@vzn/vx 0.0.591 → 0.0.595

package/src/exec/runner.ts

@@ -12,6 +12,7 @@ import {
   isOutOfFds,
   killGraceMs,
   OUT_OF_FDS_HINT,
+  type SecretMask,
 } from '../util/index.js'
 import {
   closeSignalChannel,
@@ -112,30 +113,49 @@ export function shellQuote(arg: string): string {
 }
 
 /**
- * Where a shell comment still open at the end of `command` starts, or -1.
- * A `#` opens one only unquoted and at the start of a word (`a#b`, `$#` and
- * `${#x}` are words), and a newline closes it.
+ * One pass over `command` as sh reads it. `comment`: where a comment still
+ * open at the end starts, or -1 — a `#` opens one only unquoted and at the
+ * start of a word (`a#b`, `$#` and `${#x}` are words), and a newline closes
+ * it. `body`: per line, is it a heredoc's body or terminator (`<<X` /
+ * `<<-'X'` / `<<\X` … `X`). One scan, because each needs the other: a
+ * `<<X` in a comment or quotes opens no heredoc, and a quote in a body
+ * opens nothing (X-110).
  */
-function trailingCommentStart(command: string): number {
+function shellShape(command: string): { comment: number; body: boolean[] } {
+  const lines = command.split('\n')
+  const body = lines.map(() => false)
+  const pending: Array<{ delim: string; tabs: boolean }> = []
   let quote = ''
   let comment = -1
   let atWordStart = true
+  let line = 0
   for (let i = 0; i < command.length; i++) {
     const c = command[i]!
-    if (comment >= 0) {
-      if (c === '\n') {
-        comment = -1
-        atWordStart = true
+    if (c === '\n') {
+      line++
+      comment = -1
+      if (quote !== '') continue
+      atWordStart = true
+      // A heredoc's body starts on the line after its `<<`.
+      while (pending.length > 0 && line < lines.length) {
+        const text = lines[line]!
+        body[line] = true
+        const open = pending[0]!
+        if ((open.tabs ? text.replace(/^\t+/, '') : text) === open.delim) pending.shift()
+        i += text.length + 1
+        line++
       }
       continue
     }
+    if (comment >= 0) continue
     if (quote === "'") {
       if (c === "'") quote = ''
       continue
     }
     if (c === '\\') {
+      if (command[i + 1] === '\n') line++
+      else atWordStart = false
       i++
-      atWordStart = false
       continue
     }
     if (quote === '"') {
@@ -151,25 +171,18 @@ function trailingCommentStart(command: string): number {
       comment = i
       continue
     }
+    if (c === '<' && command[i - 1] !== '<') {
+      const m = /^<<(-?)[ \t]*\\?(['"]?)([A-Za-z_]\w*)\2/.exec(command.slice(i, i + 256))
+      if (m !== null) {
+        pending.push({ delim: m[3]!, tabs: m[1] === '-' })
+        i += m[0].length - 1
+        atWordStart = false
+        continue
+      }
+    }
     atWordStart = /[\s;&|()<>]/.test(c)
   }
-  return comment
-}
-
-/** Per line: is it a heredoc's body or terminator (`<<X` / `<<-'X'` … `X`)? */
-function heredocLines(lines: readonly string[]): boolean[] {
-  const pending: Array<{ delim: string; tabs: boolean }> = []
-  return lines.map((line) => {
-    const open = pending[0]
-    if (open !== undefined) {
-      if ((open.tabs ? line.replace(/^\t+/, '') : line) === open.delim) pending.shift()
-      return true
-    }
-    for (const m of line.matchAll(/(?<!<)<<(?!<)(-?)\s*(['"]?)([A-Za-z_]\w*)\2/g)) {
-      pending.push({ delim: m[3]!, tabs: m[1] === '-' })
-    }
-    return false
-  })
+  return { comment, body }
 }
 
