@vzn/vx 0.0.596 → 0.0.597

package/src/cli/lock.ts

@@ -83,9 +83,11 @@ function bareNote(bare: number): string {
 
 async function writeLock(root: string, metas: ConfiguredMeta[], bare: number): Promise<number> {
   const entries = await Promise.all(metas.map((m) => evaluateEntry(root, m)))
-  const projects: Record<string, LockfileEntry> = {}
-  // `listProjects` sorts by name — stable lockfile diffs for free.
-  for (let i = 0; i < metas.length; i++) projects[metas[i]!.name] = entries[i]!
+  // `listProjects` sorts by name — stable lockfile diffs for free. Defined,
+  // not assigned: a project named `__proto__` set the map's prototype (D-152).
+  const projects: Record<string, LockfileEntry> = Object.fromEntries(
+    metas.map((m, i) => [m.name, entries[i]!]),
+  )
   const leaks = secretsIn(projects)
   if (leaks.length > 0) {
     process.stderr.write(

package/src/cli/plan-format.ts

@@ -1,7 +1,7 @@
 // Formatters for `--dry-run` (human / JSON) and `--graph` (DOT).
 
 import type { CacheStatus, RunPlan } from '../orchestrator/index.js'
-import { formatDuration } from '../orchestrator/index.js'
+import { formatElapsed } from '../util/index.js'
 
 /**
  * Human-readable preview. One line per real task (groups hidden, same
@@ -37,7 +37,7 @@ export function formatPlanText(plan: RunPlan): string {
     const desc = skipped ? 'noop — would not run' : describe(t.cacheStatus)
     const shortHash = t.hash ? t.hash.slice(0, 8) : ''
     const executes = !skipped && (t.cacheStatus === 'miss' || t.cacheStatus === 'no-cache')
-    const eta = executes && t.p50Ms !== undefined ? `  ~${formatDuration(t.p50Ms)}` : ''
+    const eta = executes && t.p50Ms !== undefined ? `  ~${formatElapsed(t.p50Ms)}` : ''
     // Placement, by EXECUTOR NAME rather than a local/remote word: the
     // summary line below already spends "local" and "remote" on the cache
     // tier, and a task placed on a named executor is what the reader can
@@ -94,8 +94,8 @@ export function formatPlanText(plan: RunPlan): string {
   const p = plan.predicted
   const executes = miss + nocache
   if (p !== undefined && executes > 0 && executes > p.unknownCount) {
-    const parts = [`predicted: ~${formatDuration(p.wallMs)} wall`]
-    parts.push(`~${formatDuration(p.workMs)} total execution`)
+    const parts = [`predicted: ~${formatElapsed(p.wallMs)} wall`]
+    parts.push(`~${formatElapsed(p.workMs)} total execution`)
     if (p.unknownCount > 0) {
       parts.push(`${p.unknownCount} task${p.unknownCount === 1 ? '' : 's'} without history (+?)`)
     }

