@vzn/vx 0.0.337 → 0.0.339

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.337",
+  "version": "0.0.339",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.337",
-    "@vzn/vx-linux-arm64": "0.0.337",
-    "@vzn/vx-darwin-x64": "0.0.337",
-    "@vzn/vx-darwin-arm64": "0.0.337"
+    "@vzn/vx-linux-x64": "0.0.339",
+    "@vzn/vx-linux-arm64": "0.0.339",
+    "@vzn/vx-darwin-x64": "0.0.339",
+    "@vzn/vx-darwin-arm64": "0.0.339"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -753,8 +753,7 @@ function parseStatusOutput(
   const untracked: string[] = []
   const undecodable = new Set<string>()
   let ignoredAttributes = false
-  for (let i = 0; i < tokens.length; i++) {
-    const token = tokens[i]!
+  for (const token of tokens) {
     if (token.length < 4) continue
     if (token[0] === '!') {
       if (token === '!! .gitattributes' || token.endsWith('/.gitattributes'))
@@ -767,19 +766,9 @@ function parseStatusOutput(
       untracked.push(token.slice(3))
       continue
     }
+    // No rename record follows: the spawn passes `--no-renames`, so a
+    // rename's source is a record of its own (items 976, A-59).
     dirty.add(token.slice(3))
-    // An R or C in either column → the next token is the rename/copy
-    // source path. Y carries it for a rename git sees in the worktree (the
-    // copy added with `git add -N`, the original removed): read on X alone,
-    // the source was parsed as a record of its own, stayed trusted, and a
-    // deleted file was keyed from the index (item 976).
-    const x = token[0]
-    const y = token[1]
-    const renamed = x === 'R' || x === 'C' || y === 'R' || y === 'C'
-    if (renamed && i + 1 < tokens.length && tokens[i + 1]!.length > 0) {
-      i++
-      dirty.add(tokens[i]!)
-    }
   }
   return { dirty, untracked, undecodable, ignoredAttributes }
 }
@@ -931,7 +920,18 @@ export async function startGitEnumeration(
     // `--ignored=matching` names an ignored path without descending into an
     // ignored directory: git applies an ignored `.gitattributes` as it does
     // any other, and the filter gate below must see it (A-19).
-    spawnGit(['status', '--porcelain', '-z', '-uall', '--ignored=matching', '--', ...pathspecs]),
+    // `--no-renames`: a deletion paired as an unmerged path's rename source
+    // prints only as `UU <path>`, and the deleted file stayed trusted (A-59).
+    spawnGit([
+      'status',
+      '--porcelain',
+      '-z',
+      '-uall',
+      '--ignored=matching',
+      '--no-renames',
+      '--',
+      ...pathspecs,
+    ]),
     // The gate for whether a clean filter can rewrite bytes between the
     // index and the worktree: git's merged config (`core.autocrlf`) and,
     // from git 2.42, the attributes files it reads outside the tree

package/src/cache/key-fold.ts

@@ -96,7 +96,10 @@ import type { CacheKeyInput } from './layer.js'
 // artifact records none (item 943).
 // v36: each artifact ends in a `.vx-sum` CRC-32 of its entries, checked on
 // scan and restore; a v35 artifact has none (L-19).
-export const CACHE_VERSION = 'vx-cache-v36'
+// v37: an entry saved while `git status` hid a deletion (paired as an
+// unmerged path's rename source) holds output built without a file its key
+// folds (A-59).
+export const CACHE_VERSION = 'vx-cache-v37'
 
 /**
  * The digest a key folds for an input gone between its enumeration and its

package/src/exec/sandbox-violations.ts

@@ -34,20 +34,55 @@ import type {
  * clean. We pair them by pid instead (a process has at most
  * one syscall in flight, so the pid is a sufficient key).
  *
- * We capture the first quoted-string argument as the path. paths that
- * are relative resolve against the task's cwd (set by Bun.spawn).
+ * We capture the first quoted-string argument as the path, a C string
+ * (`cStringPath` decodes it). Paths that are relative resolve against the
+ * task's cwd (set by Bun.spawn).
  */
 const SYSCALLS = 'openat|access|statx|newfstatat'
+const QUOTED = '"((?:[^"\\\\]|\\\\.)+)"'
 const STRACE_DONE_RE = new RegExp(
-  `^(\\d+)\\s+(${SYSCALLS})\\([^"]*"([^"]+)"[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+  `^(\\d+)\\s+(${SYSCALLS})\\([^"]*${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
-const STRACE_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+(${SYSCALLS})\\([^"]*"([^"]+)"[^)]*<unfinished`)
+const STRACE_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+(${SYSCALLS})\\([^"]*${QUOTED}[^)]*<unfinished`)
 const STRACE_RESUMED_RE = new RegExp(
   `^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
 /** A resumed call that SUCCEEDED — clears the pending entry, emits nothing. */
 const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>`)
 
