@vzn/vx 0.0.342 → 0.0.343

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.342",
+  "version": "0.0.343",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.342",
-    "@vzn/vx-linux-arm64": "0.0.342",
-    "@vzn/vx-darwin-x64": "0.0.342",
-    "@vzn/vx-darwin-arm64": "0.0.342"
+    "@vzn/vx-linux-x64": "0.0.343",
+    "@vzn/vx-linux-arm64": "0.0.343",
+    "@vzn/vx-darwin-x64": "0.0.343",
+    "@vzn/vx-darwin-arm64": "0.0.343"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/inputs.ts

@@ -1223,6 +1223,7 @@ async function scanUnion(
   // `/`: `{dist,lib/esm}/**` saved an empty artifact, and a hit restored
   // nothing over a cleaned tree (A-10). Expanded here, as discovery does.
   for (const pattern of positive.flatMap(slashBraceExpansions)) {
+    if (absentPrefix(cwd, pattern)) continue
     const glob = globFor(pattern)
     for (const rel of glob.scanSync({ cwd, onlyFiles: false, followSymlinks: false, dot: true })) {
       if (nested(rel) || excludeGlobs.some((g) => g.match(rel))) continue
@@ -1235,6 +1236,23 @@ async function scanUnion(
   return matches
 }
 
+/**
+ * True when `pattern`'s static directory is not on disk, so nothing can
+ * match under it. A restore into a tree without its outputs scans each
+ * glob twice (the check, then the clean), and a scan of a missing `dist`
+ * cost ~58 µs where the lstat costs a few. Anything this cannot read
+ * plainly (no prefix, an escape, an absolute path, a refused stat) scans.
+ */
+function absentPrefix(cwd: string, pattern: string): boolean {
+  const prefix = staticPrefix(pattern)
+  if (prefix === '.' || prefix.includes('\\') || path.isAbsolute(prefix)) return false
+  try {
+    return lstatSync(path.join(cwd, prefix), { throwIfNoEntry: false }) === undefined
+  } catch {
+    return false
+  }
+}
+
 // Compiled once per pattern string for the life of the process: a `Bun.Glob`
 // is immutable, and the same handful of declared globs are compiled again
 // for every task otherwise (three sites, up to thousands of times per run).

package/src/exec/sandbox-runtime.ts

@@ -1012,7 +1012,7 @@ export async function wrapSandboxedCommand(
   let wrapped = await wrapForTask(
     SandboxManager,
     inner,
-    customConfig,
+    process.platform === 'linux' ? literalReadPaths(customConfig) : customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
   )
@@ -1148,6 +1148,30 @@ function asksUnixSockets(c: Pick<ResolvedSandboxConfig, 'unixSockets'>): boolean
   return c.unixSockets === true || (c.unixSockets !== undefined && c.unixSockets.length > 0)
 }
 
+/**
+ * Linux: the read paths as SRT must be handed them to take each as the
+ * name it is. vx has expanded every grant by then, so each is a path,
+ * but SRT reads any holding `[` as a glob, where a bracket opens a class:
+ * a route granted as `pages/\[id\].tsx` was never mounted (its denial
+ * unreported, a listed grant), and a workspace under `[ws]/` was never
+ * walled. `[[]` is a class of one `[`; a lone `]` is plain text to it.
+ */
+function literalReadPaths(
+  config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
+): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
+  const fs = config?.filesystem
+  if (fs === undefined) return config
+  const escape = (paths: readonly string[]): string[] => paths.map((p) => p.replaceAll('[', '[[]'))
+  return {
+    ...config,
+    filesystem: {
+      ...fs,
+      denyRead: escape(fs.denyRead),
+      ...(fs.allowRead !== undefined ? { allowRead: escape(fs.allowRead) } : {}),
+    },
+  }
+}
+
 /** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],

package/src/orchestrator/fingerprint-watch.ts

@@ -11,7 +11,7 @@
 
 import { readFileSync, statSync } from 'node:fs'
 import path from 'node:path'
-import { FILE_HASH_RACY_MS } from '../cache/index.js'
+import { FILE_HASH_RACY_MS, racyWindowMs } from '../cache/index.js'
 import { WORKSPACE_FINGERPRINT_FILES, type WorkspaceFingerprints } from '../workspace/index.js'
 import type { Logger } from './logger.js'
 
@@ -56,7 +56,10 @@ export class FingerprintWatch {
         if (before !== undefined) moved.push(f)
         continue
       }
-      if (before !== undefined && ctimeMs < this.at - FILE_HASH_RACY_MS) continue
+      // A whole-second stamp widens the window by that second (A-2): a
+      // rewrite 400 ms after the read was stamped before it (C-59).
+      if (before !== undefined && ctimeMs < this.at - racyWindowMs(ctimeMs, FILE_HASH_RACY_MS))
+        continue
       let now: Uint8Array | undefined
       try {
         now = readFileSync(abs)