package/src/cli/run.ts

@@ -1,6 +1,7 @@
 import { appendFileSync, mkdirSync } from 'node:fs'
 import path from 'node:path'
 import { isatty } from 'node:tty'
+import { findWorkspaceRoot } from '../workspace/index.js'
 import { translateForeign } from './foreign-flags.js'
 import { flagHint, seeHelp } from './help.js'
 import {
@@ -13,7 +14,12 @@ import {
   type RunResult,
 } from '../orchestrator/index.js'
 import type { ContinueMode, TaskOutcome } from '../graph/index.js'
-import { type CachePolicy, FULL_CACHE_POLICY, parseCachePolicy } from '../cache/index.js'
+import {
+  type CachePolicy,
+  FULL_CACHE_POLICY,
+  gitRefusal,
+  parseCachePolicy,
+} from '../cache/index.js'
 import { affectedFilterFor, findCwdSelection, pickTask, resolveFilters } from './select.js'
 import { nxTargetHint, taskNamesHere } from './task-verb.js'
 import { MAX_TIMEOUT_MS, parseDecimalInt, machineParallelism } from '../util/index.js'
@@ -175,7 +181,7 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       if (n === null)
         return {
           ...out,
-          error: `invalid concurrency: ${v} (a positive integer, or a share of the cores such as 50%)`,
+          error: `--concurrency must be a positive integer, or a share of the cores such as 50% (got ${v})`,
         }
       out.concurrency = n
     } else if (a === '--all') {
@@ -261,14 +267,17 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       out.download = v
     } else if (a === '--cache-dir' || a?.startsWith('--cache-dir=')) {
       const v = a === '--cache-dir' ? before[++i] : a.slice('--cache-dir='.length)
-      if (v === undefined || v === '') return { ...out, error: `--cache-dir requires a value` }
+      if (v === undefined || v === '') return { ...out, error: `--cache-dir requires a path` }
       // Unlike every other value flag, a cache dir is an arbitrary
       // string — nothing about its shape rejects a swallowed flag. An
       // unquoted empty shell var (`--cache-dir $EMPTY --force`) would
       // otherwise create a directory literally named `--force` and drop
       // the flag. A path starting with `-` needs the `=` form.
       if (a === '--cache-dir' && v.startsWith('-')) {
-        return { ...out, error: `--cache-dir requires a path, got flag: ${v}` }
+        return {
+          ...out,
+          error: `--cache-dir requires a path (got flag ${v}; a path that starts with - needs --cache-dir=${v})`,
+        }
       }
       out.cacheDir = v
     } else if (a === '--cache' || a?.startsWith('--cache=')) {
@@ -323,14 +332,15 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       if (v === undefined)
         return { ...out, error: `--verbosity requires a value (a non-negative integer)` }
       const n = parseDecimalInt(v)
-      if (n === null) return { ...out, error: `invalid verbosity: ${v} (a non-negative integer)` }
+      if (n === null)
+        return { ...out, error: `--verbosity must be a non-negative integer (got ${v})` }
       out.verbosity = n
     } else if (a === '--dry') {
       out.dry = 'text'
     } else if (a?.startsWith('--dry=')) {
       const fmt = a.slice('--dry='.length)
       if (fmt !== 'text' && fmt !== 'json') {
-        return { ...out, error: `invalid --dry value: ${fmt} (text or json)` }
+        return { ...out, error: `--dry must be text or json (got ${fmt})` }
       }
       out.dry = fmt
     } else if (a === '--graph') {
@@ -358,7 +368,7 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       if (raw === undefined) return { ...out, error: `${a} requires a value (k=v)` }
       // Split on the FIRST `=` so values may contain `=` (e.g. a URL).
       const eq = raw.indexOf('=')
-      if (eq <= 0) return { ...out, error: `invalid --tag (expected k=v): ${raw}` }
+      if (eq <= 0) return { ...out, error: `--tag must be k=v (got ${raw})` }
       out.tags[raw.slice(0, eq)] = raw.slice(eq + 1)
     } else if (a === '--report-file' || a?.startsWith('--report-file=')) {
       const v = a === '--report-file' ? before[++i] : a.slice('--report-file='.length)
@@ -367,7 +377,10 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
       // nothing about its shape rejects a swallowed flag. A path starting
       // with `-` needs the `=` form.
       if (a === '--report-file' && v.startsWith('-')) {
-        return { ...out, error: `--report-file requires a path, got flag: ${v}` }
+        return {
+          ...out,
+          error: `--report-file requires a path (got flag ${v}; a path that starts with - needs --report-file=${v})`,
+        }
       }
       out.reportFile = v
     } else if (a === '--report') {
@@ -375,7 +388,7 @@ export function parseRunArgs(rawArgs: readonly string[], verb: 'run' | 'watch' =
     } else if (a?.startsWith('--report=')) {
       const fmt = a.slice('--report='.length)
       if (fmt !== 'markdown') {
-        return { ...out, error: `invalid --report value: ${fmt} (only markdown)` }
+        return { ...out, error: `--report must be markdown (got ${fmt})` }
       }
       out.report = fmt
     } else if (a !== undefined && a.startsWith('-')) {
@@ -620,6 +633,7 @@ export async function runCmd(args: readonly string[]): Promise<number> {
 
   const cwd = process.cwd()
   let tasks = [...parsed.tasks]
+  let picked: string | undefined
 
