@vzn/vx 0.0.347 → 0.0.349

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.347",
+  "version": "0.0.349",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.347",
-    "@vzn/vx-linux-arm64": "0.0.347",
-    "@vzn/vx-darwin-x64": "0.0.347",
-    "@vzn/vx-darwin-arm64": "0.0.347"
+    "@vzn/vx-linux-x64": "0.0.349",
+    "@vzn/vx-linux-arm64": "0.0.349",
+    "@vzn/vx-darwin-x64": "0.0.349",
+    "@vzn/vx-darwin-arm64": "0.0.349"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-binds.ts

@@ -35,16 +35,18 @@ type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
 export function bindableWrites(paths: readonly string[]): string[] {
   if (process.platform !== 'linux') return [...paths]
   return unique(
-    paths.map((p) => {
-      if (!isMountableLiteral(p)) return p
-      try {
-        if (statSync(p).isDirectory()) return p
-      } catch {
-        // Does not exist yet: `prepareOutputsForBind` creates a file for a
-        // file-shaped grant, so treat it as one.
-      }
-      return path.dirname(p)
-    }),
+    paths
+      .filter((p) => !holdsBracket(p))
+      .map((p) => {
+        if (!isMountableLiteral(p)) return p
+        try {
+          if (statSync(p).isDirectory()) return p
+        } catch {
+          // Does not exist yet: `prepareOutputsForBind` creates a file for a
+          // file-shaped grant, so treat it as one.
+        }
+        return path.dirname(p)
+      }),
   )
 }
 
@@ -188,6 +190,32 @@ export function punchWritePaths(readPath: string, writePaths: readonly string[])
   return out
 }
 
+/** Grants already reported — once per process, not per spawn. */
+const warnedBracket = new Set<string>()
+
+/**
+ * SRT drops every Linux write path holding a bracket (it reads one as a
+ * glob, and a write path must be a path), and no spelling keeps it. Left
+ * in, the read grants were punched around a bind that never came, the
+ * directory vanished from the task's view, its write read "Directory
+ * nonexistent" with no word of the grant, and the refused write went
+ * unreported, judged against it. Dropped from the binds instead, and said
+ * once: the remedy is the deepest directory above it whose name holds none.
+ */
+function holdsBracket(grant: string): boolean {
+  const at = grant.search(/[[\]]/)
+  if (at === -1) return false
+  if (!warnedBracket.has(grant)) {
+    warnedBracket.add(grant)
+    process.stderr.write(
+      `[vx] sandbox: the write grant ${grant} holds a bracket, and the Linux sandbox mounts no ` +
+        `write path that does, so a write under it is refused. Grant the directory above it ` +
+        `instead: ${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
+    )
+  }
+  return true
+}
+
 /**
  * Merge the orchestrator-provided baseline (declared inputs / outputs /
  * workspace-root anchor) with the user's resolved sandbox block to

package/src/orchestrator/execute-task.ts

@@ -37,7 +37,7 @@ import {
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { killGraceMs, maskedEmitter, printable, relPosix, secretMask, span } from '../util/index.js'
 import { SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
-import { executorLabel } from './plugin-host.js'
+import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
   mayWriteFingerprint,
   type Placeholder,
@@ -791,7 +791,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         assertExecuteResult(args.executor.name, node.id, r)
         return r
       })
-      .catch(async (err: unknown) => {
+      .catch(async (raw: unknown) => {
+        const err = nameExecutorFailure(args.executor, raw)
         const message = err instanceof Error ? err.message : String(err)
         log.taskStderr(node, `${message}\n`)
         await sweepPlaceholders(placeholders)

package/src/orchestrator/plugin-host.ts

@@ -439,6 +439,23 @@ export async function resolveCache(
 /** The plugin each resolved executor came from, so a hook of it that throws is named. */
 const executorPlugin = new WeakMap<TaskExecutor, string>()
 
+/**
+ * A plugin executor's throw from `execute`, named as every other hook's
+ * is: `plugin 'p' (executor 'e') failed in execute: …`. It read `internal
+ * error in <task>: pool down`, naming neither (C-63). The error itself is
+ * kept, its class, cause and code with it, so the scheduler still tells a
+ * refusal from a bug; the floor's own throw is vx's and stays as it is.
+ */
+export function nameExecutorFailure(executor: TaskExecutor, err: unknown): unknown {
+  if (!(err instanceof Error) || !executorPlugin.has(executor)) return err
+  try {
+    err.message = `${executorLabel(executor)} failed in execute: ${err.message}`
+  } catch {
+    // A frozen error keeps its own words.
+  }
+  return err
+}
+
 /** How a message names `executor`: its plugin and its own name, or its name alone (the floor). */
 export function executorLabel(executor: TaskExecutor): string {
   const plugin = executorPlugin.get(executor)

