@vzn/vx 0.0.590 → 0.0.594

package/src/exec/runner.ts

@@ -483,7 +483,7 @@ export interface PersistentSpawn {
    * Rejects with the spawn error if the child fails to start.
    */
   ready: Promise<void>
-  /** ms elapsed from spawn to ready (or to current time if not yet ready). */
+  /** ms from spawn to ready, to the readiness timeout giving up, or to now. */
   readyMs: () => number
 }
 
@@ -522,6 +522,9 @@ export interface PersistentOptions extends Omit<RunOptions, 'forwardArgs' | 'cap
 export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const start = Date.now()
   let readyAt: number | undefined
+  // When the readiness wait gave up: the wait's length, not the kill grace
+  // a TERM-trapping server runs out after it.
+  let gaveUpAt: number | undefined
 
   // Pattern compiled once; thrown errors surface synchronously so the
   // caller can wrap with a user-facing message.
@@ -679,6 +682,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   if (readyRe && opts.timeoutMs !== undefined) {
     readyTimer = setTimeout(() => {
       if (readyAt === undefined) {
+        gaveUpAt = Date.now()
         rejectReady(
           new PersistentReadyError(
             `persistent task not ready within ${opts.timeoutMs}ms — ` +
@@ -730,7 +734,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   return {
     child,
     ready,
-    readyMs: () => (readyAt ?? Date.now()) - start,
+    readyMs: () => (readyAt ?? gaveUpAt ?? Date.now()) - start,
   }
 }
 
@@ -807,7 +811,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
     stderr,
     ...(proc.signalCode ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
-    ...resourceUsageToCpuRss(proc.resourceUsage(), ownRssHighWater()),
+    ...resourceUsageToCpuRss(proc.resourceUsage(), rssFloorFor),
   }
 }
 
@@ -832,7 +836,7 @@ export function ownRssHighWater(): number {
   if (process.platform === 'linux') {
     try {
       const m = /VmHWM:\s+(\d+) kB/.exec(readFileSync('/proc/self/status', 'utf8'))
-      if (m !== null) return Number(m[1]) * 1024
+      if (m !== null) return (highWaterSeen = Number(m[1]) * 1024)
     } catch {
       // /proc unreadable: fall through to the current RSS.
     }
@@ -840,6 +844,22 @@ export function ownRssHighWater(): number {
   return process.memoryUsage.rss()
 }
 
+/** The last `VmHWM` read, in bytes; 0 until one is. */
+let highWaterSeen = 0
+
+/**
+ * The floor for a child's `peak`, read only when the last `VmHWM` cannot
+ * decide it: the mark never falls, so a peak within the slack of an older
+ * reading is within the slack of the current one, and goes unreported
+ * either way. A light task reads vx's own mark as its peak, so after the
+ * first such task the rest skip the read, which cost ~35 µs of the
+ * scheduler's thread per task (500 cold tasks, 2026-10-07). A current-RSS
+ * fallback is not monotonic and is never reused.
+ */
+function rssFloorFor(peak: number): number {
+  return peak <= highWaterSeen + RSS_FLOOR_SLACK_BYTES ? highWaterSeen : ownRssHighWater()
+}
+
 /**
  * What a task's captured output keeps: the first `CAPTURE_HEAD_CHARS` and
  * the last `CAPTURE_TAIL_CHARS` characters, the dropped middle counted and
@@ -1014,8 +1034,8 @@ export function peakRssBytes(maxRSS: number): number {
  */
 export function resourceUsageToCpuRss(
   usage: ReturnType<ReturnType<typeof Bun.spawn>['resourceUsage']>,
-  /** The parent's own high-water mark (`ownRssHighWater`); a peak at or under it is inherited, not the child's, and is not reported. */
-  floorBytes = 0,
+  /** The parent's own high-water mark (`ownRssHighWater`), or a function of the peak that answers it; a peak at or under it is inherited, not the child's, and is not reported. */
+  floorBytes: number | ((peak: number) => number) = 0,
 ): { cpuMs?: number; peakRssBytes?: number } {
   if (!usage) return {}
   // cpuTime.total is microseconds as a bigint → ms.
@@ -1028,5 +1048,6 @@ export function resourceUsageToCpuRss(
   // parent's (see `ownRssHighWater`, `RSS_FLOOR_SLACK_BYTES`): the child's
   // peak is unknown, bounded by it.
   const peak = peakRssBytes(usage.maxRSS)
-  return peak > floorBytes + RSS_FLOOR_SLACK_BYTES ? { cpuMs, peakRssBytes: peak } : { cpuMs }
+  const floor = typeof floorBytes === 'number' ? floorBytes : floorBytes(peak)
+  return peak > floor + RSS_FLOOR_SLACK_BYTES ? { cpuMs, peakRssBytes: peak } : { cpuMs }
 }

