@vzn/vx 0.0.333 → 0.0.335

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.333",
+  "version": "0.0.335",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.333",
-    "@vzn/vx-linux-arm64": "0.0.333",
-    "@vzn/vx-darwin-x64": "0.0.333",
-    "@vzn/vx-darwin-arm64": "0.0.333"
+    "@vzn/vx-linux-x64": "0.0.335",
+    "@vzn/vx-linux-arm64": "0.0.335",
+    "@vzn/vx-darwin-x64": "0.0.335",
+    "@vzn/vx-darwin-arm64": "0.0.335"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -737,6 +737,30 @@ function canonicalBaselines(
   }
 }
 
+/**
+ * Linux: does some mount hold the task's cwd? bwrap enters the old cwd
+ * only if it exists in the new root, and otherwise `$HOME`, with no word:
+ * a project granted no read ran in the home directory, where `cat x.txt`
+ * read `~/x.txt`. A grant at or above the cwd holds it, and so does an
+ * existing one below (bwrap builds the path to a bind), and so does a
+ * deny that IS the cwd (a single-package workspace's anchor). When none does,
+ * the cwd is denied instead: an empty directory the task enters, whose
+ * reads are refused and reported as the anchor's are.
+ */
+function cwdMounted(
+  cwd: string,
+  fs: {
+    allowRead?: readonly string[] | undefined
+    allowWrite?: readonly string[] | undefined
+    denyRead?: readonly string[] | undefined
+  },
+): boolean {
+  if (fs.denyRead?.includes(cwd) === true) return true
+  return [...(fs.allowRead ?? []), ...(fs.allowWrite ?? [])].some(
+    (p) => atOrUnder(cwd, p) || (atOrUnder(p, cwd) && existsSync(p)),
+  )
+}
+
 /**
  * A write grant that names a path in the project must BIND one there. The
  * grant was realpath'd, so `out.txt -> ../b/src/x` (committed, or planted
@@ -958,6 +982,9 @@ export async function wrapSandboxedCommand(
   const customConfig = buildCustomConfig(args, baselines)
   const scratch = pendingWriteGrants(args.config, customConfig!.filesystem!, baselines.denyRead)
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  if (process.platform === 'linux' && !cwdMounted(baselines.cwd, customConfig!.filesystem!)) {
+    customConfig!.filesystem!.denyRead!.push(baselines.cwd)
+  }
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(

package/src/orchestrator/projects.ts

@@ -7,7 +7,7 @@
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
 import {
-  frozenProjectConfig,
+  frozenProjectConfigs,
   loadProjectConfigs,
   validateProjectConfig,
   type LoadProjectConfigOptions,
@@ -216,7 +216,7 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
         typeof m.configPath === 'string' && args.staged?.get(m.name) === undefined,
     )
     const loaded = lock
-      ? await Promise.all(withFile.map((m) => frozenProjectConfig(lock, m, workspaceRoot)))
+      ? await frozenProjectConfigs(lock, withFile, workspaceRoot, args.evalCache?.store)
       : await loadProjectConfigs(
           withFile.map((m) => m.configPath),
           args.evalCache !== undefined ? { evalCache: args.evalCache } : {},

package/src/workspace/index.ts

@@ -18,7 +18,7 @@ export {
 export { computeNestedProjectDirs } from './nested-dirs.js'
 export { buildPackageGraph, type PackageGraph } from './package-graph.js'
 export {
-  frozenProjectConfig,
+  frozenProjectConfigs,
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
   lockfilePath,

package/src/workspace/lockfile.ts

@@ -16,7 +16,9 @@
 import { rename, rm } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
-import { relPosix, UserError } from '../util/index.js'
+import { relPosix, UserError, xxh3 } from '../util/index.js'
+import { VERSION } from '../version.js'
+import { CONFIG_EVAL_VERSION, type ConfigEvalStore } from './config-cache.js'
 import { validateProjectConfig } from './config-schema.js'
 
 export const LOCKFILE_NAME = 'vx-lock.json'
@@ -54,8 +56,10 @@ export async function readLockfile(root: string): Promise<Lockfile | null> {
   const file = Bun.file(lockfilePath(root))
   if (!(await file.exists())) return null
   let parsed: unknown
+  let text: string
   try {
-    parsed = JSON.parse(await file.text())
+    text = await file.text()
+    parsed = JSON.parse(text)
   } catch {
     throw new UserError(`${LOCKFILE_NAME} is not valid JSON — re-run \`vx lock\` or delete it`)
   }
@@ -95,9 +99,13 @@ export async function readLockfile(root: string): Promise<Lockfile | null> {
       throw new UserError(`${LOCKFILE_NAME}: entry for "${name}" is malformed — re-run \`vx lock\``)
     }
   }
+  lockDigests.set(parsed, xxh3(text).toString(16))
   return parsed as Lockfile
 }
 
