@vzn/vx 0.0.362 → 0.0.363

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.362",
+  "version": "0.0.363",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.362",
-    "@vzn/vx-linux-arm64": "0.0.362",
-    "@vzn/vx-darwin-x64": "0.0.362",
-    "@vzn/vx-darwin-arm64": "0.0.362"
+    "@vzn/vx-linux-x64": "0.0.363",
+    "@vzn/vx-linux-arm64": "0.0.363",
+    "@vzn/vx-darwin-x64": "0.0.363",
+    "@vzn/vx-darwin-arm64": "0.0.363"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/lock.ts

@@ -4,7 +4,7 @@
 
 import type { ProjectConfig } from '../config.js'
 import { flagHint, refusedWord, seeHelp } from './help.js'
-import { relPosix, xxh3hex } from '../util/index.js'
+import { relPosix, secretMask, xxh3hex } from '../util/index.js'
 import {
   findWorkspaceRoot,
   type LoadReads,
@@ -86,6 +86,15 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   const projects: Record<string, LockfileEntry> = {}
   // `listProjects` sorts by name — stable lockfile diffs for free.
   for (let i = 0; i < metas.length; i++) projects[metas[i]!.name] = entries[i]!
+  const leaks = secretsIn(projects)
+  if (leaks.length > 0) {
+    process.stderr.write(
+      `vx lock: ${LOCKFILE_NAME} is committed, and these configs evaluated to a secret value:\n` +
+        leaks.map((l) => `  ${l}\n`).join('') +
+        `let the shell expand it ($API_TOKEN in the command, the name in exec.env.passThrough) instead of reading process.env in the config\n`,
+    )
+    return 1
+  }
   const lock: Lockfile = { version: LOCKFILE_VERSION, projects }
   await writeLockfile(root, lock)
   const n = metas.length
@@ -95,6 +104,40 @@ async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): P
   return 0
 }
 
+/**
+ * Each place an evaluated config holds the value of a secret in this
+ * environment, by the rule output masking uses (a secret-named variable,
+ * or one a task lists in `exec.env.secret`). The lock is committed, so
+ * such a value would be published, and masking it would freeze a `***`
+ * that `--frozen` runs (L-42).
+ */
+function secretsIn(projects: Record<string, LockfileEntry>): string[] {
+  const named = new Set<string>()
+  for (const entry of Object.values(projects)) {
+    for (const task of Object.values(entry.config.tasks ?? {}))
+      for (const n of task?.exec?.env?.secret ?? []) named.add(n)
+  }
+  const secrets: [value: string, name: string][] = []
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && secretMask([{ [name]: value }], named.has(name) ? [name] : []))
+      secrets.push([value, name])
+  }
+  if (secrets.length === 0) return []
+  const found: string[] = []
+  const walk = (project: string, at: string, v: unknown): void => {
+    if (typeof v === 'string') {
+      for (const [value, name] of secrets)
+        if (v.includes(value)) found.push(`${project}: ${at} holds $${name}`)
+    } else if (Array.isArray(v)) {
+      v.forEach((x, i) => walk(project, `${at}[${i}]`, x))
+    } else if (v !== null && typeof v === 'object') {
+      for (const [k, x] of Object.entries(v)) walk(project, at === '' ? k : `${at}.${k}`, x)
+    }
+  }
+  for (const [project, entry] of Object.entries(projects)) walk(project, '', entry.config)
+  return found
+}
+
 /**
  * Audit the lock. Two layers, strictly stronger than what runs do:
  *   1. The same hash check runs perform (file bytes vs lock hash).

package/src/cli/plugin-commands.ts

@@ -10,7 +10,7 @@
 import type { VxPlugin, PluginCommand, CommandContext } from '../orchestrator/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { loadCliWorkspace } from './workspace-config.js'
-import { machineParallelism } from '../util/index.js'
+import { machineParallelism, maskedLine } from '../util/index.js'
 
 export interface ResolvedPluginCommand {
   plugin: VxPlugin
@@ -92,7 +92,7 @@ export async function resolvePluginCommand(
         workspaceRoot: ws.workspaceRoot,
         cacheDir: ws.cacheDir,
         concurrency: ws.concurrency,
-        warn: (m) => process.stderr.write(`${m}\n`),
+        warn: (m) => process.stderr.write(`${maskedLine(m)}\n`),
       },
     }
   }

