@vzn/vx 0.0.596 → 0.0.597

package/src/exec/runner.ts

@@ -18,8 +18,8 @@ import {
   closeSignalChannel,
   holdGroups,
   killTree,
-  markGroupIfGone,
   releaseGroup,
+  releaseServerGroup,
   signalThrough,
   guardLine,
   spawnGuarded,
@@ -105,6 +105,36 @@ function taskStdio(terminal: boolean | undefined, stdin: 'ignore' | 'pipe') {
     : ([stdin, 'pipe', 'pipe'] as const)
 }
 
+/**
+ * Read the terminal's modes before a task that holds it runs, and return
+ * what puts them back once it exits: a task killed in raw mode (or one
+ * that never undid its `stty raw -echo`) left the user's terminal with no
+ * echo and no Ctrl-C. Bun restores them at exit only when vx's stdout is
+ * the terminal, so `vx run … > log` kept them, and the rest of a run
+ * printed in them. `detached`, as the task is: a vx in a background job
+ * would be stopped by SIGTTOU on the set.
+ */
+function keepTerminalModes(): (() => void) | undefined {
+  const saved = stty('-g')
+  if (saved === undefined) return undefined
+  return () => {
+    if (stty('-g') !== saved) stty(saved)
+  }
+}
+
+function stty(arg: string): string | undefined {
+  try {
+    const out = Bun.spawnSync(['stty', arg], {
+      stdio: ['inherit', 'pipe', 'ignore'],
+      detached: true,
+    })
+    return out.success ? out.stdout.toString().trim() : undefined
+  } catch {
+    // No stty: the modes stay the task's, as before.
+    return undefined
+  }
+}
+
 export function shellQuote(arg: string): string {
   if (arg === '') return `''`
   // A `#` opens a comment only at a word's start, so `app#build` stays bare.
@@ -485,12 +515,14 @@ const READY_MATCH_WINDOW_CHARS = 64 * 1024
 
 /**
  * Terminal escapes a `readyWhen` pattern is matched without: CSI (colour,
- * cursor), OSC (titles, links) and the two-byte forms. Vite under
+ * cursor), OSC (titles, links), charset picks (`tput sgr0` writes
+ * `\x1b(B\x1b[m`) and the two-byte forms. Vite under
  * `FORCE_COLOR` prints `\x1b[1mLocal\x1b[22m:`, which `Local:` never matched
  * (item 1059). The streamed bytes keep them; only the tested text drops them.
  */
-// eslint-disable-next-line no-control-regex -- ESC is the point
-const TERMINAL_ESCAPE_RE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g
+const TERMINAL_ESCAPE_RE =
+  // eslint-disable-next-line no-control-regex -- ESC is the point
+  /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[ -/]+[0-~]|[@-Z\\-_])/g
 
 /**
  * Why a persistent task never became ready — the reason every label and
@@ -566,6 +598,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const readyRe = opts.readyWhen !== undefined ? new RegExp(opts.readyWhen) : undefined
 
   let child: ReturnType<typeof Bun.spawn>
+  const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     const signalFd = opts.signalChannel === true
     child = spawnGuarded((guard) =>
@@ -597,6 +630,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
         },
       ),
     )
+    if (restoreModes !== undefined) void child.exited.then(restoreModes)
     if (signalFd) {
       signalThrough(child, child.stdio[3] as number)
       const spawned = child
@@ -621,7 +655,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   })
 
   const markReady = (): void => {
-    if (readyAt === undefined) {
+    // A marker printed on the way down, once the wait gave up, is not ready.
+    if (readyAt === undefined && gaveUpAt === undefined) {
       readyAt = Date.now()
       if (readyTimer !== undefined) clearTimeout(readyTimer)
       resolveReady()
@@ -709,40 +744,42 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   opts.liveChildren?.add(child)
   opts.onSpawn?.(child.pid)
 
