@vzn/vx 0.0.349 → 0.0.352

package/src/exec/sandbox-runtime.ts

@@ -742,20 +742,19 @@ function canonicalBaselines(
  * only if it exists in the new root, and otherwise `$HOME`, with no word:
  * a project granted no read ran in the home directory, where `cat x.txt`
  * read `~/x.txt`. A grant at or above the cwd holds it, and so does an
- * existing one below (bwrap builds the path to a bind), and so does a
- * deny that IS the cwd (a single-package workspace's anchor). When none does,
+ * existing one below (bwrap builds the path to a bind). When none does,
  * the cwd is denied instead: an empty directory the task enters, whose
- * reads are refused and reported as the anchor's are.
+ * reads are refused and reported as the anchor's are. A single-package
+ * workspace's cwd is its anchor, denied already; the runtime takes the
+ * second entry as the same mount.
  */
 function cwdMounted(
   cwd: string,
   fs: {
     allowRead?: readonly string[] | undefined
     allowWrite?: readonly string[] | undefined
-    denyRead?: readonly string[] | undefined
   },
 ): boolean {
-  if (fs.denyRead?.includes(cwd) === true) return true
   return [...(fs.allowRead ?? []), ...(fs.allowWrite ?? [])].some(
     (p) => atOrUnder(cwd, p) || (atOrUnder(p, cwd) && existsSync(p)),
   )
@@ -1007,12 +1006,21 @@ export async function wrapSandboxedCommand(
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace)
       : { command: taggedCommand, forwards: false, traced: false }
-  const inner =
-    ports.length > 0 ? `${portBridgeInner(ports, tag)} ${grouped.command}` : grouped.command
+  const inner = [
+    ports.length > 0 ? portBridgeInner(ports, tag) : '',
+    process.platform === 'linux' && args.config.network !== undefined ? PROXY_BRIDGE_WAIT : '',
+    grouped.command,
+  ]
+    .filter((part) => part !== '')
+    .join(' ')
   let wrapped = await wrapForTask(
     SandboxManager,
     inner,
-    process.platform === 'linux' ? literalReadPaths(customConfig) : customConfig,
+    process.platform === 'linux'
+      ? literalReadPaths(customConfig)
+      : process.platform === 'darwin'
+        ? seatbeltBrackets(customConfig)
+        : customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
   )
@@ -1177,6 +1185,30 @@ function literalReadPaths(
   }
 }
 
+/**
+ * macOS: a grant's escaped bracket as seatbelt's SRT can read it. vx hands
+ * it the pattern, and SRT compiles any spelling holding `[` as a regex in
+ * which a backslash is a literal one, so `pages/\[id\].tsx` matched no
+ * file and the route could not be granted. `[[]` is a class of one `[`; a
+ * lone `]` is plain text (B-65).
+ */
+function seatbeltBrackets(
+  config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
+): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
+  const fs = config?.filesystem
+  if (fs === undefined) return config
+  const literal = (paths: readonly string[]): string[] =>
+    paths.map((p) => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']'))
+  return {
+    ...config,
+    filesystem: {
+      ...fs,
+      allowWrite: literal(fs.allowWrite),
+      ...(fs.allowRead !== undefined ? { allowRead: literal(fs.allowRead) } : {}),
+    },
+  }
+}
+
 /** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],
@@ -1204,6 +1236,18 @@ export function bridgedPorts(c: Pick<ResolvedSandboxConfig, 'localBinding'>): nu
   return Array.isArray(c.localBinding) ? [...new Set(c.localBinding)] : []
 }
 
