@vzn/vx 0.0.596 → 0.0.598

package/src/exec/sandbox-runtime.ts

@@ -33,6 +33,7 @@ import {
   existsSync,
   mkdirSync,
   openSync,
+  readdirSync,
   readFileSync,
   readlinkSync,
   realpathSync,
@@ -54,6 +55,7 @@ import {
   spawnFailureText,
   streamToString,
   resourceUsageToCpuRss,
+  TaskPipes,
   type CaptureConfig,
   type RunResult,
 } from './runner.js'
@@ -81,6 +83,7 @@ import {
   isMountableLiteral,
   localBindingOn,
   MOUNT_WILDCARDS,
+  namedPath,
   toRealPath,
   unique,
 } from './sandbox-paths.js'
@@ -103,6 +106,7 @@ import {
   releaseGroup,
   signalThrough,
   guardLine,
+  guardSession,
   spawnGuarded,
 } from './kill-tree.js'
 
@@ -708,7 +712,8 @@ export async function initSandbox(opts?: {
     ...(scopedDenyScan ? scopedScanConfig() : {}),
     ...bundledJavaAgent(),
   }
-  if (!srtUp) await unlinkStaleMuxSockets()
+  const wasUp = srtUp
+  if (!wasUp) await unlinkStaleMuxSockets()
   const listening = srtCleanupAdopted ? undefined : cleanupListeners()
   await SandboxManager.initialize(
     config,
@@ -718,6 +723,10 @@ export async function initSandbox(opts?: {
   )
   if (listening !== undefined) adoptSrtCleanup(listening)
   srtUp = true
+  if (!wasUp && process.platform === 'linux' && procfsIsOwn()) {
+    const { pids, paths } = sessionLeftovers(SandboxManager)
+    sessionRelease = guardSession(pids, paths)
+  }
   perTaskRun = opts?.allowAllUnixSockets === true || opts?.gitConfig === true ? config : undefined
   // `initialize()` returns early once SRT is up, and on Linux the
   // availability probe brought it up with an EMPTY config before the run's
@@ -766,12 +775,81 @@ function srtDown(): void {
   straceAvailableCache = undefined
 }
 
