@vzn/vx 0.0.434 → 0.0.436

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.434",
+  "version": "0.0.436",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.434",
-    "@vzn/vx-linux-arm64": "0.0.434",
-    "@vzn/vx-darwin-x64": "0.0.434",
-    "@vzn/vx-darwin-arm64": "0.0.434"
+    "@vzn/vx-linux-x64": "0.0.436",
+    "@vzn/vx-linux-arm64": "0.0.436",
+    "@vzn/vx-darwin-x64": "0.0.436",
+    "@vzn/vx-darwin-arm64": "0.0.436"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/show.ts

@@ -10,7 +10,7 @@ import path from 'node:path'
 import type { ProjectConfig, TaskConfig } from '../config.js'
 import { declaredTask } from '../graph/index.js'
 import { flagHint, seeHelp } from './help.js'
-import { nearMatches, relPosix, secretMask, UserError } from '../util/index.js'
+import { listed, nearMatches, relPosix, secretMask, UserError } from '../util/index.js'
 import { discoverCliProjects, loadCliProjects } from './workspace-config.js'
 import {
   findWorkspaceRoot,
@@ -94,7 +94,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   if (projectName !== undefined && (taskName !== undefined || byName.has(projectName))) {
     if (!byName.has(projectName)) {
       throw new UserError(
-        `vx show: unknown project: "${projectName}"${suggest(projectName, [...byName.keys()])}`,
+        `vx show: unknown project: "${projectName}"${suggest(projectName, [...byName.keys()], '', 'projects')}`,
       )
     }
   }
@@ -121,7 +121,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
       // `nx show projects` lists them; here a bare `vx show` does.
       const nx = projectName === 'projects' ? ' (`nx show projects` is `vx show` here)' : ''
       throw new UserError(
-        `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names])}`,
+        `vx show: unknown project or task: "${projectName}"${nx}${suggest(projectName!, [...byName.keys(), ...names], '', 'projects and tasks')}`,
       )
     }
     process.stdout.write(renderTaskAcross(root, declaring, projectName!, parsed.format))
@@ -143,7 +143,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   const task = declaredTask(config, taskName)
   if (task === undefined) {
     throw new UserError(
-      `vx show: unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`)}`,
+      `vx show: unknown task: "${meta.name}#${taskName}"${suggest(taskName, Object.keys(config?.tasks ?? {}), `${meta.name}#`, 'its tasks')}`,
     )
   }
   process.stdout.write(renderTask(meta.name, dir, taskName, task, parsed.format))
@@ -154,14 +154,21 @@ export async function showCmd(args: readonly string[]): Promise<number> {
  * Near misses by edit distance, plus partial names in either direction.
  * `prefix` makes each a spec the user can paste (`app#build`, not `build`).
  */
-function suggest(query: string, candidates: readonly string[], prefix = ''): string {
+function suggest(
+  query: string,
+  candidates: readonly string[],
+  prefix = '',
+  label = 'names',
+): string {
   const q = query.toLowerCase()
   const near = new Set(nearMatches(query, candidates))
   for (const c of candidates) {
     const n = c.toLowerCase()
     if (n.includes(q) || q.includes(n)) near.add(c)
   }
-  return near.size > 0 ? ` — did you mean ${[...near].map((n) => prefix + n).join(', ')}?` : ''
+  if (near.size > 0) return ` — did you mean ${[...near].map((n) => prefix + n).join(', ')}?`
+  // Nothing near named nothing to pick from (M-57): say what exists.
+  return candidates.length === 0 ? '' : `; ${label}: ${listed(candidates.map((c) => prefix + c))}`
 }
 
 function projectDir(root: string, meta: ProjectMeta): string {

package/src/cli/watch-fs.ts

@@ -26,7 +26,7 @@ export interface WatchHandle {
 }
 
 export interface ArmedWatcher {
-  watcher: fs.FSWatcher
+  watcher: WatchHandle
   /** Resolves `true` once the watcher reported the probe, `false` on timeout. */
   ready: Promise<boolean>
 }
@@ -157,7 +157,7 @@ export function armWatcher(
   const seen = new Promise<boolean>((resolve) => {
     markReady = resolve
   })
-  const watcher = fs.watch(dir, { recursive, persistent: true }, (_event, filename) => {
+  const listener = (filename: string | null): void => {
     if (filename == null || typeof filename !== 'string') return
     // An event naming the watched directory itself (macOS reports the
     // directory a write landed in as its own item) carries nothing a key
@@ -175,7 +175,11 @@ export function armWatcher(
     // proves this stream live.
     if (path.basename(filename) === WATCH_PROBE) return
     onEvent(filename)
-  })
+  }
+  const watcher: WatchHandle =
+    recursive && process.platform === 'linux'
+      ? treeWatcher(dir, listener)
+      : fs.watch(dir, { recursive, persistent: true }, (_event, filename) => listener(filename))
   const probe = path.join(dir, WATCH_PROBE)
   const ready = (async (): Promise<boolean> => {
     // The probe is subject to the very race it detects: a write that lands
@@ -217,6 +221,99 @@ export function armWatcher(
   return { watcher, ready }
 }
 
