@vzn/vx 0.0.401 → 0.0.403

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.401",
+  "version": "0.0.403",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.401",
-    "@vzn/vx-linux-arm64": "0.0.401",
-    "@vzn/vx-darwin-x64": "0.0.401",
-    "@vzn/vx-darwin-arm64": "0.0.401"
+    "@vzn/vx-linux-x64": "0.0.403",
+    "@vzn/vx-linux-arm64": "0.0.403",
+    "@vzn/vx-darwin-x64": "0.0.403",
+    "@vzn/vx-darwin-arm64": "0.0.403"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -1891,7 +1891,8 @@ async function runSandboxedOnce(
       config: args.config,
       skip: [taskTmpRoot(), ...srtDefaultWritePaths()],
     })
-    if (outside.length > 0) violations.push(outsideWritesHint(outside, baselines.denyRead))
+    if (outside.length > 0)
+      violations.push(outsideWritesHint(outside, baselines.denyRead, args.reportWithin))
   }
 
   // The one denial macOS never logs. MEASURED 2026-09-05, same machine, two
@@ -1959,12 +1960,22 @@ async function runSandboxedOnce(
 }
 
 /** The hint for writes refused outside the project, a few paths named. */
-function outsideWritesHint(paths: readonly string[], walled: readonly string[]): SandboxViolation {
+function outsideWritesHint(
+  paths: readonly string[],
+  walled: readonly string[],
+  within: string,
+): SandboxViolation {
   const shown = paths.slice(0, 5).join(', ')
   const more = paths.length > 5 ? ` and ${paths.length - 5} more` : ''
   const home = toRealPath(os.homedir())
   const dir = path.dirname(paths[0]!)
-  const spelled = atOrUnder(dir, home) ? `~${dir.slice(home.length)}` : dir
+  // In the workspace, from the project, as a committed config spells it:
+  // the absolute path held only on the machine that printed it.
+  const spelled = walled.some((w) => atOrUnder(dir, toRealPath(w)))
+    ? path.relative(toRealPath(within), dir) || '.'
+    : atOrUnder(dir, home)
+      ? `~${dir.slice(home.length)}`
+      : dir
   const refused =
     `vx: the sandbox refused writes outside the project, which are not reported as ` +
     `violations: ${shown}${more}.`
@@ -1979,10 +1990,13 @@ function outsideWritesHint(paths: readonly string[], walled: readonly string[]):
     ? `${refused} The task has its own temp directory, empty at its start: write under ` +
       `$TMPDIR (os.tmpdir() in Node and Bun) instead of a fixed path.`
     : `${refused} If the task needs one, grant its directory, e.g. ` +
-      `\`allow: { write: ['${spelled}/'] }\`.`
+      `\`allow: { write: [${jsString(`${spelled}/`)}] }\`.`
   return { timestamp: new Date(), hint: true, line }
 }
 
+/** A path as a JS string literal a config can take: a quote in it is escaped. */
+const jsString = (p: string): string => (p.includes("'") ? JSON.stringify(p) : `'${p}'`)
+
 /** The host's shared temp directories, canonical: what a fixed temp path in a tool names. */
 function hostTempRoots(): string[] {
   return [...new Set(['/tmp', '/var/tmp', os.tmpdir()].map(toRealPath))]
@@ -1997,7 +2011,7 @@ function hiddenReadsHint(paths: readonly string[], within: string): SandboxViola
     line:
       `vx: the sandbox hid paths outside the project that exist on this machine, which are ` +
       `not reported as violations: ${shown}${more}. If the task reads one, grant it, e.g. ` +
-      `\`allow: { read: ['${path.relative(toRealPath(within), paths[0]!)}'] }\`.`,
+      `\`allow: { read: [${jsString(path.relative(toRealPath(within), paths[0]!))}] }\`.`,
   }
 }