@vzn/vx 0.0.597 → 0.0.599

package/src/exec/kill-tree.ts

@@ -65,13 +65,16 @@ export function closeSignalChannel(child: Child): void {
 let guardFd: number | null | undefined
 
 // Three lists: groups (`+`/`-`), single pids (`=`/`_`) and paths to
-// remove (`@`/`!`), killed and removed in that order at EOF.
+// remove (`@`/`!`), killed and removed in that order at EOF. A
+// group is listed once however often its line arrives: a `-` strikes
+// one entry, and a shell that keeps a failed printf buffered (bash as
+// macOS's sh, B-10) sends the line again with its retry.
 const GUARD_SCRIPT = [
   "g=' ' k=' ' f=' '",
   'while IFS= read -r l; do',
   '  p=${l#?}',
   '  case $l in',
-  '    +*) g="$g$p " ;;',
+  '    +*) case $g in *" $p "*) ;; *) g="$g$p " ;; esac ;;',
   '    -*) case $g in *" $p "*) g="${g%% $p *} ${g#* $p }" ;; esac ;;',
   '    =*) k="$k$p " ;;',
   '    _*) case $k in *" $p "*) k="${k%% $p *} ${k#* $p }" ;; esac ;;',
@@ -168,18 +171,45 @@ function guardWrite(line: string): void {
  */
 export function spawnGuarded(spawn: (guard: number | undefined) => Child): Child {
   startGuard()
-  return spawn(typeof guardFd === 'number' ? guardFd : undefined)
+  if (typeof guardFd !== 'number') return spawn(undefined)
+  handingTo = guardProc?.pid
+  try {
+    return spawn(guardFd)
+  } finally {
+    handingTo = undefined
+  }
 }
 
+/**
+ * The guard whose pipe `spawnGuarded` is handing over right now. Only a
+ * line built for that hand-over retries: its pipe is broken only once
+ * the guard has exited, so `kill -0` ends the wait. A line for any other
+ * pipe would wait on a guard that has nothing to do with it.
+ */
+let handingTo: number | undefined
+
 /**
  * The shell line that lists `$$`'s group on the guard's pipe at `fd` and
  * closes it, so the task never holds the guard open. `$$` is the spawned
  * shell, which leads its group (every guarded spawn is `detached`); a
  * program that is not a shell is `exec`'d after it. A write to a guard
  * that has died is ignored rather than a SIGPIPE that kills the task.
+ * The pipe is vx's own nonblocking one, so a full queue fails the write
+ * (EAGAIN) and the group went unlisted: the write is retried while the
+ * guard lives. The shell cannot tell EAGAIN from EPIPE, so the guard's
+ * pid ends the wait, and vx SIGKILLs a guard it gives up on.
  */
 export function guardLine(fd: number): string {
-  return `trap '' PIPE; printf '+%s\\n' $$ >&${fd} 2>/dev/null; trap - PIPE; exec ${fd}>&-; `
+  const add = `printf '+%s\\n' $$ >&${fd} 2>/dev/null`
+  // `kill -0` counts a zombie, and a guard vx has not reaped (its event
+  // loop busy, or an init that never reaps an orphan after vx's kill -9)
+  // kept the shell spinning. Where /proc is ours, its state says dead;
+  // `##*) ` cuts at the LAST ')', as comm may hold one.
+  const alive = procfsIsOwn()
+    ? `{ read -r vx_g </proc/${handingTo}/stat; } 2>/dev/null && case "\${vx_g##*) }" in [ZX]*) false ;; esac`
+    : `kill -0 ${handingTo} 2>/dev/null`
+  const retry = handingTo === undefined ? '' : ` || until ${add}; do ${alive} || break; done`
+  return `trap '' PIPE; ${add}${retry}; trap - PIPE; exec ${fd}>&-; `
 }
 
 /**

package/src/exec/runner.ts

@@ -4,7 +4,8 @@
 // process exits. cpuMs / peakRssBytes are then surfaced on RunResult and
 // folded into the v11 `runs` table by the orchestrator.
 