   // No positionals → interactive picker (TTY only). Yields a single
   // anchored pkg#task; the rest of the pipeline treats it like any
@@ -638,6 +652,12 @@ export async function runCmd(args: readonly string[]): Promise<number> {
       )
       return 1
     }
+    // Every run needs git: refused here, not after the user has chosen.
+    const refusal = gitRefusal(await findWorkspaceRoot(cwd))
+    if (refusal !== undefined) {
+      process.stderr.write(`${refusal.message}\n`)
+      return 1
+    }
     const load = {
       ...(parsed.cacheDir !== undefined ? { cacheDir: parsed.cacheDir } : {}),
       ...(parsed.frozen ? { frozen: true } : {}),
@@ -662,10 +682,11 @@ export async function runCmd(args: readonly string[]): Promise<number> {
       }
       only = new Set(selected.names)
     }
-    const picked = await pickTask(cwd, {}, load, only)
-    if (picked === 'interrupted') return 130
-    if (!picked) return 1
-    tasks = [`${picked.project}#${picked.task}`]
+    const chosen = await pickTask(cwd, {}, load, only)
+    if (chosen === 'interrupted') return 130
+    if (!chosen) return 1
+    picked = `${chosen.project}#${chosen.task}`
+    tasks = [picked]
   }
 
   const resolved = await resolveRunOptions(parsed, cwd, tasks)
@@ -680,8 +701,14 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   const opts = resolved
   // The raw invocation, recorded on the `invocations` row so dashboards
   // show what was actually run. `args` is everything after `run`, quoted
-  // so `vx last` replays one paste-able line.
-  opts.command = ['vx', 'run', ...args.map(shellQuote)].join(' ')
+  // so `vx last` replays one paste-able line; a picked task is named in
+  // it, or the line would open the picker again.
+  opts.command = [
+    'vx',
+    'run',
+    ...(picked !== undefined ? [shellQuote(picked)] : []),
+    ...args.map(shellQuote),
+  ].join(' ')
 
   // Planning paths short-circuit execution. Both build the full task
   // graph + probe the cache; the difference is just the formatter.

package/src/cli/select.ts

@@ -26,7 +26,7 @@ import {
 import type { ProjectConfig } from '../config.js'
 import type { ProjectEntry } from '../workspace/index.js'
 import { parseDependencySpec } from '../graph/index.js'
-import { declaresInput } from '../cache/index.js'
+import { declaresInput, workspaceFilesReachInto } from '../cache/index.js'
 import { isUserError, listed, maskedLine, nearest, UserError } from '../util/index.js'
 import {
   claimedAffected,
@@ -60,12 +60,15 @@ export async function workspaceGlobOwners(
   load: CliLoadOptions = {},
   stagedLoad: () => Promise<ReadonlyMap<string, ProjectEntry>> = () =>
     loadCliProjects(root, projects, 'all', load),
+  /** The changed nested repositories (`AffectedChanges.nested`). */
+  nested: readonly string[] = [],
 ): Promise<string[]> {
   const declaresMatch = (config: ProjectConfig): boolean => {
     for (const task of Object.values(config.tasks ?? {})) {
       const cache = task.cache
       if (cache === undefined) continue
       if (changed.some((rel) => declaresInput(cache, null, rel))) return true
+      if (nested.some((dir) => workspaceFilesReachInto(cache, dir))) return true
     }
     return false
   }
@@ -319,8 +322,8 @@ export async function resolveFilters(
         workspaceRoot: root,
         since: f.gitSince,
         projects,
-        workspaceGlobOwners: (changed: readonly string[]) =>
-          workspaceGlobOwners(root, projects, changed, load, stagedOnce),
+        workspaceGlobOwners: (changed: readonly string[], nested: readonly string[]) =>
+          workspaceGlobOwners(root, projects, changed, load, stagedOnce, nested),
         fingerprintClaims: () => workspaceFingerprintClaims(root, projects, load),
         taskEdges: async () => edges ?? taskEdgesFrom(await stagedOnce()),
         ...(git !== undefined ? { untracked: async () => (await git.start()).untracked } : {}),

