@vzn/vx 0.0.599 → 0.0.601

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.599",
+  "version": "0.0.601",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.599",
-    "@vzn/vx-linux-arm64": "0.0.599",
-    "@vzn/vx-darwin-x64": "0.0.599",
-    "@vzn/vx-darwin-arm64": "0.0.599"
+    "@vzn/vx-linux-x64": "0.0.601",
+    "@vzn/vx-linux-arm64": "0.0.601",
+    "@vzn/vx-darwin-x64": "0.0.601",
+    "@vzn/vx-darwin-arm64": "0.0.601"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/exec/runner.ts

@@ -867,8 +867,8 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   // Wire up readers. We deliberately don't await them — they run for
   // the child's lifetime. The `ready` promise resolves out-of-band.
   const [stdout, stderr] = pipes.streams(child)
-  void Promise.all([consumeChunks(stdout, false), consumeChunks(stderr, true)]).finally(() =>
-    pipes.close(),
+  const readers = Promise.all([consumeChunks(stdout, false), consumeChunks(stderr, true)]).finally(
+    () => pipes.close(),
   )
 
   opts.liveChildren?.add(child)
@@ -915,10 +915,19 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
 
   // If the child exits BEFORE ready fires, that's a failure to start
   // — reject the ready promise so the caller can surface it.
-  void child.exited.then((code) => {
+  void child.exited.then(async (code) => {
     opts.liveChildren?.delete(child)
     releaseServerGroup(child)
     if (readyTimer !== undefined) clearTimeout(readyTimer)
+    // The exit can land before the readers took the marker it printed on
+    // the way out: `echo READY; exit` read as never ready under load. The
+    // drain is bounded, as a task's is, for a grandchild holding the pipe.
+    if (readyAt === undefined && gaveUpAt === undefined) {
+      await Promise.race([
+        readers,
+        new Promise((resolve) => setTimeout(resolve, POST_EXIT_DRAIN_MS).unref?.()),
+      ])
+    }
     if (readyAt === undefined && gaveUpAt === undefined) {
       rejectReady(
         new PersistentReadyError(

package/src/exec/sandbox-runtime.ts

@@ -1554,6 +1554,12 @@ function literalReadPaths(
  * `/**` is stripped before the compile). A task's read grant whose only
  * brackets are escaped names one path too, and Linux binds it whole, so
  * it gets the same subtree: `out/\[id\]` read `out/[id]` and none of it.
+ *
+ * A `*` or `?` meant as itself (escaped in a grant, or in a baseline's
+ * name) has no spelling: SRT's rewrite of each runs inside a class too,
+ * and a backslash compiles as a literal one, so `a\*.txt` granted
+ * `a\bc.txt` and never `a*.txt`. Left out and said once, as on Linux
+ * (`bindableReads`).
  */
 export function seatbeltBrackets(
   config: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2],
@@ -1563,7 +1569,9 @@ export function seatbeltBrackets(
   if (fs === undefined) return config
   const literal = (p: string): string => p.replaceAll('\\[', '[[]').replaceAll('\\]', ']')
   const bracketed = new Set(names.filter((n) => /[[\]]/.test(n)))
+  const baseline = new Set(names)
   const read = (p: string): string[] => {
+    if (!seatbeltSpells(p, 'read', baseline.has(p))) return []
     const name = bracketed.has(p) ? p : /\\[[\]]/.test(p) ? namedPath(p) : undefined
     if (name === undefined) return [literal(p)]
     const at = name.replaceAll('[', '[[]')
@@ -1574,7 +1582,7 @@ export function seatbeltBrackets(
     filesystem: {
       ...fs,
       denyRead: fs.denyRead.map((p) => p.replaceAll('[', '[[]')),
-      allowWrite: fs.allowWrite.map(literal),
+      allowWrite: fs.allowWrite.filter((p) => seatbeltSpells(p, 'write', false)).map(literal),
       ...(fs.allowRead !== undefined
         ? { allowRead: [...new Set(fs.allowRead.flatMap(read))] }
         : {}),
@@ -1582,6 +1590,28 @@ export function seatbeltBrackets(
   }
 }
 
+/** A `*` or `?` behind an odd run of backslashes: the grant means the character. */
+const ESCAPED_WILDCARD = /(?:^|[^\\])(?:\\\\)*\\[*?]/
+
+const warnedUnspellable = new Set<string>()
+
+/** Whether seatbelt's SRT can take `grant` as written; said once when not. */
+function seatbeltSpells(grant: string, kind: 'read' | 'write', name: boolean): boolean {
+  const m = name ? /[*?]/.exec(grant) : ESCAPED_WILDCARD.exec(grant)
+  if (m === null) return true
+  const at = name ? m.index : m.index + m[0].length - 2
+  if (!warnedUnspellable.has(`${kind} ${grant}`)) {
+    warnedUnspellable.add(`${kind} ${grant}`)
+    process.stderr.write(
+      `[vx] sandbox: the ${kind} grant ${grant} names a literal ${grant[at + (name ? 0 : 1)]}, ` +
+        `which the macOS sandbox reads as a pattern and cannot spell as a name, so it is not ` +
+        `granted. Rename it, or grant the directory above it: ` +
+        `${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
+    )
+  }
+  return false
+}
+
 /** SRT's wrap, with the socket lift and the git-config grant this task asked for, or none (L-6, B-41). */
 function wrapForTask(
   SandboxManager: SrtModule['SandboxManager'],