package/src/workspace/migrate-scripts.ts

@@ -107,7 +107,41 @@ const OWN_COMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
  * `enablePrePostScripts: false` in `pnpm-workspace.yaml` (D-33); Bun and
  * Yarn 1 run them whatever those say. No manager found is npm's default.
  */
-function runsScriptHooks(dir: string, memo: Map<string, string | null>): string | null {
+function runsScriptHooks(dir: string, memo: Map<string, Owner>): string | null {
+  const { manager, at } = ownerOf(dir, memo)
+  const read = (f: string): string | undefined => {
+    try {
+      return readFileSync(path.join(at, f), 'utf8')
+    } catch {
+      return undefined
+    }
+  }
+  const npmrc = read('.npmrc') ?? ''
+  const set = (key: string, value: string): boolean =>
+    new RegExp(`^\\s*${key}\\s*=\\s*${value}\\s*$`, 'm').test(npmrc)
+  const runs =
+    manager === 'berry'
+      ? false
+      : manager === 'npm'
+        ? !set('ignore-scripts', 'true')
+        : manager === 'pnpm'
+          ? !set('enable-pre-post-scripts', 'false') &&
+            !/^enablePrePostScripts:\s*false\s*$/m.test(read('pnpm-workspace.yaml') ?? '')
+          : true
+  return runs ? manager : null
+}
+
+/** The package manager that owns a directory, and the directory that says so. */
+interface Owner {
+  manager: string
+  at: string
+}
+
+/**
+ * The nearest `packageManager` field or lockfile from `dir` up: `berry` for
+ * Yarn 2+, `yarn` for Yarn 1, else the manager's name; none found is npm.
+ */
+function ownerOf(dir: string, memo: Map<string, Owner>): Owner {
   const known = memo.get(dir)
   if (known !== undefined) return known
   const read = (f: string): string | undefined => {
@@ -131,27 +165,26 @@ function runsScriptHooks(dir: string, memo: Map<string, string | null>): string
     else if (existsSync(path.join(dir, 'package-lock.json'))) manager = 'npm'
     else if (['bun.lock', 'bun.lockb'].some((f) => existsSync(path.join(dir, f)))) manager = 'bun'
   }
-  let answer: string | null
-  if (manager === undefined) {
-    const up = path.dirname(dir)
-    answer = up === dir ? 'npm' : runsScriptHooks(up, memo)
-  } else {
-    const npmrc = read('.npmrc') ?? ''
-    const set = (key: string, value: string): boolean =>
-      new RegExp(`^\\s*${key}\\s*=\\s*${value}\\s*$`, 'm').test(npmrc)
-    const runs =
-      manager === 'berry'
-        ? false
-        : manager === 'npm'
-          ? !set('ignore-scripts', 'true')
-          : manager === 'pnpm'
-            ? !set('enable-pre-post-scripts', 'false') &&
-              !/^enablePrePostScripts:\s*false\s*$/m.test(read('pnpm-workspace.yaml') ?? '')
-            : true
-    answer = runs ? manager : null
-  }
-  memo.set(dir, answer)
-  return answer
+  const up = path.dirname(dir)
+  const owner =
+    manager !== undefined
+      ? { manager, at: dir }
+      : up === dir
+        ? { manager: 'npm', at: dir }
+        : ownerOf(up, memo)
+  memo.set(dir, owner)
+  return owner
+}
+
+/**
+ * Yarn 2+ runs a script in its own shell, where `run <script>` is `yarn
+ * run <script>`; vx's shell has no `run`, and 23 of berry's scripts
+ * (`run build:zip:worker`, `run test:unit packages/…`) mapped to tasks
+ * that failed "command not found" (D-92). Spelled out, at the head of
+ * each `&&` / `||` / `;` / `|` segment.
+ */
+function berryRun(command: string): string {
+  return command.replace(/(^|&&|\|\||[;|(])(\s*)run(?=\s)/g, '$1$2yarn run')
 }
 
