@vzn/vx 0.0.253 → 0.0.255

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.253",
+  "version": "0.0.255",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.253",
-    "@vzn/vx-linux-arm64": "0.0.253",
-    "@vzn/vx-darwin-x64": "0.0.253",
-    "@vzn/vx-darwin-arm64": "0.0.253"
+    "@vzn/vx-linux-x64": "0.0.255",
+    "@vzn/vx-linux-arm64": "0.0.255",
+    "@vzn/vx-darwin-x64": "0.0.255",
+    "@vzn/vx-darwin-arm64": "0.0.255"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/inputs.ts

@@ -22,6 +22,7 @@ import { rm, rmdir } from 'node:fs/promises'
 import type { CacheInputs } from '../config.js'
 import {
   asTrees,
+  executablePath,
   isExecutableMissing,
   isLiteralPattern,
   normalizeGlob,
@@ -389,7 +390,11 @@ async function runRuntimeCommand(
   const prefix = binDirs.join(path.delimiter)
   let proc
   try {
-    const argv = process.platform === 'win32' ? shellArgv(command) : ['sh', '-c', command]
+    // vx's own `sh`, resolved on its PATH before the probe's: Bun.spawn looks
+    // a bare name up on the child's PATH, which leads with the project's
+    // `node_modules/.bin`, so a dependency's `sh` bin ran every probe (J-69).
+    const argv =
+      process.platform === 'win32' ? shellArgv(command) : [executablePath('sh'), '-c', command]
     proc = Bun.spawn(argv, {
       cwd,
       env: { ...process.env, PATH: ambient ? `${prefix}${path.delimiter}${ambient}` : prefix },

package/src/exec/sandbox-runtime.ts

@@ -2007,15 +2007,21 @@ async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
     })
     const out = await new Response(p.stdout).text()
     await p.exited
-    if (p.exitCode !== 0) straceAvailableCache = false
-    else {
+    if (p.exitCode !== 0) {
+      straceAvailableCache = false
+      warnUntraced(`strace --version exited ${p.exitCode}`)
+    } else {
       const m = /version (\d+)\.(\d+)/.exec(out)
       const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
       const form = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
       straceAvailableCache = (await traceAttaches(form)) ? form : false
     }
   } catch {
+    // Not on PATH. Said as the refused attach is: without it an undeclared
+    // read is denied but never reported, so a task that tolerates the miss
+    // passes and caches with no word of it (J's lead).
     straceAvailableCache = false
+    warnUntraced('strace is not on PATH')
   }
   return straceAvailableCache
 }
@@ -2048,14 +2054,17 @@ async function traceAttaches(form: 'plain' | 'seccomp'): Promise<boolean> {
   )
   const err = await new Response(p.stderr).text()
   if ((await p.exited) === 0) return true
-  if (!warnedNoTrace) {
-    warnedNoTrace = true
-    process.stderr.write(
-      `[vx] sandbox: strace cannot trace here (${err.trim().split('\n')[0] ?? `exit ${p.exitCode}`}), ` +
-        `so sandboxed tasks run without the report of the reads the sandbox denied; ` +
-        `the sandbox still enforces\n`,
-    )
-  }
+  warnUntraced(`strace cannot trace here (${err.trim().split('\n')[0] ?? `exit ${p.exitCode}`})`)
   return false
 }
 let warnedNoTrace = false
+
+/** Said once per process: why sandboxed tasks run untraced, and what that loses. */
+function warnUntraced(why: string): void {
+  if (warnedNoTrace) return
+  warnedNoTrace = true
+  process.stderr.write(
+    `[vx] sandbox: ${why}, so sandboxed tasks run without the report of the reads the sandbox denied; ` +
+      `the sandbox still enforces\n`,
+  )
+}

package/src/workspace/project-loader.ts

@@ -256,9 +256,11 @@ export function configLoadError(err: unknown, configPath: string, kind: string):
   if (name === 'ResolveMessage') {
     const spec = /Cannot find (?:package|module) ['"]([^'"]+)['"]/.exec(message)?.[1]
     const what = spec === undefined ? message.replace(BUST_QUERY, '') : `cannot find '${spec}'`
+    // The package the specifier names (`@vzn/vx-otel/x` → `@vzn/vx-otel`):
+    // a missing plugin was told to install core (J-59).
     const hint =
       spec?.startsWith('@vzn/vx') === true
-        ? `; install it in the workspace: bun add -d @vzn/vx`
+        ? `; install it in the workspace: bun add -d ${spec.split('/').slice(0, 2).join('/')}`
         : ''
     return new UserError(`${kind} config ${configPath}: ${what}${hint}`)
   }