+/** Strikes the live session from the group guard's lists; set by `initSandbox`. */
+let sessionRelease: (() => void) | undefined
+
+/**
+ * The runtime's session as the group guard must take it if vx dies
+ * (kill-tree.md): the bridge socats, vx's children named by the socket
+ * they listen on, and what a `kill -9` leaves in the temp directory — the
+ * bridge sockets and the `srt-*` sockets vx itself holds (the violation
+ * observer's directory, the mux). The runtime exposes none of the pids and
+ * not the observer's path, so procfs answers: vx's children, and its own
+ * socket inodes against `/proc/net/unix`. ~3 ms, once per session.
+ */
+function sessionLeftovers(SandboxManager: SrtModule['SandboxManager']): {
+  pids: number[]
+  paths: string[]
+} {
+  const sockets = new Set(
+    [SandboxManager.getLinuxHttpSocketPath(), SandboxManager.getLinuxSocksSocketPath()].filter(
+      (p): p is string => p !== undefined,
+    ),
+  )
+  const pids: number[] = []
+  const paths = [...sockets]
+  try {
+    for (const entry of readdirSync('/proc')) {
+      const first = entry.charCodeAt(0)
+      if (first < 48 || first > 57) continue
+      try {
+        const stat = readFileSync(`/proc/${entry}/stat`, 'utf8')
+        if (Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ', 2)[1]) !== process.pid) continue
+        const argv = readFileSync(`/proc/${entry}/cmdline`, 'utf8').split('\0')
+        if (argv.some((a) => [...sockets].some((s) => a.startsWith(`UNIX-LISTEN:${s},`)))) {
+          pids.push(Number(entry))
+        }
+      } catch {
+        // exited
+      }
+    }
+    const inodes = new Set<string>()
+    for (const fd of readdirSync('/proc/self/fd')) {
+      try {
+        const link = readlinkSync(`/proc/self/fd/${fd}`)
+        if (link.startsWith('socket:[')) inodes.add(link.slice(8, -1))
+      } catch {
+        // closed
+      }
+    }
+    const tmp = os.tmpdir()
+    for (const line of readFileSync('/proc/net/unix', 'utf8').split('\n')) {
+      const f = line.trim().split(/\s+/)
+      if (f.length < 8 || !inodes.has(f[6]!)) continue
+      const p = f.slice(7).join(' ')
+      const dir = path.dirname(p)
+      if (dir === tmp && path.basename(p).startsWith('srt-mux-')) paths.push(p)
+      else if (path.dirname(dir) === tmp && path.basename(dir).startsWith('srt-obs-')) {
+        paths.push(dir)
+      }
+    }
+  } catch {
+    // Best-effort, as the guard is: what was found is listed.
+  }
+  return { pids, paths }
+}
+
 /** `reset` is the one `initSandbox` waits out before it starts SRT again. */
 function trackReset(reset: Promise<unknown>): void {
   const settled = reset.then(
     () => {},
     () => {},
   )
+  // Struck once the runtime has killed its bridges and removed its files;
+  // a reset `exit` starts never settles, and the guard takes the rest.
+  const release = sessionRelease
+  sessionRelease = undefined
+  if (release !== undefined) void settled.then(release)
   resetting = settled
   void settled.then(() => {
     if (resetting === settled) resetting = undefined
@@ -1180,7 +1258,12 @@ async function wrapIn(
   tmp: string,
 ): ReturnType<typeof wrapSandboxedCommand> {
   // After the tag: SRT keys violations by the command's first 100 chars.
-  const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${javaToolOptionsFix(
+  // TMP and TEMP pass through from the host, whose temp directory the
+  // sandbox mounts read-only: a tool reading them failed to write there.
+  const alsoTmp = ['TMP', 'TEMP'].filter((name) => args.env[name] !== undefined)
+  const inTmp = `export TMPDIR=${shellQuote(tmp)}; ${alsoTmp
+    .map((name) => `export ${name}="$TMPDIR"; `)
+    .join('')}${javaToolOptionsFix(
     process.env['JAVA_TOOL_OPTIONS'],
     args.env['JAVA_TOOL_OPTIONS'],
   )}${userCommand}`
@@ -1199,6 +1282,11 @@ async function wrapIn(
     customConfig!.filesystem!.denyRead!.push(baselines.cwd)
   }
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
+  // Seatbelt judges `/dev/stdout` by the path the kernel resolves it to,
