@vzn/vx 0.0.636 → 0.0.638

package/src/orchestrator/sandbox-fix.ts

@@ -1,5 +1,5 @@
 // The `exec.sandbox.allow` entries that would have granted what a failed
-// task was denied, so the report names the line to add (CLI, JSON, MCP)
+// task was denied, so the report names the line to add (CLI, JSON)
 // rather than leaving the user to turn absolute paths into grants. Built on
 // the failure path only: a passing run never calls it.
 
@@ -9,26 +9,22 @@ import path from 'node:path'
 import type { SandboxViolation } from '../exec/index.js'
 import type { TaskOutcome } from '../graph/index.js'
 import { isLiteralPattern } from '../util/index.js'
+import { CREDENTIAL_STORES } from './sandbox-request.js'
 
 /** Grants to add under `exec.sandbox.allow`, each list sorted and unique. */
 type SandboxFix = NonNullable<TaskOutcome['sandboxFix']>
-type Kind = Exclude<keyof SandboxFix, 'withheld'>
-
-// Where credentials live. A denial here is never turned into a grant: an
-// agent applies `sandboxFix` as given, so a dependency probing ~/.ssh would
-// get its grant suggested and applied (Security, 2026-10-12).
-const CREDENTIAL_DIRS = ['.ssh', '.aws', '.gnupg', '.kube', '.config/gh', '.config/gcloud']
-const CREDENTIAL_FILES = ['.netrc', '.npmrc', '.docker/config.json', '.git-credentials', '.pypirc']
+type Kind = Exclude<keyof SandboxFix, 'withheld' | 'inputs'>
 
+// A denial in a credential store is never turned into a grant: an agent
+// applies `sandboxFix` as given, so a dependency probing ~/.ssh would get
+// its grant suggested and applied (Security, 2026-10-12). The stores are
+// the ones the sandbox denies: a hand copy here missed half of them.
 function isCredential(abs: string): boolean {
   const base = path.basename(abs)
   if (base === '.env' || base.startsWith('.env.')) return true
   const rel = path.relative(os.homedir(), abs)
   if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) return false
-  return (
-    CREDENTIAL_FILES.includes(rel) ||
-    CREDENTIAL_DIRS.some((d) => rel === d || rel.startsWith(d + path.sep))
-  )
+  return CREDENTIAL_STORES.some((d) => rel === d || rel.startsWith(d + path.sep))
 }
 
 /**
@@ -63,6 +59,16 @@ function readsDir(g: string, top: string): boolean {
   return first === top || !isLiteralPattern(first)
 }
 
