@vzn/vx 0.0.397 → 0.0.399

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.397",
+  "version": "0.0.399",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.397",
-    "@vzn/vx-linux-arm64": "0.0.397",
-    "@vzn/vx-darwin-x64": "0.0.397",
-    "@vzn/vx-darwin-arm64": "0.0.397"
+    "@vzn/vx-linux-x64": "0.0.399",
+    "@vzn/vx-linux-arm64": "0.0.399",
+    "@vzn/vx-darwin-x64": "0.0.399",
+    "@vzn/vx-darwin-arm64": "0.0.399"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -1141,8 +1141,21 @@ export async function wrapSandboxedCommand(
   // sandboxed server and all it forked outlived vx (turborepo#9666). Now
   // the namespace goes with vx, a `setsid` daemon inside included, a
   // traced one-shot task too: its strace runs inside (B-11).
-  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped))
-    wrapped = `exec ${readOnlyMasks(wrapped, scratch)}`
+  // Every mask and bind is a mount point, and git's discovery stops at
+  // one: a task granted the repository's `.git` still read "not a git
+  // repository … Stopping at filesystem boundary" (2026-10-03). The
+  // boundaries are the sandbox's, so a task that names a `.git` may walk
+  // across them; only such a task, since git-aware tools read the variable
+  // (vx's own repoFacts asks git instead of the disk under it). A value the
+  // task's environment sets wins.
+  if (process.platform === 'linux' && /^\S*bwrap /.test(wrapped)) {
+    const gitGranted = [...args.config.allowRead, ...args.config.allowWrite].some((g) =>
+      g.split(/[\\/]/).includes('.git'),
+    )
+    wrapped =
+      (gitGranted ? 'GIT_DISCOVERY_ACROSS_FILESYSTEM=${GIT_DISCOVERY_ACROSS_FILESYSTEM-1} ' : '') +
+      `exec ${readOnlyMasks(wrapped, scratch)}`
+  }
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
   const held = portsHeld(ports)

package/src/workspace/config-eval.ts

@@ -127,6 +127,9 @@ self.onmessage = async (e) => {
   const before = watched?.map(([, o]) => own(o))
   const envBefore = watched ? { ...live } : null
   const cwdBefore = watched ? globalThis.process.cwd() : null
+  // The umask is the process's, not the worker's: a config's umask(0o777)
+  // here left every file vx wrote after it 000 (D-125). Put back below.
+  const umaskIn = globalThis.process.umask()
   const same = (a, b) =>
     a !== undefined && b !== undefined && Object.is(a.value, b.value) && a.get === b.get && a.set === b.set &&
     a.writable === b.writable && a.enumerable === b.enumerable && a.configurable === b.configurable
@@ -141,8 +144,14 @@ self.onmessage = async (e) => {
     for (const k of new Set([...Object.keys(envBefore), ...Object.keys(live)]))
       if (envBefore[k] !== live[k]) out.push('process.env.' + k)
     if (globalThis.process.cwd() !== cwdBefore) out.push('process.cwd (a chdir)')
+    if (globalThis.process.umask() !== umaskIn) out.push('process.umask')
     return out
   }
+  const umaskBack = () => {
+    if (globalThis.process.umask() === umaskIn) return false
+    globalThis.process.umask(umaskIn)
+    return true
+  }
   try {
     const ns = await import(path)
     // Awaited as the in-process load's async return flattens it: a Promise
@@ -158,6 +167,7 @@ self.onmessage = async (e) => {
       json: isObject && nonJson.length === 0 ? JSON.stringify(mod) : null,
       fn: typeof mod === 'function',
       changed: changed(),
+      umask: umaskBack(),
     })
   } catch (err) {
     postMessage({
@@ -167,6 +177,7 @@ self.onmessage = async (e) => {
       message: err?.message ?? String(err),
       stack: err?.stack ?? null,
       changed: changed(),
+      umask: umaskBack(),
       position:
         err?.position && typeof err.position === 'object'
           ? { file: err.position.file, line: err.position.line, column: err.position.column }
@@ -178,6 +189,9 @@ self.onmessage = async (e) => {
 
 const FUNCTION_EXPORT = (): void => {}
 
+/** A repeat load moved the process's umask; the loader names the config (D-125). */
+export class UmaskChanged extends Error {}
+
 const WORKER_URL = `data:text/javascript,${encodeURIComponent(WORKER_SRC)}`
 
