@vzn/vx 0.0.342 → 0.0.344

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.342",
+  "version": "0.0.344",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.342",
-    "@vzn/vx-linux-arm64": "0.0.342",
-    "@vzn/vx-darwin-x64": "0.0.342",
-    "@vzn/vx-darwin-arm64": "0.0.342"
+    "@vzn/vx-linux-x64": "0.0.344",
+    "@vzn/vx-linux-arm64": "0.0.344",
+    "@vzn/vx-darwin-x64": "0.0.344",
+    "@vzn/vx-darwin-arm64": "0.0.344"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/inputs.ts

@@ -1223,6 +1223,7 @@ async function scanUnion(
   // `/`: `{dist,lib/esm}/**` saved an empty artifact, and a hit restored
   // nothing over a cleaned tree (A-10). Expanded here, as discovery does.
   for (const pattern of positive.flatMap(slashBraceExpansions)) {
+    if (absentPrefix(cwd, pattern)) continue
     const glob = globFor(pattern)
     for (const rel of glob.scanSync({ cwd, onlyFiles: false, followSymlinks: false, dot: true })) {
       if (nested(rel) || excludeGlobs.some((g) => g.match(rel))) continue
@@ -1235,6 +1236,23 @@ async function scanUnion(
   return matches
 }
 
+/**
+ * True when `pattern`'s static directory is not on disk, so nothing can
+ * match under it. A restore into a tree without its outputs scans each
+ * glob twice (the check, then the clean), and a scan of a missing `dist`
+ * cost ~58 µs where the lstat costs a few. Anything this cannot read
+ * plainly (no prefix, an escape, an absolute path, a refused stat) scans.
+ */
+function absentPrefix(cwd: string, pattern: string): boolean {
+  const prefix = staticPrefix(pattern)
+  if (prefix === '.' || prefix.includes('\\') || path.isAbsolute(prefix)) return false
+  try {
+    return lstatSync(path.join(cwd, prefix), { throwIfNoEntry: false }) === undefined
+  } catch {
+    return false
+  }
+}
+
 // Compiled once per pattern string for the life of the process: a `Bun.Glob`
 // is immutable, and the same handful of declared globs are compiled again
 // for every task otherwise (three sites, up to thousands of times per run).

package/src/exec/sandbox-runtime.ts

@@ -1012,7 +1012,7 @@ export async function wrapSandboxedCommand(
   let wrapped = await wrapForTask(
     SandboxManager,
     inner,
-    customConfig,
+    process.platform === 'linux' ? literalReadPaths(customConfig) : customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
   )
@@ -1148,6 +1148,30 @@ function asksUnixSockets(c: Pick<ResolvedSandboxConfig, 'unixSockets'>): boolean
   return c.unixSockets === true || (c.unixSockets !== undefined && c.unixSockets.length > 0)
 }
 
+/**
+ * Linux: the read paths as SRT must be handed them to take each as the
+ * name it is. vx has expanded every grant by then, so each is a path,
+ * but SRT reads any holding `[` as a glob, where a bracket opens a class:
+ * a route granted as `pages/\[id\].tsx` was never mounted (its denial
+ * unreported, a listed grant), and a workspace under `[ws]/` was never
+ * walled. `[[]` is a class of one `[`; a lone `]` is plain text to it.
+ */
+function literalReadPaths(
+  config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
+): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
+  const fs = config?.filesystem
+  if (fs === undefined) return config
+  const escape = (paths: readonly string[]): string[] => paths.map((p) => p.replaceAll('[', '[[]'))
+  return {
+    ...config,
+    filesystem: {
+      ...fs,
+      denyRead: escape(fs.denyRead),
+      ...(fs.allowRead !== undefined ? { allowRead: escape(fs.allowRead) } : {}),
+    },
+  }
+}
+
 /** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],

package/src/orchestrator/fingerprint-watch.ts

@@ -11,7 +11,7 @@
 
 import { readFileSync, statSync } from 'node:fs'
 import path from 'node:path'
-import { FILE_HASH_RACY_MS } from '../cache/index.js'
+import { FILE_HASH_RACY_MS, racyWindowMs } from '../cache/index.js'
 import { WORKSPACE_FINGERPRINT_FILES, type WorkspaceFingerprints } from '../workspace/index.js'
 import type { Logger } from './logger.js'
 
@@ -56,7 +56,10 @@ export class FingerprintWatch {
         if (before !== undefined) moved.push(f)
         continue
       }
-      if (before !== undefined && ctimeMs < this.at - FILE_HASH_RACY_MS) continue
+      // A whole-second stamp widens the window by that second (A-2): a
+      // rewrite 400 ms after the read was stamped before it (C-59).
+      if (before !== undefined && ctimeMs < this.at - racyWindowMs(ctimeMs, FILE_HASH_RACY_MS))
+        continue
       let now: Uint8Array | undefined
       try {
         now = readFileSync(abs)

package/src/workspace/fingerprint.ts

@@ -38,7 +38,7 @@ export const WORKSPACE_FINGERPRINT_FILES = [
   'bunfig.toml',
 ]
 
-// DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs}`. Everything it can
+// DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs,cts,cjs}`. Everything it can
 // declare — `concurrency`, `cacheDir`, `timeout`, and the
 // plugin list — is placement, storage or observability, never what a
 // command produces; core's three seams may change WHERE a task runs, not

package/src/workspace/project-loader.ts

@@ -23,6 +23,10 @@ export const WORKSPACE_CONFIG_FILENAMES = [
   'vx.workspace.mts',
   'vx.workspace.js',
   'vx.workspace.mjs',
+  // A CommonJS config (`module.exports = …`), as Vite and TS name theirs: it
+  // was ignored without a word (D-86).
+  'vx.workspace.cts',
+  'vx.workspace.cjs',
 ]
 
 /** Project configs already loaded in this process, by absolute path. */
@@ -660,7 +664,7 @@ async function refuseStaleWorkspaceImports(configPath: string, since: number): P
 }
 
 /**
- * Find and load `vx.workspace.{ts,mts,js,mjs}` from the workspace
+ * Find and load `vx.workspace.{ts,mts,js,mjs,cts,cjs}` from the workspace
  * root. Returns `null` if no such file exists (the common case;
  * the schema is fully optional). Validates the shape and throws
  * a `UserError` on malformed input.

package/src/workspace/workspace.ts

@@ -35,7 +35,7 @@ export interface ProjectMeta {
   /** Absolute path to the project directory. */
   dir: string
   packageJson: PackageJson
-  /** Absolute path to vx.config.{ts,mts,js,mjs} or null. */
+  /** Absolute path to vx.config.{ts,mts,js,mjs,cts,cjs} or null. */
   configPath: string | null
 }
 
@@ -51,6 +51,10 @@ export const PROJECT_CONFIG_FILENAMES = [
   'vx.config.mts',
   'vx.config.js',
   'vx.config.mjs',
+  // A CommonJS config (`module.exports = …`), as Vite and TS name theirs: it
+  // was ignored without a word (D-86).
+  'vx.config.cts',
+  'vx.config.cjs',
 ]
 
 const decoder = new TextDecoder()