package/src/exec/sandbox-deny-scan.ts

@@ -16,7 +16,7 @@
 import { lstatSync, readdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import { UserError } from '../util/index.js'
+import { relPosix, UserError } from '../util/index.js'
 import { atOrUnder, MOUNT_WILDCARDS } from './sandbox-paths.js'
 
 /** SRT's `rg --max-depth` for the scan (`DEFAULT_MANDATORY_DENY_SEARCH_DEPTH`). */
@@ -126,7 +126,7 @@ export function scopedMandatoryDenies(
     }
   }
   for (const root of roots) {
-    const rel = path.relative(cwd, root).split(path.sep).join('/')
+    const rel = relPosix(cwd, root)
     const depth = rel === '' ? 0 : rel.split('/').length
     if (depth > SEARCH_DEPTH) continue
     let dir: boolean

package/src/exec/sandbox-runtime.ts

@@ -108,9 +108,13 @@ import {
 
 type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
 let srtPromise: Promise<SrtModule> | undefined
+/** Set once loaded, for `releaseBridges`, which a sync exit handler calls. */
+let srtLoaded: SrtModule | undefined
 
 async function loadSrt(): Promise<SrtModule> {
-  if (!srtPromise) srtPromise = import('@anthropic-ai/sandbox-runtime')
+  if (!srtPromise) {
+    srtPromise = import('@anthropic-ai/sandbox-runtime').then((m) => (srtLoaded = m))
+  }
   return srtPromise
 }
 