+/**
+ * Linux: SRT starts its in-sandbox proxy bridges (`socat TCP-LISTEN:3128`
+ * and `:1080`) in the background and runs the command at once, so a
+ * networked task that dialled the proxy first met "connection refused"
+ * (curl's `000`) on a loaded box (M-20). This waits, in front of the
+ * command, until both listen in the task's network namespace, read off
+ * /proc/net (IPv4 or IPv6, state 0A). Bounded at ~5 s: a bridge that never
+ * listens leaves the command to meet the refusal it met before.
+ */
+const PROXY_BRIDGE_WAIT =
+  "( i=0; until grep -qsE ':0C38 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6 && grep -qsE ':0438 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6; do [ $i -ge 500 ] && break; i=$((i+1)); sleep 0.01; done );"
+
 /** Where a bridge's unix socket lives: the sandbox tmpdir, bound read-write on both sides. */
 export function portBridgeSocket(tag: string, port: number): string {
   return path.join(taskTmpdir(tag), `vx-port-${tag}-${port}.sock`)
@@ -2076,12 +2120,20 @@ async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why:
     } else {
       const m = /version (\d+)\.(\d+)/.exec(out)
       const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
-      const form = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
-      const refused = await traceRefusal(form)
+      let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+      let refused = await traceRefusal(form)
+      // A strace that cannot check the seccomp filter says so and traces on
+      // without it, exit 0. Inside the sandbox that line read as the trace
+      // cut short, and every sandboxed task ran twice: the plain form, if
+      // it is quiet, is the one that works here.
+      if (refused?.warned === true && form === 'seccomp') {
+        refused = await traceRefusal('plain')
+        if (refused === null) form = 'plain'
+      }
       straceAvailableCache =
         refused === null
           ? { form, why: '' }
-          : { form: false, why: `strace cannot trace here (${refused})` }
+          : { form: false, why: `strace cannot trace here (${refused.line})` }
     }
   } catch {
     // Not on PATH. Said as the refused attach is: without it an undeclared
@@ -2111,14 +2163,17 @@ export async function untracedReason(): Promise<string | null> {
 
 /**
  * Why strace may not attach here (null when it may), asked once with the flags a task's trace
- * uses (`ownGroupCommand`). `--version` answers on a host that refuses
+ * uses (`ownGroupCommand`). A strace that exits 0 having said something of
+ * its own is refused too (`warned`): in a task, its line is the retry key. `--version` answers on a host that refuses
  * ptrace (Yama's `ptrace_scope` 2 or 3, a container's seccomp profile),
  * and there every sandboxed task failed twice, the retry included, on
  * `attach: ptrace(PTRACE_SEIZE…): Operation not permitted`. Refused, the
  * run goes untraced, as without strace: bwrap still enforces, and only the
  * read-violation report is lost, which is said once.
  */
-async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
+async function traceRefusal(
+  form: 'plain' | 'seccomp',
+): Promise<{ line: string; warned: boolean } | null> {
   const p = Bun.spawn(
     [
       executablePath('strace'),
@@ -2136,8 +2191,9 @@ async function traceRefusal(form: 'plain' | 'seccomp'): Promise<string | null> {
     { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe' },
   )
   const err = await new Response(p.stderr).text()
-  if ((await p.exited) === 0) return null
-  return err.trim().split('\n')[0] || `exit ${p.exitCode}`
+  const line = err.split('\n').find((l) => STRACE_OWN_ERROR.test(l))
+  if ((await p.exited) === 0) return line === undefined ? null : { line, warned: true }
+  return { line: err.trim().split('\n')[0] || `exit ${p.exitCode}`, warned: false }
 }
 let warnedNoTrace = false
 