-import { existsSync, readFileSync } from 'node:fs'
+import type { Pointer } from 'bun:ffi'
+import { closeSync, existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
 import {
   shellArgv,
@@ -98,11 +99,134 @@ export interface RunOptions {
   terminal?: boolean
 }
 
+type Fd = 'inherit' | 'ignore' | 'pipe' | number
+
 /** A child's descriptors 0–2: vx's own for a task that holds the terminal. */
-function taskStdio(terminal: boolean | undefined, stdin: 'ignore' | 'pipe') {
-  return terminal === true
-    ? (['inherit', 'inherit', 'inherit'] as const)
-    : ([stdin, 'pipe', 'pipe'] as const)
+function taskStdio(
+  terminal: boolean | undefined,
+  stdin: 'ignore' | 'pipe',
+  pipes: TaskPipes,
+): [Fd, Fd, Fd] {
+  return terminal === true ? ['inherit', 'inherit', 'inherit'] : [stdin, ...pipes.stdio]
+}
+
+const O_NONBLOCK = 0o4000
+const O_CLOEXEC = 0o2000000
+const F_SETFL = 4
+const F_SETPIPE_SZ = 1031
+/**
+ * A pipe holds 64 KiB by default, and a 200 MB stdout drained 13% slower
+ * through one than through Bun's socketpair (min of 7: 293 vs 259 ms);
+ * at 256 KiB it drained in 230. Past the user's pipe quota the kernel
+ * refuses the resize and the pipe keeps its 64 KiB.
+ */
+const PIPE_BYTES = 256 * 1024
+
+type PipeCalls = {
+  pipe2: (fds: Pointer, flags: number) => number
+  fcntl: (fd: number, cmd: number, arg: number) => number
+  ptr: (view: Int32Array, byteOffset?: number) => Pointer
+}
+let pipeCalls: PipeCalls | null | undefined
+
+/** libc's `pipe2` and `fcntl`, bound once; null off Linux or where libc will not load. */
+function linuxPipeCalls(): PipeCalls | null {
+  if (pipeCalls !== undefined) return pipeCalls
+  pipeCalls = null
+  if (process.platform !== 'linux') return null
+  try {
+    // Loaded at the first spawn, not with the module: a static import cost
+    // every vx start 0.3 ms, a warm run that spawns nothing included.
+    const { dlopen, FFIType, ptr } = require('bun:ffi') as typeof import('bun:ffi')
+    // glibc's soname; musl's loader answers any `libc.` name with itself
+    // (ldso/dynlink.c's reserved names).
+    const { symbols } = dlopen('libc.so.6', {
+      pipe2: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
+      fcntl: { args: [FFIType.i32, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    })
+    pipeCalls = { pipe2: symbols.pipe2, fcntl: symbols.fcntl, ptr }
+  } catch {
+    // Bun's socketpair, as before: only `/dev/stdout` by path fails on it.
+  }
+  return pipeCalls
+}
+
+/**
+ * Two pipes, `[out read, out write, err read, err write]`, or undefined
+ * when libc is not bound or a descriptor is not to be had (Bun's own
+ * socketpair then fails the spawn with the reason).
+ */
+function realPipes(): Int32Array | undefined {