package/src/cli/select.ts

@@ -25,7 +25,7 @@ import {
 import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
-import { nearest, UserError } from '../util/index.js'
+import { maskedLine, nearest, UserError } from '../util/index.js'
 import { claimedAffected, fingerprintClaims, gitOfDiscovery } from '../orchestrator/index.js'
 import {
   type CliLoadOptions,
@@ -104,7 +104,7 @@ async function workspaceFingerprintClaims(
   const ctx = {
     workspaceRoot: root,
     cacheDir: load.cacheDir ?? ws.cacheDir,
-    warn: (m: string) => process.stderr.write(`${m}\n`),
+    warn: (m: string) => process.stderr.write(`${maskedLine(m)}\n`),
     projects: projects.map((p) => ({ name: p.name, dir: p.dir })),
   }
   return {

package/src/exec/sandbox-binds.ts

@@ -333,3 +333,40 @@ export function buildCustomConfig(
   }
   return custom
 }
+
+/**
+ * Linux: SRT's bwrap line with each `--tmpfs` it lays over a read-denied
+ * directory (the workspace root, a sibling's tree, the cwd with no read
+ * grant) remounted read-only once the mounts beneath it are made. bwrap's
+ * tmpfs is writable, so a write there succeeded and vanished with the
+ * sandbox: a task that wrote `../../dist` went green with its output gone,
+ * where seatbelt refuses the same write. Now it is `EROFS` on both, and a
+ * failed task's hint names the path. The mask a `scratch` glob's writes
+ * land in stays writable: that is the grant (`scratchWrites`). Placed
+ * before the `--` that ends bwrap's options; the words are SRT's own
+ * quoting, copied as they are.
+ */
+export function readOnlyMasks(wrapped: string, scratch: readonly string[] = []): string {
+  const masks: string[] = []
+  let prev = ''
+  for (const m of wrapped.matchAll(/(?:'[^']*'|"[^"]*"|[^\s'"])+/g)) {
+    if (m[0] === '--') {
+      const held = scratch.map((g) => {
+        const dir = toRealPath(path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS) + 1)))
+        const holding = masks.filter((w) => atOrUnder(dir, unquoted(w)))
+        return holding.sort((a, b) => unquoted(b).length - unquoted(a).length)[0]
+      })
+      const ro = masks.filter((w) => !held.includes(w))
+      if (ro.length === 0) return wrapped
+      const words = ro.map((w) => `--remount-ro ${w} `).join('')
+      return `${wrapped.slice(0, m.index)}${words}${wrapped.slice(m.index)}`
+    }
+    if (prev === '--tmpfs') masks.push(m[0])
+    prev = m[0]
+  }
+  return wrapped
+}
+
+/** A word as SRT's `quote` spells it, read back: single-quoted runs and `"'"`. */
+const unquoted = (word: string): string =>
+  word.replace(/'([^']*)'|"([^"]*)"/g, (_, a: string | undefined, b: string | undefined) => a ?? b!)

package/src/exec/sandbox-runtime.ts

@@ -70,6 +70,7 @@ import {
   bindableReads,
   bindableWrites,
   buildCustomConfig,
+  readOnlyMasks,
   scratchWrites,
   widenedEntries,
 } from './sandbox-binds.js'
@@ -1065,7 +1066,8 @@ export async function wrapSandboxedCommand(
   // sandboxed server and all it forked outlived vx (turborepo#9666). Now
   // the namespace goes with vx, a `setsid` daemon inside included, a
   // traced one-shot task too: its strace runs inside (B-11).
-  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped)) wrapped = `exec ${wrapped}`
+  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped))
+    wrapped = `exec ${readOnlyMasks(wrapped, scratch)}`
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   if (args.server === true) liveServers.add(tag)

package/src/graph/scheduler.ts

@@ -6,7 +6,7 @@ import {
   OUT_OF_FDS_HINT,
 } from '../util/index.js'
 import { computeReverseDepCount, mergePriorities, tieredReverseDepCount } from './priorities.js'
-import type { TaskNode } from './task-graph.js'
+import { isGroupTask, type TaskNode } from './task-graph.js'
 
 /**
  * Thrown by `execute` for a restore-tier task that turned out to have
@@ -572,6 +572,19 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     // could fail anyway.
     const aborted = (): boolean => options.signal?.aborted === true
     const serverDied = options.serverDied ?? ((): boolean => false)
+    // The dead server a dependency stands for: itself, or one a group
+    // reaches. A group is a name for its deps, and it finished the moment
+    // the server was ready, so a task behind it ran against the dead one.
+    const deadServerVia = (id: string): string | undefined => {
+      if (serverDied(id)) return id
+      const n = nodes.get(id)
+      if (n === undefined || !isGroupTask(n)) return undefined
+      for (const d of n.deps) {
+        const dead = deadServerVia(d)
+        if (dead !== undefined) return dead
+      }
+      return undefined
+    }
     const servers =
       options.serverDied === undefined
         ? []
@@ -600,7 +613,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           u?.status === 'skipped' ||
           u?.status === 'aborted' ||
           blockedRestores.has(d) ||
-          serverDied(d)
+          deadServerVia(d) !== undefined
         )
       })
     }
@@ -671,7 +684,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
           const viaRestore = node.deps.find((d) => blockedRestores.has(d))
           const blockedBy =
             blocker?.node.id ??
-            node.deps.find(serverDied) ??
+            node.deps.map(deadServerVia).find((d) => d !== undefined) ??
             viaSkip?.blockedBy ??
             (viaRestore === undefined ? undefined : blockedRestores.get(viaRestore))
           finishOne(id, {