@@ -1151,6 +1155,23 @@ export async function wrapSandboxedCommand(
   const tmp = taskTmpdir(tag)
   mkdirSync(tmp, { mode: 0o700 })
   trackTaskTmpdir(tmp)
+  try {
+    return await wrapIn(args, SandboxManager, userCommand, tag, tmp)
+  } catch (err) {
+    // Nothing spawned, so nothing releases it on exit: a `vx watch` kept
+    // one task directory per refused wrap (a held port) until it quit.
+    releaseBridges(tag)
+    throw err
+  }
+}
+
+async function wrapIn(
+  args: Parameters<typeof wrapSandboxedCommand>[0],
+  SandboxManager: SrtModule['SandboxManager'],
+  userCommand: string,
+  tag: string,
+  tmp: string,
+): ReturnType<typeof wrapSandboxedCommand> {
   // After the tag: SRT keys violations by the command's first 100 chars.
   const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${javaToolOptionsFix(
     process.env['JAVA_TOOL_OPTIONS'],
@@ -1188,6 +1209,16 @@ export async function wrapSandboxedCommand(
   // user command, so it goes INTO the sandboxed command; the host side is
   // spawned here and released when the task's process ends.
   const ports = process.platform === 'linux' ? bridgedPorts(args.config) : []
+  // Before the wrap, which holds the runtime's stub cleanup until `afterCommand`.
+  const held = portsHeld(ports)
+  if (held.length > 0) {
+    throw new UserError(
+      `sandbox: localBinding port${held.length === 1 ? '' : 's'} ${held.join(', ')} ` +
+        `${held.length === 1 ? 'is' : 'are'} already in use on this machine, so the task's own ` +
+        `cannot be exposed there and a client would reach the other listener; stop what ` +
+        `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
+    )
+  }
   const grouped =
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
@@ -1240,15 +1271,6 @@ export async function wrapSandboxedCommand(
   }
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
-  const held = portsHeld(ports)
-  if (held.length > 0) {
-    throw new UserError(
-      `sandbox: localBinding port${held.length === 1 ? '' : 's'} ${held.join(', ')} ` +
-        `${held.length === 1 ? 'is' : 'are'} already in use on this machine, so the task's own ` +
-        `cannot be exposed there and a client would reach the other listener; stop what ` +
-        `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
-    )
-  }
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) {
     spawnHostBridges(ports, tag)
@@ -1409,9 +1431,11 @@ function literalReadPaths(
  * it the pattern, and SRT compiles any spelling holding `[` as a regex in
  * which a backslash is a literal one, so `pages/\[id\].tsx` matched no
  * file and the route could not be granted. `[[]` is a class of one `[`; a
- * lone `]` is plain text (B-65).
+ * lone `]` is plain text (B-65). A deny path is a real directory, never a
+ * pattern: a nested project's wall under `[legacy]/` compiled as a class,
+ * matched nothing, and the root task read it.
  */
-function seatbeltBrackets(
+export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
 ): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
   const fs = config?.filesystem
@@ -1422,6 +1446,7 @@ function seatbeltBrackets(
     ...config,
     filesystem: {
       ...fs,
+      denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
       allowWrite: literal(fs.allowWrite),
       ...(fs.allowRead !== undefined ? { allowRead: literal(fs.allowRead) } : {}),
     },
@@ -1620,8 +1645,17 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
 export function releaseBridges(tag: string): void {
   const tmp = taskTmpdir(tag)
   if (liveTaskTmpdirs.delete(tmp)) rmSync(tmp, { recursive: true, force: true })
-  if (liveServers.delete(tag) && liveServers.size === 0 && resetDeferred) {
-    void resetSandbox().catch(() => {})
+  if (liveServers.delete(tag)) {
+    // A server's wrap counts as a live sandbox in SRT until this, and SRT
+    // removes bwrap's host stubs (`.bashrc`, `.vscode`, … under a write
+    // grant) only at a count of 0: one stopped server kept every later
+    // task's stubs in the workspace until the reset.
+    try {
+      srtLoaded!.SandboxManager.cleanupAfterCommand()
+    } catch {
+      // best-effort, as a one-shot task's
+    }
+    if (liveServers.size === 0 && resetDeferred) void resetSandbox().catch(() => {})
   }
   const bridges = hostBridges.get(tag)
   if (bridges === undefined) return
@@ -1775,6 +1809,7 @@ async function runSandboxedOnce(
   if (args.signal?.aborted === true) {
     releaseBridges(tag)
     takeRecords()
+    afterCommand(SandboxManager)
     const signal = stopSignal(args.signal.reason)
     return {
       exitCode: signalExitCode(signal),
@@ -1819,10 +1854,15 @@ async function runSandboxedOnce(
     )
     if (forwardsSignals) signalThrough(proc, proc.stdio[3] as number)
   } catch (err) {
+    if (straceLog) {
+      rmSync(straceLog, { force: true })
+      liveTempFiles.delete(straceLog)
+    }
     const stderr = spawnFailureText(err, args.cwd, 'sandboxed task')
     args.onStderr?.(stderr)
     releaseBridges(tag)
     takeRecords()
+    afterCommand(SandboxManager)
     return {
       exitCode: 127,
       durationMs: Date.now() - start,
@@ -2012,11 +2052,7 @@ async function runSandboxedOnce(
     if (hidden.length > 0) violations.push(hiddenReadsHint(hidden, args.reportWithin))
   }
 
-  try {
-    SandboxManager.cleanupAfterCommand()
-  } catch {
-    // ignore; bwrap mount-point cleanup is best-effort
-  }
+  afterCommand(SandboxManager)
 
   return {
     exitCode,
@@ -2042,6 +2078,20 @@ async function runSandboxedOnce(
   }
 }
 