+  const calls = linuxPipeCalls()
+  if (calls === null) return undefined
+  const fds = new Int32Array(4)
+  // Bun's spawn closes every descriptor it is not handed (probed, Bun
+  // 1.4.2); O_CLOEXEC keeps any other exec from holding a write end open.
+  if (calls.pipe2(calls.ptr(fds), O_CLOEXEC) !== 0) return undefined
+  if (calls.pipe2(calls.ptr(fds, 8), O_CLOEXEC) !== 0) {
+    closeSync(fds[0]!)
+    closeSync(fds[1]!)
+    return undefined
+  }
+  // vx's ends only: a task whose stdout is non-blocking fails its writes with EAGAIN.
+  calls.fcntl(fds[0]!, F_SETFL, O_NONBLOCK)
+  calls.fcntl(fds[2]!, F_SETFL, O_NONBLOCK)
+  calls.fcntl(fds[0]!, F_SETPIPE_SZ, PIPE_BYTES)
+  calls.fcntl(fds[2]!, F_SETPIPE_SZ, PIPE_BYTES)
+  return fds
+}
+
+/**
+ * A task's stdout and stderr. Bun's `'pipe'` is a socketpair, and Linux
+ * opens `/dev/stdout` through `/proc/self/fd/1`, which a socket refuses
+ * (ENXIO): `echo x > /dev/stdout` and `cmd | tee /dev/stderr` failed in
+ * every task, where a terminal or Turbo hands real pipes (X-113). So on
+ * Linux vx makes the pipes (`pipe2` through `bun:ffi`) and hands the child
+ * the write ends. macOS opens `/dev/fd/N` as a dup of the descriptor,
+ * which a socket allows, so Bun's pipe stays there.
+ */
+export class TaskPipes {
+  /** Descriptors 1 and 2 for `Bun.spawn`'s `stdio`. */
+  readonly stdio: readonly [number | 'pipe', number | 'pipe']
+  readonly #read: readonly number[]
+
+  constructor(terminal?: boolean) {
+    const fds = terminal === true ? undefined : realPipes()
+    this.stdio = fds === undefined ? ['pipe', 'pipe'] : [fds[1]!, fds[3]!]
+    this.#read = fds === undefined ? [] : [fds[0]!, fds[2]!]
+  }
+
+  /**
+   * Close vx's copies of the write ends once the spawn has returned or
+   * thrown: the child holds its own, and one left here is a writer the
+   * reader's EOF would wait for.
+   */
+  spawned(): void {
+    for (const fd of this.stdio) if (typeof fd === 'number') closeSync(fd)
+  }
+
+  /** The child's stdout and stderr. */
+  streams(
+    child: ReturnType<typeof Bun.spawn>,
+  ): [
+    ReadableStream<Uint8Array> | number | undefined,
+    ReadableStream<Uint8Array> | number | undefined,
+  ] {
+    const [out, err] = this.#read
+    return out === undefined
+      ? [child.stdout, child.stderr]
+      : [Bun.file(out).stream(), Bun.file(err!).stream()]
+  }
+
+  /**
+   * Close the read ends, once both streams have ended or been cancelled.
+   * Bun reads a dup of each, but takes it on the stream's first pull: a
+   * number closed before then was reused by the next spawn's pipe, and
+   * the stream read THAT (probed, Bun 1.4.2).
+   */
+  close(): void {
+    for (const fd of this.#read) closeSync(fd)
+  }
 }
 