 interface WorkerReply {
@@ -186,6 +200,8 @@ interface WorkerReply {
   json: string | null
   /** The default export is a function, which JSON cannot carry back. */
   fn?: boolean
+  /** The evaluation moved the process's umask; the worker put it back. */
+  umask?: boolean
   nonJson: NonJsonValue[]
   name: string
   message: string
@@ -347,6 +363,7 @@ export async function evaluateConfigFresh(configPath: string): Promise<unknown>
       timer.unref?.()
       w.postMessage({ id, path: abs, env: { ...process.env } })
     })
+    if (reply.umask === true) throw new UmaskChanged()
     const [nonJson] = reply.nonJson
     if (nonJson !== undefined) throw new UserError(nonJsonMessage(configPath, nonJson))
     // A function stands in for the one the config exported, so the caller's

package/src/workspace/project-loader.ts

@@ -9,6 +9,7 @@ import {
   CONFIG_EXIT,
   evalBudgetMs,
   evaluateConfigFresh,
+  UmaskChanged,
   WATCHED_BUILTIN_NAMES,
 } from './config-eval.js'
 import { hasEsmExport, unprovidedBareImports } from './config-imports.js'
@@ -451,6 +452,7 @@ export async function loadProjectConfigs(
   let builtins: BuiltinSnapshot | undefined
   let env: Readonly<Record<string, string | undefined>> = {}
   let cwd = ''
+  let umask = -1
   // More than one evaluation in flight: a change seen after one load may
   // be another's.
   let overlapping = false
@@ -489,6 +491,7 @@ export async function loadProjectConfigs(
     if (repeat) refuseUnprovidedImports(bytes!, configPath, 'Project')
     const mod = repeat
       ? await evaluateConfigFresh(configPath).catch((err: unknown) => {
+          if (err instanceof UmaskChanged) throw builtinsChanged(['process.umask'], configPath)
           throw configLoadError(err, configPath, 'Project') ?? err
         })
       : await loadDefaultExport(configPath, 'Project', bytes!)
@@ -496,7 +499,12 @@ export async function loadProjectConfigs(
     // turned the JSON-data walk's own check into "a cyclic reference".
     const changed = repeat
       ? []
-      : [...restoreBuiltins(builtins), ...restoreEnv(env), ...restoreCwd(cwd)]
+      : [
+          ...restoreBuiltins(builtins),
+          ...restoreEnv(env),
+          ...restoreCwd(cwd),
+          ...restoreUmask(umask),
+        ]
     // Loads overlap, so another config's change can surface after this
     // one: named here, the refusal blamed the wrong file (D-119). The round
     // finds the one that made it.
@@ -549,6 +557,7 @@ export async function loadProjectConfigs(
       builtins = builtinSnapshot()
       env = { ...process.env }
       cwd = process.cwd()
+      umask = currentUmask()
     }
     overlapping = misses.length > 1
     let next = 0
@@ -569,7 +578,12 @@ export async function loadProjectConfigs(
     }
     const changed =
       misses.length > 0
-        ? [...restoreBuiltins(builtins), ...restoreEnv(env), ...restoreCwd(cwd)]
+        ? [
+            ...restoreBuiltins(builtins),
+            ...restoreEnv(env),
+            ...restoreCwd(cwd),
+            ...restoreUmask(umask),
+          ]
         : []
     if (first?.failed instanceof ChangedInRound) {
       for (const i of misses) {
@@ -702,6 +716,9 @@ function builtinsChanged(changed: readonly string[], configPath?: string): UserE
     (changed.some((c) => c.startsWith('process.cwd'))
       ? '; a task runs in its project directory, and `cd <dir> && …` in `exec.command` moves it'
       : '') +
+    (changed.some((c) => c.startsWith('process.umask'))
+      ? '; a task sets its own with `umask <mode> && …` in `exec.command`'
+      : '') +
     (changed.some((c) => c.startsWith('globalThis.'))
       ? '; a constant configs share goes in a module each one imports'
       : '')
@@ -785,6 +802,26 @@ function restoreCwd(before: string): string[] {
   return ['process.cwd (a chdir)']
 }
 
+/**
+ * A config's `process.umask()` set the mode of every file vx and its tasks
+ * wrote after it: a cache artifact and a task's outputs landed `000`, which
+ * a user other than root could not read back (D-125). Put back, and named.
+ */
+function currentUmask(): number {
+  // Through globalThis, as restoreCwd: the playground's shim has no umask.
+  const proc = globalThis.process as { umask?: (mask?: number) => number }
+  if (typeof proc.umask !== 'function') return -1
+  // No argument reads it: setting 0 and back would open a window where a
+  // file written by an overlapping write landed world-writable.
+  return proc.umask()
+}
+
+function restoreUmask(before: number): string[] {
+  if (before === -1 || currentUmask() === before) return []
+  ;(globalThis.process as { umask: (mask: number) => number }).umask(before)
+  return ['process.umask']
+}
+
 function sameDescriptor(p: Primitives, a: PropertyDescriptor, b: PropertyDescriptor): boolean {
   return (
     // `globalThis.NaN` is watched (D-122), and NaN !== NaN.