@vzn/vx 0.0.353 → 0.0.354

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.353",
+  "version": "0.0.354",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.353",
-    "@vzn/vx-linux-arm64": "0.0.353",
-    "@vzn/vx-darwin-x64": "0.0.353",
-    "@vzn/vx-darwin-arm64": "0.0.353"
+    "@vzn/vx-linux-x64": "0.0.354",
+    "@vzn/vx-linux-arm64": "0.0.354",
+    "@vzn/vx-darwin-x64": "0.0.354",
+    "@vzn/vx-darwin-arm64": "0.0.354"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/git-inputs.ts

@@ -360,7 +360,7 @@ export function runGitLsFiles(cwd: string): GitLsResult {
     )
   }
   const { text, undecodable } = decodeGitZ(proc.stdout)
-  const parsed = parseLsFilesOutput(text, undecodable)
+  const parsed = parseLsFilesOutput(text.length === 0 ? [] : text.split('\0'), undecodable)
   const nested = expandNestedRepos(cwd, parsed.files, parsed.gitlinks)
   parsed.files = nested.files
   parsed.undecodable.push(...nested.undecodable)
@@ -445,15 +445,22 @@ export function fileIdentity(mode: string, oid: string): string {
 // `h`, …) in front. `--others` paths print bare; with `-z`, core.quotePath
 // quoting is off, so a bare path containing a literal tab still cannot
 // match the fixed-form prefix. Both answers come from ONE spawn.
-function parseLsFilesOutput(out: string, undecodableRecords: ReadonlySet<string>): GitLsResult {
+//
+// `debug`, for a `--debug` listing: each record's recorded size (aligned
+// with `records`) in, and each regular stage-0 entry's raw OID and size out.
+function parseLsFilesOutput(
+  records: readonly string[],
+  undecodableRecords: ReadonlySet<string>,
+  debug?: { sizes: readonly number[]; indexed: Map<string, { oid: string; size: number }> },
+): GitLsResult {
   const files: string[] = []
   const oids = new Map<string, string>()
   const flagged = new Set<string>()
   const gitlinks = new Set<string>()
   const undecodable: string[] = []
-  if (out.length === 0) return { files, oids, flagged, gitlinks, undecodable }
   // NUL-separated; trailing NUL produces an empty segment we skip.
-  for (const record of out.split('\0')) {
+  for (let i = 0; i < records.length; i++) {
+    const record = records[i]!
     if (record.length === 0) continue
     const m = LS_FILES_STAGE_RE.exec(record)
     const filePath = m === null ? record : record.slice(m[0].length) // --others: bare path
@@ -464,6 +471,9 @@ function parseLsFilesOutput(out: string, undecodableRecords: ReadonlySet<string>
     const stage = m[4]!
     if ((mode === '100644' || mode === '100755' || mode === '120000') && stage === '0') {
       oids.set(filePath, fileIdentity(mode, m[3]!))
+      if (debug !== undefined && mode !== '120000') {
+        debug.indexed.set(filePath, { oid: m[3]!, size: debug.sizes[i]! })
+      }
     } else if (mode === '160000') {
       gitlinks.add(filePath)
     }
@@ -477,21 +487,23 @@ function parseLsFilesOutput(out: string, undecodableRecords: ReadonlySet<string>
 }
 
 /**
- * `ls-files -s -v -z --debug` as the plain `-s -v -z` stream, plus the size
- * the index records for each regular stage-0 entry's worktree file and its
- * raw OID. With `-z`, each record's NUL is followed by its five
- * newline-ended debug lines (ctime, mtime, dev/ino, uid/gid, size/flags),
- * then the next record.
+ * `ls-files -s -v -z --debug` as the plain `-s -v -z` records, plus the size
+ * the index records for each, aligned. With `-z`, each record's NUL is
+ * followed by its five newline-ended debug lines (ctime, mtime, dev/ino,
+ * uid/gid, size/flags), then the next record. The records go to
+ * `parseLsFilesOutput` as they are: joining them for it to split again,
+ * a regex per size line and a second regex per record were ~14 ms of a
+ * 12,905-file listing.
  */
-function stripLsDebug(run: GitRun): {
-  plain: string
+function splitLsDebug(run: GitRun): {
+  records: string[]
+  sizes: number[]
   undecodable: Set<string>
-  indexed: Map<string, { oid: string; size: number }>
 } {
   const segs = run.stdout.split('\0')
   const records: string[] = []
+  const sizes: number[] = []
   const undecodable = new Set<string>()
-  const indexed = new Map<string, { oid: string; size: number }>()
   let record = segs[0]!
   let recordRaw = record
   for (let i = 1; i <= segs.length; i++) {
@@ -504,7 +516,13 @@ function stripLsDebug(run: GitRun): {
         const nl = seg.indexOf('\n', at)
         if (nl < 0) at = -1
         else {
-          if (k === 4) size = Number(/size: (\d+)/.exec(seg.slice(at, nl))?.[1] ?? -1)
+          if (k === 4) {
+            const field = seg.indexOf('size: ', at)
+            if (field >= 0 && field < nl) {
+              const n = parseInt(seg.slice(field + 6, nl), 10)
+              if (!Number.isNaN(n)) size = n
+            }
+          }
           at = nl + 1
         }
       }
@@ -512,16 +530,13 @@ function stripLsDebug(run: GitRun): {
     }
     if (record.length > 0) {
       records.push(record)
+      sizes.push(size)
       if (run.undecodable.has(recordRaw)) undecodable.add(record)
-      const m = LS_FILES_STAGE_RE.exec(record)
-      if (m !== null && m[4] === '0' && (m[2] === '100644' || m[2] === '100755')) {
-        indexed.set(record.slice(m[0].length), { oid: m[3]!, size })
-      }
     }
     record = rest
     recordRaw = seg ?? ''
   }
-  return { plain: records.join('\0'), undecodable, indexed }
+  return { records, sizes, undecodable }
 }
 