+const inProject = (grant: string): boolean => !grant.startsWith('~/') && !path.isAbsolute(grant)
+
+/** Whether a project-relative path is one the task's input globs match. */
+function keyedBy(globs: readonly string[]): (rel: string) => boolean {
+  const strip = (g: string) => g.replace(/^\.\//, '')
+  const take = globs.filter((g) => !g.startsWith('!')).map((g) => new Bun.Glob(strip(g)))
+  const drop = globs.filter((g) => g.startsWith('!')).map((g) => new Bun.Glob(strip(g.slice(1))))
+  return (rel) => take.some((g) => g.match(rel)) && !drop.some((g) => g.match(rel))
+}
+
 function kindOf(v: SandboxViolation): Kind | undefined {
   const can = v.ignorable ?? []
   if (can.length === 1) return can[0]
@@ -78,16 +84,22 @@ export function sandboxFix(
   violations: readonly SandboxViolation[],
   projectDir: string,
   mask: (text: string) => string = (t) => t,
-  /** The task's `cache.inputs.files`: a write under one is granted exactly. */
-  inputs: readonly string[] = [],
+  /**
+   * The task's `cache.inputs.files`, undefined when it does not cache: a
+   * write under one is granted exactly, and a read of the project no glob
+   * matches is named for the key too.
+   */
+  inputs?: readonly string[],
 ): SandboxFix | undefined {
-  const fix: Record<Kind | 'withheld', Set<string>> = {
+  const fix: Record<Kind | 'withheld' | 'inputs', Set<string>> = {
     read: new Set(),
     write: new Set(),
     network: new Set(),
     systemInfo: new Set(),
     withheld: new Set(),
+    inputs: new Set(),
   }
+  const keyed = inputs === undefined ? undefined : keyedBy(inputs)
   for (const v of violations) {
     if (v.hint === true || v.target === undefined) continue
     const kind = kindOf(v)
@@ -96,16 +108,19 @@ export function sandboxFix(
     else if (kind === 'systemInfo') fix.systemInfo.add(v.target)
     else if (v.path === undefined) continue
     else if (isCredential(v.path)) fix.withheld.add(grantPath(v.path, projectDir))
-    else if (kind === 'read') fix.read.add(grantPath(v.path, projectDir))
-    else {
+    else if (kind === 'read') {
+      const grant = grantPath(v.path, projectDir)
+      fix.read.add(grant)
+      if (keyed !== undefined && inProject(grant) && !keyed(grant)) fix.inputs.add(grant)
+    } else {
       const isDir =
         v.line.startsWith('mkdir') ||
         lstatSync(v.path, { throwIfNoEntry: false })?.isDirectory() === true
-      fix.write.add(writeGrant(grantPath(v.path, projectDir), isDir, inputs))
+      fix.write.add(writeGrant(grantPath(v.path, projectDir), isDir, inputs ?? []))
     }
   }
   const out: SandboxFix = {}
-  for (const k of ['read', 'write', 'network', 'systemInfo', 'withheld'] as const)
+  for (const k of ['read', 'write', 'network', 'systemInfo', 'withheld', 'inputs'] as const)
     if (fix[k].size > 0) out[k] = [...new Set([...fix[k]].map(mask))].sort()
   return Object.keys(out).length > 0 ? out : undefined
 }
@@ -114,7 +129,11 @@ export function sandboxFix(
  * The fix as the config line it is: `exec.sandbox.allow: { read: ['a'] }`,
  * or undefined when every denial was a withheld credential path.
  */
-export function sandboxFixLine({ withheld: _, ...fix }: SandboxFix): string | undefined {
+export function sandboxFixLine({
+  withheld: _,
+  inputs: __,
+  ...fix
+}: SandboxFix): string | undefined {
   if (Object.keys(fix).length === 0) return undefined
   const parts = Object.entries(fix).map(
     ([k, list]: [string, string[]]) => `${k}: [${list.map((p) => `'${p}'`).join(', ')}]`,

package/src/orchestrator/sandbox-request.ts

@@ -7,7 +7,7 @@ import { existsSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import type { ExecConfig } from '../config.js'
+import type { ExecConfig, SandboxConfig } from '../config.js'
 import {
   bindableWrites,
   initSandbox,
@@ -25,7 +25,6 @@ import {
 } from '../exec/index.js'
 import type { TaskNode } from '../graph/index.js'
 import { grantPrefix, relPosix, UserError } from '../util/index.js'
-import { WORKSPACE_FINGERPRINT_FILES } from '../workspace/index.js'
 
 /**
  * Arm the sandbox runtime for a run, lazily: only when at least one task
@@ -188,7 +187,7 @@ export async function sandboxRequestFor(
   /** The projects nested in this one (their dirs): a wall its grants do not reach. */
   nested: readonly string[] = [],
   /**
-   * The run's cache directory. `.vx` is walled wherever it is; a
+   * The run's cache directory. `.vx/cache` is walled wherever it is; a
    * `cacheDir` configured inside a project was not, and a task whose write
    * grant covered it could plant artifacts and index rows (L-24).
    */
@@ -234,7 +233,7 @@ export async function sandboxRequestFor(
   const walls = [
     ...nested,
     path.join(workspaceRoot, '.git'),
-    path.join(workspaceRoot, '.vx'),
+    path.join(workspaceRoot, '.vx', 'cache'),
     ...(cacheDir !== undefined &&
     toRealPath(cacheDir).startsWith(toRealPath(workspaceRoot) + path.sep)
       ? [cacheDir]
@@ -290,6 +289,53 @@ export async function sandboxRequestFor(
   return { sandbox: request, placeholders, withheld: links.withheld }
 }
 
