@vzn/vx 0.0.363 → 0.0.364

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.363",
+  "version": "0.0.364",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.363",
-    "@vzn/vx-linux-arm64": "0.0.363",
-    "@vzn/vx-darwin-x64": "0.0.363",
-    "@vzn/vx-darwin-arm64": "0.0.363"
+    "@vzn/vx-linux-x64": "0.0.364",
+    "@vzn/vx-linux-arm64": "0.0.364",
+    "@vzn/vx-darwin-x64": "0.0.364",
+    "@vzn/vx-darwin-arm64": "0.0.364"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/bin.ts

@@ -9,10 +9,14 @@ async function main(): Promise<void> {
     // `vx --version` needs one leaf module; the dispatcher and the util
     // barrel it pulled in were 20 ms of its 28 (2026-10-01).
     if (argv.length === 1 && (argv[0] === '--version' || argv[0] === 'version')) {
-      process.stdout.write(`vx ${(await import('./version.js')).VERSION}\n`)
+      // `Bun.stdout`, not `process.stdout`: the Node stream's first touch is
+      // ~7 ms, half of this verb (2026-10-02). A reader gone (EPIPE) is no
+      // failure of the line.
+      await Bun.write(Bun.stdout, `vx ${(await import('./version.js')).VERSION}\n`).catch(() => {})
       settled = true
       return
     }
+    listenForReadersGone()
     const { registerCoreAlias, run } = await import('./cli/index.js')
     // Every `import … from '@vzn/vx'` this process evaluates — a plugin
     // package, a workspace or project config — resolves to THIS core, not to
@@ -86,8 +90,11 @@ process.on('beforeExit', () => {
 // and exits with its own verdict; what was going to the reader goes
 // nowhere. Same for stderr (`2>&1 | head`). Here and not in the logger:
 // an embedder's streams are the embedder's.
-for (const stream of [process.stdout, process.stderr]) {
-  stream.on('error', () => {})
+// Set up past `--version`, which never touches the Node streams.
+function listenForReadersGone(): void {
+  for (const stream of [process.stdout, process.stderr]) {
+    stream.on('error', () => {})
+  }
 }
 
 void main()

package/src/cache/tar-stream.ts

@@ -53,6 +53,8 @@ function octal(h: Uint8Array, off: number, len: number): number {
     for (let i = off + 1; i < off + len; i++) n = n * 256 + h[i]!
     return n
   }
+  const plain = plainOctal(h, off, len)
+  if (plain !== null) return plain
   const s = field(h, off, len).trim()
   if (s === '') return 0
   // Every digit, not the longest parseable prefix: `parseInt` would read
@@ -61,10 +63,33 @@ function octal(h: Uint8Array, off: number, len: number): number {
   return parseInt(s, 8)
 }
 
+/**
+ * The field every writer emits — octal digits between ASCII spaces, ended
+ * by a NUL or the field's end — read off the bytes; null for anything
+ * else, which `octal` reads the slow way. Three fields a header through a
+ * decoder and a regex were most of a small artifact's read (2026-10-02).
+ */
+function plainOctal(h: Uint8Array, off: number, len: number): number | null {
+  const end = off + len
+  let i = off
+  while (i < end && h[i] === 0x20) i++
+  let n = 0
+  while (i < end && h[i]! >= 0x30 && h[i]! <= 0x37) n = n * 8 + (h[i++]! - 0x30)
+  while (i < end && h[i] === 0x20) i++
+  return i === end || h[i] === 0 ? n : null
+}
+
+function isZeroBlock(h: Uint8Array): boolean {
+  for (let i = 0; i < BLOCK; i++) if (h[i] !== 0) return false
+  return true
+}
+
 function checksumOk(h: Uint8Array): boolean {
   const stored = octal(h, 148, 8)
-  let sum = 0
-  for (let i = 0; i < BLOCK; i++) sum += i >= 148 && i < 156 ? 32 : h[i]!
+  // The checksum field counts as eight spaces.
+  let sum = 8 * 32
+  for (let i = 0; i < 148; i++) sum += h[i]!
+  for (let i = 156; i < BLOCK; i++) sum += h[i]!
   return sum === stored
 }
 
@@ -107,6 +132,18 @@ class Source {
 
   /** Exactly `n` bytes, or null at a clean end (nothing buffered), or a TarFormatError mid-entry. */
   async exact(n: number, what: string): Promise<Uint8Array | null> {
+    // Within one chunk, a view: the copy below was a third of a small
+    // artifact's read. Nothing writes to what this returns.
+    const c0 = this.chunks[0]
+    if (c0 !== undefined && c0.byteLength - this.head >= n) {
+      const view = c0.subarray(this.head, this.head + n)
+      this.head += n
+      if (this.head === c0.byteLength) {
+        this.chunks.shift()
+        this.head = 0
+      }
+      return view
+    }
     const out = new Uint8Array(n)
     let got = 0
     while (got < n) {
@@ -163,7 +200,7 @@ export async function* tarEntries(stream: ReadableStream<Uint8Array>): AsyncGene
       if (zeroBlocks === 0) throw new TarFormatError('archive has no end-of-archive marker')
       return
     }
-    if (h.every((b) => b === 0)) {
+    if (isZeroBlock(h)) {
       zeroBlocks++
       if (zeroBlocks >= 2) return
       continue