 /** Blob sizes learned once and kept: a blob's size is fixed for its OID. `Cache` is one. */
@@ -546,9 +561,16 @@ export interface BlobSizeMemo {
 async function dropResizedOids(enumeration: GitEnumeration, memo?: BlobSizeMemo): Promise<void> {
   const { trusted, indexed } = enumeration
   const wanted = new Set<string>()
+  // Each trusted path's index entry, found once: a second lookup by path
+  // in the check below was half of this pass on a 12,905-file tree.
+  const rels: string[] = []
+  const entries: Array<{ oid: string; size: number }> = []
   for (const rel of trusted.keys()) {
     const entry = indexed.get(rel)
-    if (entry !== undefined) wanted.add(entry.oid)
+    if (entry === undefined) continue // a symlink: its blob is its target string
+    rels.push(rel)
+    entries.push(entry)
+    wanted.add(entry.oid)
   }
   if (wanted.size === 0) return
   const sizes = memo?.knownBlobSizes([...wanted]) ?? new Map<string, number>()
@@ -569,12 +591,11 @@ async function dropResizedOids(enumeration: GitEnumeration, memo?: BlobSizeMemo)
     for (const [oid, n] of learned) sizes.set(oid, n)
     memo?.rememberBlobSizes(learned)
   }
-  for (const rel of trusted.keys()) {
-    const entry = indexed.get(rel)
-    if (entry === undefined) continue // a symlink: its blob is its target string
+  for (let i = 0; i < rels.length; i++) {
+    const entry = entries[i]!
     const size = sizes.get(entry.oid)
     // The index keeps the low 32 bits of a size.
-    if (size === undefined || size % 2 ** 32 !== entry.size) trusted.delete(rel)
+    if (size === undefined || size % 2 ** 32 !== entry.size) trusted.delete(rels[i]!)
   }
 }
 
@@ -1064,7 +1085,7 @@ export async function startGitEnumeration(
   // (`dropResizedOids`, A-60).
   const listing = spawnGit(['ls-files', '-s', '-v', '-z', '--debug', '--', ...pathspecs]).then(
     (run) =>
-      run === null || run.exitCode !== 0 ? { run, debug: null } : { run, debug: stripLsDebug(run) },
+      run === null || run.exitCode !== 0 ? { run, debug: null } : { run, debug: splitLsDebug(run) },
   )
   const running = Promise.all([
     listing,
@@ -1118,13 +1139,14 @@ export async function startGitEnumeration(
         `Run 'git init' in your workspace root.${stderr ? ` (git: ${stderr})` : ''}`,
     )
   }
+  const indexed = new Map<string, { oid: string; size: number }>()
   const {
     files: tracked,
     oids,
     flagged,
     gitlinks,
     undecodable,
-  } = parseLsFilesOutput(debug!.plain, debug!.undecodable)
+  } = parseLsFilesOutput(debug!.records, debug!.undecodable, { sizes: debug!.sizes, indexed })
   // Normalize `status`'s repo-root-relative paths to workspace-relative (strip
   // the `--show-prefix`) so the dirty set is keyed identically to the trusted
   // OID map. Without this, when the workspace root is a git subdir, a modified
@@ -1202,7 +1224,7 @@ export async function startGitEnumeration(
     untracked: dirty === null ? null : untracked,
     undecodable,
     startedAtMs,
-    indexed: debug!.indexed,
+    indexed,
     // A missing blob is an answer ("missing"), never a fetch from a partial
     // clone's promisor remote.
     catFile: (stdin) =>
@@ -1257,7 +1279,28 @@ export async function applyGitEnumeration(
   // ~9k files; ~5 ms this way). '/' sorts below most filename chars,
   // so the range [prefix, prefix+'\xff…') is contiguous in the sorted
   // array; lowerBound on `prefix` and on `prefix + '￿'` bracket it.
-  const sorted = [...all].sort()
+  // Git lists in order; a list that already is skips the sort.
+  let inOrder = true
+  for (let i = 1; i < all.length; i++) {
+    if (all[i - 1]! > all[i]!) {
+      inOrder = false
+      break
+    }
+  }
+  const sorted = inOrder ? all : [...all].sort()
+  // Git prints normalized relative paths, so under an absolute, normalized
+  // root a join is a concatenation: `path.join` per tracked file and
+  // `path.relative` per project were most of this pass (I-30's rule).
+  const base =
+    path.sep === '/' &&
+    path.isAbsolute(workspaceRoot) &&
+    path.normalize(workspaceRoot) === workspaceRoot
+      ? workspaceRoot.endsWith('/')
+        ? workspaceRoot
+        : `${workspaceRoot}/`
+      : undefined
+  const abs = (rel: string): string =>
+    base === undefined ? path.join(workspaceRoot, rel) : base + rel
   const lowerBound = (key: string): number => {
     let lo = 0
     let hi = sorted.length
@@ -1269,11 +1312,14 @@ export async function applyGitEnumeration(
     return lo
   }
   for (const projectDir of projectDirs) {
-    const relPrefix = path.relative(workspaceRoot, projectDir).split(path.sep).join('/')
+    const relPrefix =
+      base !== undefined && projectDir.startsWith(base) && path.normalize(projectDir) === projectDir
+        ? projectDir.slice(base.length).replace(/\/$/, '')
+        : path.relative(workspaceRoot, projectDir).split(path.sep).join('/')
     if (relPrefix === '' || relPrefix === '.') {
       cache.set(projectDir, all)
       const rootOids = new Map<string, string>()
-      for (const [rel, oid] of trusted) rootOids.set(path.join(workspaceRoot, rel), oid)
+      for (const [rel, oid] of trusted) rootOids.set(abs(rel), oid)
       cache.setOids(projectDir, rootOids)
       continue
     }
@@ -1286,7 +1332,7 @@ export async function applyGitEnumeration(
       const rel = sorted[i]!
       matches.push(rel.slice(prefix.length))
       const oid = trusted.get(rel)
-      if (oid !== undefined) projOids.set(path.join(workspaceRoot, rel), oid)
+      if (oid !== undefined) projOids.set(abs(rel), oid)
     }
     // An empty slice is a directory git did not see, not an empty project:
     // a project has at least its package.json, tracked or untracked. A
@@ -1308,7 +1354,7 @@ export async function applyGitEnumeration(
   }
   if (workspaceWide) {
     const rootOids = new Map<string, string>()
-    for (const [rel, oid] of trusted) rootOids.set(path.join(workspaceRoot, rel), oid)
+    for (const [rel, oid] of trusted) rootOids.set(abs(rel), oid)
     cache.set(workspaceRoot, all)
     cache.setOids(workspaceRoot, rootOids)
     cache.setWorkspaceRoot(workspaceRoot)