package/src/orchestrator/events.ts

@@ -9,7 +9,7 @@
 import { exitSignal } from '../exec/index.js'
 import type { TaskNode, TaskOutcome } from '../graph/index.js'
 import { isGroupTask } from '../graph/index.js'
-import { maskedCommand } from '../util/index.js'
+import { maskedCommand, secretMask } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { RunContext } from './summary.js'
 
@@ -103,8 +103,11 @@ export function busLogger(bus: EventBus): Logger {
   // run() reaches runEnd on its success path, in its finally and from a
   // signal; a plugin's onRunEnd hears the first only.
   let ended = false
+  // A status line carries plugin warnings, and a remote layer's warning
+  // quotes the server's reply, which may echo what it was sent (L-40).
+  const secrets = secretMask([process.env])
   return {
-    status: (line) => bus.emit({ kind: 'run:status', line }),
+    status: (line) => bus.emit({ kind: 'run:status', line: secrets?.mask(line) ?? line }),
     taskStdout: (node, chunk) => bus.emit({ kind: 'task:stdout', node, chunk }),
     taskStderr: (node, chunk) => bus.emit({ kind: 'task:stderr', node, chunk }),
     taskComplete: (node, outcome) => bus.emit({ kind: 'task:complete', node, outcome }),

package/src/orchestrator/plugin.ts

@@ -358,6 +358,8 @@ export interface PluginContext {
   readonly workspaceRoot: string
   /** Where vx's cache lives — read-only as far as the plugin is concerned. */
   readonly cacheDir: string
+  /** Funnel warnings into the run:status channel, as every hook's context does. */
+  warn(message: string): void
   /**
    * The run event bus. A plugin can subscribe directly if its needs exceed
    * the hooks; the subscription ends with the run, as a hook's does.
@@ -539,6 +541,7 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
     const ctx: PluginContext = {
       workspaceRoot,
       cacheDir,
+      warn,
       // A subscription made past the hooks leaves with the run like a
       // hook's does: the bus can outlive the run (`RunOptions.bus`), and
       // one left behind hears every later run on it (item 635).

package/src/orchestrator/run.ts

@@ -693,7 +693,11 @@ async function runOnBus(
         vxVersion: VERSION,
         // An embedder's `command` is redacted as the argv is: it passed a
         // token after `--` to every sink verbatim (C-67).
-        command: invocationCommand(options.command?.split(' ') ?? process.argv.slice(1)),
+        // Masked as the stored line is: `--tag key=$DEPLOY_KEY` sits before
+        // the `--` the count covers (L-44).
+        command: maskInvocation(
+          invocationCommand(options.command?.split(' ') ?? process.argv.slice(1)),
+        ),
         requestedTasks: [...options.tasks],
         cachePolicy: compactCachePolicy(policy),
         concurrency,

package/src/orchestrator/sandbox-request.ts

@@ -3,6 +3,7 @@
 // (bwrap cannot bind a path that does not exist). Shared by the cached path
 // (through the executor) and the persistent path (spawned in execute-task).
 
+import { existsSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
@@ -254,7 +255,13 @@ export async function sandboxRequestFor(
     // 0.0.76). A grant naming a wall is not strictly outside it and wins.
     // Without it a root task's `read: ['.']` read its nested projects under
     // seatbelt (B-4).
-    baseDenyRead: process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot],
+    // The host's credential stores are denied too: the rest of home stays
+    // readable (tools need `~/.cache`), but a dependency the task runs
+    // could copy a key into an output the cache shares (L-41).
+    baseDenyRead: [
+      ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
+      ...credentialStores(workspaceRoot),
+    ],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
     // walk `bun build --compile` makes from `/` down to its cwd lists
@@ -555,6 +562,44 @@ export function untouchedPlaceholderLine(projectDir: string, placeholder: string
   )
 }
 
