@vzn/vx 0.0.396 → 0.0.397

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.396",
+  "version": "0.0.397",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.396",
-    "@vzn/vx-linux-arm64": "0.0.396",
-    "@vzn/vx-darwin-x64": "0.0.396",
-    "@vzn/vx-darwin-arm64": "0.0.396"
+    "@vzn/vx-linux-x64": "0.0.397",
+    "@vzn/vx-linux-arm64": "0.0.397",
+    "@vzn/vx-darwin-x64": "0.0.397",
+    "@vzn/vx-darwin-arm64": "0.0.397"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -1145,6 +1145,15 @@ export async function wrapSandboxedCommand(
     wrapped = `exec ${readOnlyMasks(wrapped, scratch)}`
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
+  const held = portsHeld(ports)
+  if (held.length > 0) {
+    throw new UserError(
+      `sandbox: localBinding port${held.length === 1 ? '' : 's'} ${held.join(', ')} ` +
+        `${held.length === 1 ? 'is' : 'are'} already in use on this machine, so the task's own ` +
+        `cannot be exposed there and a client would reach the other listener; stop what ` +
+        `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
+    )
+  }
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) {
     spawnHostBridges(ports, tag)
@@ -1402,6 +1411,37 @@ const hostBridges = new Map<
   { ports: readonly number[]; procs: Array<ReturnType<typeof Bun.spawn>> }
 >()
 
+/**
+ * The ports a host listener already holds where the bridge would bind
+ * (`127.0.0.1`, or every address). The listen wait below reads the same
+ * table and took that listener for the bridge, whose bind had failed: the
+ * task passed and a client of the port reached the other process
+ * (2026-10-03). Linux, own procfs only, as the wait.
+ */
+function portsHeld(ports: readonly number[]): number[] {
+  if (ports.length === 0 || !procfsIsOwn()) return []
+  const held = new Set<string>()
+  for (const [file, any, loop] of [
+    ['/proc/net/tcp', '00000000', '0100007F'],
+    ['/proc/net/tcp6', '00000000000000000000000000000000', '00000000000000000000000001000000'],
+  ] as const) {
+    let table: string
+    try {
+      table = readFileSync(file, 'utf8')
+    } catch {
+      continue
+    }
+    for (const line of table.split('\n')) {
+      const f = line.trim().split(/\s+/)
+      if (f[3] !== '0A' || f[1] === undefined) continue
+      const [addr, port] = f[1].split(':')
+      // `::1` does not hold 127.0.0.1's port; every address does.
+      if (addr === any || (file === '/proc/net/tcp' && addr === loop)) held.add(port!)
+    }
+  }
+  return ports.filter((p) => held.has(p.toString(16).toUpperCase().padStart(4, '0')))
+}
+
 /**
  * Wait until each host-side bridge listens on its port, so a server that
  * says it is ready inside the sandbox is reachable on the host: the socat
@@ -1409,7 +1449,8 @@ const hostBridges = new Map<
  * right after its ready line under I/O load (M-22). Read off
  * /proc/net/tcp (127.0.0.1, state 0A); skipped where /proc is not this
  * process's (its net table could be another namespace's), ended early by
- * a bridge that exited (a port already taken), and bounded at 5 s.
+ * a bridge that exited, and bounded at 5 s. A port another listener holds
+ * reads as listening here, so the wrap refuses it first (`portsHeld`).
  */
 async function hostBridgesListen(ports: readonly number[], tag: string): Promise<void> {
   if (!procfsIsOwn()) return

package/src/workspace/config-eval.ts

@@ -61,6 +61,17 @@ export const WATCHED_BUILTIN_NAMES = [
   // A global one config set reached every config loaded after it in the
   // process: `--all` read it, `--filter` of the reader alone did not (D-122).
   'globalThis',
+  // What the check itself and vx's matching read through: a replaced
+  // `Reflect.ownKeys` blinded the check, and `RegExp.prototype.test` or
+  // `Date.now` ran vx on a config's choice (D-124).
+  'Reflect',
+  'Object',
+  'Array',
+  'RegExp.prototype',
+  'Function.prototype',
+  'Date',
+  'Date.prototype',
+  'Number.prototype',
 ] as const
 
