot(), ...srtDefaultWritePaths()],
+    })
+    if (outside.length > 0) violations.push(outsideWritesHint(outside))
+  }
 
   // The one denial macOS never logs. MEASURED 2026-09-05, same machine, two
   // runs differing only in the grant: with the cwd granted a failing task
@@ -1585,6 +1615,23 @@ async function runSandboxedOnce(
   }
 }
 
+/** The hint for writes refused outside the project, a few paths named. */
+function outsideWritesHint(paths: readonly string[]): SandboxViolation {
+  const shown = paths.slice(0, 5).join(', ')
+  const more = paths.length > 5 ? ` and ${paths.length - 5} more` : ''
+  const home = toRealPath(os.homedir())
+  const dir = path.dirname(paths[0]!)
+  const spelled = atOrUnder(dir, home) ? `~${dir.slice(home.length)}` : dir
+  return {
+    timestamp: new Date(),
+    hint: true,
+    line:
+      `vx: the sandbox refused writes outside the project, which are not reported as ` +
+      `violations: ${shown}${more}. If the task needs one, grant its directory, e.g. ` +
+      `\`allow: { write: ['${spelled}/'] }\`.`,
+  }
+}
+
 /**
  * Is `dir` inside a path the sandbox granted for reading? bwrap binds and
  * seatbelt rules are both prefix-based, so a grant covers the subtree.
@@ -1822,17 +1869,28 @@ export function darwinWallRules(
  */
 function expandGrants(
   paths: readonly string[],
-  kind: 'read' | 'write',
   walls: readonly string[],
+  /** Write globs only: where a pattern that matched nothing is put. */
+  unmatched?: string[],
 ): string[] {
   // A pattern covering a directory WHOLE is that directory. `<d>/**/*` and
   // `<d>/**` match everything UNDER `<d>` and never `<d>` itself, so a task
   // granted `read: ['**/*']` still could not list its own cwd — the exact
   // shape `bun test` and `oxlint` need. Collapsing is not a widening: the
   // pattern already covered every file there; it adds the directory entry.
-  const collapsed = paths.map((p) => {
+  //
+  // On macOS a `<d>` that is itself a glob keeps its subtree as `<d>/**/*`:
+  // SRT matches a glob as an exact regex and a literal as a subpath, so the
+  // collapsed `.*.tmp` alone covered the directory and nothing in it, and
+  // `bun build --compile` could create its extraction directory but not
+  // the runtime inside it (2026-09-29). Not `<d>/**`: SRT strips a trailing
+  // `/**` before it compiles the regex (`removeTrailingGlobSuffix`), which
+  // CI's `cp: .a1.tmp/f: Operation not permitted` showed.
+  const collapsed = paths.flatMap((p) => {
     const m = /^(.*?)\/\*\*(?:\/\*)?$/.exec(p)
-    return m === null ? p : m[1]!
+    if (m === null) return [p]
+    const dir = m[1]!
+    return process.platform !== 'linux' && !isMountableLiteral(dir) ? [dir, `${dir}/**/*`] : [dir]
   })
   if (process.platform !== 'linux') return collapsed
   const out: string[] = []
@@ -1866,7 +1924,7 @@ function expandGrants(
       out.push(abs)
       hits++
     }
-    if (hits === 0 && kind === 'write') writeGrantMatchedNothing(p)
+    if (hits === 0) unmatched?.push(p)
   }
   return out
 }
@@ -1889,6 +1947,26 @@ function scanOrNothing(pattern: string, base: string): Iterable<string> {
   }
 }
 
+/**
+ * The write globs that matched nothing at the start (Linux): the ones a
+ * write may still land under, in the sandbox's scratch, returned; the ones
+ * a read-only mount or the host's root holds, reported once each
+ * (`writeGrantMatchedNothing`). `anchors` are the deny anchors the scratch
+ * is made of.
+ */
+export function pendingWriteGrants(
+  config: Pick<ResolvedSandboxConfig, 'pendingWrites'>,
+  fs: {
+    readonly allowRead?: readonly string[] | undefined
+    readonly allowWrite?: readonly string[] | undefined
+  },
+  anchors: readonly string[],
+): string[] {
+  const { scratch, mountless } = scratchWrites(config.pendingWrites ?? [], fs, anchors)
+  for (const grant of mountless) writeGrantMatchedNothing(grant)
+  return scratch
+}
+
 /** Grants already reported — once per process, not per spawn. */
 const warnedEmptyWriteGrant = new Set<string>()
 
