@vzn/vx 0.0.599 → 0.0.600

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.599",
+  "version": "0.0.600",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.599",
-    "@vzn/vx-linux-arm64": "0.0.599",
-    "@vzn/vx-darwin-x64": "0.0.599",
-    "@vzn/vx-darwin-arm64": "0.0.599"
+    "@vzn/vx-linux-x64": "0.0.600",
+    "@vzn/vx-linux-arm64": "0.0.600",
+    "@vzn/vx-darwin-x64": "0.0.600",
+    "@vzn/vx-darwin-arm64": "0.0.600"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/sandbox-runtime.ts

@@ -1554,6 +1554,12 @@ function literalReadPaths(
  * `/**` is stripped before the compile). A task's read grant whose only
  * brackets are escaped names one path too, and Linux binds it whole, so
  * it gets the same subtree: `out/\[id\]` read `out/[id]` and none of it.
+ *
+ * A `*` or `?` meant as itself (escaped in a grant, or in a baseline's
+ * name) has no spelling: SRT's rewrite of each runs inside a class too,
+ * and a backslash compiles as a literal one, so `a\*.txt` granted
+ * `a\bc.txt` and never `a*.txt`. Left out and said once, as on Linux
+ * (`bindableReads`).
  */
 export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
@@ -1563,7 +1569,9 @@ export function seatbeltBrackets(
   if (fs === undefined) return config
   const literal = (p: string): string => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']')
   const bracketed = new Set(names.filter((n) => /[[\]]/.test(n)))
+  const baseline = new Set(names)
   const read = (p: string): string[] => {
+    if (!seatbeltSpells(p, 'read', baseline.has(p))) return []
     const name = bracketed.has(p) ? p : /\\[[\]]/.test(p) ? namedPath(p) : undefined
     if (name === undefined) return [literal(p)]
     const at = name.replaceAll('[', '[[]')
@@ -1574,7 +1582,7 @@ export function seatbeltBrackets(
     filesystem: {
       ...fs,
       denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
-      allowWrite: fs.allowWrite.map(literal),
+      allowWrite: fs.allowWrite.filter((p) => seatbeltSpells(p, 'write', false)).map(literal),
       ...(fs.allowRead !== undefined
         ? { allowRead: [...new Set(fs.allowRead.flatMap(read))] }
         : {}),
@@ -1582,6 +1590,28 @@ export function seatbeltBrackets(
   }
 }
 
+/** A `*` or `?` behind an odd run of backslashes: the grant means the character. */
+const ESCAPED_WILDCARD = /(?:^|[^\\])(?:\\\\)*\\[*?]/
+
+const warnedUnspellable = new Set<string>()
+
+/** Whether seatbelt's SRT can take `grant` as written; said once when not. */
+function seatbeltSpells(grant: string, kind: 'read' | 'write', name: boolean): boolean {
+  const m = name ? /[*?]/.exec(grant) : ESCAPED_WILDCARD.exec(grant)
+  if (m === null) return true
+  const at = name ? m.index : m.index + m[0].length - 2
+  if (!warnedUnspellable.has(`${kind} ${grant}`)) {
+    warnedUnspellable.add(`${kind} ${grant}`)
+    process.stderr.write(
+      `[vx] sandbox: the ${kind} grant ${grant} names a literal ${grant[at + (name ? 0 : 1)]}, ` +
+        `which the macOS sandbox reads as a pattern and cannot spell as a name, so it is not ` +
+        `granted. Rename it, or grant the directory above it: ` +
+        `${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
+    )
+  }
+  return false
+}
+
 /** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],