 /**
@@ -598,6 +722,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const readyRe = opts.readyWhen !== undefined ? new RegExp(opts.readyWhen) : undefined
 
   let child: ReturnType<typeof Bun.spawn>
+  const pipes = new TaskPipes(opts.terminal)
   const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     const signalFd = opts.signalChannel === true
@@ -619,7 +744,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
           // The one-shot spawn below keeps 'ignore', so a task that reads
           // stdin can never hang CI.
           stdio: [
-            ...taskStdio(opts.terminal, 'pipe'),
+            ...taskStdio(opts.terminal, 'pipe', pipes),
             ...(signalFd ? ['pipe' as const] : []),
             ...(guard === undefined ? [] : [guard]),
           ],
@@ -637,6 +762,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
       void spawned.exited.then(() => closeSignalChannel(spawned))
     }
   } catch (err) {
+    pipes.close()
     const message = err instanceof Error ? err.message : String(err)
     return {
       child: undefined as unknown as ReturnType<typeof Bun.spawn>,
@@ -645,6 +771,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
       ),
       readyMs: () => Date.now() - start,
     }
+  } finally {
+    pipes.spawned()
   }
 
   let resolveReady!: () => void
@@ -738,8 +866,10 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
 
   // Wire up readers. We deliberately don't await them — they run for
   // the child's lifetime. The `ready` promise resolves out-of-band.
-  void consumeChunks(child.stdout, false)
-  void consumeChunks(child.stderr, true)
+  const [stdout, stderr] = pipes.streams(child)
+  void Promise.all([consumeChunks(stdout, false), consumeChunks(stderr, true)]).finally(() =>
+    pipes.close(),
+  )
 
   opts.liveChildren?.add(child)
   opts.onSpawn?.(child.pid)
@@ -834,6 +964,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const fullCommand = withForwardArgs(opts.command, opts.forwardArgs)
 
   let proc: ReturnType<typeof Bun.spawn>
+  const pipes = new TaskPipes(opts.terminal)
   const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     proc = spawnGuarded((guard) =>
@@ -841,7 +972,10 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
         ...SH_ARGV0,
         cwd: opts.cwd,
         env: opts.env as Record<string, string>,
-        stdio: [...taskStdio(opts.terminal, 'ignore'), ...(guard === undefined ? [] : [guard])],
+        stdio: [
+          ...taskStdio(opts.terminal, 'ignore', pipes),
+          ...(guard === undefined ? [] : [guard]),
+        ],
         // Its own session and process group, so a kill reaches what it
         // forked (kill-tree.ts). A terminal handed over is not this
         // session's controlling one, so no read stops the group.
@@ -849,19 +983,23 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
       }),
     )
   } catch (err) {
+    pipes.close()
     const stderr = spawnFailureText(err, opts.cwd)
     opts.onStderr?.(stderr)
     return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr, spawnFailed: true }
+  } finally {
+    pipes.spawned()
   }
 
   opts.liveChildren?.add(proc)
   opts.onSpawn?.(proc.pid)
   const timeout = armTimeout(proc, opts.timeoutMs)
   const ac = new AbortController()
+  const [out, err] = pipes.streams(proc)
   const streams = Promise.all([
-    streamToString(proc.stdout, opts.onStdout, ac.signal, opts.capture?.stdout ?? true),
-    streamToString(proc.stderr, opts.onStderr, ac.signal, opts.capture?.stderr ?? true),
-  ])
+    streamToString(out, opts.onStdout, ac.signal, opts.capture?.stdout ?? true),
+    streamToString(err, opts.onStderr, ac.signal, opts.capture?.stderr ?? true),
+  ]).finally(() => pipes.close())
   // Gate on the child's own exit, not on stream EOF: an orphaned grandchild
   // can keep the pipe open past the child's exit (a timeout SIGTERM leaves the
   // grandchild alive; a NORMAL exit of `server & echo up` does too), so EOF may