 const MANIFEST_IMPORT = "import pkg from './package.json' with { type: 'json' }"
@@ -354,7 +387,7 @@ export function migrateScripts(
   outsideDir?: string,
 ): MigrationPlan {
   const projects: GeneratedProject[] = []
-  const hookMemo = new Map<string, string | null>()
+  const hookMemo = new Map<string, Owner>()
   // The workspace root among members: many of its scripts run the
   // workspace (`npm run build --workspaces`, `pnpm -r build`), and a root
   // task made of one ran every member's build again under `--all`. Since
@@ -454,6 +487,7 @@ export function migrateScripts(
     const scripts = meta === rootMeta ? rootScripts(meta) : scriptsOf(meta)
     const hooksBy = runsScriptHooks(meta.dir, hookMemo)
     const runsHooks = hooksBy !== null
+    const berry = ownerOf(meta.dir, hookMemo).manager === 'berry'
     const runnable = Object.keys(scripts).filter(
       (n) => typeof scripts[n] === 'string' && scripts[n] !== '',
     )
@@ -482,7 +516,7 @@ export function migrateScripts(
       if (!isTask(name)) continue
 
       const todos: string[] = []
-      const own = scripts[name] as string
+      const own = berry ? berryRun(scripts[name] as string) : (scripts[name] as string)
       const delegate = delegatedScript(own)
       // npm lifecycle hooks (`prepack`, `prepublishOnly`, …) belong to the
       // package manager and never ride inside a task — `pack` stays alone.

package/src/workspace/migration.ts

@@ -81,12 +81,57 @@ const BUILD_OUTPUTS: readonly [RegExp, readonly string[]][] = [
   [/\s(?:storybook build|build-storybook)\s/, ['storybook-static/**']],
 ]
 
+/** A directory a TODO may name: relative, plain, no hidden or tool dir. */
+const OUTPUT_DIR = /^(?:\.\/)?((?![./])[\w@-][\w@./-]*?)\/?$/
+
+/**
+ * The directory the command says it writes, when no tool above names one:
+ * an out-dir flag (`tsc --outDir lib`, `babel -d lib`), else the
+ * directories it cleans first (`del-cli distribution`, `rimraf dist
+ * types`). ky's build writes `distribution/`, and the TODO said `dist/**`
+ * (D-90). A file (`tsconfig.tsbuildinfo`) and `node_modules` are no output.
+ */
+function namedOutputs(command: string): string[] | undefined {
+  const dir = (w: string | undefined): string | undefined => {
+    const m = w === undefined ? null : OUTPUT_DIR.exec(w.replace(/^(["'])(.*)\1$/, '$2'))
+    if (m === null) return undefined
+    const d = m[1]!
+    return /\.[a-z]+$/i.test(d) || d.split('/').includes('node_modules') ? undefined : d
+  }
+  const flag = /\s(?:--outDir|--out-dir|--outdir|-d)[\s=](\S+)/.exec(` ${command} `)
+  const out = dir(flag?.[1])
+  if (out !== undefined) return [`${out}/**`]
+  for (const segment of command.split(/[;&|()]+/)) {
+    const words = segment.trim().split(/\s+/)
+    const at =
+      words[0] === 'rimraf' || words[0] === 'del-cli' || words[0] === 'del'
+        ? 1
+        : words[0] === 'rm' || (words[0] === 'shx' && words[1] === 'rm')
+          ? words.indexOf('rm') + 1
+          : -1
+    if (at < 0) continue
+    const args = words.slice(at).filter((w) => !w.startsWith('-'))
+    // A dir the command makes again (kit's `rm -rf ./missing_ids && mkdir
+    // ./missing_ids && vite build`) is a scratch dir it prepares, not output.
+    const made = new Set([...command.matchAll(/\bmkdir\s+(?:-p\s+)?(\S+)/g)].map((m) => dir(m[1])))
+    const dirs = args
+      .map(dir)
+      .filter((d): d is string => d !== undefined)
+      .filter((d) => !made.has(d))
+    // Every cleaned path a directory vx can name, or the guess is not this.
+    return dirs.length > 0 && dirs.length === args.filter((w) => !/\.[a-z]+$/i.test(w)).length
+      ? dirs.map((d) => `${d}/**`)
+      : undefined
+  }
+  return undefined
+}
+
 /** The cache block the task that builds `command` should declare, as a TODO on it. */
 export function cacheTodo(command: string): string {
   // Padded, separators as spaces: `next build && …` and `(next build)` match.
   const words = ` ${command.replace(/[;&|()]/g, ' ')} `
   const hit = BUILD_OUTPUTS.find(([re]) => re.test(words))
-  const outputs = (hit?.[1] ?? ['dist/**']).map((o) => `'${o}'`).join(', ')
+  const outputs = (hit?.[1] ?? namedOutputs(command) ?? ['dist/**']).map((o) => `'${o}'`).join(', ')
   return `cache: add \`cache: { inputs: { files: ['src/**'] }, outputs: { files: [${outputs}] } }\` with this package's real inputs and outputs — without it the task always runs and every file here, what it writes included, folds into the key its dependents fold; a block with EMPTY outputs would be a cached no-op, not an uncached task`
 }