package/src/cli/show.ts

@@ -41,7 +41,12 @@ export function parseShowArgs(args: readonly string[]): ShowArgs {
     else if (a.startsWith('--format=')) format = a.slice('--format='.length)
     else if (a === '--filter') {
       const v = args[++i]
-      if (v === undefined) return { ...out, error: '--filter requires a value (a pattern)' }
+      // `--filter --format json` took `--format` as the pattern; no filter opens with `--`.
+      if (v === undefined || v === '' || v.startsWith('--'))
+        return {
+          ...out,
+          error: `--filter requires a value: a project name, glob or path${seeHelp('show')}`,
+        }
       out.filters.push(v)
     } else if (a.startsWith('--filter=')) out.filters.push(a.slice('--filter='.length))
     else if (a === '--affected') out.affected = ''
@@ -55,7 +60,8 @@ export function parseShowArgs(args: readonly string[]): ShowArgs {
       return { ...out, error: `unexpected argument: ${a}${seeHelp('show')}` }
     // An empty name is a part of every name: its "did you mean" listed the
     // whole workspace.
-    else if (a === '') return { ...out, error: 'empty target (omit it to list every project)' }
+    else if (a === '')
+      return { ...out, error: `empty target (omit it to list every project)${seeHelp('show')}` }
     else out.target = a
 
     if (format !== undefined) {

package/src/cli/upgrade.ts

@@ -200,7 +200,7 @@ export async function fetchRelease(tag: string | undefined): Promise<unknown> {
   }
   // A body that is not JSON (a captive portal's page, a proxy's error
   // page served with a 200) is the same refusal as a cut one.
-  return await readOrRefuse(() => res.json() as Promise<unknown>, url, 'read the release')
+  return await readOrRefuse(() => res.json(), url, 'read the release')
 }
 
 /**

package/src/cli/watch-fs.ts

@@ -349,7 +349,9 @@ export function modifiedBefore(abs: string, t: number): boolean {
     // carry a file's OLD mtime onto the new one, and judged by mtime alone
     // such an edit was "before the arm" and never ran (item 945). No
     // process can set a ctime, and a rename or a write moves it.
-    const st = fs.statSync(abs)
+    // The link's own times, not its target's: a link made after the arm
+    // to an old file is a new input, and followed it read as the target's.
+    const st = fs.lstatSync(abs)
     return Math.max(st.mtimeMs, st.ctimeMs) < t
   } catch {
     return false
@@ -398,6 +400,10 @@ export class WatcherPool {
   // network mount, a container bind — the attempt costs a denied syscall
   // and a two-second wait before the fallback takes over anyway.
   private readonly forcePoll = (process.env['VX_WATCH_POLL'] ?? '') !== ''
+  // The stop closes the pool while a cycle may still be re-arming: an arm
+  // after it, or a proof that fails because it closed the watcher, would
+  // leave a live watcher or poller nothing ever closes.
+  private closed = false
 
   constructor(private readonly skip: (dir: string, rel: string) => boolean) {
     if (this.forcePoll)
@@ -411,6 +417,7 @@ export class WatcherPool {
   // By slot, not by handle: an OS watcher that never proves delivery is
   // swapped for a poller in place, and a drop must close what is there.
   arm(dir: string, recursive: boolean, onEvent: (filename: string) => void): WatchHandle {
+    if (this.closed) return CLOSED
     const watchers = this.watchers
     const at = watchers.length
     const handle: WatchHandle = {
@@ -442,8 +449,8 @@ export class WatcherPool {
       armed.ready.then((ok) => {
         if (ok) return
         armed.watcher.close()
-        // Dropped by a rearm before its proof settled: nothing to swap in.
-        if (watchers[at] !== armed.watcher) return
+        // Dropped by a rearm or the stop before its proof settled: nothing to swap in.
+        if (this.closed || watchers[at] !== armed.watcher) return
         // The watcher never proved delivery, so it is not one: an FSEvents
         // stream the OS refused, a filesystem that reports nothing. Swap in
         // the poller rather than run a loop that silently never fires.
@@ -462,6 +469,7 @@ export class WatcherPool {
   }
 
   closeAll(): void {
+    this.closed = true
     for (const w of this.watchers) {
       try {
         w.close()

package/src/cli/watch.ts

@@ -45,7 +45,7 @@ import {
 } from './watch-filter.js'
 import { CLOSED, fsClockNow, type WatchHandle, WatcherPool } from './watch-fs.js'
 import { ChangeJudge } from './watch-judge.js'
-import { restartTimings } from '../util/index.js'
+import { hangupIgnored, restartTimings } from '../util/index.js'
 import { memberEntries, sameMembers, sweepConfigs, watchedProjects } from './watch-set.js'
 