+/**
+ * A recursive watch on Linux, built from one non-recursive watch per
+ * directory, that never enters `IGNORED_SEGMENTS`. Bun's recursive form is
+ * the same inotify watch per directory and descended into all of them:
+ * this repo's root arm held 4,657 watches where 438 directories can
+ * matter, 40–55 ms of the arm, and a monorepo's `node_modules` met the OS
+ * watch limit (8,192 on many distros) and fell back to polling — for
+ * events the loop drops by name. A directory that appears is watched, and
+ * what it already holds is reported (it may have landed before its watch);
+ * one that goes, or moves, is dropped with everything under it, since an
+ * inotify watch follows the inode and would report the old name. The
+ * arming walk throws at the watch limit, so the pool's fallback still
+ * applies; a subdirectory that vanished mid-walk is simply not watched.
+ */
+function treeWatcher(root: string, listener: (filename: string) => void): WatchHandle {
+  const watchers = new Map<string, fs.FSWatcher>()
+  let closed = false
+  let armed = false
+  let warned = false
+  const drop = (rel: string): void => {
+    for (const [key, w] of watchers) {
+      if (key !== rel && !key.startsWith(rel + '/')) continue
+      w.close()
+      watchers.delete(key)
+    }
+  }
+  const watchDir = (rel: string, report: boolean): void => {
+    if (closed || watchers.has(rel)) return
+    const abs = rel === '' ? root : path.join(root, rel)
+    let w: fs.FSWatcher
+    try {
+      w = fs.watch(abs, { persistent: true }, (_event, name) => {
+        if (name == null || typeof name !== 'string' || name === '' || name === '.') return
+        const child = rel === '' ? name : `${rel}/${name}`
+        listener(child)
+        if (IGNORED_SEGMENTS.includes(name)) return
+        let st: fs.Stats
+        try {
+          st = fs.statSync(path.join(abs, name))
+        } catch {
+          drop(child)
+          return
+        }
+        if (!st.isDirectory()) return
+        if (watchers.has(child)) return
+        watchDir(child, true)
+      })
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code
+      const limit = code === 'ENOSPC' || code === 'EMFILE'
+      // The walk that arms is all or nothing at the watch limit, as the
+      // recursive form was, so the pool's fallback polls instead of a
+      // tree half watched without a word.
+      if (rel === '' || (limit && !armed)) throw err
+      if (limit && !warned) {
+        warned = true
+        process.stderr.write(
+          `vx watch: ${abs}: the OS watch limit is reached (${code}); directories made from here on are not watched — raise it (Linux: sysctl fs.inotify.max_user_watches)\n`,
+        )
+      }
+      return
+    }
+    w.on('error', () => drop(rel))
+    watchers.set(rel, w)
+    let entries: fs.Dirent[]
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const e of entries) {
+      const child = rel === '' ? e.name : `${rel}/${e.name}`
+      if (e.isDirectory()) {
+        if (!IGNORED_SEGMENTS.includes(e.name)) watchDir(child, report)
+      } else if (report) listener(child)
+    }
+  }
+  try {
+    watchDir('', false)
+  } catch (err) {
+    for (const w of watchers.values()) w.close()
+    throw err
+  }
+  armed = true
+  return {
+    close(): void {
+      closed = true
+      for (const w of watchers.values()) w.close()
+      watchers.clear()
+    },
+  }
+}
+
 /** True when `abs` was last modified before `t` (epoch ms); false when it cannot be read. */
 export function modifiedBefore(abs: string, t: number): boolean {
   try {

package/src/exec/sandbox-runtime.ts

@@ -32,7 +32,6 @@ import {
   lstatSync,
   existsSync,
   mkdirSync,
-  mkdtempSync,
   openSync,
   readFileSync,
   readlinkSync,
@@ -538,19 +537,42 @@ function scanCommandAgain(): string {
   }
 }
 /**
- * An empty executable only this process can write: SRT runs it outside the
- * sandbox on every wrap, so it lives in a fresh 0700 directory, never in the
- * shared `/tmp/claude`. Made once a process, again if a temp cleaner took it.
+ * An empty executable only this user can write: SRT runs it outside the
+ * sandbox on every wrap, so it lives in this user's own 0700 directory under
+ * the OS temp dir, never the shared `/tmp/claude`. One directory per user,
+ * not per process: a per-process one outlived every SIGKILLed run, and the
+ * exit hook that removed it fired under a test's emitted `exit` with the
+ * process going on (B-93). Anything else at the name (another owner, group
+ * or other bits, a link, a non-empty file) is refused, and the caller falls
+ * back to `true`.
  */
 function noScanCommand(): string {
   if (noScan !== undefined && existsSync(noScan)) return noScan
-  const dir = mkdtempSync(path.join(os.tmpdir(), 'vx-noscan-'))
+  const uid = process.getuid!()
+  const dir = path.join(os.tmpdir(), `vx-noscan-${uid}`)
+  try {
+    mkdirSync(dir, { mode: 0o700 })
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+  }
+  const d = lstatSync(dir)
+  // A link reads mode 0777 here, and a file at the name fails the write
+  // below (ENOTDIR).
+  if (d.uid !== uid || (d.mode & 0o077) !== 0) {
+    throw new Error(`${dir} is not this user's own directory`)
+  }
   const file = path.join(dir, 'rg')
-  writeFileSync(file, '', { mode: 0o700 })
-  if (noScan === undefined) {
-    process.on('exit', () => {
-      if (noScan !== undefined) rmSync(path.dirname(noScan), { recursive: true, force: true })
-    })
+  try {
+    writeFileSync(file, '', { mode: 0o700, flag: 'wx' })
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+  }
+  const f = lstatSync(file)
+  // SRT's dependency check (`Bun.which`) refuses what is not an executable
+  // file, which would make the sandbox unavailable rather than fall back. A
+  // directory's size is never 0.
+  if (f.size !== 0 || (f.mode & 0o100) === 0) {
+    throw new Error(`${file} is not an empty executable of this user's`)
   }
   noScan = file
   return file