package/src/exec/sandbox-violations.ts

@@ -100,7 +100,14 @@ export interface DeniedCall {
 // a child starts in its parent's cwd as it was at the fork.
 const CHDIR_DONE_RE = new RegExp(`^(\\d+)\\s+chdir\\(${QUOTED}\\)\\s*=\\s*0`)
 const CHDIR_UNFINISHED_RE = new RegExp(`^(\\d+)\\s+chdir\\(${QUOTED} <unfinished`)
-const CHDIR_RESUMED_RE = /^(\d+)\s+<\.\.\. chdir resumed>.*?=\s*(-?\d+)/
+const CHDIR_RESUMED_RE =
+  /^(\d+)\s+<\.\.\. chdir resumed>.*?=\s*(-?\d+)(?:\s+(ENOENT|EACCES|EPERM))?/
+// A denied `chdir` is a denied read of the directory: `cd src` into a
+// directory no grant holds failed with no line of the trace's own, and
+// `cd src || …` passed and cached.
+const CHDIR_DENIED_RE = new RegExp(
+  `^(\\d+)\\s+chdir\\(${QUOTED}\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+)
 const FCHDIR_RE = /^(\d+)\s+(?:fchdir\(\d+\)|<\.\.\. fchdir resumed>.*?)\s*=\s*0/
 const FORK = '(?:clone3?|v?fork)'
 const FORK_DONE_RE = new RegExp(`^(\\d+)\\s+${FORK}\\(.*\\)\\s*=\\s*(\\d+)$`)
@@ -150,6 +157,17 @@ export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
     out.push(call)
   }
   for (const line of text.split('\n')) {
+    // Most lines are opens that succeeded: two substring tests skip them.
+    const opener =
+      line.includes('= -1') || line.includes('<unfinished') || line.includes('resumed>')
+    if (!opener) {
+      if (
+        cwd !== undefined &&
+        (line.includes('chdir(') || line.includes('fork(') || line.includes('clone'))
+      )
+        follow(line)
+      continue
+    }
     const done = STRACE_DONE_RE.exec(line)
     if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
       denied(done[1]!, { syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
@@ -176,15 +194,32 @@ export function deniedCalls(text: string, cwd?: string): DeniedCall[] {
       }
       continue
     }
-    if (cwd === undefined) continue
+    // A refused or split `chdir` arrives here: its denial counts with or
+    // without the cwd tracking.
+    follow(line)
+  }
+  function follow(line: string): void {
     let m: RegExpExecArray | null
-    if ((m = CHDIR_DONE_RE.exec(line)) !== null) opsOf(m[1]!).push({ chdir: cStringPath(m[2]!) })
-    else if ((m = CHDIR_UNFINISHED_RE.exec(line)) !== null) chdirring.set(m[1]!, cStringPath(m[2]!))
-    else if ((m = CHDIR_RESUMED_RE.exec(line)) !== null) {
+    if ((m = CHDIR_DENIED_RE.exec(line)) !== null) {
+      denied(m[1]!, { syscall: 'chdir', rawPath: cStringPath(m[2]!), errno: m[3]! })
+      return
+    }
+    if ((m = CHDIR_UNFINISHED_RE.exec(line)) !== null) {
+      chdirring.set(m[1]!, cStringPath(m[2]!))
+      return
+    }
+    if ((m = CHDIR_RESUMED_RE.exec(line)) !== null) {
       const to = chdirring.get(m[1]!)
       chdirring.delete(m[1]!)
       if (to !== undefined && m[2] === '0') opsOf(m[1]!).push({ chdir: to })
-    } else if ((m = FCHDIR_RE.exec(line)) !== null) opsOf(m[1]!).push({ lost: true })
+      else if (to !== undefined && m[3] !== undefined) {
+        denied(m[1]!, { syscall: 'chdir', rawPath: to, errno: m[3] })
+      }
+      return
+    }
+    if (cwd === undefined) return
+    if ((m = CHDIR_DONE_RE.exec(line)) !== null) opsOf(m[1]!).push({ chdir: cStringPath(m[2]!) })
+    else if ((m = FCHDIR_RE.exec(line)) !== null) opsOf(m[1]!).push({ lost: true })
     else if ((m = FORK_DONE_RE.exec(line)) !== null) {
       forked(m[1]!, m[2]!, opsOf(m[1]!).length, line.includes('CLONE_FS'))
     } else if ((m = FORK_UNFINISHED_RE.exec(line)) !== null) {

package/src/graph/scheduler.ts

@@ -726,14 +726,22 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
               return
             }
             const message = err instanceof Error ? err.message : String(err)
+            // After the run's stop a rejection is the stop's doing (a probe
+            // it killed, C-65): aborted, as any task it kills, and unsaid.
+            const stopped = aborted()
             const outcome: TaskOutcome = withHold({
               node,
-              status: 'failed',
+              status: stopped ? 'aborted' : 'failed',
               exitCode: 1,
               durationMs: 0,
             })
             leave()
             untrack()
+            if (stopped) {
+              finishOne(id, outcome)
+              tick()
+              return
+            }
             // A UserError is a config/input failure (e.g. a failed
             // `cache.inputs.runtime` command), not a vx bug — report it
             // plainly, never as an "internal error".

