@vzn/vx 0.0.432 → 0.0.433

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.432",
+  "version": "0.0.433",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.432",
-    "@vzn/vx-linux-arm64": "0.0.432",
-    "@vzn/vx-darwin-x64": "0.0.432",
-    "@vzn/vx-darwin-arm64": "0.0.432"
+    "@vzn/vx-linux-x64": "0.0.433",
+    "@vzn/vx-linux-arm64": "0.0.433",
+    "@vzn/vx-darwin-x64": "0.0.433",
+    "@vzn/vx-darwin-arm64": "0.0.433"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/select.ts

@@ -24,7 +24,7 @@ import {
 import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
-import { maskedLine, nearest, UserError } from '../util/index.js'
+import { listed, maskedLine, nearest, UserError } from '../util/index.js'
 import {
   claimedAffected,
   fingerprintClaims,
@@ -468,5 +468,5 @@ function didYouMeanProject(
     const scoped = bare === undefined ? undefined : byBare.get(bare)
     if (scoped?.length === 1) return `. Did you mean ${scoped[0]}?`
   }
-  return ''
+  return names.length === 0 ? '' : `. Projects: ${listed(names)}`
 }

package/src/exec/sandbox-runtime.ts

@@ -32,6 +32,7 @@ import {
   lstatSync,
   existsSync,
   mkdirSync,
+  mkdtempSync,
   openSync,
   readFileSync,
   readlinkSync,
@@ -39,6 +40,7 @@ import {
   rmSync,
   statSync,
   unlinkSync,
+  writeFileSync,
 } from 'node:fs'
 import { mkdir, unlink } from 'node:fs/promises'
 import type { SandboxConfig } from '../config.js'
@@ -162,7 +164,12 @@ async function probeUncached(weakerNested: boolean): Promise<SandboxAvailability
   if (!SandboxManager.isSupportedPlatform()) {
     return { available: false, reason: `platform ${process.platform} not supported` }
   }
-  const deps = SandboxManager.checkDependencies()
+  // SRT checks the scan command its live config names, and once that is
+  // vx's no-scan file (B-92) a process `exit` hook may have removed it
+  // while the process goes on: name one that is there.
+  const deps = SandboxManager.checkDependencies(
+    noScan === undefined ? undefined : { command: scanCommandAgain() },
+  )
   if (deps.errors.length > 0) return { available: false, reason: dependencyReason(deps.errors) }
   const long = socketPathRefusal()
   if (long !== undefined) return { available: false, reason: long }
@@ -503,14 +510,50 @@ let scopedDenyScan = false
  * 1 the scan finds only the root's entries, which SRT keeps only inside a
  * write grant, where the scoped walk already reaches (the parity rows in
  * `sandbox-deny-scan.unsafe.test.ts`). A no-op in rg's place ends the
- * spawn's 3.8 ms at 1.0; SRT has no way to skip it.
+ * spawn's 3.8 ms at 1.0; SRT has no way to skip it. A file that cannot be
+ * exec'd ends it sooner still: `posix_spawn` refuses it (ENOEXEC) in
+ * 0.32 ms against `true`'s 1.06, SRT reads the refusal as an empty scan,
+ * and its dependency check (`Bun.which`) still finds the file (B-92).
  */
 function scopedScanConfig(): { mandatoryDenySearchDepth: number; ripgrep?: { command: string } } {
   try {
-    return { mandatoryDenySearchDepth: 1, ripgrep: { command: executablePath('true') } }
+    return { mandatoryDenySearchDepth: 1, ripgrep: { command: noScanCommand() } }
   } catch {
-    return { mandatoryDenySearchDepth: 1 }
+    try {
+      return { mandatoryDenySearchDepth: 1, ripgrep: { command: executablePath('true') } }
+    } catch {
+      return { mandatoryDenySearchDepth: 1 }
+    }
+  }
+}
+
+let noScan: string | undefined
+
+/** The no-scan file again (made anew if gone), or `true` where it cannot be. */
+function scanCommandAgain(): string {
+  try {
+    return noScanCommand()
+  } catch {
+    return executablePath('true')
+  }
+}
+/**
+ * An empty executable only this process can write: SRT runs it outside the
+ * sandbox on every wrap, so it lives in a fresh 0700 directory, never in the
+ * shared `/tmp/claude`. Made once a process, again if a temp cleaner took it.
+ */
+function noScanCommand(): string {
+  if (noScan !== undefined && existsSync(noScan)) return noScan
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'vx-noscan-'))
+  const file = path.join(dir, 'rg')
+  writeFileSync(file, '', { mode: 0o700 })
+  if (noScan === undefined) {
+    process.on('exit', () => {
+      if (noScan !== undefined) rmSync(path.dirname(noScan), { recursive: true, force: true })
+    })
   }
+  noScan = file
+  return file
 }
 