+  // `/dev/fd/1`, which SRT's default `/dev/stdout` grant does not name, so
+  // `echo x > /dev/stdout` failed EPERM (X-113). `/dev/fd/N` reopens only a
+  // descriptor the task already holds.
+  if (process.platform === 'darwin') customConfig!.filesystem!.allowWrite!.push('/dev/fd')
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(
       ...scopedMandatoryDenies(
@@ -1226,7 +1314,10 @@ async function wrapIn(
         `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
     )
   }
-  if (ports.length > 0) writeFileSync(portDialScript(tag), PORT_DIAL_SCRIPT)
+  if (ports.length > 0) {
+    hostBridges.set(tag, { ports, procs: [] })
+    writeFileSync(portDialScript(tag), PORT_DIAL_SCRIPT)
+  }
   const grouped =
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
@@ -1244,7 +1335,7 @@ async function wrapIn(
     process.platform === 'linux'
       ? literalReadPaths(customConfig)
       : process.platform === 'darwin'
-        ? seatbeltBrackets(customConfig)
+        ? seatbeltBrackets(customConfig, baselines.allowRead)
         : customConfig,
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
@@ -1456,22 +1547,37 @@ function literalReadPaths(
  * file and the route could not be granted. `[[]` is a class of one `[`; a
  * lone `]` is plain text (B-65). A deny path is a real directory, never a
  * pattern: a nested project's wall under `[legacy]/` compiled as a class,
- * matched nothing, and the root task read it.
+ * matched nothing, and the root task read it. So is each of `names`, the
+ * baseline reads: a linked dependency under `packages/[legacy]/` was a
+ * class too, and as an exact regex even `[[]` grants the directory's entry
+ * and none of its files, so its subtree is granted beside it (a trailing
+ * `/**` is stripped before the compile). A task's read grant whose only
+ * brackets are escaped names one path too, and Linux binds it whole, so
+ * it gets the same subtree: `out/\[id\]` read `out/[id]` and none of it.
  */
 export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
+  names: readonly string[] = [],
 ): Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] {
   const fs = config?.filesystem
   if (fs === undefined) return config
-  const literal = (paths: readonly string[]): string[] =>
-    paths.map((p) => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']'))
+  const literal = (p: string): string => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']')
+  const bracketed = new Set(names.filter((n) => /[[\]]/.test(n)))
+  const read = (p: string): string[] => {
+    const name = bracketed.has(p) ? p : /\\[[\]]/.test(p) ? namedPath(p) : undefined
+    if (name === undefined) return [literal(p)]
+    const at = name.replaceAll('[', '[[]')
+    return [at, `${at}/**/*`]
+  }
   return {
     ...config,
     filesystem: {
       ...fs,
       denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
-      allowWrite: literal(fs.allowWrite),
-      ...(fs.allowRead !== undefined ? { allowRead: literal(fs.allowRead) } : {}),
+      allowWrite: fs.allowWrite.map(literal),
+      ...(fs.allowRead !== undefined
+        ? { allowRead: [...new Set(fs.allowRead.flatMap(read))] }
+        : {}),
     },
   }
 }
@@ -1588,7 +1694,14 @@ const hostBridges = new Map<
  * (2026-10-03). Linux, own procfs only, as the wait.
  */
 function portsHeld(ports: readonly number[]): number[] {
-  if (ports.length === 0 || !procfsIsOwn()) return []
+  if (ports.length === 0) return []
+  // This run's own bridges first: a wrap claims its ports before it awaits,
+  // and two tasks granted one port both read the table before either
+  // bridge bound, so the second's bind failed unseen and its clients
+  // reached the first task.
+  const claimed = new Set([...hostBridges.values()].flatMap((b) => b.ports))
+  const ours = ports.filter((p) => claimed.has(p))
+  if (ours.length > 0 || !procfsIsOwn()) return ours
   const held = new Set<string>()
   for (const [file, any, loop] of [
     ['/proc/net/tcp', '00000000', '0100007F'],
@@ -1644,7 +1757,7 @@ async function hostBridgesListen(ports: readonly number[], tag: string): Promise
 }
 
