@vzn/vx 0.0.368 → 0.0.370

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.368",
+  "version": "0.0.370",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.368",
-    "@vzn/vx-linux-arm64": "0.0.368",
-    "@vzn/vx-darwin-x64": "0.0.368",
-    "@vzn/vx-darwin-arm64": "0.0.368"
+    "@vzn/vx-linux-x64": "0.0.370",
+    "@vzn/vx-linux-arm64": "0.0.370",
+    "@vzn/vx-darwin-x64": "0.0.370",
+    "@vzn/vx-darwin-arm64": "0.0.370"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -88,6 +88,7 @@ import {
   srtDefaultWritePaths,
 } from './sandbox-deny-scan.js'
 import {
+  hiddenReadsOutside,
   parseStraceViolations,
   refusedConnections,
   refusedWrites,
@@ -1820,6 +1821,16 @@ async function runSandboxedOnce(
     })
   }
 
+  if (exitCode !== 0) {
+    const hidden = hiddenReadsOutside(recorded, {
+      within: args.reportWithin,
+      linked: args.reportLinked,
+      config: args.config,
+      skip: [taskTmpRoot()],
+    })
+    if (hidden.length > 0) violations.push(hiddenReadsHint(hidden, args.reportWithin))
+  }
+
   try {
     SandboxManager.cleanupAfterCommand()
   } catch {
@@ -1867,6 +1878,19 @@ function outsideWritesHint(paths: readonly string[]): SandboxViolation {
   }
 }
 
+function hiddenReadsHint(paths: readonly string[], within: string): SandboxViolation {
+  const shown = paths.slice(0, 5).join(', ')
+  const more = paths.length > 5 ? ` and ${paths.length - 5} more` : ''
+  return {
+    timestamp: new Date(),
+    hint: true,
+    line:
+      `vx: the sandbox hid paths outside the project that exist on this machine, which are ` +
+      `not reported as violations: ${shown}${more}. If the task reads one, grant it, e.g. ` +
+      `\`allow: { read: ['${path.relative(toRealPath(within), paths[0]!)}'] }\`.`,
+  }
+}
+
 /**
  * Is `dir` inside a path the sandbox granted for reading? bwrap binds and
  * seatbelt rules are both prefix-based, so a grant covers the subtree.

package/src/exec/sandbox-violations.ts

@@ -4,6 +4,7 @@
 // task's owner can act on — inside the project, minus the loopback denial
 // no grant can avoid, minus what the task chose to ignore.
 
+import { statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import { bindableReads } from './sandbox-binds.js'
@@ -500,6 +501,44 @@ export function refusedWritesOutside(
   return [...paths]
 }
 
+/**
+ * The paths outside the project a read was denied that exist on this
+ * machine, files first: the reads `reportableViolations` drops at the
+ * wall. A task that failed on one said only what its tool says for a
+ * missing file — `tsc` extending a root `tsconfig.base.json` read "File
+ * not found" — and nothing named the sandbox (2026-10-02). Never a
+ * violation — a failed task's hint (`runSandboxed`). What a process walks
+ * through to reach its cwd (the project's ancestors) and what `skip` names
+ * are left out, as is a path that does not exist on the host: that miss
+ * is the tool's own.
+ */
+export function hiddenReadsOutside(
+  violations: readonly SandboxViolation[],
+  opts: {
+    within: string
+    linked?: readonly string[]
+    config: ResolvedSandboxConfig
+    skip: readonly string[]
+  },
+): string[] {
+  const reported = reportedWithin(opts.within, opts.linked ?? [])
+  const home = toRealPath(opts.within)
+  const skip = opts.skip.map(toRealPath)
+  const found = new Map<string, boolean>()
+  for (const v of filterIgnored(describe(violations), opts.config.ignore)) {
+    const p = v.path
+    if (p === undefined || v.hint === true || !v.ignorable?.includes('read') || reported(v))
+      continue
+    if (found.has(p) || atOrUnder(home, p) || skip.some((s) => atOrUnder(p, s))) continue
+    try {
+      found.set(p, statSync(p).isDirectory())
+    } catch {
+      // Not on the host either: the tool's own miss.
+    }
+  }
+  return [...found].sort((a, b) => Number(a[1]) - Number(b[1])).map(([p]) => p)
+}
+
 /** Every record described: a seatbelt one parsed, a Linux one as produced. */
 function describe(violations: readonly SandboxViolation[]): SandboxViolation[] {
   return violations.map((v) =>

package/src/workspace/config-eval.ts

@@ -109,6 +109,7 @@ self.onmessage = async (e) => {
   const own = (o) => new Map(Reflect.ownKeys(o).map((k) => [k, Object.getOwnPropertyDescriptor(o, k)]))
   const before = watched?.map(([, o]) => own(o))
   const envBefore = watched ? { ...live } : null
+  const cwdBefore = watched ? globalThis.process.cwd() : null
   const same = (a, b) =>
     a !== undefined && b !== undefined && a.value === b.value && a.get === b.get && a.set === b.set &&
     a.writable === b.writable && a.enumerable === b.enumerable && a.configurable === b.configurable
@@ -122,6 +123,7 @@ self.onmessage = async (e) => {
     })
     for (const k of new Set([...Object.keys(envBefore), ...Object.keys(live)]))
       if (envBefore[k] !== live[k]) out.push('process.env.' + k)
+    if (globalThis.process.cwd() !== cwdBefore) out.push('process.cwd (a chdir)')
     return out
   }
   try {