 const WORKER_SRC = `
@@ -109,7 +120,10 @@ self.onmessage = async (e) => {
   const watched = e.data.blame
     ? ${JSON.stringify(WATCHED_BUILTIN_NAMES)}.map((n) => [n, n.split('.').reduce((o, k) => o[k], globalThis)])
     : null
-  const own = (o) => new Map(Reflect.ownKeys(o).map((k) => [k, Object.getOwnPropertyDescriptor(o, k)]))
+  // Taken before the import: a config can replace them (D-124).
+  const RO = Reflect.ownKeys
+  const GD = Object.getOwnPropertyDescriptor
+  const own = (o) => new Map(RO(o).map((k) => [k, GD(o, k)]))
   const before = watched?.map(([, o]) => own(o))
   const envBefore = watched ? { ...live } : null
   const cwdBefore = watched ? globalThis.process.cwd() : null

package/src/workspace/project-loader.ts

@@ -448,7 +448,7 @@ export async function loadProjectConfigs(
   // Taken only when a config is evaluated in this process: reading every
   // descriptor of `Bun` makes Bun build its lazy members (`bun:sql`,
   // `node:stream`), ~7 ms of a two-config warm run where every load hit.
-  let builtins: BuiltinSnapshot = []
+  let builtins: BuiltinSnapshot | undefined
   let env: Readonly<Record<string, string | undefined>> = {}
   let cwd = ''
   // More than one evaluation in flight: a change seen after one load may
@@ -618,20 +618,51 @@ const WATCHED_BUILTINS: ReadonlyArray<readonly [string, object]> = WATCHED_BUILT
     ] as const,
 )
 
+// The check reads through these, taken when a round's snapshot is, before
+// any of its configs runs: a config that set `Reflect.ownKeys = () => []`
+// blinded it, and its `Object.prototype.exec` ran in another project's
+// task (D-124). Each round keeps its own, so an overlapping round cannot
+// hand it a replaced one. The compare and put-back use indexed loops only
+// (a replaced `Array.prototype.forEach` skipped them).
+interface Primitives {
+  ownKeys: typeof Reflect.ownKeys
+  descriptorOf: typeof Object.getOwnPropertyDescriptor
+  defineOwn: typeof Object.defineProperty
+  deleteOwn: typeof Reflect.deleteProperty
+  hasOwn: typeof Object.hasOwn
+  same: typeof Object.is
+  keyName: typeof String
+}
+
 interface OwnProperties {
   keys: PropertyKey[]
   descriptors: PropertyDescriptor[]
-  byKey: ReadonlyMap<PropertyKey, PropertyDescriptor>
 }
 
-type BuiltinSnapshot = readonly OwnProperties[]
+interface BuiltinSnapshot {
+  readonly prims: Primitives
+  readonly props: readonly OwnProperties[]
+}
 
 function builtinSnapshot(): BuiltinSnapshot {
-  return WATCHED_BUILTINS.map(([, proto]) => {
-    const keys = Reflect.ownKeys(proto)
-    const descriptors = keys.map((k) => Object.getOwnPropertyDescriptor(proto, k)!)
-    return { keys, descriptors, byKey: new Map(keys.map((k, j) => [k, descriptors[j]!])) }
-  })
+  const prims: Primitives = {
+    ownKeys: Reflect.ownKeys,
+    descriptorOf: Object.getOwnPropertyDescriptor,
+    defineOwn: Object.defineProperty,
+    deleteOwn: Reflect.deleteProperty,
+    hasOwn: Object.hasOwn,
+    same: Object.is,
+    keyName: String,
+  }
+  const props: OwnProperties[] = []
+  for (let i = 0; i < WATCHED_BUILTINS.length; i++) {
+    const proto = WATCHED_BUILTINS[i]![1]
+    const keys = prims.ownKeys(proto)
+    const descriptors: PropertyDescriptor[] = []
+    for (let j = 0; j < keys.length; j++) descriptors[j] = prims.descriptorOf(proto, keys[j]!)!
+    props[i] = { keys, descriptors }
+  }
+  return { prims, props }
 }
 