package/src/cache/inputs.ts

@@ -385,6 +385,7 @@ async function runRuntimeCommand(
   command: string,
   cwd: string,
   binDirs: readonly string[],
+  owner: RuntimeMemo | undefined,
 ): Promise<string> {
   const ambient = process.env['PATH']
   const prefix = binDirs.join(path.delimiter)
@@ -416,6 +417,12 @@ async function runRuntimeCommand(
     throw new UserError(`cache.inputs runtime command failed to spawn: ${command} (cwd: ${cwd})`)
   }
   liveProbes.add(proc)
+  let mine: Set<ReturnType<typeof Bun.spawn>> | undefined
+  if (owner !== undefined) {
+    mine = probesOf.get(owner) ?? new Set()
+    probesOf.set(owner, mine)
+    mine.add(proc)
+  }
   killProbesOnExit()
   let stdout, stderr, exitCode
   try {
@@ -426,6 +433,7 @@ async function runRuntimeCommand(
     ])
   } finally {
     liveProbes.delete(proc)
+    mine?.delete(proc)
   }
   const output = `${stdout}${stderr}`.trim()
   if (exitCode !== 0) {
@@ -449,18 +457,26 @@ async function runRuntimeCommand(
 const liveProbes = new Set<ReturnType<typeof Bun.spawn>>()
 let probeExitHooked = false
 
+type RuntimeMemo = Map<string, Promise<string>>
+/** The probes each run started, by the run's memo: one run's stop is not another's. */
+const probesOf = new WeakMap<RuntimeMemo, Set<ReturnType<typeof Bun.spawn>>>()
+
 /**
- * Kill every runtime probe still running, with its tree. A run's stop asks
- * this: a Ctrl-C while a probe ran waited for the probe, or for the signal
- * handler's bound, about 7 s, before vx exited (C-65). Its answer is no
- * longer needed; its caller sees it fail and the run reads it aborted.
+ * Kill every runtime probe still running that these memos (one run's
+ * `runtimeCache` and `workspaceRuntimeCache`) started, with its tree. A
+ * run's stop asks this: a Ctrl-C while a probe ran waited for the probe,
+ * or for the signal handler's bound, about 7 s, before vx exited (C-65).
+ * Its answer is no longer needed; its caller sees it fail and the run
+ * reads it aborted. Another run in the process keeps its own.
  */
-export function stopRuntimeProbes(): void {
-  for (const p of liveProbes) {
-    try {
-      process.kill(-p.pid, 'SIGKILL')
-    } catch {
-      // the group is gone
+export function stopRuntimeProbes(...memos: readonly RuntimeMemo[]): void {
+  for (const memo of memos) {
+    for (const p of probesOf.get(memo) ?? []) {
+      try {
+        process.kill(-p.pid, 'SIGKILL')
+      } catch {
+        // the group is gone
+      }
     }
   }
 }
@@ -501,7 +517,7 @@ async function resolveRuntimeValues(
       const key = `${memoKeyPrefix}${cmd}`
       let p = memo?.get(key)
       if (p === undefined) {
-        p = runRuntimeCommand(cmd, cwd, binDirs)
+        p = runRuntimeCommand(cmd, cwd, binDirs, memo)
         memo?.set(key, p)
       }
       return [cmd, await p] as [string, string]

package/src/cli/cache.ts

@@ -45,7 +45,10 @@ export async function cacheCmd(args: readonly string[]): Promise<number> {
     case 'prune':
       return await pruneCmd(rest)
     case undefined:
-      process.stderr.write('vx cache: missing subcommand. Try `vx cache prune`.\n')
+      // A bare `vx cache prune` refuses too: the hint names a whole command.
+      process.stderr.write(
+        `vx cache: missing subcommand. Try \`vx cache prune --older-than 30d\` or \`vx cache prune --max-size 1G\`${seeHelp('cache')}\n`,
+      )
       return 1
     default:
       process.stderr.write(

package/src/cli/show.ts

@@ -66,10 +66,17 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   const metas = await discoverCliProjects(await loadWorkspace(root, reads))
   const byName = new Map(metas.map((m) => [m.name, m]))
 