 function spawnHostBridges(ports: readonly number[], tag: string): void {
-  const procs: Array<ReturnType<typeof Bun.spawn>> = []
+  const procs = hostBridges.get(tag)!.procs
   for (const p of ports) {
     // A spawn failure (no socat on the host) is the task's to report:
     // its own side dies the same way, in its frame.
@@ -1674,10 +1787,7 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
       // see above
     }
   }
-  if (procs.length > 0) {
-    hostBridges.set(tag, { ports, procs })
-    for (const p of ports) unlinkOnExit(portBridgeSocket(tag, p))
-  }
+  if (procs.length > 0) for (const p of ports) unlinkOnExit(portBridgeSocket(tag, p))
 }
 
 /**
@@ -1736,12 +1846,22 @@ const TRACER_RETRY_LINE =
  * declared, so a second run redoes, not doubles, it.
  */
 export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRunResult> {
-  const { tracerFailed, ...first } = await runSandboxedOnce(args)
+  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce(args)
   // A stopping run has killed the children it holds; a retry would be one
   // spawned after that kill.
   if (!tracerFailed || args.signal?.aborted === true) return first
   args.onStderr?.(TRACER_RETRY_LINE)
-  const { tracerFailed: _again, ...second } = await runSandboxedOnce(args)
+  // `timeout` bounds the task's whole run (schema.md), so the retry gets
+  // what the first attempt left of it, not a fresh window.
+  const {
+    tracerFailed: _again,
+    ranMs: _ran,
+    ...second
+  } = await runSandboxedOnce(
+    args.timeoutMs === undefined
+      ? args
+      : { ...args, timeoutMs: Math.max(0, args.timeoutMs - ranMs) },
+  )
   return {
     ...second,
     durationMs: first.durationMs + second.durationMs,
@@ -1808,7 +1928,7 @@ const STRACE_OWN_ERROR = /^(?:[^\s:]*\/)?strace: /
  */
 async function runSandboxedOnce(
   args: SandboxedRunArgs,
-): Promise<SandboxedRunResult & { tracerFailed: boolean }> {
+): Promise<SandboxedRunResult & { tracerFailed: boolean; ranMs: number }> {
   const start = Date.now()
   const { SandboxManager } = await loadSrt()
   // Linux: SRT's store sees only writes (below), so read denials need
@@ -1858,6 +1978,7 @@ async function runSandboxedOnce(
       signal,
       violations: [],
       tracerFailed: false,
+      ranMs: 0,
     }
   }
   // Beside the task directories, which every sandbox replaces with its own:
@@ -1867,6 +1988,7 @@ async function runSandboxedOnce(
   if (straceLog) unlinkOnExit(straceLog)
   let proc: ReturnType<typeof Bun.spawn>
   let traceFd: number | undefined
+  const pipes = new TaskPipes()
   try {
     // Resolved on vx's own PATH (util/which.ts), not the task's, where a
     // project's node_modules/.bin comes first.
@@ -1881,8 +2003,7 @@ async function runSandboxedOnce(
         env: args.env as Record<string, string>,
         stdio: [
           'ignore',
-          'pipe',
-          'pipe',
+          ...pipes.stdio,
           forwardsSignals ? 'pipe' : 'ignore',
           guard ?? 'ignore',
           ...(traceFd === undefined ? [] : [traceFd]),
@@ -1893,6 +2014,7 @@ async function runSandboxedOnce(
     )
     if (forwardsSignals) signalThrough(proc, proc.stdio[3] as number)
   } catch (err) {
+    pipes.close()
     if (straceLog) {
       rmSync(straceLog, { force: true })
       liveTempFiles.delete(straceLog)
@@ -1910,23 +2032,27 @@ async function runSandboxedOnce(
       spawnFailed: true,
       violations: [],
       tracerFailed: false,
+      ranMs: 0,
     }
   } finally {
     // The child holds its own copy; ours would keep nothing but a descriptor.
     if (traceFd !== undefined) closeSync(traceFd)
+    pipes.spawned()
   }
 