package/src/exec/sandbox-runtime.ts

@@ -55,6 +55,7 @@ import {
   spawnFailureText,
   streamToString,
   resourceUsageToCpuRss,
+  TaskPipes,
   type CaptureConfig,
   type RunResult,
 } from './runner.js'
@@ -1281,6 +1282,11 @@ async function wrapIn(
     customConfig!.filesystem!.denyRead!.push(baselines.cwd)
   }
   customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
+  // Seatbelt judges `/dev/stdout` by the path the kernel resolves it to,
+  // `/dev/fd/1`, which SRT's default `/dev/stdout` grant does not name, so
+  // `echo x > /dev/stdout` failed EPERM (X-113). `/dev/fd/N` reopens only a
+  // descriptor the task already holds.
+  if (process.platform === 'darwin') customConfig!.filesystem!.allowWrite!.push('/dev/fd')
   if (scopedDenyScan) {
     customConfig!.filesystem!.denyWrite!.push(
       ...scopedMandatoryDenies(
@@ -1545,7 +1551,9 @@ function literalReadPaths(
  * baseline reads: a linked dependency under `packages/[legacy]/` was a
  * class too, and as an exact regex even `[[]` grants the directory's entry
  * and none of its files, so its subtree is granted beside it (a trailing
- * `/**` is stripped before the compile).
+ * `/**` is stripped before the compile). A task's read grant whose only
+ * brackets are escaped names one path too, and Linux binds it whole, so
+ * it gets the same subtree: `out/\[id\]` read `out/[id]` and none of it.
  */
 export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
@@ -1556,8 +1564,9 @@ export function seatbeltBrackets(
   const literal = (p: string): string => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']')
   const bracketed = new Set(names.filter((n) => /[[\]]/.test(n)))
   const read = (p: string): string[] => {
-    if (!bracketed.has(p)) return [literal(p)]
-    const at = p.replaceAll('[', '[[]')
+    const name = bracketed.has(p) ? p : /\\[[\]]/.test(p) ? namedPath(p) : undefined
+    if (name === undefined) return [literal(p)]
+    const at = name.replaceAll('[', '[[]')
     return [at, `${at}/**/*`]
   }
   return {
@@ -1566,7 +1575,9 @@ export function seatbeltBrackets(
       ...fs,
       denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
       allowWrite: fs.allowWrite.map(literal),
-      ...(fs.allowRead !== undefined ? { allowRead: fs.allowRead.flatMap(read) } : {}),
+      ...(fs.allowRead !== undefined
+        ? { allowRead: [...new Set(fs.allowRead.flatMap(read))] }
+        : {}),
     },
   }
 }
@@ -1977,6 +1988,7 @@ async function runSandboxedOnce(
   if (straceLog) unlinkOnExit(straceLog)
   let proc: ReturnType<typeof Bun.spawn>
   let traceFd: number | undefined
+  const pipes = new TaskPipes()
   try {
     // Resolved on vx's own PATH (util/which.ts), not the task's, where a
     // project's node_modules/.bin comes first.
@@ -1991,8 +2003,7 @@ async function runSandboxedOnce(
         env: args.env as Record<string, string>,
         stdio: [
           'ignore',
-          'pipe',
-          'pipe',
+          ...pipes.stdio,
           forwardsSignals ? 'pipe' : 'ignore',
           guard ?? 'ignore',
           ...(traceFd === undefined ? [] : [traceFd]),
@@ -2003,6 +2014,7 @@ async function runSandboxedOnce(
     )
     if (forwardsSignals) signalThrough(proc, proc.stdio[3] as number)
   } catch (err) {
+    pipes.close()
     if (straceLog) {
       rmSync(straceLog, { force: true })
       liveTempFiles.delete(straceLog)
@@ -2025,6 +2037,7 @@ async function runSandboxedOnce(
   } finally {
     // The child holds its own copy; ours would keep nothing but a descriptor.
     if (traceFd !== undefined) closeSync(traceFd)
+    pipes.spawned()
   }
 
   args.liveChildren?.add(proc)
@@ -2035,10 +2048,11 @@ async function runSandboxedOnce(
   // The unfinished last line of stderr, and whether a line was strace's.
   let partial = ''
   let straceSpoke = false
+  const [out, err] = pipes.streams(proc)
   const streams = Promise.all([
-    streamToString(proc.stdout, args.onStdout, ac.signal, args.capture?.stdout ?? true),
+    streamToString(out, args.onStdout, ac.signal, args.capture?.stdout ?? true),
     streamToString(
-      proc.stderr,
+      err,
       (chunk) => {
         // Read whatever the capture setting: a line of strace's own says
         // the trace stopped short.
@@ -2050,7 +2064,7 @@ async function runSandboxedOnce(
       ac.signal,
       args.capture?.stderr ?? true,
     ),
-  ])
+  ]).finally(() => pipes.close())
   // See runCommand: gate on child exit; a lingering grandchild pipe (timeout
   // OR a clean exit that backgrounds a process) can't hang the run — timeout
   // aborts at once, otherwise drainOrAbort bounds the post-exit drain.

