@vzn/vx 0.0.445 → 0.0.447

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.445",
+  "version": "0.0.447",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.445",
-    "@vzn/vx-linux-arm64": "0.0.445",
-    "@vzn/vx-darwin-x64": "0.0.445",
-    "@vzn/vx-darwin-arm64": "0.0.445"
+    "@vzn/vx-linux-x64": "0.0.447",
+    "@vzn/vx-linux-arm64": "0.0.447",
+    "@vzn/vx-darwin-x64": "0.0.447",
+    "@vzn/vx-darwin-arm64": "0.0.447"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/upgrade.ts

@@ -29,7 +29,7 @@ export function isBunfsPath(p: string): boolean {
 
 /**
  * True when running as a `bun build --compile` binary. Keys off
- * `Bun.main` (and argv[1]) rather than `import.meta.path`: with
+ * `Bun.main` (and argv[1]), `import.meta.path` only last: with
  * `--minify --bytecode` — vx's release build flags — `import.meta.path`
  * reports the ORIGINAL SOURCE path, not the bunfs path, so the old
  * check silently failed for every installed binary and `vx

package/src/cli/watch.ts

@@ -432,6 +432,23 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
   })
   /** Per-project arms by directory, so `rearm` can add and drop them. */
   const perProject = new Map<string, WatchHandle>()
+  // An OS watch holds the directory's inode, not its path: one removed and
+  // made again (`rm -rf packages && git checkout packages`) keeps reporting
+  // for the deleted one. Each arm notes the directory it holds, and a
+  // re-arm replaces any whose path now names another. The birth time is
+  // part of the name: a freed inode number is handed straight to the next
+  // directory made (measured on this box's /tmp), so the number alone
+  // said "the same one" of a new directory.
+  const armedAs = new Map<string, string>()
+  const inodeOf = (dir: string): string | undefined => {
+    try {
+      const st = fs.statSync(dir)
+      return `${st.dev}:${st.ino}:${st.birthtimeMs}`
+    } catch {
+      return undefined
+    }
+  }
+  const stale = (dir: string): boolean => armedAs.get(dir) !== inodeOf(dir)
   /** The root arm: recursive when workspace-wide, else the root's own files only. */
   let rootArm: WatchHandle = CLOSED
   const armProject = (proj: ProjectMeta): void => {
@@ -442,6 +459,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
         trigger(`${proj.name} ${filename}`, path.join(proj.dir, filename))
       })
       perProject.set(proj.dir, handle)
+      armedAs.set(proj.dir, inodeOf(proj.dir) ?? '')
     } catch (err) {
       sayCannot(`cannot watch ${proj.dir}`, err)
     }
@@ -629,7 +647,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
     } else if (!workspaceWide) {
       const keep = new Set(projectDirs)
       for (const [dir, handle] of perProject) {
-        if (keep.has(dir)) continue
+        if (keep.has(dir) && !stale(dir)) continue
         handle.close()
         perProject.delete(dir)
       }
@@ -655,15 +673,60 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
   // re-read with the set: a glob added to the list watched nothing new
   // until a restart (item 1018).
   const baseArms = new Map<string, WatchHandle>()
+  // A base removed and made again is no event to its own watch (it holds
+  // the deleted directory) nor to the root arm, which drops every name but
+  // its own files: `watching 0 project(s)` and silence until a restart. So
+  // each base is watched from its nearest directory that exists, for the
+  // next name on the way down: its parent while it is there, an ancestor
+  // when the parent went too (`apps/` removed under `apps/web/*`).
+  const baseParents = new Map<string, WatchHandle>()
+  let baseNames = new Map<string, Set<string>>()
+  const armBaseParents = (): void => {
+    baseNames = new Map()
+    for (const base of memberBases) {
+      let dir = path.dirname(base)
+      let name = path.basename(base)
+      while (inodeOf(dir) === undefined && dir !== workspaceRoot && dir !== path.dirname(dir)) {
+        name = path.basename(dir)
+        dir = path.dirname(dir)
+      }
+      baseNames.set(dir, (baseNames.get(dir) ?? new Set()).add(name))
+    }
+    for (const [dir, handle] of baseParents) {
+      if (baseNames.has(dir) && !stale(dir)) continue
+      handle.close()
+      baseParents.delete(dir)
+    }
+    for (const dir of baseNames.keys()) {
+      if (baseParents.has(dir)) continue
+      try {
+        baseParents.set(
+          dir,
+          arm(dir, false, (filename) => {
+            if (!baseNames.get(dir)?.has(filename)) return
+            reread = true
+            const abs = path.join(dir, filename)
+            trigger(path.relative(workspaceRoot, abs), abs)
+          }),
+        )
+        armedAs.set(dir, inodeOf(dir) ?? '')
+      } catch (err) {
+        sayCannot(`cannot watch ${dir}`, err)
+      }
+    }
+  }
   const armBases = (): void => {
+    armBaseParents()
     const want = new Set(memberBases)
     for (const [base, handle] of baseArms) {
-      if (want.has(base)) continue
+      if (want.has(base) && !stale(base)) continue
       handle.close()
       baseArms.delete(base)
     }
     for (const base of want) {
       if (baseArms.has(base)) continue
+      // Gone for now: its parent's arm hears it come back.
+      if (inodeOf(base) === undefined) continue
       let members = memberEntries(base)
       try {
         baseArms.set(
@@ -683,6 +746,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<number> {
             trigger(`${path.relative(workspaceRoot, base)}/${filename}`, path.join(base, filename))
           }),
         )
+        armedAs.set(base, inodeOf(base) ?? '')
       } catch (err) {
         sayCannot(`cannot watch ${base}`, err)
       }