   args.liveChildren?.add(proc)
   args.onSpawn?.(proc.pid)
   const timeout = armTimeout(proc, args.timeoutMs)
+  const armedAt = Date.now()
   const ac = new AbortController()
   // The unfinished last line of stderr, and whether a line was strace's.
   let partial = ''
   let straceSpoke = false
+  const [out, err] = pipes.streams(proc)
   const streams = Promise.all([
-    streamToString(proc.stdout, args.onStdout, ac.signal, args.capture?.stdout ?? true),
+    streamToString(out, args.onStdout, ac.signal, args.capture?.stdout ?? true),
     streamToString(
-      proc.stderr,
+      err,
       (chunk) => {
         // Read whatever the capture setting: a line of strace's own says
         // the trace stopped short.
@@ -1938,11 +2064,12 @@ async function runSandboxedOnce(
       ac.signal,
       args.capture?.stderr ?? true,
     ),
-  ])
+  ]).finally(() => pipes.close())
   // See runCommand: gate on child exit; a lingering grandchild pipe (timeout
   // OR a clean exit that backgrounds a process) can't hang the run — timeout
   // aborts at once, otherwise drainOrAbort bounds the post-exit drain.
   await proc.exited
+  const ranMs = Date.now() - armedAt
   await timeout.settle()
   let cut = false
   if (timeout.timedOut()) ac.abort()
@@ -2120,6 +2247,7 @@ async function runSandboxedOnce(
     // that is someone else's. macOS's `sandbox-exec` execs the command, so
     // its usage is the task's.
     ...(process.platform === 'linux' ? {} : resourceUsageToCpuRss(proc.resourceUsage())),
+    ranMs,
     tracerFailed:
       straceLog !== undefined &&
       !timeout.timedOut() &&
@@ -2405,7 +2533,7 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  */
 export function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
   const heads = grants
-    .filter((g) => !isMountableLiteral(g))
+    .filter((g) => namedPath(g) === undefined)
     .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
   return walls.filter((w) => heads.some((h) => atOrUnder(w, h)))
 }
@@ -2429,7 +2557,7 @@ export function darwinWallRules(
     for (const w of walls) {
       const at = `(subpath "${sbplResolvedPath(w, 'wall')}")`
       const kept = literals
-        .filter((l) => isMountableLiteral(l) && atOrUnder(l, w))
+        .filter((l) => atOrUnder(l, w))
         .map((l) => `(require-not (subpath "${sbplResolvedPath(l, 'grant')}"))`)
       rules.push(
         kept.length === 0
@@ -2438,8 +2566,11 @@ export function darwinWallRules(
       )
     }
   }
-  deny('file-read-data', c.wallsReached?.read ?? [], [...c.allowRead, ...baseAllowRead])
-  deny('file-write*', c.wallsReached?.write ?? [], c.allowWrite)
+  // A baseline is a name the filesystem handed back, never a pattern: a
+  // bracket in it does not make it a glob.
+  const named = (grants: readonly string[]): string[] => grants.flatMap((g) => namedPath(g) ?? [])
+  deny('file-read-data', c.wallsReached?.read ?? [], [...named(c.allowRead), ...baseAllowRead])
+  deny('file-write*', c.wallsReached?.write ?? [], named(c.allowWrite))
   return rules
 }
 
@@ -2527,8 +2658,9 @@ function expandGrants(
       // A hit that IS a wall, or lies inside one, was matched, not named:
       // `read: ['*']` in a root project bound `.git` and `.vx`, and
       // `packages/*` a nested project its key excludes (B-1). A grant that
-      // names a wall literally never reaches this loop and stays.
-      if (walls.some((w) => atOrUnder(real, w))) continue
+      // names a wall literally never reaches this loop and stays, and one
+      // spelled with escaped brackets names it as surely.
+      if (namedPath(p) === undefined && walls.some((w) => atOrUnder(real, w))) continue
       out.push(abs)
       hits++
     }
@@ -2618,10 +2750,16 @@ function grantSpelled(p: string, within: string): string {
  * names what is missing when there is no form, for the warning and for
  * `vx info`.
  */
-let straceAvailableCache: { form: false | 'plain' | 'seccomp'; why: string } | undefined
-async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
-  if (process.platform !== 'linux') return { form: false, why: '' }
-  if (straceAvailableCache !== undefined) return straceAvailableCache
+let straceAvailableCache: Promise<{ form: false | 'plain' | 'seccomp'; why: string }> | undefined
+function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
+  if (process.platform !== 'linux') return Promise.resolve({ form: false, why: '' })
+  // The promise is the memo, not its answer: a run starts a wave of tasks
+  // at once, and each asked before the first answer landed (one probe per task).
+  straceAvailableCache ??= probeStrace()
+  return straceAvailableCache
+}
+
+async function probeStrace(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
   try {
     const p = Bun.spawn([executablePath('strace'), '--version'], {
       stdout: 'pipe',
@@ -2629,33 +2767,28 @@ async function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why:
     })
     const out = await new Response(p.stdout).text()
     await p.exited
-    if (p.exitCode !== 0) {
-      straceAvailableCache = { form: false, why: `strace --version exited ${p.exitCode}` }
-    } else {
-      const m = /version (\d+)\.(\d+)/.exec(out)
-      const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
-      let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
-      let refused = await traceRefusal(form)
-      // A strace that cannot check the seccomp filter says so and traces on
-      // without it, exit 0. Inside the sandbox that line read as the trace
-      // cut short, and every sandboxed task ran twice: the plain form, if
-      // it is quiet, is the one that works here.
-      if (refused?.warned === true && form === 'seccomp') {
-        refused = await traceRefusal('plain')
-        if (refused === null) form = 'plain'
-      }
-      straceAvailableCache =
-        refused === null
-          ? { form, why: '' }
-          : { form: false, why: `strace cannot trace here (${refused.line})` }
+    if (p.exitCode !== 0) return { form: false, why: `strace --version exited ${p.exitCode}` }
+    const m = /version (\d+)\.(\d+)/.exec(out)
+    const [major, minor] = m ? [Number(m[1]), Number(m[2])] : [0, 0]
+    let form: 'plain' | 'seccomp' = major > 5 || (major === 5 && minor >= 3) ? 'seccomp' : 'plain'
+    let refused = await traceRefusal(form)
+    // A strace that cannot check the seccomp filter says so and traces on
+    // without it, exit 0. Inside the sandbox that line read as the trace
+    // cut short, and every sandboxed task ran twice: the plain form, if
+    // it is quiet, is the one that works here.
+    if (refused?.warned === true && form === 'seccomp') {
+      refused = await traceRefusal('plain')
+      if (refused === null) form = 'plain'
     }
+    return refused === null
+      ? { form, why: '' }
+      : { form: false, why: `strace cannot trace here (${refused.line})` }
   } catch {
     // Not on PATH. Said as the refused attach is: without it an undeclared
     // read is denied but never reported, so a task that tolerates the miss
     // passes and caches with no word of it (J's lead).
-    straceAvailableCache = { form: false, why: 'strace is not on PATH' }
+    return { form: false, why: 'strace is not on PATH' }
   }
-  return straceAvailableCache
 }
 