package/src/exec/sandbox-runtime.ts

@@ -89,6 +89,7 @@ import {
 } from './sandbox-deny-scan.js'
 import {
   parseStraceViolations,
+  refusedConnections,
   refusedWrites,
   refusedWritesOutside,
   reportableViolations,
@@ -1732,6 +1733,7 @@ async function runSandboxedOnce(
             bindableWrites(args.config.allowWrite),
             scratch,
           ),
+          ...refusedConnections(records.map((v) => v.line)),
         ]
       : []
   if (straceLog) {

package/src/exec/sandbox-violations.ts

@@ -419,6 +419,8 @@ function matchesIgnore(
  * crossing, and the task can grant it.
  */
 function describeMacViolation(line: string): Partial<SandboxViolation> {
+  const proxy = PROXY_DENY_RE.exec(line)
+  if (proxy !== null) return { target: proxy[1]!, ignorable: ['network'] }
   const m = /deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/.exec(line)
   if (m === null) return {}
   const [op, target] = [m[1]!, m[2]!]
@@ -589,6 +591,28 @@ function filterIgnored(
   return violations.filter((v) => !matchesIgnore(v, ignore))
 }
 
+/**
+ * SRT's filtering proxy records a connection it refused as `deny
+ * network-outbound <host>:<port> (<reason>)`, on both platforms: the one
+ * component that knows the host. Read as its own shape, so `ignore.network`
+ * silences it by host; the seatbelt pattern above wants `deny(<n>)`.
+ */
+const PROXY_DENY_RE = /^deny network-outbound (\S+) \([^)]*\)$/
+
+/**
+ * Linux: the connections the proxy refused, from the store records. Only
+ * the write observer's records were read there, so a task denied a host
+ * failed with its own `403` and no report, and one that survived the
+ * refusal passed, where macOS reports the same record (2026-10-02).
+ */
+export function refusedConnections(records: readonly string[]): SandboxViolation[] {
+  return [...new Set(records.filter((r) => PROXY_DENY_RE.test(r)))].map((line) => ({
+    line,
+    timestamp: new Date(),
+    ...describeMacViolation(line),
+  }))
+}
+
 /**
  * The writes SRT's Linux observer saw that this task's binds do not cover.
  * The observer reports every write-intent syscall as `deny <syscall>
@@ -612,6 +636,11 @@ export function refusedWrites(
     const m = /^deny (\S+) (\/.*)$/.exec(record)
     if (m === null) continue
     const [, syscall, raw] = m as unknown as [string, string, string]
+    // A descriptor or pseudo-file is the task's, and resolving it here
+    // reads vx's own: strace's log is `/dev/fd/5`, and a vx started with
+    // `5>out.log` in the project reported a write to `out.log` and failed
+    // a clean task (2026-10-02).
+    if (/^\/(?:dev|proc)\//.test(raw)) continue
     const abs = toRealPath(raw)
     if (isUnderAny(abs, binds) || underGlob(abs, globs)) continue
     const key = `${syscall}|${abs}`

package/src/orchestrator/execute-task.ts

@@ -915,7 +915,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         signal: res.signal,
         hidden: req.sandbox && ((f: string) => !sandboxReads(req.sandbox!, f)),
       })
-      if (verdict !== undefined) log.taskStderr(node, `\n${verdict}\n`)
+      // The line quotes the command's first word, which a config may have
+      // built from a secret: masked as the task's own output is (L-37).
+      if (verdict !== undefined) log.taskStderr(node, `\n${secrets?.mask(verdict) ?? verdict}\n`)
       // A committed file another task's clean removed, still gone: vx
       // cleans outputs before a run where Turbo does not, so a reader with
       // no edge to the producer fails naming only the file (A-48).

package/src/workspace/config-schema.ts

@@ -777,6 +777,36 @@ const FOREIGN_FIELDS: ReadonlyMap<ReadonlySet<string>, Readonly<Record<string, s
         'a command run outside vx: a task never reads the terminal (its stdin is EOF, or a pipe vx holds under `persistent`)',
     },
   ],
+  // wireit's `files` / `output` and include-style spellings written into
+  // a cache block, refused with no word on where they go (D-118).
+  [
+    CACHE_FIELDS,
+    {
+      files: '`inputs.files`',
+      output: '`outputs.files`',
+      env: '`inputs.env`',
+      dependencies: "the task's `dependsOn` (an upstream's key folds into this one)",
+      enabled: 'no field: a task with a `cache` block caches, one without runs every time',
+    },
+  ],
+  [
+    CACHE_INPUT_FIELDS,
+    {
+      globs: '`files`',
+      include: '`files`',
+      patterns: '`files`',
+      exclude: "`files` with a `!` entry (`'!**/*.test.ts'`)",
+      ignore: "`files` with a `!` entry (`'!**/*.test.ts'`)",
+    },
+  ],
+  [
+    CACHE_OUTPUT_FIELDS,
+    {
+      globs: '`files`',
+      include: '`files`',
+      exclude: "`files` with a `!` entry (`'!dist/cache/**'`)",
+    },
+  ],
   // A package's turbo.json and Nx's project.json keys, written into a
   // project's vx.config (D-56). `tags` had read as a typo of `tasks`.
   [