-  // Readiness deadline. Reject FIRST so the failure reads as a
-  // timeout, then SIGTERM — the exit handler's later reject is a
-  // no-op on the settled promise. Cleared the moment ready fires so
-  // a healthy server is never killed by a stale timer.
+  // Readiness deadline: SIGTERM, wait the grace for the GROUP, SIGKILL
+  // what is left, and only then reject. The caller's teardown used to
+  // signal the group again a turn after this SIGTERM, and a server whose
+  // handler is a one-shot (`process.once('SIGTERM')`, a trap that resets
+  // itself) died on the second mid-cleanup. Cleared the moment ready
+  // fires so a healthy server is never killed by a stale timer.
   let readyTimer: ReturnType<typeof setTimeout> | undefined
   if (readyRe && opts.timeoutMs !== undefined) {
-    const giveUp = (): void => {
-      if (readyAt === undefined) {
-        gaveUpAt = Date.now()
-        rejectReady(
-          new PersistentReadyError(
-            `persistent task not ready within ${opts.timeoutMs}ms — ` +
-              `readyWhen pattern never matched; child killed`,
-            'timeout',
-          ),
-        )
-        // Listed on the group guard until the SIGKILL: the shell may die
-        // on the SIGTERM and let the group go while the server runs out
-        // the grace, and a vx that exits inside it (the timer is unref'd)
-        // leaves the server to the guard (kill-tree.ts, item 865).
-        const letGo = holdGroups([child])
+    const giveUp = async (): Promise<void> => {
+      if (readyAt !== undefined) return
+      gaveUpAt = Date.now()
+      // Listed on the group guard until the SIGKILL: the shell may die on
+      // the SIGTERM and let the group go while the server runs out the
+      // grace, and a vx killed inside it leaves the server to the guard
+      // (kill-tree.ts, item 865).
+      const letGo = holdGroups([child])
+      try {
         killTree(child, 'SIGTERM')
-        // Same escalation as `armTimeout`: a server that traps TERM and
-        // never became ready is not in the persistent registry, so nothing
-        // else would ever kill it — it outlived the run under init.
-        const killTimer = setTimeout(() => {
-          killTree(child, 'SIGKILL')
-          letGo()
-        }, killGraceMs(TIMEOUT_SIGKILL_GRACE_MS))
-        killTimer.unref?.()
+        // A server that traps TERM and never became ready is not in the
+        // persistent registry, so nothing else would ever kill it.
+        const left = await untilGroupsGone([child], killGraceMs(TIMEOUT_SIGKILL_GRACE_MS))
+        for (const c of left) killTree(c, 'SIGKILL')
+        await child.exited
+      } finally {
+        letGo()
       }
+      rejectReady(
+        new PersistentReadyError(
+          `persistent task not ready within ${opts.timeoutMs}ms — ` +
+            `readyWhen pattern never matched; child killed`,
+          'timeout',
+        ),
+      )
     }
     readyTimer = setTimeout(() => {
-      readyTimer = afterPendingExits(giveUp)
+      readyTimer = afterPendingExits(() => void giveUp())
     }, opts.timeoutMs)
   }
 
@@ -750,10 +787,9 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   // — reject the ready promise so the caller can surface it.
   void child.exited.then((code) => {
     opts.liveChildren?.delete(child)
-    markGroupIfGone(child)
-    releaseGroup(child)
+    releaseServerGroup(child)
     if (readyTimer !== undefined) clearTimeout(readyTimer)
-    if (readyAt === undefined) {
+    if (readyAt === undefined && gaveUpAt === undefined) {
       rejectReady(
         new PersistentReadyError(
           `persistent task exited before becoming ready (exit ${code ?? '?'})` +
@@ -798,6 +834,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const fullCommand = withForwardArgs(opts.command, opts.forwardArgs)
 
   let proc: ReturnType<typeof Bun.spawn>
+  const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     proc = spawnGuarded((guard) =>
       Bun.spawn(shellArgv((guard === undefined ? '' : guardLine(3)) + execWrap(fullCommand)), {
@@ -832,6 +869,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   // lets a clean exit EOF immediately and only cuts off a stuck reader after a
   // brief grace — without this the run hangs forever.
   await proc.exited
+  restoreModes?.()
   await timeout.settle()
   let cut = false
   if (timeout.timedOut()) ac.abort()

package/src/exec/sandbox-paths.ts

@@ -27,6 +27,17 @@ export function isMountableLiteral(grant: string): boolean {
   return !MOUNT_WILDCARDS.test(grant)
 }
 
