@vzn/vx 0.0.344 → 0.0.345

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.344",
+  "version": "0.0.345",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.344",
-    "@vzn/vx-linux-arm64": "0.0.344",
-    "@vzn/vx-darwin-x64": "0.0.344",
-    "@vzn/vx-darwin-arm64": "0.0.344"
+    "@vzn/vx-linux-x64": "0.0.345",
+    "@vzn/vx-linux-arm64": "0.0.345",
+    "@vzn/vx-darwin-x64": "0.0.345",
+    "@vzn/vx-darwin-arm64": "0.0.345"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/select.ts

@@ -60,18 +60,20 @@ export async function workspaceGlobOwners(
     }
     return false
   }
-  // A frozen run with no lock is refused here, before the tolerant sweep
-  // below could answer "nothing affected" and exit 0 without ever reaching
-  // the run's own refusal.
-  if (load.frozen === true && (await readLockfile(root)) === null) {
-    throw new UserError(FROZEN_WITHOUT_LOCK)
-  }
   try {
     const staged = await stagedLoad()
     return [...staged.values()].filter((p) => declaresMatch(p.config)).map((p) => p.name)
   } catch {
     // Fall through to the per-file sweep.
   }
+  // A frozen run with no lock is refused here, before the tolerant sweep
+  // below could answer "nothing affected" and exit 0 without ever reaching
+  // the run's own refusal. Asked only once the staged load failed: a
+  // frozen load that succeeded read the lock, and a second read parsed it
+  // again (1,000 projects: a 1.1 MB lock, ~10 ms).
+  if (load.frozen === true && (await readLockfile(root)) === null) {
+    throw new UserError(FROZEN_WITHOUT_LOCK)
+  }
   const owners: string[] = []
   await Promise.all(
     projects.map(async (meta) => {

package/src/orchestrator/sandbox-request.ts

@@ -187,6 +187,15 @@ export async function sandboxRequestFor(
    */
   cacheDir?: string,
 ): Promise<SandboxRequest> {
+  // SRT reads a Linux path holding a bracket as a glob and drops it from
+  // the writes, so no grant here could be mounted (B-60).
+  const home = toRealPath(node.projectDir)
+  if (process.platform === 'linux' && /[[\]]/.test(home)) {
+    throw new UserError(
+      `exec.sandbox: ${home} holds a bracket ([ or ]), and the Linux sandbox mounts no path ` +
+        `that does — rename the directory, or run the task without exec.sandbox`,
+    )
+  }
   const depDirs = [
     path.join(node.projectDir, 'node_modules'),
     path.join(workspaceRoot, 'node_modules'),