 /**
@@ -641,13 +672,17 @@ function builtinSnapshot(): BuiltinSnapshot {
  * evaluated config: the full check was ~0.1 ms a config, ~100 ms of a
  * 1,000-config cold load.
  */
-function unchanged(proto: object, keys: readonly PropertyKey[], was: OwnProperties): boolean {
+function unchanged(
+  p: Primitives,
+  proto: object,
+  keys: readonly PropertyKey[],
+  was: OwnProperties,
+): boolean {
   if (keys.length !== was.keys.length) return false
   for (let j = 0; j < keys.length; j++) {
     const key = keys[j]!
     if (key !== was.keys[j]) return false
-    if (!sameDescriptor(was.descriptors[j]!, Object.getOwnPropertyDescriptor(proto, key)!))
-      return false
+    if (!sameDescriptor(p, was.descriptors[j]!, p.descriptorOf(proto, key)!)) return false
   }
   return true
 }
@@ -676,27 +711,38 @@ function builtinsChanged(changed: readonly string[], configPath?: string): UserE
 }
 
 /** Puts back what changed since `before`, naming each property it put back. */
-function restoreBuiltins(before: BuiltinSnapshot): string[] {
+function restoreBuiltins(before: BuiltinSnapshot | undefined): string[] {
   const changed: string[] = []
-  WATCHED_BUILTINS.forEach(([name, proto], i) => {
-    const keys = Reflect.ownKeys(proto)
-    if (unchanged(proto, keys, before[i]!)) return
-    const was = before[i]!.byKey
-    for (const key of keys) {
-      const prior = was.get(key)
-      const now = Object.getOwnPropertyDescriptor(proto, key)!
-      if (prior !== undefined && sameDescriptor(prior, now)) continue
-      changed.push(`${name}.${String(key)}`)
-      if (prior === undefined) Reflect.deleteProperty(proto, key)
-      else Object.defineProperty(proto, key, prior)
-    }
-    for (const [key, prior] of was) {
-      if (!Object.hasOwn(proto, key)) {
-        changed.push(`${name}.${String(key)}`)
-        Object.defineProperty(proto, key, prior)
+  if (before === undefined) return changed
+  const p = before.prims
+  for (let i = 0; i < WATCHED_BUILTINS.length; i++) {
+    const name = WATCHED_BUILTINS[i]![0]
+    const proto = WATCHED_BUILTINS[i]![1]
+    const was = before.props[i]!
+    const keys = p.ownKeys(proto)
+    if (unchanged(p, proto, keys, was)) continue
+    // Slow path, a change only: a linear lookup keeps it off `Map`.
+    for (let j = 0; j < keys.length; j++) {
+      const key = keys[j]!
+      let prior: PropertyDescriptor | undefined
+      for (let k = 0; k < was.keys.length; k++) {
+        if (was.keys[k] === key) {
+          prior = was.descriptors[k]
+          break
+        }
       }
+      if (prior !== undefined && sameDescriptor(p, prior, p.descriptorOf(proto, key)!)) continue
+      changed[changed.length] = name + '.' + p.keyName(key)
+      if (prior === undefined) p.deleteOwn(proto, key)
+      else p.defineOwn(proto, key, prior)
     }
-  })
+    for (let k = 0; k < was.keys.length; k++) {
+      const key = was.keys[k]!
+      if (p.hasOwn(proto, key)) continue
+      changed[changed.length] = name + '.' + p.keyName(key)
+      p.defineOwn(proto, key, was.descriptors[k]!)
+    }
+  }
   return changed
 }
 
@@ -739,10 +785,10 @@ function restoreCwd(before: string): string[] {
   return ['process.cwd (a chdir)']
 }
 
-function sameDescriptor(a: PropertyDescriptor, b: PropertyDescriptor): boolean {
+function sameDescriptor(p: Primitives, a: PropertyDescriptor, b: PropertyDescriptor): boolean {
   return (
     // `globalThis.NaN` is watched (D-122), and NaN !== NaN.
-    Object.is(a.value, b.value) &&
+    p.same(a.value, b.value) &&
     a.get === b.get &&
     a.set === b.set &&
     a.writable === b.writable &&