@vzn/vx 0.0.313 → 0.0.315

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.313",
+  "version": "0.0.315",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.313",
-    "@vzn/vx-linux-arm64": "0.0.313",
-    "@vzn/vx-darwin-x64": "0.0.313",
-    "@vzn/vx-darwin-arm64": "0.0.313"
+    "@vzn/vx-linux-x64": "0.0.315",
+    "@vzn/vx-linux-arm64": "0.0.315",
+    "@vzn/vx-darwin-x64": "0.0.315",
+    "@vzn/vx-darwin-arm64": "0.0.315"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/info.ts

@@ -114,13 +114,17 @@ export function renderInfo(f: InfoFacts): string {
 }
 
 /**
- * `available (3 tasks declare exec.sandbox)`, or `unavailable — <why>; 3
+ * `available (3 tasks declare exec.sandbox)`, with `, untraced — <why>, so
+ * the reads it denies go unreported` where no strace can trace, or
+ * `unavailable — <why>; 3
  * tasks declare exec.sandbox and will fail`: a declared sandbox whose
  * runtime cannot start fails the task, so the doctor names it before a run
  * does.
  */
 function describeSandbox(s: InfoFacts['sandbox']): string {
   const declared = `${s.declared} task${s.declared === 1 ? '' : 's'} declare${s.declared === 1 ? 's' : ''} exec.sandbox`
+  if (s.available && s.untraced !== null)
+    return `available (${declared}), untraced — ${s.untraced}, so the reads it denies go unreported`
   if (s.available) return `available (${declared})`
   return `unavailable — ${s.reason}; ${declared}${s.declared > 0 ? ' and will fail' : ''}`
 }

package/src/exec/index.ts

@@ -17,6 +17,7 @@ export {
   probeSandbox,
   unavailableReason,
   resetSandbox,
+  untracedReason,
   resolveSandboxConfig,
   runSandboxed,
   releaseBridges,

package/src/exec/sandbox-runtime.ts

@@ -1994,11 +1994,13 @@ function writeGrantMatchedNothing(grant: string): void {
 /**
  * Memoized check: is `strace` on PATH on a Linux host, and does it know
  * `--seccomp-bpf` (5.3+)? `'seccomp'` is the fast form; `'plain'` traces
- * every syscall through ptrace and is kept only for an old strace.
+ * every syscall through ptrace and is kept only for an old strace. `why`
+ * names what is missing when there is no form, for the warning and for
+ * `vx info`.
  */
-let straceAvailableCache: false | 'plain' | 'seccomp' | undefined
-async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
-  if (process.platform !== 'linux') return false
+let straceAvailableCache: { form: false | 'plain' | 'seccomp'; why: string } | undefined
+async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
+  if (process.platform !== 'linux') return { form: false, why: '' }
   if (straceAvailableCache !== undefined) return straceAvailableCache
   try {
     const p = Bun.spawn([executablePath('strace'), '--version'], {
@@ -2008,26 +2010,45 @@ async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
     const out = await new Response(p.stdout).text()
     await p.exited
     if (p.exitCode !== 0) {
-      straceAvailableCache = false
-      warnUntraced(`strace --version exited ${p.exitCode}`)
+      straceAvailableCache = { form: false, why: `strace --version exited ${p.exitCode}` }
     } else {
       const m = /version (\d+)\.(\d+)/.exec(out)
       const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
       const form = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
-      straceAvailableCache = (await traceAttaches(form)) ? form : false
+      const refused = await traceRefusal(form)
+      straceAvailableCache =
+        refused === null
+          ? { form, why: '' }
+          : { form: false, why: `strace cannot trace here (${refused})` }
     }
   } catch {
     // Not on PATH. Said as the refused attach is: without it an undeclared
     // read is denied but never reported, so a task that tolerates the miss
     // passes and caches with no word of it (J's lead).
-    straceAvailableCache = false
-    warnUntraced('strace is not on PATH')
+    straceAvailableCache = { form: false, why: 'strace is not on PATH' }
   }
   return straceAvailableCache
 }
 
+async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
+  const { form, why } = await straceState()
+  if (form === false && why !== '') warnUntraced(why)
+  return form
+}
+
+/**
+ * Why a sandboxed task on this host runs without the report of the reads
+ * the sandbox denied, or null when it is traced (or the host is not
+ * Linux, where the report does not come from strace). Says nothing on
+ * stderr: `vx info` reports it as a fact (B-51's lead).
+ */
+export async function untracedReason(): Promise<string | null> {
+  const { why } = await straceState()
+  return why === '' ? null : why
+}
+
 /**
- * Whether strace may attach here, asked once with the flags a task's trace
+ * Why strace may not attach here (null when it may), asked once with the flags a task's trace
  * uses (`ownGroupCommand`). `--version` answers on a host that refuses
  * ptrace (Yama's `ptrace_scope` 2 or 3, a container's seccomp profile),
  * and there every sandboxed task failed twice, the retry included, on
@@ -2035,7 +2056,7 @@ async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {
  * run goes untraced, as without strace: bwrap still enforces, and only the
  * read-violation report is lost, which is said once.
  */
-async function traceAttaches(form: 'plain' | 'seccomp'): Promise<boolean> {
+async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
   const p = Bun.spawn(
     [
       executablePath('strace'),
@@ -2053,9 +2074,8 @@ async function traceAttaches(form: 'plain' | 'seccomp'): Promise<boolean> {
     { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe' },
   )
   const err = await new Response(p.stderr).text()
-  if ((await p.exited) === 0) return true
-  warnUntraced(`strace cannot trace here (${err.trim().split('\n')[0] ?? `exit ${p.exitCode}`})`)
-  return false
+  if ((await p.exited) === 0) return null
+  return err.trim().split('\n')[0] || `exit ${p.exitCode}`
 }
 let warnedNoTrace = false
 