 /** One line for a watcher or re-read the OS refused; the loop goes on without it. */
@@ -146,8 +146,9 @@ export async function watchCmd(args: readonly string[]): Promise<number> {
   }
   process.once('SIGTERM', () => stop.abort('SIGTERM'))
   // A task runs in its own session (exec/kill-tree.ts): the terminal
-  // closing reaches the loop alone, and the loop passes it on.
-  process.once('SIGHUP', () => stop.abort('SIGHUP'))
+  // closing reaches the loop alone, and the loop passes it on — unless vx
+  // was started with it ignored (nohup).
+  if (!hangupIgnored()) process.once('SIGHUP', () => stop.abort('SIGHUP'))
 
   // Enumerate projects-in-scope so we know what dirs to watch: the bare
   // tasks' scope (`opts.projects`; undefined means "every project", or
@@ -406,6 +407,9 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
         try {
           await held?.stop()
           held = undefined
+          // A Ctrl-C while the old server shut down ran a cycle anyway: a
+          // `not run` row and a footer printed above `stopped` (WD-22).
+          if (stop.aborted) break
           restartTimings()
           // On the mtime clock, as the arm is: from `Date.now()` a write the
           // run made within a tick of it carried an earlier mtime and read as
@@ -415,10 +419,6 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
           held = cycle.persistent
           if (cycle.refused !== undefined) process.stderr.write(`vx watch: ${cycle.refused}\n`)
           changes.lastCycle = { start, end: Date.now() }
-          if (reread && !stop.aborted) {
-            reread = false
-            await rearm()
-          }
         } catch (err) {
           // A re-run can fail catastrophically when the workspace
           // itself moved out from under us — e.g. the user deleted
@@ -430,6 +430,13 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
           const message = err instanceof Error ? err.message : String(err)
           process.stderr.write(`vx watch: cycle failed: ${message}\n`)
         }
+        // After a failed cycle too: a package added with a config that does
+        // not load yet fails its cycle, and unarmed, the fix to that config
+        // was never an event.
+        if (reread && !stop.aborted) {
+          reread = false
+          await rearm()
+        }
         // What landed mid-run is judged on settled state, one window
         // after the run, under the label of what actually arrived.
         if (changes.pending.size === 0 || stop.aborted) break

package/src/cli/workspace-config.ts

@@ -71,7 +71,9 @@ export function parseCacheDirFlag(
   const v = a === '--cache-dir' ? args[i + 1] : a.slice('--cache-dir='.length)
   if (v === undefined || v === '') return { error: '--cache-dir requires a path' }
   if (a === '--cache-dir' && v.startsWith('-')) {
-    return { error: `--cache-dir requires a path, got flag: ${v}` }
+    return {
+      error: `--cache-dir requires a path (got flag ${v}; a path that starts with - needs --cache-dir=${v})`,
+    }
   }
   return { cacheDir: v, next: a === '--cache-dir' ? i + 1 : i }
 }

package/src/config.ts

@@ -608,6 +608,25 @@ type Known<T, Shape> = { [P in keyof T]: P extends keyof Shape ? unknown : never
 /** `T[P]` when `T` has it; `unknown` (no keys to check) when it does not. */
 type At<T, P extends PropertyKey> = T extends { readonly [Q in P]?: infer V } ? V : unknown
 
