@vzn/vx 0.0.434 → 0.0.435

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.434",
+  "version": "0.0.435",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.434",
-    "@vzn/vx-linux-arm64": "0.0.434",
-    "@vzn/vx-darwin-x64": "0.0.434",
-    "@vzn/vx-darwin-arm64": "0.0.434"
+    "@vzn/vx-linux-x64": "0.0.435",
+    "@vzn/vx-linux-arm64": "0.0.435",
+    "@vzn/vx-darwin-x64": "0.0.435",
+    "@vzn/vx-darwin-arm64": "0.0.435"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/show.ts

@@ -10,7 +10,7 @@ import path from 'node:path'
 import type { ProjectConfig, TaskConfig } from '../config.js'
 import { declaredTask } from '../graph/index.js'
 import { flagHint, seeHelp } from './help.js'
-import { nearMatches, relPosix, secretMask, UserError } from '../util/index.js'
+import { listed, nearMatches, relPosix, secretMask, UserError } from '../util/index.js'
 import { discoverCliProjects, loadCliProjects } from './workspace-config.js'
 import {
   findWorkspaceRoot,
@@ -94,7 +94,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   if (projectName !== undefined && (taskName !== undefined || byName.has(projectName))) {
     if (!byName.has(projectName)) {
       throw new UserError(
-        `vx show: unknown project: "${projectName}"${suggest(projectName, [...byName.keys()])}`,
+        `vx show: unknown project: "${projectName}"${suggest(projectName, [...byName.keys()], '', 'projects')}`,
       )
     }
   }
@@ -121,7 +121,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
       // `nx show projects` lists them; here a bare `vx show` does.
       const nx = projectName === 'projects' ? ' (`nx show projects` is `vx show` here)' : ''
       throw new UserError(
-        `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names])}`,
+        `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names], '', 'projects and tasks')}`,
       )
     }
     process.stdout.write(renderTaskAcross(root, declaring, projectName!, parsed.format))
@@ -143,7 +143,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   const task = declaredTask(config, taskName)
   if (task === undefined) {
     throw new UserError(
-      `vx show: unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`)}`,
+      `vx show: unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`, 'its tasks')}`,
     )
   }
   process.stdout.write(renderTask(meta.name, dir, taskName, task, parsed.format))
@@ -154,14 +154,21 @@ export async function showCmd(args: readonly string[]): Promise<number> {
  * Near misses by edit distance, plus partial names in either direction.
  * `prefix` makes each a spec the user can paste (`app#build`, not `build`).
  */
-function suggest(query: string, candidates: readonly string[], prefix = ''): string {
+function suggest(
+  query: string,
+  candidates: readonly string[],
+  prefix = '',
+  label = 'names',
+): string {
   const q = query.toLowerCase()
   const near = new Set(nearMatches(query, candidates))
   for (const c of candidates) {
     const n = c.toLowerCase()
     if (n.includes(q) || q.includes(n)) near.add(c)
   }
-  return near.size > 0 ? ` — did you mean ${[...near].map((n) => prefix + n).join(', ')}?` : ''
+  if (near.size > 0) return ` — did you mean ${[...near].map((n) => prefix + n).join(', ')}?`
+  // Nothing near named nothing to pick from (M-57): say what exists.
+  return candidates.length === 0 ? '' : `; ${label}: ${listed(candidates.map((c) => prefix + c))}`
 }
 
 function projectDir(root: string, meta: ProjectMeta): string {

package/src/exec/sandbox-runtime.ts

@@ -32,7 +32,6 @@ import {
   lstatSync,
   existsSync,
   mkdirSync,
-  mkdtempSync,
   openSync,
   readFileSync,
   readlinkSync,
@@ -538,19 +537,42 @@ function scanCommandAgain(): string {
   }
 }
 /**
- * An empty executable only this process can write: SRT runs it outside the
- * sandbox on every wrap, so it lives in a fresh 0700 directory, never in the
- * shared `/tmp/claude`. Made once a process, again if a temp cleaner took it.
+ * An empty executable only this user can write: SRT runs it outside the
+ * sandbox on every wrap, so it lives in this user's own 0700 directory under
+ * the OS temp dir, never the shared `/tmp/claude`. One directory per user,
+ * not per process: a per-process one outlived every SIGKILLed run, and the
+ * exit hook that removed it fired under a test's emitted `exit` with the
+ * process going on (B-93). Anything else at the name (another owner, group
+ * or other bits, a link, a non-empty file) is refused, and the caller falls
+ * back to `true`.
  */
 function noScanCommand(): string {
   if (noScan !== undefined && existsSync(noScan)) return noScan
-  const dir = mkdtempSync(path.join(os.tmpdir(), 'vx-noscan-'))
+  const uid = process.getuid!()
+  const dir = path.join(os.tmpdir(), `vx-noscan-${uid}`)
+  try {
+    mkdirSync(dir, { mode: 0o700 })
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+  }
+  const d = lstatSync(dir)
+  // A link reads mode 0777 here, and a file at the name fails the write
+  // below (ENOTDIR).
+  if (d.uid !== uid || (d.mode & 0o077) !== 0) {
+    throw new Error(`${dir} is not this user's own directory`)
+  }
   const file = path.join(dir, 'rg')
-  writeFileSync(file, '', { mode: 0o700 })
-  if (noScan === undefined) {
-    process.on('exit', () => {
-      if (noScan !== undefined) rmSync(path.dirname(noScan), { recursive: true, force: true })
-    })
+  try {
+    writeFileSync(file, '', { mode: 0o700, flag: 'wx' })
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+  }
+  const f = lstatSync(file)
+  // SRT's dependency check (`Bun.which`) refuses what is not an executable
+  // file, which would make the sandbox unavailable rather than fall back. A
+  // directory's size is never 0.
+  if (f.size !== 0 || (f.mode & 0o100) === 0) {
+    throw new Error(`${file} is not an empty executable of this user's`)
   }
   noScan = file
   return file