package/src/orchestrator/execute-task.ts

@@ -33,6 +33,7 @@ import {
   type TaskExecutor,
   type TaskInputs,
   PersistentReadyError,
+  sandboxReads,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { killGraceMs, maskedEmitter, printable, relPosix, secretMask, span } from '../util/index.js'
@@ -875,6 +876,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         cwd: node.projectDir,
         bins: taskBinDirs(node, args.workspaceRoot),
         signal: res.signal,
+        hidden: req.sandbox && ((f: string) => !sandboxReads(req.sandbox!, f)),
       })
       if (verdict !== undefined) log.taskStderr(node, `\n${verdict}\n`)
       // A committed file another task's clean removed, still gone: vx

package/src/orchestrator/framed-output.ts

@@ -468,6 +468,19 @@ export function formatPersistentTailBlock(
   return lines.join('\n') + '\n'
 }
 
+/**
+ * What a kept server writes after the summary, one line at a time under its
+ * id (`app#dev │ Local: http://localhost:5173`), so several servers'
+ * logs read apart. `text` holds whole lines, its last newline cut off.
+ */
+export function formatKeptLines(node: TaskNode, text: string, colors: ColorSupport): string {
+  const prefix = `${paintTaskId(node, colors)} ${paint('', '│', colors, { dim: true })} `
+  return text
+    .split('\n')
+    .map((line) => `${prefix}${line}\n`)
+    .join('')
+}
+
 /**
  * Between the requested task's frame and the summary footer, list the
  * persistent tasks (dev servers / watchers) the run is keeping alive in

package/src/orchestrator/logger.ts

@@ -4,6 +4,7 @@ import {
   formatFailureRecap,
   formatFrameClose,
   formatFrameOpen,
+  formatKeptLines,
   formatPersistentTailBlock,
   formatTaskBlock,
   formatTaskExecutedLine,
@@ -318,6 +319,39 @@ export function defaultLogger(
     { node: TaskNode; outcome?: TaskOutcome; out: Tail; err: Tail }
   >()
   let flushedPersistent = false
+  // After that flush nothing prints a tail again, yet a kept server writes
+  // for as long as vx holds it: `vx run dev --all` showed none of its
+  // servers' logs while it ran (C-56). So a ready server's output streams
+  // from then on, a line at a time under its id; the partial line each
+  // holds waits for its newline, a second runEnd, or `settle`.
+  const KEPT_LINE_CAP = 64 * 1024
+  const keptLines = new Map<string, { node: TaskNode; rest: string }>()
+  const streamKept = (node: TaskNode, chunk: string): void => {
+    const held = keptLines.get(node.id) ?? { node, rest: '' }
+    keptLines.set(node.id, held)
+    const text = held.rest + chunk
+    const cut = text.lastIndexOf('\n')
+    if (cut < 0) {
+      // A line that never ends (a `\r` progress bar) is printed at the cap
+      // rather than held without bound.
+      if (text.length < KEPT_LINE_CAP) held.rest = text
+      else {
+        held.rest = ''
+        writer.write(fenced(formatKeptLines(node, text, colors)))
+      }
+      return
+    }
+    held.rest = text.slice(cut + 1)
+    writer.write(fenced(formatKeptLines(node, text.slice(0, cut), colors)))
+  }
+  const flushKept = (): void => {
+    for (const held of keptLines.values()) {
+      if (held.rest.length > 0) writer.write(fenced(formatKeptLines(held.node, held.rest, colors)))
+      held.rest = ''
+    }
+  }
+  const printsKept = (tail: { outcome?: TaskOutcome }): boolean =>
+    flushedPersistent && tail.outcome !== undefined && view.mode !== 'errors-only'
   // The recap's material, decided at each failure so nothing is held for a
   // task that passed. A buffered task's tail is read off the buffers the
   // frame drains; a live-streamed one keeps no buffer, so a bounded ring
@@ -411,6 +445,8 @@ export function defaultLogger(
 
