@vzn/vx 0.0.332 → 0.0.334

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.332",
+  "version": "0.0.334",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.332",
-    "@vzn/vx-linux-arm64": "0.0.332",
-    "@vzn/vx-darwin-x64": "0.0.332",
-    "@vzn/vx-darwin-arm64": "0.0.332"
+    "@vzn/vx-linux-x64": "0.0.334",
+    "@vzn/vx-linux-arm64": "0.0.334",
+    "@vzn/vx-darwin-x64": "0.0.334",
+    "@vzn/vx-darwin-arm64": "0.0.334"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -737,6 +737,30 @@ function canonicalBaselines(
   }
 }
 
+/**
+ * Linux: does some mount hold the task's cwd? bwrap enters the old cwd
+ * only if it exists in the new root, and otherwise `$HOME`, with no word:
+ * a project granted no read ran in the home directory, where `cat x.txt`
+ * read `~/x.txt`. A grant at or above the cwd holds it, and so does an
+ * existing one below (bwrap builds the path to a bind), and so does a
+ * deny that IS the cwd (a single-package workspace's anchor). When none does,
+ * the cwd is denied instead: an empty directory the task enters, whose
+ * reads are refused and reported as the anchor's are.
+ */
+function cwdMounted(
+  cwd: string,
+  fs: {
+    allowRead?: readonly string[] | undefined
+    allowWrite?: readonly string[] | undefined
+    denyRead?: readonly string[] | undefined
+  },
+): boolean {
+  if (fs.denyRead?.includes(cwd) === true) return true
+  return [...(fs.allowRead ?? []), ...(fs.allowWrite ?? [])].some(
+    (p) => atOrUnder(cwd, p) || (atOrUnder(p, cwd) && existsSync(p)),
+  )
+}
+
 /**
  * A write grant that names a path in the project must BIND one there. The
  * grant was realpath'd, so `out.txt -> ../b/src/x` (committed, or planted
@@ -958,6 +982,9 @@ export async function wrapSandboxedCommand(
   const customConfig = buildCustomConfig(args, baselines)
   const scratch = pendingWriteGrants(args.config, customConfig!.filesystem!, baselines.denyRead)
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  if (process.platform === 'linux' && !cwdMounted(baselines.cwd, customConfig!.filesystem!)) {
+    customConfig!.filesystem!.denyRead!.push(baselines.cwd)
+  }
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(
@@ -1268,10 +1295,11 @@ const TRACER_RETRY_LINE =
  * On Linux the task runs under strace, which only REPORTS what the sandbox
  * denied. strace failing on its own (`ptrace(PTRACE_LISTEN,…): Input/output
  * error`, after a build that had finished) turned green work red on CI five
- * times (STATUS Next 24): its exit was the task's. Since B-11 it is not —
- * strace runs detached (`-DD`), and a tracer that dies leaves the command
- * running untraced — but the trace then stops short, and a denial after it
- * goes unreported. So an attempt whose stderr carries strace's own word is
+ * times (STATUS Next 24): its exit was the task's. Since B-11 strace runs
+ * detached (`-DD`), yet under `--seccomp-bpf` (strace 6.8 implies
+ * `--kill-on-exit`) a tracer that dies still SIGKILLs the command: exit
+ * 137 on CI (M-18). Untraced or killed, the trace stopped short and a
+ * denial after it goes unreported. So an attempt whose stderr carries strace's own word is
  * run once more, whatever its exit, unless the run is stopping: the sandbox kept its writes to what it
  * declared, so a second run redoes, not doubles, it.
  */
@@ -1329,8 +1357,13 @@ function collectRecords(
   }
 }
 
-/** strace's own message, a line of a traced task's stderr. */
-const STRACE_OWN_ERROR = /^strace: /
+/**
+ * strace's own message, a line of a traced task's stderr. strace names
+ * itself by its argv[0], the absolute path vx runs it by
+ * (`/usr/bin/strace: ptrace(PTRACE_LISTEN,…)` on CI), so a bare
+ * `strace: ` never matched there and the retry never fired.
+ */
+const STRACE_OWN_ERROR = /^(?:[^\s:]*\/)?strace: /
 