+/**
+ * The one path a grant names, or undefined for a pattern. A grant whose
+ * only brackets are escaped (`out/\[id\]`) names `out/[id]` as surely as a
+ * literal does, though it is still scanned and matched as a glob.
+ */
+export function namedPath(grant: string): string | undefined {
+  if (isMountableLiteral(grant)) return grant
+  const escaped = /\\([[\]])/g
+  return isMountableLiteral(grant.replace(escaped, '')) ? grant.replace(escaped, '$1') : undefined
+}
+
 /**
  * Canonicalize a path with realpath, tolerating paths that don't exist
  * yet: resolve the longest existing ancestor and re-append the rest.

package/src/exec/sandbox-runtime.ts

@@ -33,6 +33,7 @@ import {
   existsSync,
   mkdirSync,
   openSync,
+  readdirSync,
   readFileSync,
   readlinkSync,
   realpathSync,
@@ -81,6 +82,7 @@ import {
   isMountableLiteral,
   localBindingOn,
   MOUNT_WILDCARDS,
+  namedPath,
   toRealPath,
   unique,
 } from './sandbox-paths.js'
@@ -103,6 +105,7 @@ import {
   releaseGroup,
   signalThrough,
   guardLine,
+  guardSession,
   spawnGuarded,
 } from './kill-tree.js'
 
@@ -708,7 +711,8 @@ export async function initSandbox(opts?: {
     ...(scopedDenyScan ? scopedScanConfig() : {}),
     ...bundledJavaAgent(),
   }
-  if (!srtUp) await unlinkStaleMuxSockets()
+  const wasUp = srtUp
+  if (!wasUp) await unlinkStaleMuxSockets()
   const listening = srtCleanupAdopted ? undefined : cleanupListeners()
   await SandboxManager.initialize(
     config,
@@ -718,6 +722,10 @@ export async function initSandbox(opts?: {
   )
   if (listening !== undefined) adoptSrtCleanup(listening)
   srtUp = true
+  if (!wasUp && process.platform === 'linux' && procfsIsOwn()) {
+    const { pids, paths } = sessionLeftovers(SandboxManager)
+    sessionRelease = guardSession(pids, paths)
+  }
   perTaskRun = opts?.allowAllUnixSockets === true || opts?.gitConfig === true ? config : undefined
   // `initialize()` returns early once SRT is up, and on Linux the
   // availability probe brought it up with an EMPTY config before the run's
@@ -766,12 +774,81 @@ function srtDown(): void {
   straceAvailableCache = undefined
 }
 