   return {
     settle() {
+      // The bus delivers one `run:end`, so the CLI's last word reaches here.
+      flushKept()
       writer.settle()
     },
     failureRecap() {
@@ -483,6 +519,7 @@ export function defaultLogger(
       // like the failures below: run() calls runEnd twice on the success
       // path (once before the summary, once in its finally), and a
       // kept-alive child keeps writing between the two.
+      if (flushedPersistent) flushKept()
       if (!flushedPersistent) {
         flushedPersistent = true
         if (view.mode !== 'none' && view.mode !== 'errors-only') {
@@ -533,7 +570,8 @@ export function defaultLogger(
       }
       const tail = persistentTails.get(node.id)
       if (tail !== undefined) {
-        appendTail(tail.out, chunk)
+        if (printsKept(tail)) streamKept(node, chunk)
+        else appendTail(tail.out, chunk)
         return
       }
       pushChunk(stdoutBuffers, node.id, chunk)
@@ -550,7 +588,8 @@ export function defaultLogger(
       }
       const tail = persistentTails.get(node.id)
       if (tail !== undefined) {
-        appendTail(tail.err, chunk)
+        if (printsKept(tail)) streamKept(node, chunk)
+        else appendTail(tail.err, chunk)
         return
       }
       pushChunk(stderrBuffers, node.id, chunk)

package/src/orchestrator/options.ts

@@ -180,9 +180,10 @@ export interface RunOptions {
    */
   signal?: AbortSignal
   /**
-   * Hand the requested persistent tasks still running, and the persistent
-   * tasks they depend on (C-46), back on `RunSummary.persistent` instead
-   * of stopping them when the graph ends.
+   * Hand the requested persistent tasks still running, those a requested
+   * group stands for (C-52), and the persistent tasks they depend on
+   * (C-46), back on `RunSummary.persistent` instead of stopping them when
+   * the graph ends.
    * The caller owns them from then on and stops them with its `stop()`.
    * The watch loop sets this: a dev server stays up while watch idles and
    * is replaced only when the next cycle starts.
@@ -229,7 +230,8 @@ export interface RunOptions {
    * The raw command string for the `invocations` row (e.g.
    * `'vx run build test --all'`). When absent, run() falls back to
    * `process.argv.slice(1).join(' ')` so programmatic callers still
-   * record something useful.
+   * record something useful. Telemetry sinks get it with what follows
+   * `--` counted, not quoted, as they get the argv (C-67).
    */
   command?: string
   /**

package/src/orchestrator/plugin-host.ts

@@ -386,12 +386,13 @@ export function buildAdmission(
 }
 
 /**
- * Collect every plugin's `cache` layer in declaration order. One layer is
- * used as is; two or more are chained (lookup walks them, save reaches all;
- * see ChainedCache). A bare local layer that another declared layer already
- * wraps (`layer.local === ctx.localCache`) is dropped, so a remote plugin
- * that layers over the local handle does not also write the local store
- * directly. A plugin declaring nothing leaves that store, unwrapped.
+ * Collect every plugin's `cache` layer in declaration order, with the local
+ * store at the tail, and chain them (lookup walks them, save reaches all;
+ * see ChainedCache). The local store is dropped when a declared layer wraps
+ * it (`layer.local === ctx.localCache`), so a remote plugin that layers over
+ * the local handle does not also write it directly. Only a single layer
+ * left is used as is: the local store when no plugin declares one, or the
+ * one layer that wraps it.
  */
 export async function resolveCache(
   plugins: readonly VxPlugin[],