package/src/workspace/migrate-scripts.ts

@@ -738,6 +738,24 @@ export function migrateScripts(
       return !LIFECYCLE.test(n) && (base === undefined || !(base in scripts))
     })
   }
+  // Why a root mapped nothing: `eslint .` beside a member's `lint` runs
+  // nothing of the workspace, and the note said it did.
+  const rootLeftOut = (): string => {
+    if (rootMeta === undefined) return 'run the workspace'
+    const scripts = scriptsOf(rootMeta)
+    const named = Object.keys(scripts).filter(
+      (n) => typeof scripts[n] === 'string' && scripts[n] !== '' && !LIFECYCLE.test(n),
+    )
+    const runs = runningMembers(
+      scripts,
+      rootMeta.dir,
+      metas.filter((m) => m !== root).map((m) => m.dir),
+    )
+    const shared = named.filter((n) => memberTasks.has(n) && !runs.has(n))
+    if (shared.length === 0) return 'run the workspace'
+    const list = `${shared.slice(0, 8).join(', ')}${shared.length > 8 ? ', …' : ''}`
+    return `${shared.length < named.length ? 'run the workspace or ' : ''}share a member's task name (${list})`
+  }
   const rootName =
     root?.name ??
     (outsideRuns
@@ -768,7 +786,7 @@ export function migrateScripts(
     // A nameless root's vx.config is skipped (vx names projects by their
     // manifest's name), so the hand-written one needs a name first (vuejs/core).
     notes.push(
-      `${rootName} (the workspace root) not mapped: its scripts run the workspace; declare its own tasks in its vx.config by hand` +
+      `${rootName} (the workspace root) not mapped: its scripts ${rootLeftOut()}; declare its own tasks in its vx.config by hand` +
         (rootName === 'package.json' ? ', after giving its package.json a "name"' : ''),
     )
   }

package/src/workspace/project-loader.ts

@@ -441,6 +441,7 @@ export async function loadProjectConfigs(
   // `node:stream`), ~7 ms of a two-config warm run where every load hit.
   let builtins: BuiltinSnapshot = []
   let env: Readonly<Record<string, string | undefined>> = {}
+  let cwd = ''
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
@@ -484,7 +485,9 @@ export async function loadProjectConfigs(
       : await loadDefaultExport(configPath, 'Project', bytes!)
     // Before anything reads through them: a replaced `Array.prototype.includes`
     // turned the JSON-data walk's own check into "a cyclic reference".
-    const changed = repeat ? [] : [...restoreBuiltins(builtins), ...restoreEnv(env)]
+    const changed = repeat
+      ? []
+      : [...restoreBuiltins(builtins), ...restoreEnv(env), ...restoreCwd(cwd)]
     // Loads overlap, so another config's change can surface after this
     // one: named here, the refusal blamed the wrong file (D-119). The round
     // finds the one that made it.
@@ -536,6 +539,7 @@ export async function loadProjectConfigs(
     if (misses.length > 0) {
       builtins = builtinSnapshot()
       env = { ...process.env }
+      cwd = process.cwd()
     }
     overlapping = misses.length > 1
     let next = 0
@@ -554,7 +558,10 @@ export async function loadProjectConfigs(
         if (r.closure !== undefined) learnedClosures.push(r.closure)
       }
     }
-    const changed = misses.length > 0 ? [...restoreBuiltins(builtins), ...restoreEnv(env)] : []
+    const changed =
+      misses.length > 0
+        ? [...restoreBuiltins(builtins), ...restoreEnv(env), ...restoreCwd(cwd)]
+        : []
     if (first?.failed instanceof ChangedInRound) {
       for (const i of misses) {
         const configPath = prepared[i]!.configPath
@@ -644,9 +651,13 @@ class ChangedInRound {
 /** Without `configPath`, no config alone was found to make the change. */
 function builtinsChanged(changed: readonly string[], configPath?: string): UserError {
   const who = configPath === undefined ? 'a project config' : configPath
-  const env = changed.some((c) => c.startsWith('process.env.'))
-    ? '; a task gets an env var through `exec.env.define` or `passThrough`'
-    : ''
+  const env =
+    (changed.some((c) => c.startsWith('process.env.'))
+      ? '; a task gets an env var through `exec.env.define` or `passThrough`'
+      : '') +
+    (changed.some((c) => c.startsWith('process.cwd'))
+      ? '; a task runs in its project directory, and `cd <dir> && …` in `exec.command` moves it'
+      : '')
   return new UserError(
     `${who} changed ${changed.join(', ')} while it was evaluated — a config must not change the built-ins vx runs on: other configs are read through them and cache keys are made with them${env}`,
   )
@@ -702,6 +713,20 @@ function restoreEnv(before: Readonly<Record<string, string | undefined>>): strin
   return changed
 }
 
+/**
+ * A config's `process.chdir()` moved the whole process: every relative path
+ * vx resolves after it, its own and a plugin's, read from the config's
+ * choice (D-120). Put back, and named as the change.
+ */
+function restoreCwd(before: string): string[] {
+  // Through globalThis: the playground bundles this module, and its
+  // browser shim carries no free process global.
+  const proc = globalThis.process
+  if (before === '' || proc.cwd() === before) return []
+  proc.chdir(before)
+  return ['process.cwd (a chdir)']
+}
+
 function sameDescriptor(a: PropertyDescriptor, b: PropertyDescriptor): boolean {
   return (
     a.value === b.value &&