 async function wantsStraceDetection(): Promise<false | 'plain' | 'seccomp'> {

package/src/exec/sandbox-violations.ts

@@ -4,7 +4,7 @@
 // task's owner can act on — inside the project, minus the loopback denial
 // no grant can avoid, minus what the task chose to ignore.
 
-import { lstatSync, statSync } from 'node:fs'
+import { existsSync, lstatSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import { bindableReads, bindableWrites } from './sandbox-binds.js'
@@ -364,6 +364,10 @@ export async function parseStraceViolations(
   // workspace, never reported.
   const pendingWrites = (args.config.pendingWrites ?? []).map((g) => new Bun.Glob(g))
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
+  const mounted = new Set([
+    ...allowAbs,
+    ...bindableWrites(args.config.allowWrite).map((p) => toRealPath(absolutize(p))),
+  ])
   // A read under a widened write grant's directory is never refused, so it
   // is reported when it succeeds: an entry that was there at the start and
   // no grant covers is an input the key never saw, and so is the
@@ -388,12 +392,14 @@ export async function parseStraceViolations(
     baselines.cwd,
     widened.size > 0,
   )) {
-    const abs = toRealPath(absolutize(rawPath, dir ?? baselines.cwd))
+    const lexical = absolutize(rawPath, dir ?? baselines.cwd)
+    const abs = toRealPath(lexical)
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
-    if (isUnderAny(abs, allowAbs) || underGlob(abs, pendingWrites)) continue
+    if (isUnderAny(abs, allowAbs) && !hiddenByLink(lexical, abs, mounted, denyAnchors)) continue
+    if (underGlob(abs, pendingWrites)) continue
     if (read === true && !undeclared(abs)) continue
     // A hidden path answers ENOENT, as a missing one does: a probe
     // (`./gen.sh || …`, `test -x`, a PATH walk) is a refusal only where
@@ -427,6 +433,39 @@ export async function parseStraceViolations(
   return out
 }
 