 /**
@@ -183,27 +196,34 @@ export function withForwardArgs(command: string, args: readonly string[] | undef
   // `X FWD` closed nothing and the args never reached the command (X-12).
   // They go on the last line that is a command, where `cat <<X FWD` is
   // still `cat FWD` reading the heredoc.
-  const lines = command.trimEnd().split('\n')
-  const body = heredocLines(lines)
-  if (body[lines.length - 1] === true) {
-    const last = body.lastIndexOf(false)
+  const trimmed = command.trimEnd()
+  const lines = trimmed.split('\n')
+  const shape = shellShape(trimmed)
+  if (shape.body[lines.length - 1] === true) {
+    const last = shape.body.lastIndexOf(false)
     const tail = lines.slice(last + 1).join('\n')
     return `${withForwardArgs(lines.slice(0, last + 1).join('\n'), args)}\n${tail}`
   }
   const quoted = args.map(shellQuote).join(' ')
-  let comment = trailingCommentStart(command)
+  // Of the trimmed command: the newline closing a template literal's last
+  // line closed its comment too, and `echo args: # c\n` took the args into
+  // the comment (X-110).
+  let comment = shape.comment
   if (comment < 0) {
     // A command that ends in a newline (a template literal's closing line)
     // ran the args as a command of their own: `--watch: not found`. Kept
     // when an odd run of backslashes ends it: that escapes what follows.
-    const body = command.trimEnd()
-    const escaped = (/\\+$/.exec(body)?.[0].length ?? 0) % 2 === 1
-    return `${escaped ? command : body} ${quoted}`
+    const escaped = (/\\+$/.exec(trimmed)?.[0].length ?? 0) % 2 === 1
+    return `${escaped ? command : trimmed} ${quoted}`
   }
   // A comment-only last line after a commented line: the args go before
   // the earliest comment, or they land inside it (`echo one # c\n# two`).
-  for (let c = comment; c >= 0; c = trailingCommentStart(command.slice(0, c).trimEnd())) comment = c
-  return `${command.slice(0, comment).trimEnd()} ${quoted} ${command.slice(comment)}`
+  for (let c = comment; c >= 0; c = shellShape(trimmed.slice(0, c).trimEnd()).comment) comment = c
+  // What precedes the comment may end in a heredoc: the args go where they
+  // would with no comment, never on its terminator.
+  const head = trimmed.slice(0, comment).trimEnd()
+  const gap = trimmed.slice(head.length, comment) || ' '
+  return `${withForwardArgs(head, args)}${gap}${trimmed.slice(comment)}`
 }
 
 // Any shell control/expansion character means the wrapping `sh` has real
@@ -348,6 +368,18 @@ const SIGNAL_ALIASES = new Set(['SIGIOT', 'SIGPOLL', 'SIGCLD'])
  */
 const TIMEOUT_SIGKILL_GRACE_MS = 2000
 
+/**
+ * Run `fn` one loop turn later, once the child exits already pending are
+ * read. A deadline due in the same turn as a child's exit fires BEFORE Bun
+ * reaps it: a task that exited 0 inside its timeout, seen late by a busy vx,
+ * was SIGTERMed as a zombie and failed as timed out, and a server that died
+ * before ready read as a readiness timeout (2026-10-08). A turn later the
+ * exit has settled the caller, which clears the returned timer.
+ */
+function afterPendingExits(fn: () => void): ReturnType<typeof setTimeout> {
+  return setTimeout(fn, 0)
+}
+
 /**
  * Arm a SIGTERM timeout on a spawned child. Returns a handle whose
  * `timedOut()` reports whether the timer fired — so the caller can
@@ -368,7 +400,10 @@ export function armTimeout(
   let firedAt: number | undefined
   let killTimer: ReturnType<typeof setTimeout> | undefined
   const graceMs = killGraceMs(TIMEOUT_SIGKILL_GRACE_MS)
-  const timer = setTimeout(() => {
+  let timer = setTimeout(() => {
+    timer = afterPendingExits(fire)
+  }, timeoutMs)
+  function fire(): void {
     firedAt = Date.now()
     killTree(proc, 'SIGTERM')
     // Escalate to SIGKILL after a grace: a child that TRAPS+IGNORES SIGTERM
@@ -379,7 +414,7 @@ export function armTimeout(
     // the CLI alive.
     killTimer = setTimeout(() => killTree(proc, 'SIGKILL'), graceMs)
     killTimer.unref?.()
-  }, timeoutMs)
+  }
   return {
     timedOut: () => firedAt !== undefined,
     settle: async () => {
@@ -483,7 +518,7 @@ export interface PersistentSpawn {
    * Rejects with the spawn error if the child fails to start.
    */
   ready: Promise<void>
-  /** ms elapsed from spawn to ready (or to current time if not yet ready). */
+  /** ms from spawn to ready, to the readiness timeout giving up, or to now. */
   readyMs: () => number
 }
 