+/** The digest of the bytes each lock `readLockfile` returned was parsed from. */
+const lockDigests = new WeakMap<object, string>()
+
 export async function writeLockfile(root: string, lock: Lockfile): Promise<void> {
   // Written beside its name and renamed over it: `Bun.write` truncates in
   // place, so a `--frozen` run, or `vx watch --frozen` woken by the write
@@ -123,26 +131,36 @@ export async function writeLockfile(root: string, lock: Lockfile): Promise<void>
 
 /**
  * Run-time config load from the lock: return the FROZEN resolved config
- * for a project the lock has an entry for. No evaluation happens — this
- * is the fast, eval-free trust path — and no staleness check either (see
- * below): the lock's contract is "what runs is what was locked", so a
- * config file edited since `vx lock` still runs as locked until
- * `vx lock --check` says otherwise. An unlocked project is a hard error;
- * silently falling back to evaluation would break frozen-env semantics.
+ * for each project, in order. No evaluation happens — this is the fast,
+ * eval-free trust path — and no staleness check either (see below): the
+ * lock's contract is "what runs is what was locked", so a config file
+ * edited since `vx lock` still runs as locked until `vx lock --check`
+ * says otherwise. An unlocked project is a hard error; silently falling
+ * back to evaluation would break frozen-env semantics.
+ *
+ * `store` remembers which entries of which lock bytes this validator
+ * accepted, beside the config evaluations and keyed like them (vx's and
+ * Bun's versions): validating 1,000 entries was ~30 ms of every warm
+ * `--frozen` run, for a verdict that cannot change until the bytes or vx
+ * do.
  */
-export async function frozenProjectConfig(
+export async function frozenProjectConfigs(
   lock: Lockfile,
-  meta: { name: string; configPath: string },
+  metas: ReadonlyArray<{ name: string; configPath: string }>,
   root: string,
-): Promise<ProjectConfig> {
-  const rel = relPosix(root, meta.configPath)
-  const entry = lock.projects[meta.name]
-  if (!entry || entry.configPath !== rel) {
-    throw new UserError(
-      `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
-        `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
-    )
-  }
+  store?: ConfigEvalStore,
+): Promise<ProjectConfig[]> {
+  const entries = metas.map((meta) => {
+    const rel = relPosix(root, meta.configPath)
+    const entry = lock.projects[meta.name]
+    if (!entry || entry.configPath !== rel) {
+      throw new UserError(
+        `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
+          `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
+      )
+    }
+    return entry
+  })
   // No staleness checks here, deliberately: --frozen runs after
   // `vx lock --check` in any sane pipeline, and that audit re-
   // evaluates everything — a per-file byte-hash re-check would be
@@ -151,6 +169,30 @@ export async function frozenProjectConfig(
   // in the file solely for --check's fast file-changed reporting.
   // The lock is hand-editable; the stored config crosses the same
   // boundary a freshly evaluated one does.
-  validateProjectConfig(entry.config, `${LOCKFILE_NAME} (${meta.name})`)
-  return entry.config
+  const digest = store === undefined ? undefined : lockDigests.get(lock)
+  const keys =
+    digest === undefined
+      ? undefined
+      : metas.map(
+          (m) =>
+            `vx-lock-valid-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${Bun.version}\0${digest}\0${m.name}`,
+        )
+  const known =
+    keys === undefined || store === undefined
+      ? new Map<string, string>()
+      : store.getConfigEvals !== undefined
+        ? store.getConfigEvals(keys)
+        : new Map(keys.flatMap((k) => (store.getConfigEval(k) === null ? [] : [[k, '1'] as const])))
+  const accepted: Array<readonly [string, string]> = []
+  for (let i = 0; i < entries.length; i++) {
+    const key = keys?.[i]
+    if (key !== undefined && known.has(key)) continue
+    validateProjectConfig(entries[i]!.config, `${LOCKFILE_NAME} (${metas[i]!.name})`)
+    if (key !== undefined) accepted.push([key, '1'])
+  }
+  if (store !== undefined && accepted.length > 0) {
+    if (store.putConfigEvals !== undefined) store.putConfigEvals(accepted)
+    else for (const [k, v] of accepted) store.putConfigEval(k, v)
+  }
+  return entries.map((e) => e.config)
 }