-  // `//#task` is Turbo's root package's task: the root project here (D-39).
+  // `//#task` is Turbo's root package's task: the root project here (D-39),
+  // and `//` alone is that project, as `--filter //` reads it (D-46).
   const rootMeta = metas.find((m) => path.resolve(m.dir) === path.resolve(root))
-  if (parsed.target?.startsWith('//#') && rootMeta !== undefined)
-    parsed.target = `${rootMeta.name}#${parsed.target.slice(3)}`
+  if (parsed.target === '//' || parsed.target?.startsWith('//#')) {
+    if (rootMeta === undefined) {
+      throw new UserError(
+        `vx show: "${parsed.target}" names the workspace root's project, and the root is no project here`,
+      )
+    }
+    parsed.target = `${rootMeta.name}${parsed.target.slice(2)}`
+  }
   const hashAt = parsed.target?.indexOf('#') ?? -1
   const projectName =
     parsed.target === undefined
@@ -87,7 +94,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   if (projectName !== undefined && (taskName !== undefined || byName.has(projectName))) {
     if (!byName.has(projectName)) {
       throw new UserError(
-        `unknown project: "${projectName}"${suggest(projectName, [...byName.keys()])}`,
+        `vx show: unknown project: "${projectName}"${suggest(projectName, [...byName.keys()])}`,
       )
     }
   }
@@ -114,7 +121,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
       // `nx show projects` lists them; here a bare `vx show` does.
       const nx = projectName === 'projects' ? ' (`nx show projects` is `vx show` here)' : ''
       throw new UserError(
-        `unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names])}`,
+        `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names])}`,
       )
     }
     process.stdout.write(renderTaskAcross(root, declaring, projectName!, parsed.format))
@@ -136,7 +143,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   const task = declaredTask(config, taskName)
   if (task === undefined) {
     throw new UserError(
-      `unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`)}`,
+      `vx show: unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`)}`,
     )
   }
   process.stdout.write(renderTask(meta.name, dir, taskName, task, parsed.format))

package/src/cli/why.ts

@@ -44,7 +44,8 @@ export const WHAT_TO_DO: Readonly<Record<string, string>> = {
   package: "the project's package.json changed (a dependency, version or script)",
   workspace:
     'a lockfile or root manifest changed, which re-keys every task; a lockfile plugin keys each project on its own dependencies',
-  config: "the task's evaluated config changed (its vx.config or a file that imports)",
+  config:
+    "the task's evaluated config changed (its vx.config or a file it imports); `vx show <that task>` prints it as it is now",
   upstream: "a dependency's key moved; `vx why <that task>` says why",
   plugin: "a key plugin's material changed; that plugin decides what it folds",
 }
@@ -267,7 +268,9 @@ export async function whyCmd(args: readonly string[]): Promise<number> {
                   '`vx why <that task>`',
                   upstream.map((n) => `\`vx why ${n}\``).join(', '),
                 )
-              : WHAT_TO_DO[k]
+              : k === 'config'
+                ? WHAT_TO_DO[k]!.replace('`vx show <that task>`', `\`vx show ${taskId}\``)
+                : WHAT_TO_DO[k]
           lines.push(`    ${k.padEnd(kindW)}  ${todo}`)
         }
       }

package/src/exec/env.ts

@@ -71,6 +71,7 @@ export interface BuildEnvOptions {
    * (`oxlint`, `tsc`, `vitest`, …) resolve without a PM wrapper. Matches
    * vite-task's behavior — explicit per-project bin, no tree walk, so
    * sibling projects' bins stay invisible per the project-isolation rule.
+   * One holding `path.delimiter` is left out: PATH cannot name it.
    */
   binPaths?: readonly string[]
 }
@@ -90,8 +91,12 @@ export function buildIsolatedEnv(opts: BuildEnvOptions): NodeJS.ProcessEnv {
     out[name] = value
   }
 
-  if (opts.binPaths && opts.binPaths.length > 0) {
-    const prefix = opts.binPaths.join(path.delimiter)
+  // A directory holding the delimiter cannot be named in PATH: split, it
+  // became two entries naming nothing, the second RELATIVE, so resolved
+  // against the task's cwd. The 127 verdict says why it is missing.
+  const bins = opts.binPaths?.filter((dir) => !dir.includes(path.delimiter)) ?? []
+  if (bins.length > 0) {
+    const prefix = bins.join(path.delimiter)
     out['PATH'] = out['PATH'] ? `${prefix}${path.delimiter}${out['PATH']}` : prefix
   }
 

package/src/exec/sandbox-binds.ts

@@ -36,7 +36,7 @@ export function bindableWrites(paths: readonly string[]): string[] {
   if (process.platform !== 'linux') return [...paths]
   return unique(
     paths
-      .filter((p) => !holdsBracket(p))
+      .filter((p) => !holdsGlobChar(p))
       .map((p) => {
         if (!isMountableLiteral(p)) return p
         try {
@@ -191,31 +191,66 @@ export function punchWritePaths(readPath: string, writePaths: readonly string[])
 }
 
 /** Grants already reported — once per process, not per spawn. */
-const warnedBracket = new Set<string>()
+const warnedGlob = new Set<string>()
 
 /**
- * SRT drops every Linux write path holding a bracket (it reads one as a
- * glob, and a write path must be a path), and no spelling keeps it. Left
- * in, the read grants were punched around a bind that never came, the
- * directory vanished from the task's view, its write read "Directory
+ * SRT drops every Linux write path holding `[`, `]`, `*` or `?` (it reads
+ * one as a glob, and a write path must be a path) or a backslash (Bun's
+ * realpath refuses it; `bindableReads`), and no spelling keeps
+ * it. Left in, the read grants were punched around a bind that never came,
+ * the directory vanished from the task's view, its write read "Directory
  * nonexistent" with no word of the grant, and the refused write went
  * unreported, judged against it. Dropped from the binds instead, and said
  * once: the remedy is the deepest directory above it whose name holds none.
  */
-function holdsBracket(grant: string): boolean {
-  const at = grant.search(/[[\]]/)
+function holdsGlobChar(grant: string): boolean {
+  const at = srtStripped(grant).search(/[[\]*?\\]/)
   if (at === -1) return false
-  if (!warnedBracket.has(grant)) {
-    warnedBracket.add(grant)
+  if (!warnedGlob.has(grant)) {
+    warnedGlob.add(grant)
     process.stderr.write(
-      `[vx] sandbox: the write grant ${grant} holds a bracket, and the Linux sandbox mounts no ` +
-        `write path that does, so a write under it is refused. Grant the directory above it ` +
-        `instead: ${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
+      `[vx] sandbox: the write grant ${grant} holds ${globChar(grant[at]!)}, and the Linux ` +
+        `sandbox mounts no write path that does, so a write under it is refused. Grant the ` +
+        `directory above it instead: ${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
     )
   }
   return true
 }
 