+/** Strikes the live session from the group guard's lists; set by `initSandbox`. */
+let sessionRelease: (() => void) | undefined
+
+/**
+ * The runtime's session as the group guard must take it if vx dies
+ * (kill-tree.md): the bridge socats, vx's children named by the socket
+ * they listen on, and what a `kill -9` leaves in the temp directory — the
+ * bridge sockets and the `srt-*` sockets vx itself holds (the violation
+ * observer's directory, the mux). The runtime exposes none of the pids and
+ * not the observer's path, so procfs answers: vx's children, and its own
+ * socket inodes against `/proc/net/unix`. ~3 ms, once per session.
+ */
+function sessionLeftovers(SandboxManager: SrtModule['SandboxManager']): {
+  pids: number[]
+  paths: string[]
+} {
+  const sockets = new Set(
+    [SandboxManager.getLinuxHttpSocketPath(), SandboxManager.getLinuxSocksSocketPath()].filter(
+      (p): p is string => p !== undefined,
+    ),
+  )
+  const pids: number[] = []
+  const paths = [...sockets]
+  try {
+    for (const entry of readdirSync('/proc')) {
+      const first = entry.charCodeAt(0)
+      if (first < 48 || first > 57) continue
+      try {
+        const stat = readFileSync(`/proc/${entry}/stat`, 'utf8')
+        if (Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ', 2)[1]) !== process.pid) continue
+        const argv = readFileSync(`/proc/${entry}/cmdline`, 'utf8').split('\0')
+        if (argv.some((a) => [...sockets].some((s) => a.startsWith(`UNIX-LISTEN:${s},`)))) {
+          pids.push(Number(entry))
+        }
+      } catch {
+        // exited
+      }
+    }
+    const inodes = new Set<string>()
+    for (const fd of readdirSync('/proc/self/fd')) {
+      try {
+        const link = readlinkSync(`/proc/self/fd/${fd}`)
+        if (link.startsWith('socket:[')) inodes.add(link.slice(8, -1))
+      } catch {
+        // closed
+      }
+    }
+    const tmp = os.tmpdir()
+    for (const line of readFileSync('/proc/net/unix', 'utf8').split('\n')) {
+      const f = line.trim().split(/\s+/)
+      if (f.length < 8 || !inodes.has(f[6]!)) continue
+      const p = f.slice(7).join(' ')
+      const dir = path.dirname(p)
+      if (dir === tmp && path.basename(p).startsWith('srt-mux-')) paths.push(p)
+      else if (path.dirname(dir) === tmp && path.basename(dir).startsWith('srt-obs-')) {
+        paths.push(dir)
+      }
+    }
+  } catch {
+    // Best-effort, as the guard is: what was found is listed.
+  }
+  return { pids, paths }
+}
+
 /** `reset` is the one `initSandbox` waits out before it starts SRT again. */
 function trackReset(reset: Promise<unknown>): void {
   const settled = reset.then(
     () => {},
     () => {},
   )
+  // Struck once the runtime has killed its bridges and removed its files;
+  // a reset `exit` starts never settles, and the guard takes the rest.
+  const release = sessionRelease
+  sessionRelease = undefined
+  if (release !== undefined) void settled.then(release)
   resetting = settled
   void settled.then(() => {
     if (resetting === settled) resetting = undefined
@@ -1180,7 +1257,12 @@ async function wrapIn(
   tmp: string,
 ): ReturnType<typeof wrapSandboxedCommand> {
   // After the tag: SRT keys violations by the command's first 100 chars.
-  const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${javaToolOptionsFix(
+  // TMP and TEMP pass through from the host, whose temp directory the
+  // sandbox mounts read-only: a tool reading them failed to write there.
+  const alsoTmp = ['TMP', 'TEMP'].filter((name) => args.env[name] !== undefined)
+  const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${alsoTmp
