@vzn/vx 0.0.425 → 0.0.426

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.425",
+  "version": "0.0.426",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.425",
-    "@vzn/vx-linux-arm64": "0.0.425",
-    "@vzn/vx-darwin-x64": "0.0.425",
-    "@vzn/vx-darwin-arm64": "0.0.425"
+    "@vzn/vx-linux-x64": "0.0.426",
+    "@vzn/vx-linux-arm64": "0.0.426",
+    "@vzn/vx-darwin-x64": "0.0.426",
+    "@vzn/vx-darwin-arm64": "0.0.426"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/workspace/workspace.ts

@@ -470,13 +470,28 @@ async function memberDirs(root: string, pattern: string): Promise<string[]> {
     // `pack*/*` did not (item 987). Followed only where the depth is bounded:
     // under `**` the scan would walk every pnpm `node_modules` link.
     const followSymlinks = !expanded.includes('**')
-    for await (const rel of glob.scan({ cwd: root, onlyFiles: true, dot: false, followSymlinks })) {
-      // Skip nested node_modules — workspace package globs shouldn't
-      // ever reach into them, but a pathological pattern like `**`
-      // would. Avoid splitting the path on the hot loop.
-      if (rel.includes(`${path.sep}node_modules${path.sep}`)) continue
-      if (rel.startsWith(`node_modules${path.sep}`)) continue
-      dirs.push(path.dirname(path.resolve(root, rel)))
+    try {
+      for await (const rel of glob.scan({
+        cwd: root,
+        onlyFiles: true,
+        dot: false,
+        followSymlinks,
+      })) {
+        // Skip nested node_modules — workspace package globs shouldn't
+        // ever reach into them, but a pathological pattern like `**`
+        // would. Avoid splitting the path on the hot loop.
+        if (rel.includes(`${path.sep}node_modules${path.sep}`)) continue
+        if (rel.startsWith(`node_modules${path.sep}`)) continue
+        dirs.push(path.dirname(path.resolve(root, rel)))
+      }
+    } catch (err) {
+      // The scan stops at a directory it may not open and cannot skip it,
+      // so the readdir path's skip is not on offer here (D-132).
+      if (!isPermissionError(err)) throw err
+      const where = relPosix(root, path.resolve(root, err.path ?? ''))
+      throw new UserError(
+        `${where}: not readable by this user (${err.code}), and the workspace glob "${pattern}" walks into it`,
+      )
     }
   }
   return dirs