package/src/orchestrator/failure-mode.ts

@@ -22,10 +22,13 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 /**
  * Per-key outcome projection: every keyed (project, task, hash) under
  * `source` (`runs`, or a relation with its `id`, `project`, `task`, `hash`,
- * `status`, `cache_hit` columns) with how often it failed, how often it
+ * `status`, `cache_hit`, `cached` columns) with how often it failed, how often it
  * passed — an executed success or a cache hit, which replays a success —
- * and how often it failed AFTER its first pass (`relapses`). Every
- * flakiness reader is a filter over this one projection.
+ * and how often it failed AFTER its first pass (`relapses`). A task with
+ * no cache block keys on its config alone and runs every time, so its key
+ * says nothing about its inputs: no reader counts it, as no run's row
+ * calls it flaky. Every flakiness reader is a filter over this one
+ * projection.
  */
 function keyOutcomesSql(source: string, where = ''): string {
   return `SELECT project, task, hash, SUM(failed) AS failures, SUM(passed) AS passes,
@@ -39,7 +42,7 @@ function keyOutcomesSql(source: string, where = ''): string {
              CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
                THEN 1 ELSE 0 END AS passed
            FROM ${source}
-           WHERE ${KEYED_RUNS_SQL}${where}))
+           WHERE ${KEYED_RUNS_SQL} AND cached IS NOT 0${where}))
        GROUP BY project, task, hash`
 }
 

package/src/orchestrator/run-records.ts

@@ -14,6 +14,8 @@ import { isCacheHit, taskTelemetryOf, type TaskTelemetry } from './telemetry.js'
 
 export interface RunRecordsInput {
   outcomes: readonly TaskOutcome[]
+  /** Tasks that ran behind a failed dependency (`--continue=always`). */
+  tainted?: ReadonlySet<string>
   runId: string
   /** Wall-clock ms at run start; every per-task ns offset is anchored to it. */
   startedAtMs: number
@@ -66,7 +68,11 @@ export function assembleRunRecords(input: RunRecordsInput): RunRecords {
     if (o.status === 'aborted') continue
     if (input.withTelemetry) telemetryTasks.push(taskTelemetryOf(o))
     runs.push({
-      ...(o.hash !== undefined ? { hash: o.hash } : {}),
+      // A failure behind a failed dependency is recorded keyless (`''`, which
+      // the key readers skip): the flaky list asks a key whether it failed.
+      ...(o.hash !== undefined && !(o.status === 'failed' && input.tainted?.has(o.node.id) === true)
+        ? { hash: o.hash }
+        : {}),
       project: o.node.projectName,
       task: o.node.taskName,
       status: o.status,

package/src/orchestrator/run.ts

@@ -939,6 +939,7 @@ async function runOnBus(
     // dispatch, and the tracker carries it to what is built on it.
     const taintSeeds = new Set(excluded.seeds)
     const taint = taintTracker(options.continueMode === 'always', taintSeeds, nodes)
+    const taintedRan = new Set<string>()
     const dependedOn = new Set<string>()
     for (const n of nodes.values()) for (const d of n.deps) dependedOn.add(d)
 
@@ -959,6 +960,7 @@ async function runOnBus(
       )
         taintSeeds.add(node.id)
       const tainted = taint.judge(node, upstream)
+      if (tainted) taintedRan.add(node.id)
       return {
         node,
         upstream,
@@ -1027,7 +1029,7 @@ async function runOnBus(
     const historyDb = prepared.localCache.dbHandle()
     const cacheOff = cachesNothing(policy)
     const judgeFlaky = (o: TaskOutcome): void => {
-      const candidates = flakyCandidates([o])
+      const candidates = flakyCandidates([o], taintedRan)
       if (candidates.length === 0) return
       try {
         const found = detectFlaky(historyDb, candidates)[0]
@@ -1212,6 +1214,7 @@ async function runOnBus(
     const recordsOf = (final: TaskOutcome[], runOk: boolean) =>
       assembleRunRecords({
         outcomes: final,
+        tainted: taintedRan,
         runId,
         startedAtMs: endedAtMsAtStart,
         endedAtMs,
@@ -1759,7 +1762,10 @@ export function projectNamed(
 }
 
 /** The executed, keyed outcomes of a run — what flakiness is judged on. */
-function flakyCandidates(outcomes: readonly TaskOutcome[]): FlakyCandidate[] {
+function flakyCandidates(
+  outcomes: readonly TaskOutcome[],
+  tainted: ReadonlySet<string>,
+): FlakyCandidate[] {
   const out: FlakyCandidate[] = []
   for (const o of outcomes) {
     if (o.status !== 'success' && o.status !== 'failed') continue
@@ -1768,6 +1774,9 @@ function flakyCandidates(outcomes: readonly TaskOutcome[]): FlakyCandidate[] {
     // and runs every time, so one bad network day would read as a flake for
     // thirty days. Groups do no work.
     if (o.hash === undefined || o.node.config.cache === undefined || isGroupTask(o.node)) continue
+    // Behind a failed dependency the failure is the dependency's: the key it
+    // had passed on read as a flake for thirty days.
+    if (o.status === 'failed' && tainted.has(o.node.id)) continue
     out.push({
       project: o.node.projectName,
       task: o.node.taskName,