+/** A trailing `/**` SRT strips before it asks whether a path is a glob. */
+const srtStripped = (grant: string): string => grant.replace(/\/\*\*$/, '')
+
+const globChar = (c: string): string =>
+  c === '[' || c === ']' ? 'a bracket' : c === '\\' ? 'a backslash' : `a ${c}`
+
+/**
+ * Linux: the read grants SRT can mount as the paths they are. It reads
+ * one holding `*` or `?` as a glob and mounts every match, and no spelling
+ * makes either literal (its rewrite of each runs inside a class too), so a
+ * grant of `a*b.txt` granted `aXb.txt`. One holding a backslash it skips:
+ * Bun's `realpathSync` throws ENOENT on such a path (Node's does not), and
+ * SRT mounts no path it cannot resolve. Left out, so a read of it is
+ * refused and reported, and said once; a bracket has a spelling
+ * (`literalReadPaths`).
+ */
+export function bindableReads(paths: readonly string[]): string[] {
+  if (process.platform !== 'linux') return [...paths]
+  return paths.filter((grant) => {
+    const at = srtStripped(grant).search(/[*?\\]/)
+    if (at === -1) return true
+    if (!warnedGlob.has(grant)) {
+      warnedGlob.add(grant)
+      process.stderr.write(
+        `[vx] sandbox: the read grant ${grant} holds ${globChar(grant[at]!)}, which the Linux ` +
+          `sandbox ${grant[at] === '\\' ? 'cannot resolve' : 'reads as a pattern that also matches its siblings'}, so it is not granted. ` +
+          `Rename it, or grant the directory above it: ` +
+          `${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
+      )
+    }
+    return false
+  })
+}
+
 /**
  * Merge the orchestrator-provided baseline (declared inputs / outputs /
  * workspace-root anchor) with the user's resolved sandbox block to

package/src/exec/sandbox-runtime.ts

@@ -63,7 +63,7 @@ import {
   UserError,
   xxh3hex,
 } from '../util/index.js'
-import { bindableWrites, buildCustomConfig, scratchWrites } from './sandbox-binds.js'
+import { bindableReads, bindableWrites, buildCustomConfig, scratchWrites } from './sandbox-binds.js'
 import {
   atOrUnder,
   isMountableLiteral,
@@ -1167,7 +1167,8 @@ function asksUnixSockets(c: Pick<ResolvedSandboxConfig, 'unixSockets'>): boolean
  * but SRT reads any holding `[` as a glob, where a bracket opens a class:
  * a route granted as `pages/\[id\].tsx` was never mounted (its denial
  * unreported, a listed grant), and a workspace under `[ws]/` was never
- * walled. `[[]` is a class of one `[`; a lone `]` is plain text to it.
+ * walled. `[[]` is a class of one `[`; a lone `]` is plain text to it. A
+ * `*` or `?` has no such spelling: `bindableReads` leaves its grant out.
  */
 function literalReadPaths(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
@@ -1179,8 +1180,9 @@ function literalReadPaths(
     ...config,
     filesystem: {
       ...fs,
+      // A `*` or `?` in a deny path matches its siblings too: a wider wall.
       denyRead: escape(fs.denyRead),
-      ...(fs.allowRead !== undefined ? { allowRead: escape(fs.allowRead) } : {}),
+      ...(fs.allowRead !== undefined ? { allowRead: escape(bindableReads(fs.allowRead)) } : {}),
     },
   }
 }

package/src/exec/sandbox-violations.ts

@@ -6,6 +6,7 @@
 
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
+import { bindableReads } from './sandbox-binds.js'
 import type {
   ResolvedSandboxConfig,
   SandboxedRunArgs,
@@ -274,7 +275,10 @@ export async function parseStraceViolations(
   // real paths (see `canonicalBaselines`), so comparing a link-path here
   // would report an explicitly-allowed read as a violation.
   const allowAbs = new Set<string>(
-    [...baselines.allowRead, ...args.config.allowRead].map((p) => toRealPath(absolutize(p))),
+    // A grant SRT could not mount (`bindableReads`) permits nothing.
+    [...baselines.allowRead, ...bindableReads(args.config.allowRead)].map((p) =>
+      toRealPath(absolutize(p)),
+    ),
   )
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
 

package/src/orchestrator/doctor.ts

@@ -347,17 +347,15 @@ async function countLoadableTasks(
       } catch (err) {
         // Counted as zero, and named: the loader's message opens with the
         // absolute path — bare for a schema refusal, behind `Project config`
-        // for an import that failed — which the row carries
-        // workspace-relative instead, once (the second form named the file
-        // twice, 2026-09-16).
+        // for an import that failed, and with `:line:col` after it for a
+        // syntax error — which the row carries workspace-relative instead,
+        // once (the second form named the file twice, 2026-09-16; the third
+        // still did).
         const raw = err instanceof Error ? err.message : String(err)
-        let message = raw
-        for (const prefix of [`${meta.configPath}: `, `Project config ${meta.configPath}: `]) {
-          if (raw.startsWith(prefix)) {
-            message = raw.slice(prefix.length)
-            break
-          }
-        }
+        const bare = raw.startsWith('Project config ') ? raw.slice('Project config '.length) : raw
+        const message = bare.startsWith(`${meta.configPath}:`)
+          ? bare.slice(meta.configPath.length + 1).trimStart()
+          : raw
         errors.push({
           path: path.relative(root, meta.configPath).split(path.sep).join('/'),
           message,