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {

package/src/orchestrator/run.ts

@@ -38,6 +38,7 @@ import {
   parseSize,
   printTimings,
   ulid,
+  listed,
   nearest,
   UserError,
   machineParallelism,
@@ -378,7 +379,7 @@ async function runOnBus(
   // case too; the message is identical, so that branch stays below.
   if (prepared.unresolvedTasks.length > 0) {
     log.status(
-      `No projects declare task(s): ${prepared.unresolvedTasks.join(', ')}.${elsewhereHint(prepared.declaredElsewhere)}${didYouMean(prepared.unresolvedTasks, prepared.hintProjects)}${await initHint(prepared)}`,
+      `No projects declare task(s): ${prepared.unresolvedTasks.join(', ')}.${elsewhereHint(prepared.declaredElsewhere)}${didYouMean(prepared.unresolvedTasks, prepared.hintProjects, prepared.declaredElsewhere)}${await initHint(prepared)}`,
     )
     await teardown()
     prepared.cache.close()
@@ -1427,7 +1428,7 @@ export async function planRun(options: RunOptions): Promise<RunPlan> {
       return {
         tasks: [],
         unresolvedTasks: prepared.unresolvedTasks,
-        unresolvedHint: `${elsewhereHint(prepared.declaredElsewhere)}${didYouMean(prepared.unresolvedTasks, prepared.hintProjects)}${await initHint(prepared)}`,
+        unresolvedHint: `${elsewhereHint(prepared.declaredElsewhere)}${didYouMean(prepared.unresolvedTasks, prepared.hintProjects, prepared.declaredElsewhere)}${await initHint(prepared)}`,
       }
     }
     if (prepared.empty === 'no-tasks-declared' && prepared.declaredElsewhere.length > 0) {
@@ -1520,12 +1521,16 @@ async function initHint(prepared: {
 function didYouMean(
   unresolved: readonly string[],
   projects: ReadonlyMap<string, ProjectEntry>,
+  elsewhere: readonly string[] = [],
 ): string {
   const tasksOf = (p: ProjectEntry | undefined): string[] => Object.keys(p?.config.tasks ?? {})
   const allTasks = new Set<string>()
   for (const p of projects.values()) for (const t of tasksOf(p)) allTasks.add(t)
   // A Set: two typos of the same task hint it once, not once per typo.
   const hints = new Set<string>()
+  // A typo past two edits named nothing to pick from (M-56): with no near
+  // name, say what exists instead.
+  const lists = new Set<string>()
   for (const spec of unresolved) {
     const at = spec.indexOf('#')
     const nx = nxProjectTarget(spec, projects)
@@ -1536,18 +1541,31 @@ function didYouMean(
     if (at < 0) {
       const t = nearest(spec, allTasks)
       if (t !== undefined) hints.add(t)
+      // A name outside the selection is already said, with `--all`.
+      else if (allTasks.size > 0 && !elsewhere.includes(spec)) {
+        lists.add(`Tasks: ${listed(allTasks)}.`)
+      }
       continue
     }
     const [proj, task] = [spec.slice(0, at), spec.slice(at + 1)]
     if (!projects.has(proj)) {
       const p = projectNamed(proj, projects) ?? nearest(proj, projects.keys())
       if (p !== undefined && tasksOf(projects.get(p)).includes(task)) hints.add(`${p}#${task}`)
+      else if (p === undefined && projects.size > 0) {
+        lists.add(`No project is named ${proj}; projects: ${listed(projects.keys())}.`)
+      }
       continue
     }
     const t = nearest(task, tasksOf(projects.get(proj)))
     if (t !== undefined) hints.add(`${proj}#${t}`)
+    else if (tasksOf(projects.get(proj)).length > 0) {
+      lists.add(`${proj}'s tasks: ${listed(tasksOf(projects.get(proj)))}.`)
+    }
   }
-  return hints.size === 0 ? '' : ` Did you mean ${[...hints].join(', ')}?`
+  return (
+    (hints.size === 0 ? '' : ` Did you mean ${[...hints].join(', ')}?`) +
+    [...lists].map((l) => ` ${l}`).join('')
+  )
 }
 