@@ -522,6 +557,9 @@ export interface PersistentOptions extends Omit<RunOptions, 'forwardArgs' | 'cap
 export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const start = Date.now()
   let readyAt: number | undefined
+  // When the readiness wait gave up: the wait's length, not the kill grace
+  // a TERM-trapping server runs out after it.
+  let gaveUpAt: number | undefined
 
   // Pattern compiled once; thrown errors surface synchronously so the
   // caller can wrap with a user-facing message.
@@ -677,8 +715,9 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   // a healthy server is never killed by a stale timer.
   let readyTimer: ReturnType<typeof setTimeout> | undefined
   if (readyRe && opts.timeoutMs !== undefined) {
-    readyTimer = setTimeout(() => {
+    const giveUp = (): void => {
       if (readyAt === undefined) {
+        gaveUpAt = Date.now()
         rejectReady(
           new PersistentReadyError(
             `persistent task not ready within ${opts.timeoutMs}ms — ` +
@@ -701,6 +740,9 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
         }, killGraceMs(TIMEOUT_SIGKILL_GRACE_MS))
         killTimer.unref?.()
       }
+    }
+    readyTimer = setTimeout(() => {
+      readyTimer = afterPendingExits(giveUp)
     }, opts.timeoutMs)
   }
 
@@ -730,7 +772,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   return {
     child,
     ready,
-    readyMs: () => (readyAt ?? Date.now()) - start,
+    readyMs: () => (readyAt ?? gaveUpAt ?? Date.now()) - start,
   }
 }
 
@@ -807,7 +849,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
     stderr,
     ...(proc.signalCode ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
-    ...resourceUsageToCpuRss(proc.resourceUsage(), ownRssHighWater()),
+    ...resourceUsageToCpuRss(proc.resourceUsage(), rssFloorFor),
   }
 }
 
@@ -832,7 +874,7 @@ export function ownRssHighWater(): number {
   if (process.platform === 'linux') {
     try {
       const m = /VmHWM:\s+(\d+) kB/.exec(readFileSync('/proc/self/status', 'utf8'))
-      if (m !== null) return Number(m[1]) * 1024
+      if (m !== null) return (highWaterSeen = Number(m[1]) * 1024)
     } catch {
       // /proc unreadable: fall through to the current RSS.
     }
@@ -840,6 +882,22 @@ export function ownRssHighWater(): number {
   return process.memoryUsage.rss()
 }
 
+/** The last `VmHWM` read, in bytes; 0 until one is. */
+let highWaterSeen = 0
+
+/**
+ * The floor for a child's `peak`, read only when the last `VmHWM` cannot
+ * decide it: the mark never falls, so a peak within the slack of an older
+ * reading is within the slack of the current one, and goes unreported
+ * either way. A light task reads vx's own mark as its peak, so after the
+ * first such task the rest skip the read, which cost ~35 µs of the
+ * scheduler's thread per task (500 cold tasks, 2026-10-07). A current-RSS
+ * fallback is not monotonic and is never reused.
+ */
+function rssFloorFor(peak: number): number {
+  return peak <= highWaterSeen + RSS_FLOOR_SLACK_BYTES ? highWaterSeen : ownRssHighWater()
+}
+
 /**
  * What a task's captured output keeps: the first `CAPTURE_HEAD_CHARS` and
  * the last `CAPTURE_TAIL_CHARS` characters, the dropped middle counted and
@@ -863,6 +921,23 @@ export function droppedOutputLine(dropped: number): string {
   )
 }
 