package/src/orchestrator/prepare.ts

@@ -20,6 +20,7 @@ import {
   LayeredCache,
   applyGitEnumeration,
   gitPathspecs,
+  MAX_SCOPED_PATHSPECS,
   startGitEnumeration,
   lazyGitEnumeration,
 } from '../cache/index.js'
@@ -31,6 +32,7 @@ import {
   type LoadReads,
   loadWorkspace,
   FROZEN_WITHOUT_LOCK,
+  type Lockfile,
   readLockfile,
   resolveCacheDir,
   type ProjectEntry,
@@ -181,9 +183,13 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // config, discovery, the cache open and the config evaluation. Its
   // ~60 ms is the warm run's wall floor on a 1000-project tree; it used to
   // start after discovery and the cache open, ~25 ms later. A scoped run
-  // waits: its pathspecs depend on which projects the configs pull in.
-  const unscoped =
-    options.projects === undefined && options.tasks.some((spec) => spec.indexOf('#') <= 0)
+  // waits: its pathspecs depend on which projects the configs pull in —
+  // unless it already names more projects than pathspecs scope, where the
+  // walk is the whole tree either way (an `--affected` run on 1,000
+  // projects waited ~60 ms for it after the configs loaded).
+  const wholeTree =
+    (options.projects === undefined || options.projects.length > MAX_SCOPED_PATHSPECS) &&
+    options.tasks.some((spec) => spec.indexOf('#') <= 0)
   // A `discover` hook that reads the worktree (nx()'s graph key) starts the
   // whole-tree enumeration a scoped run would otherwise scope later, here or
   // in the CLI's selection pass; the run reuses it instead of walking the
@@ -192,7 +198,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   const git =
     (reused !== undefined ? gitOfDiscovery(reused.projects) : undefined) ??
     lazyGitEnumeration(workspaceRoot)
-  if (unscoped) void git.start()
+  if (wholeTree) void git.start()
   const workspace = await loadWorkspace(workspaceRoot, reads)
   const { workspaceConfig, plugins } = await loadWorkspacePlugins(workspaceRoot, (m) =>
     log.status(m),
@@ -277,10 +283,24 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
   // so consuming the lock by default would silently serve stale
   // freezes. `vx lock --check` is the full re-evaluation audit.
   // See docs/design/config-lock-2026-06.md.
-  const lock = options.frozen === true ? await readLockfile(workspaceRoot) : null
-  if (options.frozen === true && lock === null) {
-    throw new UserError(FROZEN_WITHOUT_LOCK)
-  }
+  // Read once, and only when a config is to be read from it: the CLI's
+  // selection pass may have staged every config (`options.staged`), and
+  // its load refused a frozen run without a lock. A 1,000-project lock is
+  // 1.1 MB of JSON (I-27).
+  let lockRead: Promise<Lockfile> | undefined
+  const readLock = (): Promise<Lockfile> =>
+    (lockRead ??= readLockfile(workspaceRoot).then((read) => {
+      if (read === null) throw new UserError(FROZEN_WITHOUT_LOCK)
+      return read
+    }))
+  const staged = options.staged
+  const allStaged =
+    staged !== undefined &&
+    projectMetas.every(
+      (m) => typeof m.configPath !== 'string' || m.configPath === '' || staged.has(m.name),
+    )
+  if (options.frozen === true && !allStaged) await readLock()
+  const lock = options.frozen === true ? readLock : null
 
   const loadArgs = {
     workspaceRoot,
@@ -436,7 +456,14 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
         workspaceRoot,
         gitPathspecs(workspaceRoot, projectDirs, usesWorkspaceInputs),
       ))
-    applyGitEnumeration(enumeration, workspaceRoot, projectDirs, gitFilesCache, usesWorkspaceInputs)
+    await applyGitEnumeration(
+      enumeration,
+      workspaceRoot,
+      projectDirs,
+      gitFilesCache,
+      usesWorkspaceInputs,
+      localCache,
+    )
     mark('git enumeration')
     const hashCache = createHashCache()
     const fingerprintWatch = new FingerprintWatch(workspaceRoot, fingerprints, fingerprintsAt)

package/src/orchestrator/projects.ts

@@ -116,8 +116,12 @@ interface LoadProjectsBase {
    * way, since the package graph cannot see the cross form.
    */
   seeds: 'all' | Iterable<string>
-  /** Read configs from the lock instead of evaluating them (`--frozen`). */
-  lock: Lockfile | null
+  /**
+   * Read configs from the lock instead of evaluating them (`--frozen`),
+   * asked only when a config is to be read: a run whose every config the
+   * CLI's selection pass staged never parses it again.
+   */
+  lock: (() => Promise<Lockfile>) | null
   evalCache: LoadProjectConfigOptions['evalCache']
   warn: (message: string) => void
   /**
@@ -223,7 +227,9 @@ export async function loadProjects(args: LoadProjectsArgs): Promise<LoadedProjec
         typeof m.configPath === 'string' && args.staged?.get(m.name) === undefined,
     )
     const loaded = lock
-      ? await frozenProjectConfigs(lock, withFile, workspaceRoot, args.evalCache?.store)
+      ? withFile.length === 0
+        ? []
+        : await frozenProjectConfigs(await lock(), withFile, workspaceRoot, args.evalCache?.store)
       : await loadProjectConfigs(
           withFile.map((m) => m.configPath),
           args.evalCache !== undefined ? { evalCache: args.evalCache } : {},