+/**
+ * The runtime counts every wrap as a live sandbox until this, and removes
+ * the empty files bwrap made on the host as mount points (`.bashrc`,
+ * `.vscode`, … under a write grant) only at a count of 0: a wrap with no
+ * call here kept every later task's stubs on the host until the reset.
+ */
+function afterCommand(SandboxManager: SrtModule['SandboxManager']): void {
+  try {
+    SandboxManager.cleanupAfterCommand()
+  } catch {
+    // ignore; bwrap mount-point cleanup is best-effort
+  }
+}
+
 /** The hint for writes refused outside the project, a few paths named. */
 function outsideWritesHint(
   paths: readonly string[],

package/src/exec/sandbox-violations.ts

@@ -44,8 +44,8 @@ const SYSCALLS = 'openat|access|statx|newfstatat'
 const QUOTED = '"((?:[^"\\\\]|\\\\.)+)"'
 // The directory descriptor a call names, `-y`'s path included: taken up to
 // the `, "` that opens the path argument, since a directory's name may hold
-// a quote (`4</ws/q"d>`).
-const DIRFD = '(?:AT_FDCWD|\\d+)(?:<.*?>)?, '
+// a quote (`4</ws/q"d>`). Captured: a relative path is in that directory.
+const DIRFD = '(?:AT_FDCWD|\\d+)(?:<(.*?)>)?, '
 const STRACE_DONE_RE = new RegExp(
   `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
@@ -163,7 +163,7 @@ type Op = { chdir: string } | { lost: true } | { call: number }
 export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCall[] {
   const pending = new Map<
     string,
-    { syscall: string; rawPath: string; read?: true; dirfd?: string }
+    { syscall: string; rawPath: string; read?: true; dirfd?: string; dir?: string }
   >()
   const out: DeniedCall[] = []
   const ops = new Map<string, Op[]>()
@@ -210,19 +210,22 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
       continue
     }
     const done = STRACE_DONE_RE.exec(line)
-    if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
-      denied(done[1]!, { syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
+    if (done?.[2] !== undefined && done[4] !== undefined && done[5] !== undefined) {
+      const rawPath = cStringPath(done[4])
+      denied(done[1]!, { syscall: done[2], rawPath, errno: done[5], ...within(done[3], rawPath) })
       continue
     }
     const unfinished = STRACE_UNFINISHED_RE.exec(line)
     if (
       unfinished?.[1] !== undefined &&
       unfinished[2] !== undefined &&
-      unfinished[3] !== undefined
+      unfinished[4] !== undefined
     ) {
+      const rawPath = cStringPath(unfinished[4])
       pending.set(unfinished[1], {
         syscall: unfinished[2],
-        rawPath: cStringPath(unfinished[3]),
+        rawPath,
+        ...within(unfinished[3], rawPath),
         ...(reads && OPEN_READ_UNFINISHED_RE.test(line) ? { read: true as const } : {}),
         ...(reads ? { dirfd: OPEN_READ_UNFINISHED_RE.exec(line)?.[2] ?? 'AT_FDCWD' } : {}),
       })
@@ -237,7 +240,12 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
       // resume just retires the pending entry.
       const fd = held?.read === true ? RESUMED_FD_RE.exec(line) : null
       if (held !== undefined && resumed?.[3] !== undefined) {
-        denied(resumedOk[1], { syscall: held.syscall, rawPath: held.rawPath, errno: resumed[3] })
+        denied(resumedOk[1], {
+          syscall: held.syscall,
+          rawPath: held.rawPath,
+          errno: resumed[3],
+          ...(held.dir !== undefined ? { dir: held.dir } : {}),
+        })
       } else if (held !== undefined && fd !== null) {
         const at = readPath(held.dirfd ?? 'AT_FDCWD', held.rawPath, fd[1])
         if (at !== undefined) {
@@ -250,6 +258,12 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
     // without the cwd tracking.
     follow(line)
   }
+  // `-y` names the directory a relative path was opened in: a denial
+  // through a descriptor (`openat(4</ws/p/sub>, "g")`) was placed in the
+  // cwd, naming a file the task never asked for.
+  function within(dir: string | undefined, rawPath: string): { dir?: string } {
+    return dir !== undefined && !rawPath.startsWith('/') ? { dir: cStringPath(dir) } : {}
+  }
   function follow(line: string): void {
     let m: RegExpExecArray | null
     if ((m = CHDIR_DENIED_RE.exec(line)) !== null) {
@@ -303,7 +317,7 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
   }
   for (const [pid, list] of ops) {
     list.forEach((op, i) => {
-      if (!('call' in op)) return
+      if (!('call' in op) || out[op.call]!.dir !== undefined) return
       const dir = dirsOf(pid)[i]
       if (dir !== undefined && dir !== cwd) out[op.call]!.dir = dir
     })