+/**
+ * A captured `text` with `secrets` masked. A value the dropped middle cut
+ * left a piece at the head's end and one at the tail's start, which the
+ * whole-value mask missed, and the cache entry stored and replayed both.
+ */
+export function maskCaptured(text: string, secrets: SecretMask): string {
+  const at = text.indexOf('\n[vx] ', CAPTURE_HEAD_CHARS - 1)
+  const end = at === -1 ? -1 : text.indexOf('\n', at + 1) + 1
+  if (at === -1 || at > CAPTURE_HEAD_CHARS || !DROPPED_LINE.test(text.slice(at, end))) {
+    return secrets.mask(text)
+  }
+  const [head, tail] = secrets.maskCut(text.slice(0, at), text.slice(end))
+  return head + text.slice(at, end) + tail
+}
+
+const DROPPED_LINE = /^\n\[vx\] [\d.]+ MiB of output not kept — /
+
 const isHighSurrogate = (code: number): boolean => code >= 0xd800 && code <= 0xdbff
 
 /**
@@ -877,7 +952,10 @@ class BoundedCapture {
   private dropped = 0
 
   push(chunk: string): void {
-    if (this.head.length < CAPTURE_HEAD_CHARS) {
+    // Once the tail has begun the head is closed, even a unit short of its
+    // bound (the surrogate case below): a later short chunk fit there and
+    // was retained ahead of the chunk before it.
+    if (this.tailLen === 0 && this.head.length < CAPTURE_HEAD_CHARS) {
       let room = CAPTURE_HEAD_CHARS - this.head.length
       if (chunk.length <= room) {
         this.head += chunk
@@ -1014,8 +1092,8 @@ export function peakRssBytes(maxRSS: number): number {
  */
 export function resourceUsageToCpuRss(
   usage: ReturnType<ReturnType<typeof Bun.spawn>['resourceUsage']>,
-  /** The parent's own high-water mark (`ownRssHighWater`); a peak at or under it is inherited, not the child's, and is not reported. */
-  floorBytes = 0,
+  /** The parent's own high-water mark (`ownRssHighWater`), or a function of the peak that answers it; a peak at or under it is inherited, not the child's, and is not reported. */
+  floorBytes: number | ((peak: number) => number) = 0,
 ): { cpuMs?: number; peakRssBytes?: number } {
   if (!usage) return {}
   // cpuTime.total is microseconds as a bigint → ms.
@@ -1028,5 +1106,6 @@ export function resourceUsageToCpuRss(
   // parent's (see `ownRssHighWater`, `RSS_FLOOR_SLACK_BYTES`): the child's
   // peak is unknown, bounded by it.
   const peak = peakRssBytes(usage.maxRSS)
-  return peak > floorBytes + RSS_FLOOR_SLACK_BYTES ? { cpuMs, peakRssBytes: peak } : { cpuMs }
+  const floor = typeof floorBytes === 'number' ? floorBytes : floorBytes(peak)
+  return peak > floor + RSS_FLOOR_SLACK_BYTES ? { cpuMs, peakRssBytes: peak } : { cpuMs }
 }

package/src/exec/sandbox-deny-scan.ts

@@ -16,7 +16,7 @@
 import { lstatSync, readdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import { UserError } from '../util/index.js'
+import { relPosix, UserError } from '../util/index.js'
 import { atOrUnder, MOUNT_WILDCARDS } from './sandbox-paths.js'
 