package/src/graph/priorities.ts

@@ -152,8 +152,7 @@ export function mergePriorities(
   // it sorts above the baseline for any node it covers, and add the
   // baseline as a tie-break for parity within the override set.
   const SCALE = 1 << 20
-  const out = new Map<string, number>()
-  for (const [id, w] of baseline) out.set(id, w)
+  const out = new Map(baseline)
   for (const [id, w] of overrides) {
     const b = baseline.get(id) ?? 0
     out.set(id, w * SCALE + b)

package/src/index.ts

@@ -34,7 +34,9 @@ export { isLiteralPattern, normalizeGlob } from './util/index.js'
 // A task's command as vx prints it: values of its `exec.env.secret` names
 // masked. `vx show` and telemetry show this; a plugin that hands a command
 // to someone else (`@vzn/vx-mcp`'s `listTasks`, an AI agent) does too (L-26).
-export { maskedCommand } from './util/index.js'
+// `maskedLine` is the same for a line no one task owns: the error `vx mcp`
+// hands an agent (L-11).
+export { maskedCommand, maskedLine } from './util/index.js'
 
 // Schema types and helpers (used by user vx.config files and presets).
 export type {

package/src/orchestrator/doctor.ts

@@ -16,6 +16,7 @@ import {
   isUnsupportedBun,
   machineMemoryBytes,
   machineParallelism,
+  maskedLine,
   relPosix,
 } from '../util/index.js'
 import { VERSION } from '../version.js'
@@ -397,7 +398,8 @@ async function countLoadableTasks(
           : raw
         errors.push({
           path: relPosix(root, where),
-          message,
+          // A config's own throw is its author's text, a secret too (L-11).
+          message: maskedLine(message),
         })
       }
     }),

package/src/orchestrator/execute-task.ts

@@ -462,7 +462,7 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
           const after = noticeMs < 1000 ? `${noticeMs} ms` : `${noticeMs / 1000} s`
           const unbounded = effectiveTimeout === undefined ? ', with no exec.timeout' : ''
           log.status(
-            `vx: ${node.id} not ready after ${after}: waiting for a line matching /${readyWhen}/ (readyWhen)${unbounded}`,
+            `vx: ${node.id} not ready after ${after}: waiting for a line matching /${serverSecrets?.mask(readyWhen) ?? readyWhen}/ (readyWhen)${unbounded}`,
           )
         }, noticeMs)
   if (notice !== undefined) {
@@ -531,7 +531,12 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     return {
       node,
       status: 'failed',
-      exitCode: ready?.reason === 'timeout' ? await spawn.child.exited : (ready?.exitCode ?? 1),
+      // A server that traps the TERM and exits 0 still timed out, as a
+      // one-shot task that does so reports 143 (X-116).
+      exitCode:
+        ready?.reason === 'timeout'
+          ? (await spawn.child.exited) || signalExitCode('SIGTERM')
+          : (ready?.exitCode ?? 1),
       durationMs: spawn.readyMs(),
       ...(ready !== undefined ? { notReady: ready.reason } : {}),
       wallclockStartNs,
@@ -867,6 +872,24 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     for (const c of captured)
       if (c.kind === 'env' && named.includes(c.name) && !secretNamed(c.name))
         c.hash = MASKED + c.hash
+  // A runtime probe's row is named by its command, which a TS config may
+  // build from `process.env`: the run history stored it and `vx why`
+  // printed it (L-11).
+  const nameSecrets =
+    captured.length > 0 ? secretMask([process.env, env, step.env?.define], step.env?.secret) : null
+  if (nameSecrets !== null) {
+    // Two probes that differ only by a secret mask to one name, and a row
+    // is stored once per name: numbered, the second's change still shows.
+    const seen = new Set(captured.map((c) => `${c.kind}\0${c.name}`))
+    for (const c of captured) {
+      const masked = nameSecrets.mask(c.name)
+      if (masked === c.name) continue
+      let name = masked
+      for (let n = 2; seen.has(`${c.kind}\0${name}`); n++) name = `${masked} (${n})`
+      seen.add(`${c.kind}\0${name}`)
+      c.name = name
+    }
+  }
   const inputs: TaskInputs | undefined = described?.inputs
   const inputChanges = described !== undefined ? args.explainMiss?.(node.id, captured) : undefined
   // A plugin may keep the request past the run (the cache closed): it gets
@@ -1493,7 +1516,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       ? {
           // vx's own notes ride with the lines and are no denial (B-20).
           sandboxViolations: finalViolations.filter((v) => v.hint !== true).length,
-          sandboxViolationLines: finalViolations.map((v) => v.line),
+          // A denied path is the task's own spelling, a secret in it too.
+          sandboxViolationLines: finalViolations.map((v) => secrets?.mask(v.line) ?? v.line),
         }
       : {}),
   }