@@ -1905,8 +1983,9 @@ function writeGrantMatchedNothing(grant: string): void {
   if (warnedEmptyWriteGrant.has(grant)) return
   warnedEmptyWriteGrant.add(grant)
   process.stderr.write(
-    `[vx] sandbox: the write grant ${grant} matches nothing yet, so it mounts nothing and ` +
-      `a file the task creates under it will fail with "Read-only file system". A bind mount ` +
+    `[vx] sandbox: the write grant ${grant} matches nothing yet, and a read grant mounts its ` +
+      `directory read-only, so a file the task creates under it will fail with "Read-only file ` +
+      `system". A bind mount ` +
       `covers what exists when the task starts — grant the directory instead: ` +
       `${grantPrefix(grant)}/**\n`,
   )

package/src/exec/sandbox-violations.ts

@@ -200,15 +200,59 @@ export function reportableViolations(
   // A record the producer did not describe is a seatbelt one, straight
   // from SRT's store — parse it here so the filters below never see a
   // platform's line format.
-  const described = violations.map((v) =>
-    v.target === undefined ? { ...v, ...describeMacViolation(v.line) } : v,
-  )
   return filterIgnored(
-    loopbackNoise(withinReported(described, opts.within, opts.linked ?? []), opts.config),
+    loopbackNoise(
+      withinReported(describe(violations), opts.within, opts.linked ?? []),
+      opts.config,
+    ),
     opts.config.ignore,
   )
 }
 
+/**
+ * The writes refused OUTSIDE the project, as distinct paths: the denials
+ * `reportableViolations` drops at the wall. A read there is the walk every
+ * process makes from `/`, but a refused write is the task failing to put
+ * something it needed: `bun build --compile` extracting a cross-compile
+ * runtime into `~/.bun/install/cache` said only "Failed to extract
+ * executable" and the report named nothing (2026-09-29). Never a
+ * violation — a failed task's hint (`runSandboxed`). The kernel's
+ * pseudo-files, a descriptor's non-path, and what `skip` names (the task's
+ * own temp root, SRT's default write paths) are left out: Linux's observer
+ * records every write ATTEMPT, and a write to `/dev/null` or the task's
+ * `TMPDIR` landed.
+ */
+export function refusedWritesOutside(
+  violations: readonly SandboxViolation[],
+  opts: {
+    within: string
+    linked?: readonly string[]
+    config: ResolvedSandboxConfig
+    skip: readonly string[]
+  },
+): string[] {
+  const reported = reportedWithin(opts.within, opts.linked ?? [])
+  const skip = ['/dev', '/proc', '/sys', ...opts.skip.map(toRealPath)]
+  const paths = new Set<string>()
+  for (const v of filterIgnored(describe(violations), opts.config.ignore)) {
+    // Write-only: a strace record is ignorable as a read OR a write, and
+    // names a READ (a sibling's file at the wall is the sandbox working).
+    const write = v.ignorable?.length === 1 && v.ignorable[0] === 'write'
+    // Absolute only: a descriptor the runtime writes through (`/proc/self/fd/N`)
+    // canonicalizes to `anon_inode:[eventfd]`, which names no place.
+    if (v.path === undefined || !path.isAbsolute(v.path) || !write || reported(v)) continue
+    if (!skip.some((s) => atOrUnder(v.path!, s))) paths.add(v.path)
+  }
+  return [...paths]
+}
+
+/** Every record described: a seatbelt one parsed, a Linux one as produced. */
+function describe(violations: readonly SandboxViolation[]): SandboxViolation[] {
+  return violations.map((v) =>
+    v.target === undefined ? { ...v, ...describeMacViolation(v.line) } : v,
+  )
+}
+
 /**
  * Drop the loopback denial no grant can avoid.
  *
@@ -261,15 +305,20 @@ function withinReported(
   within: string,
   linked: readonly string[],
 ): SandboxViolation[] {
+  return violations.filter(reportedWithin(within, linked))
+}
+
+function reportedWithin(
+  within: string,
+  linked: readonly string[],
+): (v: SandboxViolation) => boolean {
   const roots = [toRealPath(within), ...linked]
   // `root === '/'` would otherwise compare against `'//'` and drop
   // everything — the one prefix that needs no separator appended.
   const prefixes = roots.map((root) => (root.endsWith(path.sep) ? root : root + path.sep))
-  return violations.filter(
-    (v) =>
-      v.path === undefined ||
-      roots.some((root, i) => v.path === root || v.path!.startsWith(prefixes[i]!)),
-  )
+  return (v) =>
+    v.path === undefined ||
+    roots.some((root, i) => v.path === root || v.path!.startsWith(prefixes[i]!))
 }
 