 /**
  * One attempt of `runSandboxed`.
@@ -1437,7 +1470,7 @@ async function runSandboxedOnce(
         // Read whatever the capture setting: a line of strace's own says
         // the trace stopped short.
         const lines = (partial + chunk).split('\n')
-        partial = (lines.pop() ?? '').slice(0, 64)
+        partial = (lines.pop() ?? '').slice(0, 512)
         if (lines.some((l) => STRACE_OWN_ERROR.test(l))) straceSpoke = true
         args.onStderr?.(chunk)
       },

package/src/workspace/migrate-scripts.ts

@@ -252,7 +252,37 @@ function upstreamBuildOnWorker(tasks: GeneratedTask[]): void {
  * task again beside the member's own (D-45).
  */
 const RUNS_MEMBERS =
-  /(^|[\s;&|(])(turbo|nx|lerna|ultra|wireit|nps|moon|rush|vx)(\s|$)|\s(-r|--recursive|--filter|-F|--workspaces|-ws|--workspace|-w|-C|--dir|--cwd|--prefix|--if-present|--parallel|--stream)(\s|=|$)|\bworkspaces?\s+(foreach|run)\b|\bvp\s+run\s|\bcd\s/
+  /(^|[\s;&|(])(turbo|nx|lerna|ultra|wireit|nps|moon|rush|vx)(\s|$)|\bworkspaces?\s+(foreach|run)\b|\bvp\s+run\s|\bcd\s/
+
+/** A workspace flag, read only where a package manager takes it (`pmRunsMembers`). */
+const MEMBER_FLAG =
+  /^(-r|--recursive|--filter|-F|--workspaces|-ws|--workspace|-w|-C|--dir|--cwd|--prefix|--if-present|--parallel|--stream)(=|$)/
+
+/**
+ * The workspace flags are a package manager's: on the program it runs they
+ * mean something else, and berry's `bench` (`yarn node -r ./setup.ts …`,
+ * node's `--require`) was left out as running the members (D-81). With no
+ * manager named, a `run` verb is one.
+ */
+function pmRunsMembers(script: string): boolean {
+  for (const segment of script.split(/&&|\|\||[;|()]/)) {
+    const words = segment.trim().split(/\s+/)
+    let i = words.findIndex((w) => /^(pnpm|npm|yarn|bun)$/.test(w))
+    // npm/cli runs itself: `node . run test --workspaces`.
+    if (i < 0) i = words.indexOf('run')
+    if (i < 0) continue
+    // `exec`, `dlx` and `x` take the manager's flags up to the program name.
+    let program = false
+    for (i++; i < words.length; i++) {
+      const w = words[i]!
+      if (MEMBER_FLAG.test(w)) return true
+      if (program && !w.startsWith('-')) break
+      if (w === 'node') break
+      if (w === 'exec' || w === 'dlx' || w === 'x') program = true
+    }
+  }
+  return false
+}
 
 /** A package manager running a script by name: `pnpm build`, `npm run x`, `bun run x`. */
 const RUNS_SCRIPT =
@@ -267,7 +297,9 @@ function runningMembers(scripts: Readonly<Record<string, unknown>>): Set<string>
   const text = Object.entries(scripts).filter(
     (e): e is [string, string] => typeof e[1] === 'string',
   )
-  const out = new Set(text.filter(([, v]) => RUNS_MEMBERS.test(` ${v}`)).map(([n]) => n))
+  const out = new Set(
+    text.filter(([, v]) => RUNS_MEMBERS.test(` ${v}`) || pmRunsMembers(v)).map(([n]) => n),
+  )
   for (let grew = true; grew;) {
     grew = false
     for (const [n, v] of text) {