+/**
+ * A granted file the task could not open because a link on the path it
+ * opened is not in the sandbox. A grant is mounted at its real path and
+ * bwrap mounts no link, so `read: ['config.json']` over `config.json ->
+ * conf/real.json` bound the target and left the name the task opens out;
+ * judged by its real path, the ENOENT was granted and dropped, and a tool
+ * that fell back on the missing file was cached green. The link is there
+ * when the directory holding it is mounted; a target missing on the host
+ * is missing outside the sandbox too, and outside the deny anchor the
+ * host is mounted, links and all.
+ */
+function hiddenByLink(
+  lexical: string,
+  real: string,
+  mounted: Set<string>,
+  anchors: readonly string[],
+): boolean {
+  if (lexical === real || !existsSync(real)) return false
+  let at = lexical
+  const links: string[] = []
+  for (let up = path.dirname(at); up !== at; at = up, up = path.dirname(at)) {
+    try {
+      if (lstatSync(at).isSymbolicLink()) links.push(at)
+    } catch {
+      // Not on the host by this spelling: no link to judge here.
+    }
+  }
+  return links.some((l) => {
+    const holder = toRealPath(path.dirname(l))
+    return anchors.some((a) => atOrUnder(holder, a)) && !isUnderAny(holder, mounted)
+  })
+}
+
 /**
  * Does a violation line match something the task said to ignore?
  *
@@ -444,9 +483,11 @@ function matchesIgnore(
   ignore: NonNullable<ResolvedSandboxConfig['ignore']>,
 ): boolean {
   if (v.target === undefined || v.ignorable === undefined) return false
+  const proxy = PROXY_DENY_RE.test(v.line)
   for (const which of v.ignorable) {
-    const patterns = ignore[which]
-    if (patterns === undefined) continue
+    const listed = ignore[which]
+    if (listed === undefined) continue
+    const patterns = proxy ? listed.map(hostKey) : listed
     const subject = which === 'read' || which === 'write' ? (v.path ?? v.target) : v.target
     if (patterns.some((pat) => pat === subject || new Bun.Glob(pat).match(subject))) return true
   }
@@ -460,7 +501,7 @@ function matchesIgnore(
  */
 function describeMacViolation(line: string): Partial<SandboxViolation> {
   const proxy = PROXY_DENY_RE.exec(line)
-  if (proxy !== null) return { target: proxy[1]!, ignorable: ['network'] }
+  if (proxy !== null) return { target: hostKey(proxy[1]!), ignorable: ['network'] }
   const m = /deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/.exec(line)
   if (m === null) return {}
   const [op, target] = [m[1]!, m[2]!]
@@ -677,6 +718,18 @@ function filterIgnored(
  */
 const PROXY_DENY_RE = /^deny network-outbound (\S+) \([^)]*\)$/
 
+/**
+ * `<host>[:<port>]` as the proxy matches it: case-blind, no trailing dot.
+ * The record keeps the client's spelling (curl sends `EXAMPLE.Com`, curl
+ * and Bun keep `example.com.`), so an exact match against the ignore list
+ * left a refusal the task named in its report.
+ */
+function hostKey(target: string): string {
+  const colon = target.lastIndexOf(':')
+  const host = colon === -1 ? target : target.slice(0, colon)
+  return host.toLowerCase().replace(/\.$/, '') + (colon === -1 ? '' : target.slice(colon))
+}
+
 /**
  * Linux: the connections the proxy refused, from the store records. Only
  * the write observer's records were read there, so a task denied a host

package/src/graph/priorities.ts

@@ -152,8 +152,7 @@ export function mergePriorities(
   // it sorts above the baseline for any node it covers, and add the
   // baseline as a tie-break for parity within the override set.
   const SCALE = 1 << 20
-  const out = new Map<string, number>()
-  for (const [id, w] of baseline) out.set(id, w)
+  const out = new Map(baseline)
   for (const [id, w] of overrides) {
     const b = baseline.get(id) ?? 0
     out.set(id, w * SCALE + b)

package/src/graph/scheduler.ts

@@ -179,8 +179,8 @@ export interface TaskOutcome {
   /** The attempts that failed and were run again, in order: when each ended (epoch ms) and how. */
   failedAttempts?: readonly { endedAt: number; exitCode: number; timedOut?: true }[]
   /**
-   * Set when this run proved the task flaky: its key holds both outcomes on
-   * record (this run's included) or it needed a retry. Its row carries it.
+   * Set when this run proved the task flaky: its key failed after it had
+   * passed (this run's included) or it needed a retry. Its row carries it.
    */
   flaky?: { passes: number; failures: number }
   /**