package/src/orchestrator/doctor.ts

@@ -18,7 +18,7 @@ import {
   machineParallelism,
 } from '../util/index.js'
 import { VERSION } from '../version.js'
-import { probeSandbox, resetSandbox } from '../exec/index.js'
+import { probeSandbox, resetSandbox, untracedReason } from '../exec/index.js'
 import {
   buildPackageGraph,
   computeWorkspaceFingerprint,
@@ -97,9 +97,12 @@ export interface InfoFacts {
    * tasks declare one. A declared sandbox whose runtime cannot start is a
    * hard failure at run time, not a downgrade — so the doctor says so
    * first (root inside a container, a missing bubblewrap, a nested
-   * seatbelt), with the probe's own reason.
+   * seatbelt), with the probe's own reason. `untraced` is why an available
+   * Linux sandbox cannot report the reads it denied (no `strace`, or one
+   * that may not attach), else null: the sandbox still enforces, and a task
+   * that tolerates a denied read passes with no word of it.
    */
-  sandbox: { available: boolean; reason: string; declared: number }
+  sandbox: { available: boolean; reason: string; declared: number; untraced: string | null }
 }
 
 export interface CollectInfoOptions {
@@ -231,10 +234,16 @@ export async function collectInfo(cwd: string, opts: CollectInfoOptions = {}): P
 async function sandboxFact(declared: number): Promise<InfoFacts['sandbox']> {
   try {
     const verdict = await probeSandbox()
-    return { available: verdict.available, reason: stableSandboxReason(verdict.reason), declared }
+    const untraced = verdict.available ? await untracedReason() : null
+    return {
+      available: verdict.available,
+      reason: stableSandboxReason(verdict.reason),
+      declared,
+      untraced,
+    }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
-    return { available: false, reason: stableSandboxReason(message), declared }
+    return { available: false, reason: stableSandboxReason(message), declared, untraced: null }
   } finally {
     await resetSandbox()
   }

package/src/workspace/migrate-scripts.ts

@@ -254,6 +254,33 @@ function upstreamBuildOnWorker(tasks: GeneratedTask[]): void {
 const RUNS_MEMBERS =
   /(^|[\s;&|(])(turbo|nx|lerna|ultra|wireit|nps|moon|rush|vx)(\s|$)|\s(-r|--recursive|--filter|-F|--workspaces|-ws|--workspace|-w|-C|--dir|--cwd|--prefix|--if-present|--parallel|--stream)(\s|=|$)|\bworkspaces?\s+(foreach|run)\b|\bvp\s+run\s|\bcd\s/
 
+/** A package manager running a script by name: `pnpm build`, `npm run x`, `bun run x`. */
+const RUNS_SCRIPT =
+  /(?:^|[\s;&|(])(?:pnpm|npm|yarn|bun)\s+(?:run(?:-script)?\s+)?([^\s;&|()'"-][^\s;&|()'"]*)/g
+
+/**
+ * The scripts that run the members, directly or through another of these
+ * scripts: vite's `ci-docs` (`pnpm build && pnpm docs-build`) runs each
+ * member's build through the root's own `build` (`pnpm -r … run build`).
+ */
+function runningMembers(scripts: Readonly<Record<string, unknown>>): Set<string> {
+  const text = Object.entries(scripts).filter(
+    (e): e is [string, string] => typeof e[1] === 'string',
+  )
+  const out = new Set(text.filter(([, v]) => RUNS_MEMBERS.test(` ${v}`)).map(([n]) => n))
+  for (let grew = true; grew;) {
+    grew = false
+    for (const [n, v] of text) {
+      if (out.has(n)) continue
+      if ([...v.matchAll(RUNS_SCRIPT)].some((m) => out.has(m[1]!))) {
+        out.add(n)
+        grew = true
+      }
+    }
+  }
+  return out
+}
+
 /**
  * `outside`: the root manifest when the root is no member (pnpm's and
  * Yarn's default), whose own scripts (`lint: eslint .`) went unmapped
@@ -296,12 +323,15 @@ export function migrateScripts(
       .filter(([, v]) => typeof v === 'string' && v !== '')
       .map(([n]) => n),
   )
-  const rootScripts = (meta: ProjectMeta): Record<string, unknown> =>
-    Object.fromEntries(
-      Object.entries(scriptsOf(meta)).filter(
-        ([n, v]) => typeof v === 'string' && !memberTasks.has(n) && !RUNS_MEMBERS.test(` ${v}`),
+  const rootScripts = (meta: ProjectMeta): Record<string, unknown> => {
+    const scripts = scriptsOf(meta)
+    const runs = runningMembers(scripts)
+    return Object.fromEntries(
+      Object.entries(scripts).filter(
+        ([n, v]) => typeof v === 'string' && !memberTasks.has(n) && !runs.has(n),
       ),
     )
+  }
   const rootMapped =
     rootMeta === undefined
       ? 0