package/src/exec/sandbox-runtime.ts

@@ -1148,7 +1148,12 @@ export async function wrapSandboxedCommand(
 
   const baselines = canonicalBaselines(args)
   const customConfig = buildCustomConfig(args, baselines)
-  const scratch = pendingWriteGrants(args.config, customConfig!.filesystem!, baselines.denyRead)
+  const scratch = pendingWriteGrants(
+    args.config,
+    customConfig!.filesystem!,
+    baselines.denyRead,
+    baselines.cwd,
+  )
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
   if (process.platform === 'linux' && !cwdMounted(baselines.cwd, customConfig!.filesystem!)) {
     customConfig!.filesystem!.denyRead!.push(baselines.cwd)
@@ -2400,7 +2405,7 @@ function scanOrNothing(pattern: string, base: string): Iterable<string> {
  * write may still land under, in the sandbox's scratch, returned; the ones
  * a read-only mount or the host's root holds, reported once each
  * (`writeGrantMatchedNothing`). `anchors` are the deny anchors the scratch
- * is made of.
+ * is made of; `within`, the task's directory, which the report spells from.
  */
 export function pendingWriteGrants(
   config: Pick<ResolvedSandboxConfig, 'pendingWrites'>,
@@ -2409,9 +2414,10 @@ export function pendingWriteGrants(
     readonly allowWrite?: readonly string[] | undefined
   },
   anchors: readonly string[],
+  within: string,
 ): string[] {
   const { scratch, mountless } = scratchWrites(config.pendingWrites ?? [], fs, anchors)
-  for (const grant of mountless) writeGrantMatchedNothing(grant)
+  for (const grant of mountless) writeGrantMatchedNothing(grant, within)
   return scratch
 }
 
@@ -2427,18 +2433,29 @@ const warnedEmptyWriteGrant = new Set<string>()
  * the relative pattern keeps its wildcard component), and printing it
  * would tell the user to grant the PARENT of the directory they meant.
  */
-function writeGrantMatchedNothing(grant: string): void {
+function writeGrantMatchedNothing(grant: string, within: string): void {
   if (warnedEmptyWriteGrant.has(grant)) return
   warnedEmptyWriteGrant.add(grant)
+  // As a committed config spells them (B-97): the absolute path held only
+  // on the machine that printed it, as in `outsideWritesHint`.
+  const dir = grantSpelled(grantPrefix(grant), within)
   process.stderr.write(
-    `[vx] sandbox: the write grant ${grant} matches nothing yet, and a read grant mounts its ` +
-      `directory read-only, so a file the task creates under it will fail with "Read-only file ` +
-      `system". A bind mount ` +
-      `covers what exists when the task starts — grant the directory instead: ` +
-      `${grantPrefix(grant)}/**\n`,
+    `[vx] sandbox: the write grant ${jsString(grantSpelled(grant, within))} matches nothing ` +
+      `yet, and a read grant mounts its directory read-only, so a file the task creates under ` +
+      `it will fail with "Read-only file system". A bind mount covers what exists when the ` +
+      `task starts — grant the directory instead: ` +
+      `\`allow: { write: [${jsString(dir === '.' ? '.' : `${dir}/`)}] }\`\n`,
   )
 }
 
+/** An absolute grant path as a config spells it: from `within`, from `~`, or whole. */
+function grantSpelled(p: string, within: string): string {
+  const real = toRealPath(within)
+  if (atOrUnder(p, real)) return path.relative(real, p) || '.'
+  const home = toRealPath(os.homedir())
+  return atOrUnder(p, home) ? `~${p.slice(home.length)}` : p
+}
+
 /**
  * Memoized check: is `strace` on PATH on a Linux host, and does it know
  * `--seccomp-bpf` (5.3+)? `'seccomp'` is the fast form; `'plain'` traces

package/src/orchestrator/history.ts

@@ -60,6 +60,12 @@ export type HistoryTable = ReadonlyMap<string, TaskHistory>
 
 export interface HistoryProvider {
   loadFor(taskIds: readonly string[]): Promise<HistoryTable>
+  /**
+   * Only `p50DurationMs` of each task `loadFor` would answer, for a reader
+   * that needs nothing else (`--dry`'s prediction). Optional: without it
+   * the reader takes them from `loadFor`.
+   */
+  p50sFor?(taskIds: readonly string[]): Promise<ReadonlyMap<string, number>>
 }
 
 /** A no-op provider — every lookup returns an empty table. */
@@ -96,15 +102,7 @@ export class LocalHistoryProvider implements HistoryProvider {
   async loadFor(taskIds: readonly string[]): Promise<HistoryTable> {
     const out = new Map<string, TaskHistory>()
     if (taskIds.length === 0) return out
-
-    const floorRow = this.db
-      .query(
-        `SELECT MIN(id) AS id FROM runs WHERE run_id =
-           (SELECT run_id FROM invocations ORDER BY rowid DESC LIMIT 1 OFFSET ?)`,
-      )
-      .get(this.recent - 1) as { id: number | null }
-    // Fewer invocations than the window (or none): the whole table is the window.
-    const floor = floorRow.id ?? 0
+    const floor = this.floor()
 
     // `skipped` rows are excluded: a skip is a task the run never executed,
     // so it belongs in no success/hit RATE and no duration. Percentiles are
@@ -189,6 +187,44 @@ export class LocalHistoryProvider implements HistoryProvider {
     return out
   }
 
+  /**
+   * The same window's p50s alone. `loadFor`'s rates and resource maxima
+   * read every row of the window and join each hit to its entry: 38 ms at
+   * 27,000 rows against 4 for the executed successes' durations alone.
+   */
+  async p50sFor(taskIds: readonly string[]): Promise<ReadonlyMap<string, number>> {
+    const out = new Map<string, number>()
+    if (taskIds.length === 0) return out
+    const rows = this.db
+      .query(
+        `SELECT project, task, GROUP_CONCAT(duration_ms) AS ds FROM runs
+         WHERE id >= ? AND status = 'success' AND (cache_hit IS NULL OR cache_hit = 0)
+         GROUP BY project, task`,
+      )
+      .all(this.floor()) as Array<{ project: string; task: string; ds: string }>
+    const wanted = new Set(taskIds)
+    for (const row of rows) {
+      const key = `${row.project}#${row.task}`
+      if (!wanted.has(key)) continue
+      const durations = row.ds.split(',').map(Number)
+      durations.sort((a, b) => a - b)
+      out.set(key, pickPercentile(durations, 0.5))
+    }
+    return out
+  }
+
+  /** The first `runs` id of the newest `recent` invocations (see `loadFor`). */
+  private floor(): number {
+    const row = this.db
+      .query(
+        `SELECT MIN(id) AS id FROM runs WHERE run_id =
+           (SELECT run_id FROM invocations ORDER BY rowid DESC LIMIT 1 OFFSET ?)`,
+      )
+      .get(this.recent - 1) as { id: number | null }
+    // Fewer invocations than the window (or none): the whole table is the window.
+    return row.id ?? 0
+  }
+
   /** Mixed-outcome key count per `project#task`, over the slice, for `pairs` only. */
   private mixedOutcomeKeys(
     floor: number,