package/src/orchestrator/plugin-host.ts

@@ -449,8 +449,12 @@ const executorPlugin = new WeakMap<TaskExecutor, string>()
  */
 export function nameExecutorFailure(executor: TaskExecutor, err: unknown): unknown {
   if (!(err instanceof Error) || !executorPlugin.has(executor)) return err
+  // Once: one error an executor rejects several tasks with (a failed
+  // connection it memoized) reaches here once per task (C-74).
+  const prefix = `${executorLabel(executor)} failed in execute: `
+  if (err.message.startsWith(prefix)) return err
   try {
-    err.message = `${executorLabel(executor)} failed in execute: ${err.message}`
+    err.message = `${prefix}${err.message}`
   } catch {
     // A frozen error keeps its own words.
   }

package/src/orchestrator/run.ts

@@ -538,7 +538,7 @@ async function runOnBus(
   // ends after it is the stop's own kill, and was named a crash (item 1061).
   let endedBeforeStop: ReadonlySet<ReturnType<typeof Bun.spawn>> | undefined
   const onAbort = (): void => {
-    stopRuntimeProbes()
+    stopRuntimeProbes(hashCache.runtime, hashCache.workspaceRuntime)
     endedBeforeStop = new Set([...persistentRegistry.values()].filter(hasEnded))
     aborting = terminateChildren(
       () => [...liveChildren, ...persistentRegistry.values()],
@@ -670,6 +670,25 @@ async function runOnBus(
     }
 
     const sandboxArmer = prepareSandbox(nodes.values())
+    // The probe is ~220 ms of spawns, paid by the first sandboxed task to
+    // execute. A task no cache can answer (no `cache`, reads off, or
+    // persistent) is sure to: start it now, under the classify and the
+    // upstream work. The task's own `arm()` rethrows a refusal, and the
+    // end of the run waits for it: one that landed after the reset left
+    // SRT's proxies holding the process open.
+    const surelyRuns = (n: TaskNode): boolean =>
+      n.config.exec?.persistent !== undefined ||
+      n.config.cache === undefined ||
+      !(policy.localRead || policy.remoteRead)
+    const sandboxed =
+      sandboxArmer === null
+        ? []
+        : [...nodes.values()].filter((n) => n.config.exec?.sandbox !== undefined)
+    let prewarming: Promise<void> | undefined
+    const prewarm = (): void => {
+      prewarming ??= sandboxArmer?.arm().catch(() => {})
+    }
+    if (sandboxed.some(surelyRuns)) prewarm()
     const keyed = keyedProjects(nodes, prepared.keyOnly)
     const outputDirSnapshots: OutputDirSnapshot[] = []
     // Saves run off the execution slot, twice the cap at once (memory:
@@ -771,6 +790,8 @@ async function runOnBus(
         hashCache,
         concurrency,
       })
+      // A confirmed miss runs too.
+      if (sandboxed.some((n) => shortCircuit.preProbed.get(n.id)?.hit === null)) prewarm()
     }
 
     // Whether this task runs behind a failure (`continueMode: 'always'`
@@ -1127,6 +1148,7 @@ async function runOnBus(
     // Tear down SRT's network bridge + (on macOS) log monitor. No-op if
     // no task was sandboxed; otherwise SRT keeps proxy servers alive and
     // the next vx run would init on top of stale state.
+    await prewarming
     if (sandboxArmer?.armed) {
       try {
         await resetSandbox()

package/src/orchestrator/sandbox-request.ts

@@ -104,7 +104,8 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
  * Linux, the runtime module's own load included) even when every task was
  * a cache hit and nothing executed; measured 2026-09-10 on this repo's
  * own warm gate: `classify + probe` 288 ms of a 798 ms run. A hit needs
- * no sandbox, so a hit pays nothing.
+ * no sandbox, so a hit pays nothing. `run()` arms early only when a
+ * sandboxed task is sure to execute (C-76).
  *
  * The domain union is computed here from every sandboxed node, because
  * SRT runs ONE filtering proxy per run and checks every request against
@@ -190,13 +191,23 @@ export async function sandboxRequestFor(
   // The runtime reads a path holding a bracket as a pattern: on Linux it
   // mounts no such write path (B-60); seatbelt's rules compile it as a
   // character class, so vx's own workspace wall matched nothing (B-65).
+  // A `*` or `?` is one too, and its grants matched the project's siblings.
   const home = toRealPath(node.projectDir)
-  if (process.platform !== 'win32' && /[[\]]/.test(home)) {
+  if (process.platform !== 'win32' && /[[\]*?]/.test(home)) {
     throw new UserError(
-      `exec.sandbox: ${home} holds a bracket ([ or ]), which the sandbox runtime reads as a ` +
+      `exec.sandbox: ${home} holds [, ], * or ?, which the sandbox runtime reads as a ` +
         `pattern, not a name — rename the directory, or run the task without exec.sandbox`,
     )
   }
+  // Bun's realpath throws ENOENT on a path holding a backslash, and SRT
+  // mounts no path it cannot resolve: the task saw no project and ran in
+  // $HOME.
+  if (process.platform === 'linux' && home.includes('\\')) {
+    throw new UserError(
+      `exec.sandbox: ${home} holds a backslash, which the Linux sandbox cannot resolve, so ` +
+        `it mounts none of the project — rename the directory, or run the task without exec.sandbox`,
+    )
+  }
   const depDirs = [
     path.join(node.projectDir, 'node_modules'),
     path.join(workspaceRoot, 'node_modules'),