package/src/orchestrator/hit-restore.ts

@@ -130,7 +130,7 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
         // set that shrank would otherwise vouch for a tree it never saw,
         // and the failure it would let through is a skipped restore.
         const covers = dirPrefixes.every((pre) => dirRows.some((r) => r.path === pre))
-        setKnown = covers && (await args.cache.outputDirsCurrent!(node.projectDir, dirRows))
+        setKnown = covers && (await args.cache.outputDirsCurrent(node.projectDir, dirRows))
         endDirs()
       }
       let treeMatches: boolean

package/src/orchestrator/lockfile-claim.ts

@@ -71,6 +71,7 @@ interface Digests {
 
 interface Memo {
   version: number
+  claimant: string
   lock: string
   /** `extraFiles` → content hash when the digests were computed. */
   extras?: Record<string, string>
@@ -120,6 +121,11 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
   const { file, digest, version } = options
   const scope = options.scope ?? 'project'
   const part = options.part ?? 'deps'
+  // `version` is one claimant's counter, and another claimant of the file
+  // at the same number read this one's memo: one that named no extra file
+  // left the other's patch edits out of its key (X-130). The functions'
+  // source stands for the claimant; a rebuild that changes it is a miss.
+  const claimant = xxh3hex([part, String(digest), String(options.extraFiles ?? '')].join('\0'))
   if (scope !== 'project' && scope !== 'workspace') {
     throw new Error(`scope must be 'project' or 'workspace', not ${JSON.stringify(scope)}`)
   }
@@ -159,7 +165,7 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
     const memoFile = path.join(cacheDir, 'lockfile-claims', `${file}.json`)
     // The extra files the last digest read, and their hashes now: a warm run
     // re-hashes the files the memo names and never parses to learn them.
-    const memo = await readMemo(memoFile, version, lockHash)
+    const memo = await readMemo(memoFile, version, claimant, lockHash)
     let extras: Record<string, string> = {}
     let extraStats: Record<string, string> = {}
     let importers: ReadonlyMap<string, string> | undefined
@@ -182,8 +188,7 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
           ? new Map<string, string>()
           : await computeAndMemo(
               memoFile,
-              version,
-              lockHash,
+              { version, claimant, lock: lockHash },
               extras,
               digest(text, new Map(Object.entries(extras))),
             )
@@ -273,11 +278,14 @@ function importerOf(workspaceRoot: string, projectDir: string): string {
 async function readMemo(
   memoFile: string,
   version: number,
+  claimant: string,
   lock: string,
 ): Promise<{ extras: Record<string, string>; importers: Map<string, string> } | undefined> {
   try {
     const memo = (await Bun.file(memoFile).json()) as Memo
-    if (memo.version !== version || memo.lock !== lock) return undefined
+    if (memo.version !== version || memo.claimant !== claimant || memo.lock !== lock) {
+      return undefined
+    }
     return { extras: memo.extras ?? {}, importers: new Map(Object.entries(memo.importers)) }
   } catch {
     return undefined
@@ -286,12 +294,11 @@ async function readMemo(
 