 /** SRT's `rg --max-depth` for the scan (`DEFAULT_MANDATORY_DENY_SEARCH_DEPTH`). */
@@ -126,7 +126,7 @@ export function scopedMandatoryDenies(
     }
   }
   for (const root of roots) {
-    const rel = path.relative(cwd, root).split(path.sep).join('/')
+    const rel = relPosix(cwd, root)
     const depth = rel === '' ? 0 : rel.split('/').length
     if (depth > SEARCH_DEPTH) continue
     let dir: boolean

package/src/exec/sandbox-paths.ts

@@ -78,14 +78,16 @@ export function localBindingOn(c: { localBinding?: boolean | readonly number[] }
 }
 
 /**
- * Whether a sandboxed task may read `file`: it lies under a read grant,
- * a write grant or a baseline read, by its canonical path. A path no
- * grant holds is not there inside the sandbox, which the shell reports
+ * Whether a sandboxed task may read `file`: it lies under no denial (the
+ * rest of the host is mounted read-only), or under a read grant, a write
+ * grant or a baseline read, by its canonical path. A path no grant holds
+ * under a denial is not there inside the sandbox, which the shell reports
  * as "not found" with no denial a trace can see (an `execve`).
  */
 export function sandboxReads(
   sandbox: {
     readonly baseAllowRead: readonly string[]
+    readonly baseDenyRead: readonly string[]
     readonly config: {
       readonly allowRead: readonly string[]
       readonly allowWrite: readonly string[]
@@ -94,7 +96,11 @@ export function sandboxReads(
   file: string,
 ): boolean {
   const real = toRealPath(file)
-  return [...sandbox.baseAllowRead, ...sandbox.config.allowRead, ...sandbox.config.allowWrite].some(
-    (g) => atOrUnder(real, toRealPath(g)),
+  const under = (g: string): boolean => atOrUnder(real, toRealPath(g))
+  return (
+    !sandbox.baseDenyRead.some(under) ||
+    [...sandbox.baseAllowRead, ...sandbox.config.allowRead, ...sandbox.config.allowWrite].some(
+      under,
+    )
   )
 }

package/src/exec/sandbox-runtime.ts

@@ -108,9 +108,13 @@ import {
 
 type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
 let srtPromise: Promise<SrtModule> | undefined
+/** Set once loaded, for `releaseBridges`, which a sync exit handler calls. */
+let srtLoaded: SrtModule | undefined
 
 async function loadSrt(): Promise<SrtModule> {
-  if (!srtPromise) srtPromise = import('@anthropic-ai/sandbox-runtime')
+  if (!srtPromise) {
+    srtPromise = import('@anthropic-ai/sandbox-runtime').then((m) => (srtLoaded = m))
+  }
   return srtPromise
 }
 