+const C_ESCAPES: Record<string, number> = { n: 10, t: 9, r: 13, v: 11, f: 12, a: 7, b: 8 }
+
+/**
+ * The path a strace C string spells. strace escapes a quote, a backslash
+ * and a control byte, and writes a non-ASCII byte as octal (`é` is
+ * `\303\251`): read raw, `q"t.txt` was cut at `q\` and `é.txt` named
+ * `\303\251.txt`, so the report and every `ignore` pattern missed the file.
+ */
+function cStringPath(raw: string): string {
+  if (!raw.includes('\\')) return raw
+  const bytes: number[] = []
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i]!
+    if (c !== '\\') {
+      bytes.push(...Buffer.from(c, 'utf8'))
+      continue
+    }
+    const next = raw[++i] ?? ''
+    const octal = /^[0-7]{1,3}/.exec(raw.slice(i, i + 3))?.[0]
+    const hex = next === 'x' ? /^[0-9a-fA-F]{1,2}/.exec(raw.slice(i + 1, i + 3))?.[0] : undefined
+    if (octal !== undefined) {
+      bytes.push(parseInt(octal, 8))
+      i += octal.length - 1
+    } else if (hex !== undefined) {
+      bytes.push(parseInt(hex, 16))
+      i += hex.length
+    } else {
+      bytes.push(C_ESCAPES[next] ?? next.charCodeAt(0))
+    }
+  }
+  return Buffer.from(bytes).toString('utf8')
+}
+
 /** One denied syscall, however strace chose to lay it out. */
 export interface DeniedCall {
   syscall: string
@@ -68,7 +103,7 @@ export function deniedCalls(text: string): DeniedCall[] {
   for (const line of text.split('\n')) {
     const done = STRACE_DONE_RE.exec(line)
     if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
-      out.push({ syscall: done[2], rawPath: done[3], errno: done[4] })
+      out.push({ syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
       continue
     }
     const unfinished = STRACE_UNFINISHED_RE.exec(line)
@@ -77,7 +112,7 @@ export function deniedCalls(text: string): DeniedCall[] {
       unfinished[2] !== undefined &&
       unfinished[3] !== undefined
     ) {
-      pending.set(unfinished[1], { syscall: unfinished[2], rawPath: unfinished[3] })
+      pending.set(unfinished[1], { syscall: unfinished[2], rawPath: cStringPath(unfinished[3]) })
       continue
     }
     const resumedOk = STRACE_RESUMED_OK_RE.exec(line)

package/src/orchestrator/plugin.ts

@@ -615,7 +615,7 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
     } catch (err) {
       throw new PluginSetupError(
         plugin,
-        `plugin '${plugin.name}' failed to load: ${err instanceof Error ? err.message : String(err)}`,
+        `plugin '${plugin.name}' failed in setup: ${err instanceof Error ? err.message : String(err)}`,
       )
     }
   }

package/src/workspace/migrate-scripts.ts

@@ -247,12 +247,13 @@ function upstreamBuildOnWorker(tasks: GeneratedTask[]): void {
 /**
  * A root script that runs the members rather than checking the repo:
  * pnpm's `-r` / `--filter` / `-C`, Yarn's `--cwd` (excalidraw's
- * `build:common`), npm's `--prefix`, the workspace flags, Bun's `--filter`,
+ * `build:common`) and `yarn workspace <name>` (cal.com's `prisma`), npm's
+ * `--prefix`, the workspace flags, Bun's `--filter`,
  * Vite+'s `vp run` (tiptap), and the other runners, vx itself included. Mapped, it ran every member's
  * task again beside the member's own (D-45).
  */
 const RUNS_MEMBERS =
-  /(^|[\s;&|(])(turbo|nx|lerna|ultra|wireit|nps|moon|rush|vx)(\s|$)|\bworkspaces?\s+(foreach|run)\b|\bvp\s+run\s|\bcd\s/
+  /(^|[\s;&|(])(turbo|nx|lerna|ultra|wireit|nps|moon|rush|vx)(\s|$)|\bworkspaces?\s+(foreach|run)\b|\byarn\s+workspace\s|\bvp\s+run\s|\bcd\s/
 
 /** A workspace flag, read only where a package manager takes it (`pmRunsMembers`). */
 const MEMBER_FLAG =