 /**

package/src/util/edit-distance.ts

@@ -72,3 +72,13 @@ export function nearMatches(name: string, candidates: Iterable<string>, limit =
   }
   return out.slice(0, limit)
 }
+
+/**
+ * The names to offer when no one name is near: sorted, the first `limit`,
+ * then a count. A typo past two edits named nothing to pick from (M-56).
+ */
+export function listed(names: Iterable<string>, limit = 8): string {
+  const all = [...new Set(names)].sort()
+  const more = all.length - limit
+  return all.slice(0, limit).join(', ') + (more > 0 ? `, and ${more} more` : '')
+}

package/src/util/index.ts

@@ -49,7 +49,7 @@ export {
 export { appendTail, createTail, resetTail, tailText, type Tail } from './tail.js'
 export { ulid } from './ulid.js'
 export { splitTaskId } from './task-id.js'
-export { editDistance, nearMatches, nearest } from './edit-distance.js'
+export { editDistance, listed, nearMatches, nearest } from './edit-distance.js'
 export { CORE_VERBS, MOVED_VERBS } from './verbs.js'
 export { isUnsupportedBun, MIN_BUN, unsupportedBunMessage } from './bun-version.js'
 export { executablePath, shellArgv } from './which.js'

package/src/workspace/project-loader.ts

@@ -123,9 +123,15 @@ function servableSource(bytes: Uint8Array, loader: 'ts' | 'js'): string | null {
   } catch {
     return null
   }
-  return hasEsmExport(source, loader) ? source : null
+  return !COMMONJS_HINT.test(source) || hasEsmExport(source, loader) ? source : null
 }
 
+// What makes Bun run a file as CommonJS is one of these names at the top
+// level (an escaped `\u006dodule` too, so any backslash counts). Source
+// with none of them runs as a module whichever path loads it, so it skips
+// the parse: 16–20 µs a config, 1,000 cold configs (2026-10-03).
+const COMMONJS_HINT = /\b(?:module|exports|require|this|__dirname|__filename)\b|\\/
+
 /** vx's module-cache query, which no user wrote: stripped from anything shown to them. */
 const BUST_QUERY = /\?vx-(?:bust|held)=[^'"\s]*/g
 
@@ -303,7 +309,11 @@ export function configLoadError(err: unknown, configPath: string, kind: string):
   }
   if (name === 'BuildMessage') {
     const pos = (err as { position?: BuildPosition | null }).position ?? {}
-    const file = typeof pos.file === 'string' && pos.file.length > 0 ? pos.file : configPath
+    // A served config's position names its specifier, query and all.
+    const file =
+      typeof pos.file === 'string' && pos.file.length > 0
+        ? pos.file.replace(BUST_QUERY, '')
+        : configPath
     const at =
       typeof pos.line === 'number'
         ? `:${pos.line}${typeof pos.column === 'number' ? `:${pos.column}` : ''}`

package/src/workspace/workspace.ts

@@ -118,7 +118,8 @@ export async function findWorkspaceRoot(
   if (nearest !== null) return nearest
   throw new UserError(
     `Could not find a workspace root in any parent of ${start} ` +
-      `(looked for pnpm-workspace.yaml or package.json)`,
+      `(looked for pnpm-workspace.yaml or package.json): run vx inside a project, ` +
+      `or create a package.json (\`bun init\` or \`npm init -y\`) and run \`vx init\``,
   )
 }