package/src/orchestrator/shell-verdict.ts

@@ -43,6 +43,10 @@ export function shellVerdict(args: {
   if (args.code === 126) {
     return `[vx] exit 126 is the shell's "found but cannot execute": ${what} is not executable or is a directory — chmod +x it`
   }
+  const unnamed = args.bins.find((dir) => dir.includes(path.delimiter))
+  if (unnamed !== undefined) {
+    return `[vx] exit 127 is the shell's "command not found": ${what} is not on this task's PATH — ${unnamed} holds "${path.delimiter}", which PATH reads as a separator, so vx cannot put it there; move the workspace to a path without "${path.delimiter}"`
+  }
   return `[vx] exit 127 is the shell's "command not found": ${what} is not on this task's PATH — vx puts ${args.bins.join(' and ')} first and never a sibling project's bin; install it in this package or at the workspace root`
 }
 

package/src/orchestrator/summary.ts

@@ -272,7 +272,8 @@ export function formatSummarySection(
 /**
  * `42 tasks · 38 cached (90%) · 3.2s`, `2 tasks · all cached · 23ms`,
  * with the failures first when there are any. Cached is every hit (up to
- * date, restored locally or remotely) over every task that has a cache.
+ * date, restored locally or remotely) over every task that consulted a
+ * cache: a skipped or not-yet-run task never did.
  */
 function resultLine(
   stats: SummaryStats,
@@ -283,9 +284,11 @@ function resultLine(
   const parts = [`${stats.total} task${stats.total === 1 ? '' : 's'}`]
   if (stats.failed > 0) parts.push(paint(ERROR, `${stats.failed} failed`, colors, { bold: true }))
   // A task with no `cache` block could never hit: it is counted apart, not
-  // as a miss, or `vx run dev` would read "0 cached (0%)".
+  // as a miss, or `vx run dev` would read "0 cached (0%)". A skipped task
+  // never asked either, and counted as a miss it put "0 cached (0%)" on a
+  // run in which no task has a cache.
   const noCache = stats.noCache ?? 0
-  const cacheable = stats.total - noCache
+  const cacheable = stats.total - noCache - stats.skipped - (stats.left ?? 0)
   if (cacheable > 0)
     parts.push(
       hits === cacheable

package/src/workspace/config-schema.ts

@@ -754,7 +754,22 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         'one task per configuration (`build:production`, with its own `exec.command`)',
     },
   ],
-  [EXEC_FIELDS, { cmd: '`command`', script: '`command`' }],
+  [
+    EXEC_FIELDS,
+    {
+      cmd: '`command`',
+      script: '`command`',
+      // Nx run-commands' options and shell-runner habits, refused with no
+      // word on where they go (D-100).
+      cwd: '`cd <dir> && …` in `command`: a task runs in its project directory',
+      args: 'the arguments written into `command`, or after `--` on `vx run`',
+      commands: 'one `command` (`a && b`, or `a & b; wait` to run them at once), or one task each',
+      parallel: 'one task each, which vx runs at once, or `a & b; wait` in `command`',
+      shell: 'no field: `command` always runs in a shell',
+      interactive:
+        'a command run outside vx: a task never reads the terminal (its stdin is EOF, or a pipe vx holds under `persistent`)',
+    },
+  ],
   // A package's turbo.json and Nx's project.json keys, written into a
   // project's vx.config (D-56). `tags` had read as a typo of `tasks`.
   [
@@ -806,6 +821,24 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
       defaultBase: '`affectedBase`',
       tasksRunnerOptions: 'a cache plugin in `plugins` (`nxCache()` from `@vzn/vx-migrate`)',
       globalPassThroughEnv: '`exec.env.passThrough` on the tasks it passes to',
+      // pnpm-workspace.yaml's, Lerna's and the package.json's own keys
+      // pasted into vx.workspace: refused with no word on where vx reads
+      // them (D-98).
+      packages:
+        "`workspaces` in package.json or pnpm-workspace.yaml's `packages`, where vx reads the members",
+      workspaces:
+        "`workspaces` in package.json or pnpm-workspace.yaml's `packages`, where vx reads the members",
+      projects:
+        "`workspaces` in package.json or pnpm-workspace.yaml's `packages`, where vx reads the members",
+      ignore:
+        'a `!` pattern in the workspace globs (package.json `workspaces` or pnpm-workspace.yaml)',
+      catalog:
+        "pnpm-workspace.yaml's or package.json's `catalog`, where the package manager reads it",
+      npmClient: "no field: a task's command runs as written, with no package manager in between",
+      cache:
+        "each task's `cache` in its project's vx.config (a task caches only when it declares one)",
+      remote: 'a cache plugin in `plugins`',
+      env: '`cache.inputs.env` on the tasks it keys, or `exec.env` on the tasks it passes to',
     },
   ],
 ])

package/src/workspace/migrate-scripts.ts

@@ -343,6 +343,48 @@ function cdsToMembers(script: string, rootDir: string, memberDirs: readonly stri
   return false
 }
 
