@vzn/vx 0.0.586 → 0.0.588

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.586",
+  "version": "0.0.588",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.586",
-    "@vzn/vx-linux-arm64": "0.0.586",
-    "@vzn/vx-darwin-x64": "0.0.586",
-    "@vzn/vx-darwin-arm64": "0.0.586"
+    "@vzn/vx-linux-x64": "0.0.588",
+    "@vzn/vx-linux-arm64": "0.0.588",
+    "@vzn/vx-darwin-x64": "0.0.588",
+    "@vzn/vx-darwin-arm64": "0.0.588"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/run.ts

@@ -7,11 +7,9 @@ import { defaultAffectedBase, findWorkspaceRoot } from '../workspace/index.js'
 import {
   planRun,
   formatRunReportMarkdown,
-  outcomeLabel,
   projectOutcome,
   run as runOrchestrator,
   shellQuote,
-  type OutcomeView,
   type RunOptions,
   type RunResult,
 } from '../orchestrator/index.js'
@@ -567,6 +565,7 @@ export async function resolveRunOptions(
     flow: detectFlow(parsed),
     ...(parsed.frozen ? { frozen: true } : {}),
     ...(parsed.outputLogs !== undefined ? { outputLogs: parsed.outputLogs } : {}),
+    ...(parsed.verbosity > 0 ? { summaryTable: true } : {}),
     ...(parsed.download !== undefined ? { download: parsed.download } : {}),
     ...(parsed.continueMode !== undefined ? { continueMode: parsed.continueMode } : {}),
     forwardArgs: parsed.forwardArgs,
@@ -707,7 +706,6 @@ export async function runCmd(args: readonly string[]): Promise<number> {
     return 1
   }
   const result: RunResult = { ok: summary.ok, outcomes: summary.outcomes.map(projectOutcome) }
-  if (parsed.verbosity > 0) printSummary(result)
   // Report generation is post-run, gated on the flags — zero cost when
   // both are absent. Rendered once, however many sinks asked for it.
   if (parsed.report === 'markdown' || parsed.reportFile !== undefined) {
@@ -742,35 +740,3 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   }
   return result.ok ? 0 : 1
 }
-
-function printSummary(summary: RunResult): void {
-  const rows = summary.outcomes.map((o) => formatRow(o))
-  if (rows.length === 0) return
-  const widths = {
-    task: Math.max(4, ...rows.map((r) => r.task.length)),
-    status: Math.max(6, ...rows.map((r) => r.status.length)),
-    duration: Math.max(8, ...rows.map((r) => r.duration.length)),
-  }
-  const header =
-    'TASK'.padEnd(widths.task) +
-    '  ' +
-    'STATUS'.padEnd(widths.status) +
-    '  ' +
-    'DURATION'.padStart(widths.duration)
-  process.stdout.write(`\n${header}\n`)
-  process.stdout.write('-'.repeat(header.length) + '\n')
-  for (const r of rows) {
-    process.stdout.write(
-      r.task.padEnd(widths.task) +
-        '  ' +
-        r.status.padEnd(widths.status) +
-        '  ' +
-        r.duration.padStart(widths.duration) +
-        '\n',
-    )
-  }
-}
-
-function formatRow(o: OutcomeView): { task: string; status: string; duration: string } {
-  return { task: o.taskId, status: outcomeLabel(o), duration: `${o.durationMs}ms` }
-}

package/src/exec/sandbox-violations.ts

@@ -7,7 +7,7 @@
 import { statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
-import { bindableReads } from './sandbox-binds.js'
+import { bindableReads, bindableWrites } from './sandbox-binds.js'
 import type {
   ResolvedSandboxConfig,
   SandboxedRunArgs,
@@ -321,17 +321,22 @@ export async function parseStraceViolations(
   const text = await Bun.file(logPath).text()
   if (text.length === 0) return []
 