+/** The objects inside each task's `exec`, held to their keys as `exec` is (D-156). */
+type KnownExecs<T extends ProjectConfig> = {
+  tasks?: {
+    [K in keyof NonNullable<T['tasks']>]?: {
+      exec?: KnownExec<At<NonNullable<T['tasks']>[K], 'exec'>>
+    }
+  }
+}
+
+type KnownExec<E> = {
+  env?: Known<At<E, 'env'>, ExecEnv>
+  persistent?: Known<At<E, 'persistent'>, PersistentConfig>
+  sandbox?: Known<At<E, 'sandbox'>, SandboxConfig> & {
+    allow?: Known<At<At<E, 'sandbox'>, 'allow'>, SandboxGrants>
+    deny?: Known<At<At<E, 'sandbox'>, 'deny'>, SandboxDenials>
+    ignore?: Known<At<At<E, 'sandbox'>, 'ignore'>, SandboxIgnore>
+  }
+}
+
 /**
  * Identity function — exists only so TypeScript narrows literal types
  * and, crucially, **validates `dependsOn` against this project's own
@@ -617,6 +636,7 @@ type At<T, P extends PropertyKey> = T extends { readonly [Q in P]?: infer V } ?
  */
 export function defineProject<const T extends ProjectConfig>(
   config: T &
+    KnownExecs<T> &
     Known<T, ProjectConfig> & {
       tasks?: {
         [K in keyof NonNullable<T['tasks']>]?: Known<NonNullable<T['tasks']>[K], TaskConfig> & {
@@ -640,6 +660,7 @@ export function defineWorkspace<T extends WorkspaceConfig>(
         At<T, 'cacheRetention'>,
         NonNullable<WorkspaceConfig['cacheRetention']>
       >
+      rules?: Known<At<T, 'rules'>, WorkspaceRules>
     },
 ): T {
   return config

package/src/exec/executor.ts

@@ -145,7 +145,7 @@ export interface ExecuteRequest {
    * `RunOptions.signal`) or when `timeoutMs` elapses. An executor ends its
    * work and returns: a child an executor spawned is not one core can
    * reach (H-10, H-12). One already aborted is work not to start (B-55).
-   * A non-zero exit after the timeout's abort is recorded `timedOut`. Core
+   * Any exit after the timeout's abort, a 0 included, is a timeout. Core
    * waits the kill grace (`VX_KILL_GRACE_MS`, 2 s) after the abort, then
    * settles the attempt without `execute` and abandons it (H-14).
    */

package/src/exec/kill-tree.ts

@@ -64,17 +64,37 @@ export function closeSignalChannel(child: Child): void {
  */
 let guardFd: number | null | undefined
 
+// Three lists: groups (`+`/`-`), single pids (`=`/`_`) and paths to
+// remove (`@`/`!`), killed and removed in that order at EOF.
 const GUARD_SCRIPT = [
-  "g=' '",
+  "g=' ' k=' ' f=' '",
   'while IFS= read -r l; do',
+  '  p=${l#?}',
   '  case $l in',
-  '    +*) g="$g${l#+} " ;;',
-  '    -*) p=${l#-}; case $g in *" $p "*) g="${g%% $p *} ${g#* $p }" ;; esac ;;',
+  '    +*) g="$g$p " ;;',
+  '    -*) case $g in *" $p "*) g="${g%% $p *} ${g#* $p }" ;; esac ;;',
+  '    =*) k="$k$p " ;;',
+  '    _*) case $k in *" $p "*) k="${k%% $p *} ${k#* $p }" ;; esac ;;',
+  '    @*) f="$f$p " ;;',
+  '    !*) case $f in *" $p "*) f="${f%%" $p "*} ${f#*" $p "}" ;; esac ;;',
   '  esac',
   'done <&3',
   'for p in $g; do kill -s KILL -- "-$p"; done 2>/dev/null',
+  'for p in $k; do kill -s KILL "$p"; done 2>/dev/null',
+  'set -f; for p in $f; do rm -rf -- "$p"; done 2>/dev/null',
 ].join('\n')
 
+/** The guard's process, so a guard vx stops writing to is stopped too. */
+let guardProc: Child | undefined
+
+/**
+ * How long a write waits on a guard that is behind. Bun opens the pipe
+ * nonblocking, and the kernel queues ~280 unread writes whatever their
+ * size: a burst of releases, or a guard the scheduler has not yet run,
+ * makes a write EAGAIN while the guard lives.
+ */
+const GUARD_STALL_MS = 1_000
+
 function startGuard(): void {
   if (guardFd !== undefined) return
   guardFd = null
@@ -89,31 +109,49 @@ function startGuard(): void {
     guard.unref()
     const fd = guard.stdio[3] as number
     guardFd = fd
+    guardProc = guard
     // A guard that has died (killed, the OOM killer) is handed to no later
     // spawn: its pipe is broken, and a shell whose printf buffers (bash as
     // macOS's sh) flushed the failed `+<pgid>` line into the task's own
     // stdout, cached replay included (B-10).
     void guard.exited.then(() => {
-      if (guardFd !== fd) return
-      guardFd = null
-      try {
-        closeSync(fd)
-      } catch {
-        // already closed
-      }
+      if (guardFd === fd) stopGuard()
     })
   } catch {
     // The limit as it was: nothing takes the groups down.
   }
 }
 