package/src/graph/scheduler.ts

@@ -208,7 +208,7 @@ export interface ScheduleOptions {
    *   - 'deps-ok': a failed/skipped/aborted upstream skips its
    *     dependents; independent siblings keep running.
    *   - 'never': the first failure stops dispatch — in-flight tasks
-   *     finish naturally, everything not yet started completes as
+   *     finish their attempt but start no retry, everything not yet started completes as
    *     skipped (restore-tier included: a fail-fast run stops
    *     restoring too).
    *   - 'always': dependents run even when an upstream failed. Their
@@ -227,6 +227,11 @@ export interface ScheduleOptions {
    * 'never' it stops dispatch.
    */
   serverDied?: (id: string) => boolean
+  /**
+   * Called once, when 'never' stops dispatch: a task in flight then
+   * finishes its attempt but starts no retry.
+   */
+  onFailFast?: () => void
   execute: (node: TaskNode, upstream: TaskOutcome[]) => Promise<TaskOutcome>
   onStart?: (node: TaskNode) => void
   onFinish?: (outcome: TaskOutcome) => void
@@ -424,6 +429,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // dequeued task is skipped instead of dispatched (in-flight tasks
   // finish naturally and their dependents drain through the same path).
   let failFastTripped = false
+  const tripFailFast = (): void => {
+    if (failFastTripped) return
+    failFastTripped = true
+    options.onFailFast?.()
+  }
   const outcomes = new Map<string, TaskOutcome>()
 
   // Reverse adjacency + pending dep counts. Built once. A task becomes
@@ -588,7 +598,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
 
   return new Promise<Map<string, TaskOutcome>>((resolve) => {
     const finishOne = (id: string, outcome: TaskOutcome): void => {
-      if (continueMode === 'never' && outcome.status === 'failed') failFastTripped = true
+      if (continueMode === 'never' && outcome.status === 'failed') tripFailFast()
       outcomes.set(id, outcome)
       // A dormant server is asked again: the dispatch settles it once its
       // last dependant is in.
@@ -686,7 +696,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     const willSkip = (id: string): boolean => {
       if (failFastTripped || aborted()) return true
       if (continueMode === 'never' && servers.some(serverDied)) {
-        failFastTripped = true
+        tripFailFast()
         return true
       }
       if (inRestoreTier(id)) return false

package/src/graph/task-graph.ts

@@ -3,6 +3,7 @@ import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
   isLiteralPattern,
+  relPosix,
   splitNegations,
   staticPrefix,
   taskGlob,
@@ -872,7 +873,7 @@ function detectOutputCollisions(
   const entries: Entry[] = wsDeclarers.map((node) => ({ node, globs: wsFilesOf(node) ?? [] }))
   for (const bucket of byProject.values()) {
     for (const node of bucket) {
-      const rel = path.relative(workspaceRoot, node.projectDir).split(path.sep).join('/')
+      const rel = relPosix(workspaceRoot, node.projectDir)
       const globs = (filesOf(node) ?? []).map((g) => (rel === '' ? g : `${rel}/${g}`))
       entries.push({ node, globs, rel })
     }
@@ -1243,7 +1244,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   if (!rootReaders) return
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
-      const rel = path.relative(workspaceRoot, node.projectDir).split(path.sep).join('/')
+      const rel = relPosix(workspaceRoot, node.projectDir)
       const globs = splitNegations(node.config.cache!.outputs.files).positive.map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )

package/src/index.ts

@@ -168,6 +168,9 @@ export type {
   DiscoverContext,
   NamedProject,
   PluginSetupContext,
+  PluginHookName,
+  PluginHookHandlers,
+  RunStartInfo,
 } from './orchestrator/index.js'
 // The per-task execution contract a plugin's `executor` capability returns.
 // (`runCommand` / `runSandboxed`, the local executor's own primitives, left