@@ -275,9 +279,16 @@ export function dependencyReason(errors: readonly string[]): string {
  * listen" on macOS and "Failed to create bridge sockets after 5 attempts"
  * on Linux (its retry loop swallows the code), neither naming the
  * directory (2026-09-16). Checked up front, with room for the sequence.
+ * On Linux the longer name is the network bridge's,
+ * `claude-http-<16 hex>.sock`, and it is the one that fails there.
  */
 export function socketPathRefusal(tmpdir = os.tmpdir()): string | undefined {
-  const sample = path.join(tmpdir, `srt-mux-${process.pid}-zzz.sock`)
+  const sample = path.join(
+    tmpdir,
+    process.platform === 'linux'
+      ? `claude-http-${'0'.repeat(16)}.sock`
+      : `srt-mux-${process.pid}-zzz.sock`,
+  )
   const limit = process.platform === 'darwin' ? 103 : 107
   const length = Buffer.byteLength(sample)
   if (length <= limit) return undefined
@@ -1151,6 +1162,23 @@ export async function wrapSandboxedCommand(
   const tmp = taskTmpdir(tag)
   mkdirSync(tmp, { mode: 0o700 })
   trackTaskTmpdir(tmp)
+  try {
+    return await wrapIn(args, SandboxManager, userCommand, tag, tmp)
+  } catch (err) {
+    // Nothing spawned, so nothing releases it on exit: a `vx watch` kept
+    // one task directory per refused wrap (a held port) until it quit.
+    releaseBridges(tag)
+    throw err
+  }
+}
+
+async function wrapIn(
+  args: Parameters<typeof wrapSandboxedCommand>[0],
+  SandboxManager: SrtModule['SandboxManager'],
+  userCommand: string,
+  tag: string,
+  tmp: string,
+): ReturnType<typeof wrapSandboxedCommand> {
   // After the tag: SRT keys violations by the command's first 100 chars.
   const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${javaToolOptionsFix(
     process.env['JAVA_TOOL_OPTIONS'],
@@ -1188,6 +1216,16 @@ export async function wrapSandboxedCommand(
   // user command, so it goes INTO the sandboxed command; the host side is
   // spawned here and released when the task's process ends.
   const ports = process.platform === 'linux' ? bridgedPorts(args.config) : []
+  // Before the wrap, which holds the runtime's stub cleanup until `afterCommand`.
+  const held = portsHeld(ports)
+  if (held.length > 0) {
+    throw new UserError(
+      `sandbox: localBinding port${held.length === 1 ? '' : 's'} ${held.join(', ')} ` +
+        `${held.length === 1 ? 'is' : 'are'} already in use on this machine, so the task's own ` +
+        `cannot be exposed there and a client would reach the other listener; stop what ` +
+        `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
+    )
+  }
   const grouped =
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
@@ -1215,7 +1253,13 @@ export async function wrapSandboxedCommand(
       ...macProfileRules(args.config),
       ...darwinWallRules(args.config, baselines.allowRead),
     ]
-    if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
+    try {
+      if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
+    } catch (err) {
+      releaseBridges(tag)
+      afterCommand(SandboxManager)
+      throw err
+    }
   }
   // Linux: the shell execs bwrap, so bwrap is the spawn itself and its
   // `--die-with-parent` is keyed to vx. Behind a shell that waited on it,
@@ -1240,15 +1284,6 @@ export async function wrapSandboxedCommand(
   }
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
-  const held = portsHeld(ports)
-  if (held.length > 0) {
-    throw new UserError(
-      `sandbox: localBinding port${held.length === 1 ? '' : 's'} ${held.join(', ')} ` +
-        `${held.length === 1 ? 'is' : 'are'} already in use on this machine, so the task's own ` +
-        `cannot be exposed there and a client would reach the other listener; stop what ` +
-        `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
-    )
-  }
   if (args.server === true) liveServers.add(tag)
   if (ports.length > 0) {
     spawnHostBridges(ports, tag)
@@ -1361,11 +1396,14 @@ function ownGroupCommand(
     .join(' ')
   const body = shellQuote(`exec ${TRACE_FD}>&-; ${userCommand}`)
   const run = `{ trap - INT QUIT; exec ${setsid ?? ''}${tracer} ${shellQuote(sh)} -c ${body} 3<&-; } & c=$!;`
+  // Bash reports a job a signal killed on its stderr, the task's: a task
+  // whose shell died of SIGKILL printed this whole wrapper (X-111).
+  const wait = `wait "$c" 2>/dev/null`
   if (setsid === undefined) {
-    return { command: `${tag0} ${run} wait "$c"`, forwards: false, traced: true }
+    return { command: `${tag0} ${run} ${wait}`, forwards: false, traced: true }
   }
   const watch = `{ IFS= read -r s && kill -s "$s" -- "-$c"; } 2>/dev/null <&3 3<&- &`
-  return { command: `${tag0} ${run} ${watch} wait "$c"`, forwards: true, traced: true }
+  return { command: `${tag0} ${run} ${watch} ${wait}`, forwards: true, traced: true }
 }
 
