@vzn/vx 0.0.365 → 0.0.367

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.365",
+  "version": "0.0.367",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.365",
-    "@vzn/vx-linux-arm64": "0.0.365",
-    "@vzn/vx-darwin-x64": "0.0.365",
-    "@vzn/vx-darwin-arm64": "0.0.365"
+    "@vzn/vx-linux-x64": "0.0.367",
+    "@vzn/vx-linux-arm64": "0.0.367",
+    "@vzn/vx-darwin-x64": "0.0.367",
+    "@vzn/vx-darwin-arm64": "0.0.367"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -543,6 +543,35 @@ function hostHasIpv6(): boolean {
   return hasIpv6
 }
 
+/**
+ * Refuse a network entry SRT's own schema refuses, naming it. vx handed
+ * the union over unchecked, and SRT's proxy matched as it could: a URL
+ * (`https://example.com`), a dotless host or a port past 65535 matched
+ * nothing, so the grant silently reached no host, and `'*'`, which the
+ * schema refuses as too broad, opened every host to every sandboxed task
+ * of the run, the allowlist being the run's (2026-10-02).
+ */
+function assertDomains(
+  schema: SrtModule['NetworkConfigSchema'],
+  allowed: readonly string[],
+  denied: readonly string[],
+): void {
+  const bad = [
+    ...allowed
+      .filter((d) => !schema.shape.allowedDomains.safeParse([d]).success)
+      .map((d) => `allow.network "${d}"`),
+    ...denied
+      .filter((d) => !schema.shape.deniedDomains.safeParse([d]).success)
+      .map((d) => `deny.network "${d}"`),
+  ]
+  if (bad.length === 0) return
+  throw new UserError(
+    `sandbox: ${bad.join(', ')} is not a host pattern: name a host ("example.com"), a ` +
+      `subdomain wildcard ("*.example.com") or either with a port ("example.com:443"); no ` +
+      `scheme or path, and "*" or "*.com" is refused as too broad (a bare "*" only in deny)`,
+  )
+}
+
 /**
  * One-time SRT initialization per orchestrator run. Starts the proxy
  * servers + (on macOS) the violation log monitor. Safe to call repeatedly
@@ -586,7 +615,8 @@ export async function initSandbox(opts?: {
   await resetting
   // Before SRT starts, so the very first task already has one.
   await mkdir(sandboxTmpdir(), { recursive: true })
-  const { SandboxManager } = await loadSrt()
+  const { SandboxManager, NetworkConfigSchema } = await loadSrt()
+  assertDomains(NetworkConfigSchema, opts?.allowedDomains ?? [], opts?.deniedDomains ?? [])
   scopedDenyScan = process.platform === 'linux' && canScopeDenyScan(process.cwd())
   const config: Parameters<typeof SandboxManager.initialize>[0] = {
     network: {

package/src/orchestrator/sandbox-request.ts

@@ -11,6 +11,7 @@ import type { ExecConfig } from '../config.js'
 import {
   bindableWrites,
   initSandbox,
+  resetSandbox,
   probeSandbox,
   punchWalls,
   resolveSandboxConfig,
@@ -141,6 +142,10 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
             ...(gitConfig ? { gitConfig: true } : {}),
           })
         } catch (err) {
+          // The Linux probe brings the runtime up, and only an armed run
+          // resets it: a refusal past the probe left its proxy holding the
+          // process open, and the run hung after its summary (2026-10-02).
+          await resetSandbox().catch(() => {})
           // A throw from the runtime itself (its bridge needs socat, which
           // the dependency check does not cover) gets the same one-line
           // verdict as a refused probe, not an internal error with a stack.

package/src/util/secret-mask.ts

@@ -63,7 +63,16 @@ export function secretMask(
 ): SecretMask | null {
   const values = new Set<string>()
   const add = (value: string | undefined): void => {
-    if (value !== undefined && value.length >= MIN_SECRET_CHARS) values.add(value)
+    if (value === undefined || value.length < MIN_SECRET_CHARS) return
+    values.add(value)
+    // A multi-line value (a PEM key) is also masked line by line, as GitHub
+    // Actions does: a tool that indents or reflows it prints no copy of the
+    // whole value, and every line leaked (L-36).
+    if (!value.includes('\n')) return
+    for (const line of value.split(/\r?\n/)) {
+      const trimmed = line.trim()
+      if (trimmed.length >= MIN_SECRET_CHARS) values.add(trimmed)
+    }
   }
   for (const source of sources) {
     if (source === undefined) continue