 /**
@@ -300,8 +349,11 @@ function filterIgnored(
 export function refusedWrites(
   records: readonly string[],
   writable: readonly string[],
+  /** Write globs whose writes land in the sandbox's scratch (`scratchWrites`): granted. */
+  scratch: readonly string[] = [],
 ): SandboxViolation[] {
   const binds = new Set(writable.map((w) => toRealPath(absolutize(w))))
+  const globs = scratch.map((g) => new Bun.Glob(g))
   const seen = new Set<string>()
   const out: SandboxViolation[] = []
   for (const record of records) {
@@ -309,7 +361,7 @@ export function refusedWrites(
     if (m === null) continue
     const [, syscall, raw] = m as unknown as [string, string, string]
     const abs = toRealPath(raw)
-    if (isUnderAny(abs, binds)) continue
+    if (isUnderAny(abs, binds) || underGlob(abs, globs)) continue
     const key = `${syscall}|${abs}`
     if (seen.has(key)) continue
     seen.add(key)
@@ -323,3 +375,12 @@ export function refusedWrites(
   }
   return out
 }
+
+/** `p`, or a directory holding it, matches one of `globs`. */
+function underGlob(p: string, globs: readonly InstanceType<typeof Bun.Glob>[]): boolean {
+  if (globs.length === 0) return false
+  for (let at = p; ; at = path.dirname(at)) {
+    if (globs.some((g) => g.match(at))) return true
+    if (path.dirname(at) === at) return false
+  }
+}

package/src/orchestrator/sandbox-request.ts

@@ -415,15 +415,16 @@ async function prepareOutputsForBind(
     const hasWildcard = !isMountableLiteral(g)
     // A grant OUTSIDE the project is the user's own path — never joined
     // onto the project dir, which would create a literal `~` there. Its
-    // directory is still created when the grant is a glob, because then
-    // the static prefix is unambiguously a directory and bwrap cannot
-    // bind one that does not exist: `~/.bun/install/cache/**` on a runner
-    // that has never populated it silently granted nothing, and the task
-    // failed with the tool's own confusing message (`bun build --compile`
-    // reported a network error for an unwritable cache; 2026-09-05).
+    // directory is still created when the grant names one — a glob's
+    // static prefix, or a literal spelled `dir/` — because bwrap cannot
+    // bind a directory that does not exist: `~/.bun/install/cache/**` on a
+    // runner that has never populated it silently granted nothing, and the
+    // task failed with the tool's own confusing message (`bun build
+    // --compile` reported a network error for an unwritable cache;
+    // 2026-09-05). The `dir/` spelling was skipped until 2026-09-29.
     if (path.isAbsolute(g) || g.startsWith('~')) {
-      if (!hasWildcard) continue
-      const abs = expandHome(grantPrefix(g))
+      if (!hasWildcard && !g.endsWith('/')) continue
+      const abs = expandHome(hasWildcard ? grantPrefix(g) : g)
       await mkdir(abs, { recursive: true }).catch(() => undefined)
       continue
     }