 /** What strace stops on: the reads, and what moves or makes a process's cwd. */
@@ -1409,9 +1447,11 @@ function literalReadPaths(
  * it the pattern, and SRT compiles any spelling holding `[` as a regex in
  * which a backslash is a literal one, so `pages/\[id\].tsx` matched no
  * file and the route could not be granted. `[[]` is a class of one `[`; a
- * lone `]` is plain text (B-65).
+ * lone `]` is plain text (B-65). A deny path is a real directory, never a
+ * pattern: a nested project's wall under `[legacy]/` compiled as a class,
+ * matched nothing, and the root task read it.
  */
-function seatbeltBrackets(
+export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
 ): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
   const fs = config?.filesystem
@@ -1422,6 +1462,7 @@ function seatbeltBrackets(
     ...config,
     filesystem: {
       ...fs,
+      denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
       allowWrite: literal(fs.allowWrite),
       ...(fs.allowRead !== undefined ? { allowRead: literal(fs.allowRead) } : {}),
     },
@@ -1620,8 +1661,17 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
 export function releaseBridges(tag: string): void {
   const tmp = taskTmpdir(tag)
   if (liveTaskTmpdirs.delete(tmp)) rmSync(tmp, { recursive: true, force: true })
-  if (liveServers.delete(tag) && liveServers.size === 0 && resetDeferred) {
-    void resetSandbox().catch(() => {})
+  if (liveServers.delete(tag)) {
+    // A server's wrap counts as a live sandbox in SRT until this, and SRT
+    // removes bwrap's host stubs (`.bashrc`, `.vscode`, … under a write
+    // grant) only at a count of 0: one stopped server kept every later
+    // task's stubs in the workspace until the reset.
+    try {
+      srtLoaded!.SandboxManager.cleanupAfterCommand()
+    } catch {
+      // best-effort, as a one-shot task's
+    }
+    if (liveServers.size === 0 && resetDeferred) void resetSandbox().catch(() => {})
   }
   const bridges = hostBridges.get(tag)
   if (bridges === undefined) return
@@ -1775,6 +1825,7 @@ async function runSandboxedOnce(
   if (args.signal?.aborted === true) {
     releaseBridges(tag)
     takeRecords()
+    afterCommand(SandboxManager)
     const signal = stopSignal(args.signal.reason)
     return {
       exitCode: signalExitCode(signal),
@@ -1819,10 +1870,15 @@ async function runSandboxedOnce(
     )
     if (forwardsSignals) signalThrough(proc, proc.stdio[3] as number)
   } catch (err) {
+    if (straceLog) {
+      rmSync(straceLog, { force: true })
+      liveTempFiles.delete(straceLog)
+    }
     const stderr = spawnFailureText(err, args.cwd, 'sandboxed task')
     args.onStderr?.(stderr)
     releaseBridges(tag)
     takeRecords()
+    afterCommand(SandboxManager)
     return {
       exitCode: 127,
       durationMs: Date.now() - start,
@@ -2012,11 +2068,7 @@ async function runSandboxedOnce(
     if (hidden.length > 0) violations.push(hiddenReadsHint(hidden, args.reportWithin))
   }
 
-  try {
-    SandboxManager.cleanupAfterCommand()
-  } catch {
-    // ignore; bwrap mount-point cleanup is best-effort
-  }
+  afterCommand(SandboxManager)
 
   return {
     exitCode,
@@ -2042,6 +2094,20 @@ async function runSandboxedOnce(
   }
 }
 
+/**
+ * The runtime counts every wrap as a live sandbox until this, and removes
+ * the empty files bwrap made on the host as mount points (`.bashrc`,
+ * `.vscode`, … under a write grant) only at a count of 0: a wrap with no
+ * call here kept every later task's stubs on the host until the reset.
+ */
+function afterCommand(SandboxManager: SrtModule['SandboxManager']): void {
+  try {
+    SandboxManager.cleanupAfterCommand()
+  } catch {
+    // ignore; bwrap mount-point cleanup is best-effort
+  }
+}
+
 /** The hint for writes refused outside the project, a few paths named. */
 function outsideWritesHint(
   paths: readonly string[],