 async function computeAndMemo(
   memoFile: string,
-  version: number,
-  lock: string,
+  identity: Pick<Memo, 'version' | 'claimant' | 'lock'>,
   extras: Record<string, string>,
   importers: ReadonlyMap<string, string>,
 ): Promise<ReadonlyMap<string, string>> {
-  const memo: Memo = { version, lock, extras, importers: Object.fromEntries(importers) }
+  const memo: Memo = { ...identity, extras, importers: Object.fromEntries(importers) }
   // Write-then-rename: a reader never sees a half-written memo, and two
   // concurrent runs each land a whole one.
   const tmp = `${memoFile}.tmp-${process.pid}-${Date.now()}`

package/src/orchestrator/logger.ts

@@ -518,9 +518,11 @@ export function defaultLogger(
       killStatus()
       // Persistent tails first: they are context for whatever ran against
       // the server, so they read above the failures they explain. `none`
-      // and `errors-only` state their contracts absolutely (no per-task
-      // output / only failed tasks print), so they stay silent — the tail
-      // is still captured and still bounded, just never printed. Guarded
+      // prints no per-task output and `errors-only` only failed tasks: a
+      // server that died on its own before the run stopped it is failed by
+      // now (run.ts sets its outcome in place), and under `errors-only` its
+      // tail was dropped with the healthy ones', so the crash read only as a
+      // count (WD-25). The rest is still captured and bounded. Guarded
       // like the failures below: run() calls runEnd twice on the success
       // path (once before the summary, once in its finally), and though the
       // bus delivers `run:end` once (`busLogger`), a renderer an embedder
@@ -528,12 +530,13 @@ export function defaultLogger(
       if (flushedPersistent) flushKept()
       if (!flushedPersistent) {
         flushedPersistent = true
-        if (view.mode !== 'none' && view.mode !== 'errors-only') {
+        if (view.mode !== 'none') {
           for (const t of persistentTails.values()) {
             // No outcome means the task never completed — it is still
             // pre-ready, so there is no "since ready" window to render and
             // its buffered output belongs to the frame it never got.
             if (t.outcome === undefined) continue
+            if (view.mode === 'errors-only' && t.outcome.status !== 'failed') continue
             emitBlock(
               fenced(
                 formatPersistentTailBlock(

package/src/orchestrator/plugin-host.ts

@@ -10,7 +10,7 @@
 import path from 'node:path'
 import { ChainedCache, type CacheLayer } from '../cache/index.js'
 import { localExecutor, type TaskExecutor } from '../exec/index.js'
-import { settleWithin, teardownTimeoutMs, UserError } from '../util/index.js'
+import { maskedLine, settleWithin, teardownTimeoutMs, UserError } from '../util/index.js'
 import type { ProjectConfig, WorkspaceConfig, WorkspaceRules } from '../config.js'
 import { checkGraph, type TaskNode } from '../graph/index.js'
 import type {
@@ -86,8 +86,13 @@ async function safe<T>(plugin: VxPlugin, hook: string, fn: () => T | Promise<T>)
   try {
     return await fn()
   } catch (err) {
+    // Masked here, not by whoever prints it: an embedder of `run()` and
+    // `vx mcp` print it as they get it, and the throw quotes what the
+    // plugin was told (a remote's reply, a header) (L-11).
     throw new UserError(
-      `plugin '${plugin.name}' failed in ${hook}: ${err instanceof Error ? err.message : String(err)}`,
+      maskedLine(
+        `plugin '${plugin.name}' failed in ${hook}: ${err instanceof Error ? err.message : String(err)}`,
+      ),
     )
   }
 }