+    .map((name) => `export ${name}="$TMPDIR"; `)
+    .join('')}${javaToolOptionsFix(
     process.env['JAVA_TOOL_OPTIONS'],
     args.env['JAVA_TOOL_OPTIONS'],
   )}${userCommand}`
@@ -1226,7 +1308,10 @@ async function wrapIn(
         `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
     )
   }
-  if (ports.length > 0) writeFileSync(portDialScript(tag), PORT_DIAL_SCRIPT)
+  if (ports.length > 0) {
+    hostBridges.set(tag, { ports, procs: [] })
+    writeFileSync(portDialScript(tag), PORT_DIAL_SCRIPT)
+  }
   const grouped =
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
@@ -1244,7 +1329,7 @@ async function wrapIn(
     process.platform === 'linux'
       ? literalReadPaths(customConfig)
       : process.platform === 'darwin'
-        ? seatbeltBrackets(customConfig)
+        ? seatbeltBrackets(customConfig, baselines.allowRead)
         : customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
@@ -1456,22 +1541,32 @@ function literalReadPaths(
  * file and the route could not be granted. `[[]` is a class of one `[`; a
  * lone `]` is plain text (B-65). A deny path is a real directory, never a
  * pattern: a nested project's wall under `[legacy]/` compiled as a class,
- * matched nothing, and the root task read it.
+ * matched nothing, and the root task read it. So is each of `names`, the
+ * baseline reads: a linked dependency under `packages/[legacy]/` was a
+ * class too, and as an exact regex even `[[]` grants the directory's entry
+ * and none of its files, so its subtree is granted beside it (a trailing
+ * `/**` is stripped before the compile).
  */
 export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
+  names: readonly string[] = [],
 ): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
   const fs = config?.filesystem
   if (fs === undefined) return config
-  const literal = (paths: readonly string[]): string[] =>
-    paths.map((p) => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']'))
+  const literal = (p: string): string => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']')
+  const bracketed = new Set(names.filter((n) => /[[\]]/.test(n)))
+  const read = (p: string): string[] => {
+    if (!bracketed.has(p)) return [literal(p)]
+    const at = p.replaceAll('[', '[[]')
+    return [at, `${at}/**/*`]
+  }
   return {
     ...config,
     filesystem: {
       ...fs,
       denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
-      allowWrite: literal(fs.allowWrite),
-      ...(fs.allowRead !== undefined ? { allowRead: literal(fs.allowRead) } : {}),
+      allowWrite: fs.allowWrite.map(literal),
+      ...(fs.allowRead !== undefined ? { allowRead: fs.allowRead.flatMap(read) } : {}),
     },
   }
 }
@@ -1588,7 +1683,14 @@ const hostBridges = new Map<
  * (2026-10-03). Linux, own procfs only, as the wait.
  */
 function portsHeld(ports: readonly number[]): number[] {
-  if (ports.length === 0 || !procfsIsOwn()) return []
+  if (ports.length === 0) return []
+  // This run's own bridges first: a wrap claims its ports before it awaits,
+  // and two tasks granted one port both read the table before either
+  // bridge bound, so the second's bind failed unseen and its clients
+  // reached the first task.
+  const claimed = new Set([...hostBridges.values()].flatMap((b) => b.ports))
+  const ours = ports.filter((p) => claimed.has(p))
+  if (ours.length > 0 || !procfsIsOwn()) return ours
   const held = new Set<string>()
   for (const [file, any, loop] of [
     ['/proc/net/tcp', '00000000', '0100007F'],
@@ -1644,7 +1746,7 @@ async function hostBridgesListen(ports: readonly number[], tag: string): Promise
 }
 