+/**
+ * Whether a sandboxed task could read `real` (a canonical path inside its
+ * project): under one of its read or write grants or its `node_modules`,
+ * and not behind a wall. vx packs a symlinked output as its target's
+ * bytes, outside the sandbox, so a link the task planted to a file it was
+ * denied (`dist/x -> ../.env` under `read: ['src/']`) packed that file
+ * into the cache wherever creating the link went unseen: seatbelt, or
+ * Linux untraced. The grants are matched as written, not expanded: a
+ * glob's hit made by the task itself counts.
+ */
+export function sandboxReadable(
+  node: TaskNode,
+  sandbox: SandboxConfig,
+  workspaceRoot: string,
+  nested: readonly string[] = [],
+): (real: string) => boolean {
+  const projectReal = toRealPath(node.projectDir)
+  const at = (p: string): string =>
+    p.startsWith('~')
+      ? path.join(homedir(), p.slice(1))
+      : path.isAbsolute(p)
+        ? p
+        : path.join(projectReal, p)
+  const grants = [...(sandbox.allow?.read ?? []), ...(sandbox.allow?.write ?? [])].map(at)
+  const literals = [
+    ...grants.filter(isMountableLiteral).map((g) => toRealPath(g.replace(/\/+$/, '') || '/')),
+    toRealPath(path.join(node.projectDir, 'node_modules')),
+    toRealPath(path.join(workspaceRoot, 'node_modules')),
+  ]
+  const globs = grants.filter((g) => !isMountableLiteral(g)).map((g) => new Bun.Glob(g))
+  const walls = [
+    ...nested,
+    path.join(workspaceRoot, '.git'),
+    path.join(workspaceRoot, '.vx', 'cache'),
+  ].map(toRealPath)
+  return (real) => {
+    if (walls.some((w) => atOrUnder(real, w))) return false
+    if (literals.some((l) => atOrUnder(real, l))) return true
+    // A directory a glob matches is granted whole.
+    for (let p = real; atOrUnder(p, projectReal); p = path.dirname(p)) {
+      if (globs.some((g) => g.match(p))) return true
+      if (p === projectReal) break
+    }
+    return false
+  }
+}
+
 /**
  * The sandbox half of the request, plus the empty files vx created so a
  * literal write grant had something to bind (`placeholders`). They are
@@ -619,9 +665,9 @@ export function untouchedPlaceholderLine(projectDir: string, placeholder: string
 /**
  * Where tools keep credentials under the user's home. A sandboxed task
  * reads none of them unless its `allow.read` names one (a publish task's
- * `~/.npmrc`).
+ * `~/.npmrc`), and `sandboxFix` never suggests one as a grant.
  */
-const CREDENTIAL_STORES = [
+export const CREDENTIAL_STORES = [
   '.ssh',
   '.gnupg',
   '.aws',
@@ -647,6 +693,26 @@ const CREDENTIAL_STORES = [
   '.terraform.d/credentials.tfrc.json',
   '.vault-token',
   '.pgpass',
+  // Deploy and service CLIs a JS build runs beside, each at its home on
+  // Linux and macOS, and the agent CLIs that may run vx itself.
+  '.config/configstore/firebase-tools.json',
+  '.local/share/com.vercel.cli/auth.json',
+  'Library/Application Support/com.vercel.cli/auth.json',
+  '.netlify/config.json',
+  '.config/netlify/config.json',
+  'Library/Preferences/netlify/config.json',
+  '.wrangler/config',
+  '.config/.wrangler/config',
+  'Library/Preferences/.wrangler/config',
+  '.fly/config.yml',
+  '.supabase/access-token',
+  '.config/doctl',
+  'Library/Application Support/doctl',
+  '.config/stripe/config.toml',
+  '.config/op',
+  '.expo/state.json',
+  '.claude/.credentials.json',
+  '.codex/auth.json',
 ]
 