package/src/orchestrator/affected-tasks.ts

@@ -105,16 +105,40 @@ export function affectedRoots(
     return (changes.paths.get(n.projectName) ?? []).some((rel) => declaresInput(cache, rel, null))
   }
   const reached = new Map<string, boolean>()
-  const reaches = (id: string): boolean => {
-    const known = reached.get(id)
-    if (known !== undefined) return known
-    // The graph is acyclic (the builder refuses a cycle); the mark only
-    // stops a diamond being walked twice.
-    reached.set(id, false)
-    const n = nodes.get(id)
-    const hit = n !== undefined && (seeded(n) || passesChanged(n) || n.deps.some(reaches))
-    reached.set(id, hit)
-    return hit
+  // Post-order on an explicit stack: a closure is as deep as the graph, and
+  // a recursion per edge threw `RangeError` on a chain the builder takes
+  // (item 737's 50,000; ~15,000 sufficed here). A frame holds the next dep
+  // to ask, -1 before the task itself is.
+  const reaches = (root: string): boolean => {
+    const stack: Array<[id: string, next: number]> = [[root, -1]]
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1]!
+      const id = frame[0]
+      if (frame[1] === -1) {
+        if (reached.has(id)) {
+          stack.pop()
+          continue
+        }
+        const n = nodes.get(id)
+        if (n === undefined || seeded(n) || passesChanged(n)) {
+          reached.set(id, n !== undefined)
+          stack.pop()
+          continue
+        }
+        frame[1] = 0
+      }
+      const deps = nodes.get(id)!.deps
+      let i = frame[1]
+      while (i < deps.length && reached.get(deps[i]!) === false) i++
+      frame[1] = i
+      if (i === deps.length || reached.get(deps[i]!) === true) {
+        reached.set(id, i < deps.length)
+        stack.pop()
+        continue
+      }
+      stack.push([deps[i]!, -1])
+    }
+    return reached.get(root)!
   }
   return ids.filter(reaches)
 }

package/src/orchestrator/doctor.ts

@@ -16,6 +16,7 @@ import {
   isUnsupportedBun,
   machineMemoryBytes,
   machineParallelism,
+  relPosix,
 } from '../util/index.js'
 import { VERSION } from '../version.js'
 import { probeSandbox, resetSandbox, untracedReason } from '../exec/index.js'
@@ -395,7 +396,7 @@ async function countLoadableTasks(
           ? bare.slice(where.length + 1).trimStart()
           : raw
         errors.push({
-          path: path.relative(root, where).split(path.sep).join('/'),
+          path: relPosix(root, where),
           message,
         })
       }

package/src/orchestrator/execute-task.ts

@@ -51,7 +51,7 @@ import {
   span,
   UserError,
 } from '../util/index.js'
-import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
+import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS, terminateChildren } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
   mayWriteFingerprint,
@@ -133,6 +133,8 @@ export interface ExecuteArgs {
    * terms (item 962).
    */
   stopSignal?: AbortSignal
+  /** `continueMode: 'never'` stopped dispatch: no further attempt starts. */
+  failFast?: AbortSignal
   /**
    * Registry the orchestrator owns. For each persistent task we
    * spawn, we stash the subprocess handle here so the orchestrator
@@ -464,6 +466,11 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   try {
     await spawn.ready
   } catch (err) {
+    // A shell that exited before ready can leave its group running
+    // (`server & …; exit`): never registered, so no teardown reached it,
+    // and it held its port against the next `vx watch` cycle's server.
+    if (err instanceof PersistentReadyError && err.reason === 'exited')
+      await terminateChildren(() => [spawn.child])
     // A server the run's stop killed while it started is aborted, as any
     // task the stop kills (item 962): it read `failed (never ready:
     // exited, exit 130)` with a recap after every Ctrl-C (C-62). The stop
@@ -512,6 +519,10 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // One the readiness timeout is killing reports the signal's, as an
     // ordinary timeout does (X-24).
     const ready = err instanceof PersistentReadyError ? err : undefined
+    // The timer's SIGKILL is a grace away and the shell may die on the
+    // TERM first: a server that ignores it held its port past run() into
+    // the next `vx watch` cycle. Return once the group is gone.
+    if (ready?.reason === 'timeout') await terminateChildren(() => [spawn.child])
     return {
       node,
       status: 'failed',
@@ -1058,7 +1069,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // no edge to the producer fails naming only the file (A-48).
       if (code !== 0) {
         for (const c of (args.gitFilesCache?.trackedCleansMissing(node.id) ?? []).slice(0, 3)) {
-          const rel = path.relative(args.workspaceRoot, c.path).split(path.sep).join('/')
+          const rel = relPosix(args.workspaceRoot, c.path)
           log.taskStderr(
             node,
             `\n[vx] ${rel} is tracked by git, and ${c.by} removed it as an output before its run; it is still missing. A task that reads it needs dependsOn on ${c.by}.\n`,
@@ -1153,7 +1164,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       }
     }
 