 function spawnHostBridges(ports: readonly number[], tag: string): void {
-  const procs: Array<ReturnType<typeof Bun.spawn>> = []
+  const procs = hostBridges.get(tag)!.procs
   for (const p of ports) {
     // A spawn failure (no socat on the host) is the task's to report:
     // its own side dies the same way, in its frame.
@@ -1674,10 +1776,7 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
       // see above
     }
   }
-  if (procs.length > 0) {
-    hostBridges.set(tag, { ports, procs })
-    for (const p of ports) unlinkOnExit(portBridgeSocket(tag, p))
-  }
+  if (procs.length > 0) for (const p of ports) unlinkOnExit(portBridgeSocket(tag, p))
 }
 
 /**
@@ -1736,12 +1835,22 @@ const TRACER_RETRY_LINE =
  * declared, so a second run redoes, not doubles, it.
  */
 export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRunResult> {
-  const { tracerFailed, ...first } = await runSandboxedOnce(args)
+  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce(args)
   // A stopping run has killed the children it holds; a retry would be one
   // spawned after that kill.
   if (!tracerFailed || args.signal?.aborted === true) return first
   args.onStderr?.(TRACER_RETRY_LINE)
-  const { tracerFailed: _again, ...second } = await runSandboxedOnce(args)
+  // `timeout` bounds the task's whole run (schema.md), so the retry gets
+  // what the first attempt left of it, not a fresh window.
+  const {
+    tracerFailed: _again,
+    ranMs: _ran,
+    ...second
+  } = await runSandboxedOnce(
+    args.timeoutMs === undefined
+      ? args
+      : { ...args, timeoutMs: Math.max(0, args.timeoutMs - ranMs) },
+  )
   return {
     ...second,
     durationMs: first.durationMs + second.durationMs,
@@ -1808,7 +1917,7 @@ const STRACE_OWN_ERROR = /^(?:[^\s:]*\/)?strace: /
  */
 async function runSandboxedOnce(
   args: SandboxedRunArgs,
-): Promise<SandboxedRunResult & { tracerFailed: boolean }> {
+): Promise<SandboxedRunResult & { tracerFailed: boolean; ranMs: number }> {
   const start = Date.now()
   const { SandboxManager } = await loadSrt()
   // Linux: SRT's store sees only writes (below), so read denials need
@@ -1858,6 +1967,7 @@ async function runSandboxedOnce(
       signal,
       violations: [],
       tracerFailed: false,
+      ranMs: 0,
     }
   }
   // Beside the task directories, which every sandbox replaces with its own:
@@ -1910,6 +2020,7 @@ async function runSandboxedOnce(
       spawnFailed: true,
       violations: [],
       tracerFailed: false,
+      ranMs: 0,
     }
   } finally {
     // The child holds its own copy; ours would keep nothing but a descriptor.
@@ -1919,6 +2030,7 @@ async function runSandboxedOnce(
   args.liveChildren?.add(proc)
   args.onSpawn?.(proc.pid)
   const timeout = armTimeout(proc, args.timeoutMs)
+  const armedAt = Date.now()
   const ac = new AbortController()
   // The unfinished last line of stderr, and whether a line was strace's.
   let partial = ''
@@ -1943,6 +2055,7 @@ async function runSandboxedOnce(
   // OR a clean exit that backgrounds a process) can't hang the run — timeout
   // aborts at once, otherwise drainOrAbort bounds the post-exit drain.
   await proc.exited
+  const ranMs = Date.now() - armedAt
   await timeout.settle()
   let cut = false
   if (timeout.timedOut()) ac.abort()
@@ -2120,6 +2233,7 @@ async function runSandboxedOnce(
     // that is someone else's. macOS's `sandbox-exec` execs the command, so
     // its usage is the task's.
     ...(process.platform === 'linux' ? {} : resourceUsageToCpuRss(proc.resourceUsage())),
+    ranMs,
     tracerFailed:
       straceLog !== undefined &&
       !timeout.timedOut() &&
@@ -2405,7 +2519,7 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  */
 export function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
   const heads = grants
-    .filter((g) => !isMountableLiteral(g))
+    .filter((g) => namedPath(g) === undefined)
     .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
   return walls.filter((w) => heads.some((h) => atOrUnder(w, h)))
 }
@@ -2429,7 +2543,7 @@ export function darwinWallRules(
     for (const w of walls) {
       const at = `(subpath "${sbplResolvedPath(w, 'wall')}")`
       const kept = literals
-        .filter((l) => isMountableLiteral(l) && atOrUnder(l, w))
+        .filter((l) => atOrUnder(l, w))
         .map((l) => `(require-not (subpath "${sbplResolvedPath(l, 'grant')}"))`)
       rules.push(
         kept.length === 0
@@ -2438,8 +2552,11 @@ export function darwinWallRules(
       )
     }
   }
-  deny('file-read-data', c.wallsReached?.read ?? [], [...c.allowRead, ...baseAllowRead])
-  deny('file-write*', c.wallsReached?.write ?? [], c.allowWrite)
+  // A baseline is a name the filesystem handed back, never a pattern: a
+  // bracket in it does not make it a glob.
+  const named = (grants: readonly string[]): string[] => grants.flatMap((g) => namedPath(g) ?? [])
+  deny('file-read-data', c.wallsReached?.read ?? [], [...named(c.allowRead), ...baseAllowRead])
+  deny('file-write*', c.wallsReached?.write ?? [], named(c.allowWrite))
   return rules
 }
 