-  // Treat every baseAllow + sandbox.allowRead path as "this was
-  // explicitly permitted; any -ENOENT here is the user's own missing
-  // file, not a sandbox-induced denial". Same for absolute denyRead
-  // checks below. Canonical on BOTH sides — the policy is expressed in
-  // real paths (see `canonicalBaselines`), so comparing a link-path here
-  // would report an explicitly-allowed read as a violation.
+  // Treat every baseAllow + sandbox.allowRead + allowWrite path as "this
+  // was explicitly permitted; any -ENOENT here is the user's own missing
+  // file, not a sandbox-induced denial". A write grant counts: GNU cp
+  // opens its destination before creating it, and tsc probes its
+  // buildinfo. Same for absolute denyRead checks below. Canonical on BOTH
+  // sides — the policy is expressed in real paths (see
+  // `canonicalBaselines`), so comparing a link-path here would report an
+  // explicitly-allowed read as a violation.
   const allowAbs = new Set<string>(
-    // A grant SRT could not mount (`bindableReads`) permits nothing.
-    [...baselines.allowRead, ...bindableReads(args.config.allowRead)].map((p) =>
-      toRealPath(absolutize(p)),
-    ),
+    // A grant SRT could not mount (`bindableReads`, `bindableWrites`)
+    // permits nothing.
+    [
+      ...baselines.allowRead,
+      ...bindableReads(args.config.allowRead),
+      ...args.config.allowWrite.filter((w) => bindableWrites([w]).length > 0),
+    ].map((p) => toRealPath(absolutize(p))),
   )
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
   // A read under a widened write grant's directory is never refused, so it

package/src/orchestrator/index.ts

@@ -38,7 +38,6 @@ export {
   projectNode,
   projectOutcome,
   outcomeWord,
-  outcomeLabel,
 } from './events.js'
 export type {
   EventBus,

package/src/orchestrator/options.ts

@@ -207,6 +207,11 @@ export interface RunOptions {
    * is replaced only when the next cycle starts.
    */
   holdPersistent?: boolean
+  /**
+   * Print the per-task table (`--verbosity 1`) just above the footer: the
+   * footer is the run's last word, so the caller cannot print it after.
+   */
+  summaryTable?: boolean
   /**
    * vx's stdin is a terminal: each `exec.interactive` task is handed it,
    * alone (placement.ts `terminalHolders`). The CLI sets it from

package/src/orchestrator/run.ts

@@ -92,7 +92,7 @@ import { assembleRunRecords } from './run-records.js'
 import { hasEnded, selectKeepAlive, shutdownPersistent } from './persistent.js'
 import { writeRunProfile, writeRunSummary } from './run-artifacts.js'
 import { createSaveLane } from './save-lane.js'
-import { formatRunSummary } from './summary.js'
+import { formatOutcomeTable, formatRunSummary } from './summary.js'
 import { detectFlaky, type FlakyCandidate, type FlakyFinding } from './failure-mode.js'
 import { createMissExplainer } from './miss-reason.js'
 import type { RunOptions, RunSummary } from './options.js'
@@ -1328,6 +1328,7 @@ async function runOnBus(
     // sandbox reset included, so any warning they raise lands above it. A
     // task's own facts (flaky, blocked) ride its row. Only a kept server's
     // own output follows.
+    if (options.summaryTable === true) for (const line of formatOutcomeTable(list)) log.status(line)
     for (const line of formatRunSummary(list, totalMs, colors, runContext)) log.status(line)
 
     // Edge case the summary already reported: the user requested a

package/src/orchestrator/summary.ts

@@ -6,6 +6,7 @@
 import type { TaskOutcome } from '../graph/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { tallyOutcomes } from './tally.js'
+import { outcomeLabel, projectOutcome } from './events.js'
 import { isGroupTask } from '../graph/index.js'
 import { formatElapsed } from '../util/index.js'
 
@@ -314,6 +315,34 @@ function resultLine(
   return parts.join(` ${paint('', '\u00b7', colors, { dim: true })} `)
 }
 
+/**
+ * The `--verbosity 1` per-task table (`RunOptions.summaryTable`). Groups are
+ * left out as the footer and `--report` leave them: a group ran no command.
+ */
+export function formatOutcomeTable(outcomes: readonly TaskOutcome[]): string[] {
+  const rows = outcomes
+    .filter((o) => !isGroupTask(o.node))
+    .map((o) => {
+      const v = projectOutcome(o)
+      return { task: v.taskId, status: outcomeLabel(v), duration: `${v.durationMs}ms` }
+    })
+  if (rows.length === 0) return []
+  const widths = {
+    task: Math.max(4, ...rows.map((r) => r.task.length)),
+    status: Math.max(6, ...rows.map((r) => r.status.length)),
+    duration: Math.max(8, ...rows.map((r) => r.duration.length)),
+  }
+  const line = (task: string, status: string, duration: string) =>
+    `${task.padEnd(widths.task)}  ${status.padEnd(widths.status)}  ${duration.padStart(widths.duration)}`
+  const header = line('TASK', 'STATUS', 'DURATION')
+  return [
+    '',
+    header,
+    '-'.repeat(header.length),
+    ...rows.map((r) => line(r.task, r.status, r.duration)),
+  ]
+}
+
 // Local byte formatter — the orchestrator can't import cli/format.ts
 // (module boundary), and the footer only needs one compact form.
 export function formatRunSummary(