package/src/orchestrator/run.ts

@@ -5,7 +5,12 @@
 import type { ProjectEntry } from '../workspace/index.js'
 import { loadWorkspace, unreachedHint, unreachedPackages } from '../workspace/index.js'
 import path from 'node:path'
-import { type CacheLayer, type CachePolicy, FULL_CACHE_POLICY } from '../cache/index.js'
+import {
+  type CacheLayer,
+  type CachePolicy,
+  FULL_CACHE_POLICY,
+  stopRuntimeProbes,
+} from '../cache/index.js'
 import { VERSION } from '../version.js'
 import {
   resetSandbox,
@@ -533,6 +538,7 @@ async function runOnBus(
   // ends after it is the stop's own kill, and was named a crash (item 1061).
   let endedBeforeStop: ReadonlySet<ReturnType<typeof Bun.spawn>> | undefined
   const onAbort = (): void => {
+    stopRuntimeProbes()
     endedBeforeStop = new Set([...persistentRegistry.values()].filter(hasEnded))
     aborting = terminateChildren(
       () => [...liveChildren, ...persistentRegistry.values()],
@@ -634,7 +640,9 @@ async function runOnBus(
       runContextRecord = {
         runId,
         vxVersion: VERSION,
-        command: options.command ?? invocationCommand(process.argv.slice(1)),
+        // An embedder's `command` is redacted as the argv is: it passed a
+        // token after `--` to every sink verbatim (C-67).
+        command: invocationCommand(options.command?.split(' ') ?? process.argv.slice(1)),
         requestedTasks: [...options.tasks],
         cachePolicy: compactCachePolicy(policy),
         concurrency,

package/src/orchestrator/sandbox-request.ts

@@ -187,13 +187,14 @@ export async function sandboxRequestFor(
    */
   cacheDir?: string,
 ): Promise<SandboxRequest> {
-  // SRT reads a Linux path holding a bracket as a glob and drops it from
-  // the writes, so no grant here could be mounted (B-60).
+  // The runtime reads a path holding a bracket as a pattern: on Linux it
+  // mounts no such write path (B-60); seatbelt's rules compile it as a
+  // character class, so vx's own workspace wall matched nothing (B-65).
   const home = toRealPath(node.projectDir)
-  if (process.platform === 'linux' && /[[\]]/.test(home)) {
+  if (process.platform !== 'win32' && /[[\]]/.test(home)) {
     throw new UserError(
-      `exec.sandbox: ${home} holds a bracket ([ or ]), and the Linux sandbox mounts no path ` +
-        `that does — rename the directory, or run the task without exec.sandbox`,
+      `exec.sandbox: ${home} holds a bracket ([ or ]), which the sandbox runtime reads as a ` +
+        `pattern, not a name — rename the directory, or run the task without exec.sandbox`,
     )
   }
   const depDirs = [

package/src/orchestrator/shell-verdict.ts

@@ -23,13 +23,22 @@ export function shellVerdict(args: {
   bins: string[]
   /** The signal that killed the child when the runner saw one (`RunResult.signal`). */
   signal?: string | undefined
+  /** A sandboxed task's view: whether a file is hidden from it (no grant reads it). */
+  hidden?: ((file: string) => boolean) | undefined
 }): string | undefined {
   if (args.code !== 127 && args.code !== 126) return signalVerdict(args.code, args.signal)
   const word = execWord(args.command)
   const what = word ?? 'a command in this task'
   if (word !== undefined && word.includes('/')) {
     const file = path.resolve(args.cwd, word)
-    return `[vx] exit ${args.code} is the shell's "${args.code === 127 ? 'not found' : 'cannot execute'}": ${word} ${fileVerdict(file)}`
+    // The file the host has may be one the sandbox does not: then the
+    // shell's "not found" is the sandbox's, and the file's own state (its
+    // `#!` line) is not the reason.
+    const verdict =
+      existsSync(file) && args.hidden?.(file) === true
+        ? `exists, but no sandbox grant reads it, so inside the sandbox it is not there — add it (or its directory) to exec.sandbox.allow.read`
+        : fileVerdict(file)
+    return `[vx] exit ${args.code} is the shell's "${args.code === 127 ? 'not found' : 'cannot execute'}": ${word} ${verdict}`
   }
   if (args.code === 126) {
     return `[vx] exit 126 is the shell's "found but cannot execute": ${what} is not executable or is a directory — chmod +x it`