-    if (effectiveExitCode === 0 || attempt >= maxAttempts) break
+    if (effectiveExitCode === 0 || attempt >= maxAttempts || args.failFast?.aborted === true) break
     failedAttempts.push({
       endedAt: Date.now(),
       exitCode: effectiveExitCode,

package/src/orchestrator/hit-restore.ts

@@ -22,6 +22,7 @@ import {
 import type { TaskOutcome } from '../graph/index.js'
 import {
   asTrees,
+  relPosix,
   secretMask,
   span,
   splitNegations,
@@ -165,10 +166,10 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
         const expectedRels = new Set(projExpected.map((e) => e.path))
         const expectedWsRels = new Set(wsExpected.map((e) => e.path))
         const actualRels = actualAbs
-          .map((p) => path.relative(node.projectDir, p).split(path.sep).join('/'))
+          .map((p) => relPosix(node.projectDir, p))
           .filter((rel) => expectedRels.has(rel) || !isAddition(rel))
         const actualWsRels = actualWsAbs
-          .map((p) => path.relative(args.workspaceRoot, p).split(path.sep).join('/'))
+          .map((p) => relPosix(args.workspaceRoot, p))
           .filter((rel) => expectedWsRels.has(rel) || !isAddition(rel))
         const rowsPresent = (
           actual: readonly string[],

package/src/orchestrator/index.ts

@@ -43,6 +43,7 @@ export type {
   EventBus,
   RunEvent,
   RunEventSubscriber,
+  RunStartInfo,
   WireEvent,
   TaskView,
   OutcomeView,

package/src/orchestrator/lockfile-claim.ts

@@ -15,7 +15,7 @@
 
 import path from 'node:path'
 import { rename, stat } from 'node:fs/promises'
-import { xxh3, xxh3hex } from '../util/index.js'
+import { relPosix, xxh3, xxh3hex } from '../util/index.js'
 import type { TaskNode } from '../graph/index.js'
 import type {
   FingerprintChange,
@@ -270,8 +270,7 @@ function digestFor(importers: ReadonlyMap<string, string>, importer: string): st
 
 /** The lockfile's importer path for a project directory: `.` for the root, POSIX otherwise. */
 function importerOf(workspaceRoot: string, projectDir: string): string {
-  const rel = path.relative(workspaceRoot, projectDir)
-  return rel === '' ? '.' : rel.split(path.sep).join('/')
+  return relPosix(workspaceRoot, projectDir) || '.'
 }
 
 async function readMemo(

package/src/orchestrator/logger.ts

@@ -318,7 +318,7 @@ export function defaultLogger(
   // for as long as vx holds it: `vx run dev --all` showed none of its
   // servers' logs while it ran (C-56). So a ready server's output streams
   // from then on, a line at a time under its id; the partial line each
-  // holds waits for its newline, a second runEnd, or `settle`.
+  // holds waits for its newline, a status line, a second runEnd, or `settle`.
   const KEPT_LINE_CAP = 64 * 1024
   const keptLines = new Map<string, { node: TaskNode; rest: string }>()
   const streamKept = (node: TaskNode, chunk: string): void => {
@@ -450,6 +450,9 @@ export function defaultLogger(
       writer.settle()
     },
     status(line) {
+      // A kept server's held partial line is older than this line: held
+      // past it, a server's last words printed below its own exit notice.
+      flushKept()
       writer.write(`${line}\n`)
     },
     runStart(info) {