@@ -2527,8 +2644,9 @@ function expandGrants(
       // A hit that IS a wall, or lies inside one, was matched, not named:
       // `read: ['*']` in a root project bound `.git` and `.vx`, and
       // `packages/*` a nested project its key excludes (B-1). A grant that
-      // names a wall literally never reaches this loop and stays.
-      if (walls.some((w) => atOrUnder(real, w))) continue
+      // names a wall literally never reaches this loop and stays, and one
+      // spelled with escaped brackets names it as surely.
+      if (namedPath(p) === undefined && walls.some((w) => atOrUnder(real, w))) continue
       out.push(abs)
       hits++
     }
@@ -2618,10 +2736,16 @@ function grantSpelled(p: string, within: string): string {
  * names what is missing when there is no form, for the warning and for
  * `vx info`.
  */
-let straceAvailableCache: { form: false | 'plain' | 'seccomp'; why: string } | undefined
-async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
-  if (process.platform !== 'linux') return { form: false, why: '' }
-  if (straceAvailableCache !== undefined) return straceAvailableCache
+let straceAvailableCache: Promise<{ form: false | 'plain' | 'seccomp'; why: string }> | undefined
+function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
+  if (process.platform !== 'linux') return Promise.resolve({ form: false, why: '' })
+  // The promise is the memo, not its answer: a run starts a wave of tasks
+  // at once, and each asked before the first answer landed (one probe per task).
+  straceAvailableCache ??= probeStrace()
+  return straceAvailableCache
+}
+
+async function probeStrace(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
   try {
     const p = Bun.spawn([executablePath('strace'), '--version'], {
       stdout: 'pipe',
@@ -2629,33 +2753,28 @@ async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why:
     })
     const out = await new Response(p.stdout).text()
     await p.exited
-    if (p.exitCode !== 0) {
-      straceAvailableCache = { form: false, why: `strace --version exited ${p.exitCode}` }
-    } else {
-      const m = /version (\d+)\.(\d+)/.exec(out)
-      const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
-      let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
-      let refused = await traceRefusal(form)
-      // A strace that cannot check the seccomp filter says so and traces on
-      // without it, exit 0. Inside the sandbox that line read as the trace
-      // cut short, and every sandboxed task ran twice: the plain form, if
-      // it is quiet, is the one that works here.
-      if (refused?.warned === true && form === 'seccomp') {
-        refused = await traceRefusal('plain')
-        if (refused === null) form = 'plain'
-      }
-      straceAvailableCache =
-        refused === null
-          ? { form, why: '' }
-          : { form: false, why: `strace cannot trace here (${refused.line})` }
+    if (p.exitCode !== 0) return { form: false, why: `strace --version exited ${p.exitCode}` }
+    const m = /version (\d+)\.(\d+)/.exec(out)
+    const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
+    let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+    let refused = await traceRefusal(form)
+    // A strace that cannot check the seccomp filter says so and traces on
+    // without it, exit 0. Inside the sandbox that line read as the trace
+    // cut short, and every sandboxed task ran twice: the plain form, if
+    // it is quiet, is the one that works here.
+    if (refused?.warned === true && form === 'seccomp') {
+      refused = await traceRefusal('plain')
+      if (refused === null) form = 'plain'
     }
+    return refused === null
+      ? { form, why: '' }
+      : { form: false, why: `strace cannot trace here (${refused.line})` }
   } catch {
     // Not on PATH. Said as the refused attach is: without it an undeclared
     // read is denied but never reported, so a task that tolerates the miss
     // passes and caches with no word of it (J's lead).
-    straceAvailableCache = { form: false, why: 'strace is not on PATH' }
+    return { form: false, why: 'strace is not on PATH' }
   }
-  return straceAvailableCache
 }
 
 async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {