@vzn/vx 0.0.584 → 0.0.585

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.584",
+  "version": "0.0.585",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.584",
-    "@vzn/vx-linux-arm64": "0.0.584",
-    "@vzn/vx-darwin-x64": "0.0.584",
-    "@vzn/vx-darwin-arm64": "0.0.584"
+    "@vzn/vx-linux-x64": "0.0.585",
+    "@vzn/vx-linux-arm64": "0.0.585",
+    "@vzn/vx-darwin-x64": "0.0.585",
+    "@vzn/vx-darwin-arm64": "0.0.585"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/orchestrator/sandbox-request.ts

@@ -240,12 +240,18 @@ export async function sandboxRequestFor(
       ? [cacheDir]
       : []),
   ].map(toRealPath)
-  const config = wallOff(
-    resolveSandboxConfig(sandbox, node.projectDir, walls),
-    workspaceRoot,
-    walls,
-  )
+  const resolved = resolveSandboxConfig(sandbox, node.projectDir, walls)
+  // Made before the walls judge the binds: a directory grant naming nothing
+  // yet (`dist/`, `dist/**`) was judged as a file, its bind its parent, and
+  // a root project's was refused for `.git`.
   const placeholders = await prepareOutputsForBind(node.projectDir, sandbox.allow?.write ?? [])
+  let config: ResolvedSandboxConfig
+  try {
+    config = wallOff(resolved, workspaceRoot, walls)
+  } catch (err) {
+    await sweepPlaceholders(placeholders)
+    throw err
+  }
   const request: NonNullable<ExecuteRequest['sandbox']> = {
     // Only what the task declared, plus node_modules. Write paths are
     // readable too: a task that writes `dist/x` expects to read it back

package/src/workspace/migration.ts

@@ -50,9 +50,13 @@ export const PERSISTENT_TASK_NAMES: ReadonlySet<string> = new Set([
  * forwarded `--` args are appended to, and only the body takes them, as
  * npm appends them to the script and never to its hooks. A plain ` && `
  * join handed them to the post hook, and `test -f x && echo A; echo B` ran
- * `echo B` after a failed pre hook and went green (item 905). Each part
- * ends on its own line, so a trailing `# comment` cannot swallow the
- * paren. A script with no hooks is its body, verbatim.
+ * `echo B` after a failed pre hook and went green (item 905). npm appends
+ * them as TEXT: no part sees them as `$1`…, so the function quotes them
+ * into `vx_a`, clears its positional parameters, and evals the body with
+ * `vx_a` after it; `"$@"` on the body made a script's `$1` the first
+ * forwarded arg and its `$*` print them twice. Each part ends on its own
+ * line, so a trailing `# comment` cannot swallow the paren. A script with
+ * no hooks is its body, verbatim.
  */
 export function foldScriptHooks(
   pre: string | undefined,
@@ -60,14 +64,22 @@ export function foldScriptHooks(
   post: string | undefined,
 ): string {
   if (pre === undefined && post === undefined) return body
+  const quoted = `'${body.replaceAll("'", `'\\''`)}'`
   const parts = [
     ...(pre === undefined ? [] : [`(${pre}\n)`]),
-    `(${body} "$@"\n)`,
+    `(eval ${quoted}"$vx_a"\n)`,
     ...(post === undefined ? [] : [`(${post}\n)`]),
   ]
-  return `vx_script() {\n${parts.join(' && ')}\n}\nvx_script`
+  return `vx_script() {\n${QUOTE_ARGS}\nset --\n${parts.join(' && ')}\n}\nvx_script`
 }
 
+/** Each argument single-quoted into `vx_a`, in sh alone (no spawn per arg). */
+const QUOTE_ARGS =
+  `vx_q="'" vx_a=\n` +
+  `for vx_s in "$@"; do vx_r=; while :; do case $vx_s in *"$vx_q"*) ` +
+  `vx_r="$vx_r\${vx_s%%"$vx_q"*}'\\''"; vx_s=\${vx_s#*"$vx_q"};; *) break;; esac; done; ` +
+  `vx_a="$vx_a '$vx_r$vx_s'"; done`
+
 /**
  * Where a framework's build writes by default, for the cache TODO: the
  * hint said `dist/**` to every build, `next build` included, which writes