package/src/orchestrator/plan.ts

@@ -189,9 +189,16 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
   if (args.history !== undefined) {
     try {
       const realIds = tasks.filter((t) => t.cacheStatus !== 'group').map((t) => t.node.id)
-      const table = await args.history.loadFor(realIds)
+      const p50s =
+        args.history.p50sFor !== undefined
+          ? await args.history.p50sFor(realIds)
+          : new Map(
+              [...(await args.history.loadFor(realIds))].flatMap(([id, h]) =>
+                h.p50DurationMs === undefined ? [] : [[id, h.p50DurationMs] as const],
+              ),
+            )
       for (const t of tasks) {
-        const p50 = table.get(t.node.id)?.p50DurationMs
+        const p50 = p50s.get(t.node.id)
         if (p50 !== undefined) t.p50Ms = p50
       }
       return { tasks, predicted: predictPlan(tasks), ...downgradeField(args) }

package/src/orchestrator/sandbox-request.ts

@@ -553,7 +553,8 @@ export function placeholderSweeper(placeholders: readonly Placeholder[]): () =>
  * The line a failed task gets for a placeholder it never wrote. Not a
  * diagnosis — the task may have died before its first write — but the
  * one clue to the trap: a grant that meant a directory is bound as a
- * file, and the task's own `mkdir` says only "File exists". Added when
+ * file, and the task's own `mkdir` says only "File exists" (or "Not a
+ * directory" for a path inside it, B-96). Added when
  * the task already failed and the sandbox reported nothing else, so it
  * never reddens a pass and never buries a real denial.
  */
@@ -562,7 +563,7 @@ export function untouchedPlaceholderLine(projectDir: string, placeholder: string
   return (
     `vx: the sandbox write grant \`${rel}\` named nothing on disk, so vx bound it as an empty ` +
     `file, which the task never wrote (removed again). If the task creates a directory there ` +
-    `("File exists" from its own mkdir), spell the grant \`${rel}/\` — a literal without the ` +
+    `("File exists" or "Not a directory" from its own mkdir), spell the grant \`${rel}/\` — a literal without the ` +
     `slash is a file.`
   )
 }

package/src/workspace/workspace.ts

@@ -86,6 +86,9 @@ export async function findWorkspaceRoot(
   let dir = path.resolve(start)
   const below: string[] = []
   let nearest: string | null = null
+  // The nearest manifest with workspace globs of its own, once passed: an
+  // outer root claims the tree only by listing this directory itself.
+  let inner: string | null = null
   while (true) {
     let globs: string[] | null
     try {
@@ -99,7 +102,7 @@ export async function findWorkspaceRoot(
     }
     if (globs !== null) {
       nearest ??= dir
-      if (claimsMember(dir, below, globs)) return dir
+      if (claimsMember(dir, inner === null ? below : [inner], globs)) return dir
       // pnpm takes the nearest `pnpm-workspace.yaml` as the root, listed or
       // not. Walking past it, `apps/inner` resolved to the outer workspace
       // while `apps/inner/pkgs/x` resolved to the inner one: two roots and
@@ -113,6 +116,11 @@ export async function findWorkspaceRoot(
     // package below it, and `packages/tools/standalone` ran as a stranger
     // in a workspace that does not list it (item 989).
     if (globs !== null) below.push(dir)
+    // `apps/tool/workspace` with its own `workspaces`, under a root listing
+    // `apps/*`, resolved to the outer root through `apps/tool`, and its
+    // members ran in a workspace that does not list them (D-137). npm makes
+    // an outer root own a nested one only when it lists that directory.
+    if (inner === null && globs !== null && globs.length > 0) inner = dir
     dir = parent
   }
   if (nearest !== null) return nearest