+/** The workspace flags that move a package manager off the package it runs in. */
+const ELSEWHERE_FLAG = /^(-r|--recursive|--filter|-F|--workspaces|-ws|--workspace)(=|$)/
+const DIR_FLAG = /^(-C|--dir|--cwd|--prefix)(?:=(.*))?$/
+
+/**
+ * The part of a member's script that runs another member's work: pinia's
+ * online-playground `build` is `pnpm -C ../pinia run build && vite build`,
+ * and mapped verbatim it built pinia again beside pinia's own task, writing
+ * the dist its siblings read. `yarn workspace <name>`, a runner, `pnpm -r`
+ * / `--filter`, and a `cd` / `-C` / `--cwd` / `--prefix` whose innermost
+ * member is another one count; a fixture inside the member, or the root,
+ * does not.
+ */
+function siblingRun(script: string, dir: string, others: readonly string[]): string | undefined {
+  const inside = (a: string, b: string): boolean => a === b || a.startsWith(b + path.sep)
+  const intoOther = (target: string): boolean => {
+    const t = path.resolve(dir, target.replace(/^(["'])(.*)\1$/, '$2'))
+    if (/[$`~*?]/.test(target)) return false
+    const owner = [dir, ...others]
+      .filter((d) => inside(t, d))
+      .sort((x, y) => y.length - x.length)[0]
+    return owner !== undefined && owner !== dir
+  }
+  for (const segment of script.split(/&&|\|\||[;|()]/)) {
+    const s = segment.trim()
+    if (RUNS_MEMBERS.test(` ${s}`)) return s
+    for (const m of s.matchAll(CD)) if (intoOther(m[1]!)) return s
+    const words = s.split(/\s+/)
+    const at = words.findIndex((w) => /^(pnpm|pn|npm|yarn|bun)$/.test(w))
+    if (at < 0) continue
+    for (let i = at + 1; i < words.length; i++) {
+      const w = words[i]!
+      if (ELSEWHERE_FLAG.test(w)) return s
+      const flag = DIR_FLAG.exec(w)
+      if (flag === null) continue
+      const target = flag[2] ?? words[++i]
+      if (target !== undefined && intoOther(target)) return s
+    }
+  }
+  return undefined
+}
+
 /** A package manager running a script by name: `pnpm build`, `npm run x`, `bun run x`. */
 const RUNS_SCRIPT =
   /(?:^|[\s;&|(])(?:pnpm|pn|npm|yarn|bun)\s+(?:run(?:-script)?\s+)?([^\s;&|()'"-][^\s;&|()'"]*)/g
@@ -589,6 +631,19 @@ export function migrateScripts(
           `${hooksBy} ran ${hooks.map((h) => `\`${h}\``).join(' and ')} around this script without being asked; folded into the command in that order`,
         )
       }
+      const sibling =
+        meta === rootMeta
+          ? undefined
+          : siblingRun(
+              own,
+              meta.dir,
+              metas.filter((m) => m !== root && m !== meta).map((m) => m.dir),
+            )
+      if (sibling !== undefined) {
+        todos.push(
+          `\`${sibling}\` runs another member's work outside the graph, again beside that member's own task: name that task under dependsOn (\`<member>#<task>\`) and drop it from the command`,
+        )
+      }
       const exec: Record<string, unknown> = { command }
       const npm = npmEnv(command, name, hooks.length > 0)
       if (Object.keys(npm.define).length > 0) exec['env'] = { define: npm.define }

package/src/workspace/project-loader.ts

@@ -541,13 +541,38 @@ const WATCHED_BUILTINS: ReadonlyArray<readonly [string, object]> = [
   ['Promise.prototype', Promise.prototype],
 ]
 
-type BuiltinSnapshot = ReadonlyArray<ReadonlyMap<PropertyKey, PropertyDescriptor>>
+interface OwnProperties {
+  keys: PropertyKey[]
+  descriptors: PropertyDescriptor[]
+  byKey: ReadonlyMap<PropertyKey, PropertyDescriptor>
+}
+
+type BuiltinSnapshot = readonly OwnProperties[]
 
 function builtinSnapshot(): BuiltinSnapshot {
-  return WATCHED_BUILTINS.map(
-    ([, proto]) =>
-      new Map(Reflect.ownKeys(proto).map((k) => [k, Object.getOwnPropertyDescriptor(proto, k)!])),
-  )
+  return WATCHED_BUILTINS.map(([, proto]) => {
+    const keys = Reflect.ownKeys(proto)
+    const descriptors = keys.map((k) => Object.getOwnPropertyDescriptor(proto, k)!)
+    return { keys, descriptors, byKey: new Map(keys.map((k, j) => [k, descriptors[j]!])) }
+  })
+}
+
+/**
+ * The same keys in the same order with the same descriptors: nothing to
+ * put back. Read by position, without the by-key lookups and the second
+ * pass for deleted keys, it is the cold path's common case once per
+ * evaluated config: the full check was ~0.1 ms a config, ~100 ms of a
+ * 1,000-config cold load.
+ */
+function unchanged(proto: object, keys: readonly PropertyKey[], was: OwnProperties): boolean {
+  if (keys.length !== was.keys.length) return false
+  for (let j = 0; j < keys.length; j++) {
+    const key = keys[j]!
+    if (key !== was.keys[j]) return false
+    if (!sameDescriptor(was.descriptors[j]!, Object.getOwnPropertyDescriptor(proto, key)!))
+      return false
+  }
+  return true
 }
 
 /** Loads run together, so the config named is the one whose load saw the change. */
@@ -565,8 +590,10 @@ function builtinsChanged(changed: readonly string[], configPath?: string): UserE
 function restoreBuiltins(before: BuiltinSnapshot): string[] {
   const changed: string[] = []
   WATCHED_BUILTINS.forEach(([name, proto], i) => {
-    const was = before[i]!
-    for (const key of Reflect.ownKeys(proto)) {
+    const keys = Reflect.ownKeys(proto)
+    if (unchanged(proto, keys, before[i]!)) return
+    const was = before[i]!.byKey
+    for (const key of keys) {
       const prior = was.get(key)
       const now = Object.getOwnPropertyDescriptor(proto, key)!
       if (prior !== undefined && sameDescriptor(prior, now)) continue