@vzn/vx 0.0.598 → 0.0.599

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.598",
+  "version": "0.0.599",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.598",
-    "@vzn/vx-linux-arm64": "0.0.598",
-    "@vzn/vx-darwin-x64": "0.0.598",
-    "@vzn/vx-darwin-arm64": "0.0.598"
+    "@vzn/vx-linux-x64": "0.0.599",
+    "@vzn/vx-linux-arm64": "0.0.599",
+    "@vzn/vx-darwin-x64": "0.0.599",
+    "@vzn/vx-darwin-arm64": "0.0.599"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/archive.ts

@@ -209,6 +209,9 @@ interface PackArgs {
   within?: string
 }
 
+/** The largest second count ustar's 12-byte mtime field holds: 11 octal digits. */
+const USTAR_MTIME_MAX = 8 ** 11 - 1
+
 /** At or below this many outputs, `planArtifact` stats them on the calling thread. */
 const ON_THREAD_STATS = 32
 
@@ -309,10 +312,10 @@ export async function planArtifact(args: PackArgs): Promise<ArtifactPlan> {
         size: st.size,
         mode,
         mtimeMs: Math.floor(st.mtimeMs),
-        // ustar's octal field holds no sign: an mtime before 1970 made the
-        // header unreadable and every save of it a "corrupt artifact". The
-        // sidecar above carries the real value.
-        mtime: Math.max(0, Math.floor(st.mtimeMs / 1000)),
+        // ustar's octal field holds no sign and 11 digits: an mtime before
+        // 1970 made the header unreadable, and one past March 2242 failed
+        // every save of the task. The sidecar above carries the real value.
+        mtime: Math.min(USTAR_MTIME_MAX, Math.max(0, Math.floor(st.mtimeMs / 1000))),
       }
     }),
   )

package/src/cache/cache.ts

@@ -1570,13 +1570,14 @@ export class Cache implements CacheLayer {
     } catch (err) {
       // A UserError here is the extractor naming the tree's fault (an
       // output directory that links out of the project).
-      if (
-        err instanceof ArchiveSecurityError ||
-        err instanceof CorruptArtifactError ||
-        err instanceof UserError
-      ) {
-        throw err
-      }
+      if (err instanceof CorruptArtifactError || err instanceof UserError) throw err
+      // The save and the ingest proved every name safe, so one that reads
+      // unsafe now is damaged or tampered bytes: a long name's pax record
+      // has no header checksum, and the name is judged before the CRC at
+      // the end is read. Thrown as is, it failed the task on every run with
+      // the entry kept (X-115).
+      if (err instanceof ArchiveSecurityError)
+        throw new CorruptArtifactError(hash, err.message, err)
       // What is on disk, not what is in the archive: a directory standing
       // where the entry holds a file, or a file where it needs a directory.
       // The clean removes the FILES the output globs select and the

package/src/orchestrator/execute-task.ts

@@ -531,7 +531,12 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     return {
       node,
       status: 'failed',
-      exitCode: ready?.reason === 'timeout' ? await spawn.child.exited : (ready?.exitCode ?? 1),
+      // A server that traps the TERM and exits 0 still timed out, as a
+      // one-shot task that does so reports 143 (X-116).
+      exitCode:
+        ready?.reason === 'timeout'
+          ? (await spawn.child.exited) || signalExitCode('SIGTERM')
+          : (ready?.exitCode ?? 1),
       durationMs: spawn.readyMs(),
       ...(ready !== undefined ? { notReady: ready.reason } : {}),
       wallclockStartNs,