-function guardWrite(line: string): void {
-  if (typeof guardFd !== 'number') return
+/**
+ * Stop guarding for the rest of the process, and stop the guard with it:
+ * a guard that lived on would keep every group whose release it never got
+ * and SIGKILL them at vx's clean exit.
+ */
+function stopGuard(): void {
+  const fd = guardFd
+  guardFd = null
+  guardProc?.kill('SIGKILL')
+  if (typeof fd !== 'number') return
   try {
-    writeSync(guardFd, line)
+    closeSync(fd)
   } catch {
-    guardFd = null
+    // already closed
+  }
+}
+
+function guardWrite(line: string): void {
+  if (typeof guardFd !== 'number') return
+  const deadline = Date.now() + GUARD_STALL_MS
+  for (;;) {
+    try {
+      writeSync(guardFd, line)
+      return
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EAGAIN' || Date.now() >= deadline) break
+      Bun.sleepSync(1)
+    }
   }
+  stopGuard()
 }
 
 /**
@@ -157,6 +195,25 @@ export function releaseGroup(child: Child): void {
   else guardWrite(`-${child.pid}\n`)
 }
 
+/**
+ * List what the guard takes down besides groups if vx dies: the sandbox
+ * runtime's session. The runtime spawns its bridge socat as a plain child
+ * in vx's OWN group, which the guard must never kill, and a `kill -9`
+ * leaves its sockets in the temp directory. So each pid is killed alone
+ * and each path removed, by a name only that session carries. The
+ * returned function strikes them once the session is down, so a pid the
+ * kernel reuses is never killed on its account. Starts the guard: a spawn
+ * follows. A path holding whitespace is not listed (the lists split on it).
+ */
+export function guardSession(pids: readonly number[], paths: readonly string[]): () => void {
+  startGuard()
+  const listed = paths.filter((p) => !/\s/.test(p))
+  guardWrite(pids.map((p) => `=${p}\n`).join('') + listed.map((p) => `@${p}\n`).join(''))
+  return () => {
+    guardWrite(pids.map((p) => `_${p}\n`).join('') + listed.map((p) => `!${p}\n`).join(''))
+  }
+}
+
 /** Groups a teardown is still taking down: how many hold each, and whether its runner let it go. */
 const holds = new Map<number, { count: number; released: boolean }>()
 
@@ -181,7 +238,7 @@ export function holdGroups(children: readonly Child[]): () => void {
       if (hold === undefined) continue
       if (--hold.count > 0) continue
       holds.delete(pid)
-      if (hold.released) guardWrite(`-${pid}\n`)
+      if (owed.delete(pid) || hold.released) guardWrite(`-${pid}\n`)
     }
   }
 }
@@ -197,9 +254,23 @@ export function holdGroups(children: readonly Child[]): () => void {
  */
 const goneGroups = new WeakSet<Child>()
 
-/** Note, as `child`'s leader exits, whether its group went with it. */
-export function markGroupIfGone(child: Child): void {
-  if (!groupAlive(child)) goneGroups.add(child)
+/** Server groups that outlived their leader: struck when a teardown next lets them go. */
+const owed = new Set<number>()
+
+/**
+ * A persistent child's leader has exited. An empty group is struck and
+ * never signalled again. One with a member left stays listed until a
+ * teardown lets it go: the run's registry still owns a ready server after
+ * its shell exits and stops its group at the end, and struck here, the
+ * `server` of a `server & echo up` was left to nobody by a `kill -9` of vx.
+ */
+export function releaseServerGroup(child: Child): void {
+  if (groupAlive(child)) {
+    owed.add(child.pid)
+    return
+  }
+  goneGroups.add(child)
+  releaseGroup(child)
 }
 
 export function killTree(child: Child, signal: 'SIGINT' | 'SIGTERM' | 'SIGKILL'): void {