+/**
+ * Where tools keep credentials under the user's home. A sandboxed task
+ * reads none of them unless its `allow.read` names one (a publish task's
+ * `~/.npmrc`).
+ */
+const CREDENTIAL_STORES = [
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.config/gcloud',
+  '.config/gh',
+  '.docker/config.json',
+  '.netrc',
+  '.git-credentials',
+  '.npmrc',
+  '.yarnrc.yml',
+  '.pypirc',
+]
+
+/** The stores present on this host, learned once per home. */
+let presentStores: { home: string; paths: string[] } | undefined
+
+/** The credential stores to deny, less any that holds the workspace. */
+function credentialStores(workspaceRoot: string): string[] {
+  const home = homedir()
+  if (presentStores?.home !== home) {
+    presentStores = {
+      home,
+      paths: CREDENTIAL_STORES.map((rel) => path.join(home, rel)).filter((p) => existsSync(p)),
+    }
+  }
+  return presentStores.paths.filter(
+    (p) => workspaceRoot !== p && !workspaceRoot.startsWith(p + path.sep),
+  )
+}
+
 /** `~/x` against the user's home; anything else unchanged. */
 function expandHome(p: string): string {
   return p.startsWith('~') ? path.join(homedir(), p.slice(1)) : p

package/src/util/index.ts

@@ -55,4 +55,11 @@ export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.
 export { executablePath, shellArgv } from './which.js'
 export { procfsIsOwn } from './procfs.js'
 export { realPath } from './real-path.js'
-export { maskedCommand, maskedEmitter, MASKED, secretMask, type SecretMask } from './secret-mask.js'
+export {
+  maskedCommand,
+  maskedEmitter,
+  maskedLine,
+  MASKED,
+  secretMask,
+  type SecretMask,
+} from './secret-mask.js'

package/src/util/secret-mask.ts

@@ -124,6 +124,11 @@ export function maskedCommand(command: string, env?: TaskEnvSecrets): string {
   return secretMask([process.env, env?.define], env?.secret)?.mask(command) ?? command
 }
 
+/** A line vx prints for no one task (a plugin's warning): this process's secrets masked. */
+export function maskedLine(line: string): string {
+  return secretMask([process.env])?.mask(line) ?? line
+}
+
 /** What of a task's `exec.env` names its secrets. */
 export interface TaskEnvSecrets {
   readonly define?: Readonly<Record<string, string>>

package/src/workspace/affected.ts

@@ -123,28 +123,32 @@ export interface FingerprintClaims {
  * or `<since>` doesn't resolve to a commit.
  */
 export async function affectedProjects(args: AffectedArgs): Promise<Set<string>> {
+  // Turbo's CI spelling, `[origin/main...HEAD]`, is the base alone here:
+  // vx already diffs from the merge base (three dots' meaning), and the
+  // working tree it diffs to holds HEAD (D-117). Any other range is refused.
+  const since = /^(.+)\.\.\.HEAD$/.exec(args.since)?.[1] ?? args.since
   // The base reaches git as an argument, never through a shell, so `$(…)`
   // is opaque — but an option-like value is not: `--output=<path>` is a
   // real `git diff` option and an arbitrary file write. This is a security
   // boundary, so it is a check that knows it is one, before any spawn, and
   // every git call below also ends its options (`--end-of-options`) so a
   // second caller cannot lose the guard by accident.
-  if (args.since.length === 0 || args.since.startsWith('-')) {
+  if (since.length === 0 || since.startsWith('-')) {
     throw new UserError(
-      `git ref "${args.since}" is not a ref: a base cannot be empty or start with "-".`,
+      `git ref "${since}" is not a ref: a base cannot be empty or start with "-".`,
     )
   }
   // `A..B` / `A...B` reached `rev-parse --verify`, which refuses a range, and
   // the user read "did not resolve" about refs that both exist. `..` is
   // illegal in a ref name (git-check-ref-format), so this refuses no ref.
-  const range = args.since.indexOf('..')
+  const range = since.indexOf('..')
   if (range >= 0) {
     throw new UserError(
-      `git ref "${args.since}" is a range: ranges are not supported — pass the base alone ` +
-        `("${args.since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
+      `git ref "${since}" is a range: ranges are not supported — pass the base alone ` +
+        `("${since.slice(0, range) || 'HEAD'}"); vx diffs it against the working tree.`,
     )
   }
-  await verifyRef(args.workspaceRoot, args.since)
+  await verifyRef(args.workspaceRoot, since)
   // Diff from the MERGE BASE of `since` and HEAD, not from `since` itself:
   // on a branch whose base has moved on, `git diff <base>` reports every
   // file OTHER people changed on the base (over-selection that defeats a
@@ -152,7 +156,7 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   // byte-identical content. Turbo and Nx both diff from the merge base;
   // when there is none (unrelated histories, a detached probe) the ref
   // itself is the base, as before.
-  const base = await mergeBase(args.workspaceRoot, args.since)
+  const base = await mergeBase(args.workspaceRoot, since)
 
   const [diffed, untracked] = await Promise.all([
     // `--no-renames` is crucial for project-affected detection: with