 /** The stores present on this host, learned once per home. */
@@ -697,7 +763,7 @@ export type WriteReach = 'none' | 'project' | 'workspace'
 /**
  * Where a task that ran a command may have written files no declaration
  * names — the files whose run-start facts (the git snapshot, its index
- * OIDs, the `package.json` digest) a later key must not reuse (item 743).
+ * OIDs) a later key must not reuse (item 743).
  *
  * A cached task declares its outputs and is held to them. A task with no
  * `cache` block can declare none, so it may have written anywhere
@@ -732,20 +798,25 @@ export function commandWriteReach(node: TaskNode, workspaceRoot: string): WriteR
 }
 
 /**
- * May this task's command rewrite a file the workspace fingerprint folds
- * (a lockfile, `pnpm-workspace.yaml`)? Those sit at the workspace root, so
+ * May this task's command rewrite a root file a plugin claims (`claimed`:
+ * a lockfile, `pnpm-workspace.yaml`)? Those sit at the workspace root, so
  * an unsandboxed task may only when the root is its own project (`pnpm
  * install` without `--frozen-lockfile` in a root task); a sandboxed one
  * when a write grant covers one. Anyone else writing there crosses a
- * project boundary, out of contract.
+ * project boundary, out of contract. With nothing claimed, no key folds a
+ * root file this way.
  */
-export function mayWriteFingerprint(node: TaskNode, workspaceRoot: string): boolean {
+export function mayWriteFingerprint(
+  node: TaskNode,
+  workspaceRoot: string,
+  claimed: readonly string[],
+): boolean {
   const exec = node.config.exec
-  if (exec === undefined) return false
+  if (exec === undefined || claimed.length === 0) return false
   if (exec.sandbox === undefined) return node.projectDir === workspaceRoot
   for (const grant of exec.sandbox.allow?.write ?? []) {
     const abs = path.resolve(node.projectDir, expandHome(grantPrefix(grant)))
-    for (const f of WORKSPACE_FINGERPRINT_FILES) {
+    for (const f of claimed) {
       if (atOrUnder(path.join(workspaceRoot, f), abs)) return true
     }
   }

package/src/orchestrator/signals.ts

@@ -21,7 +21,7 @@ import type { Logger } from './logger.js'
 /**
  * How long a SIGTERMed child gets before SIGKILL on the way out. The
  * end-of-run persistent shutdown grants the same two seconds; both read
- * `VX_KILL_GRACE_MS` (util/settle.ts) so the suites that prove the
+ * `VX_RUN_KILL_GRACE` (util/settle.ts) so the suites that prove the
  * escalation do not wait the full grace.
  */
 export const SIGNAL_SHUTDOWN_GRACE_MS = 2000

package/src/orchestrator/stable-keys.ts

@@ -28,7 +28,8 @@ export interface DeriveStableKeysArgs {
   nodes: Map<string, TaskNode>
   cache: CacheLayer
   workspaceRoot: string
-  workspaceFingerprint: string
+  /** The root files the plugins claim (`VxPlugin.fingerprint`), for `mayWriteFingerprint`. */
+  claimedFiles: readonly string[]
   forwardArgs?: readonly string[] | undefined
   nestedDirsByProject: Map<string, string[]>
   gitFilesCache: GitFilesCache
@@ -58,7 +59,7 @@ export interface StableKey {
  * cache-enabled, non-group tasks paired with their keys.
  *
  * Reuses the run's `hashCache`, so execute-task's later computeTaskHash
- * for the same node hits the memo (package.json bytes + task config) —
+ * for the same node hits the memo (the task config hash, file lists) —
  * the key bytes are derived here, the heavy per-project hashing is
  * shared. No cache layer is touched: keys only.
  */
@@ -82,8 +83,8 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   //   - wsOutputUpstream: any upstream declares cache.outputs.workspaceFiles
   //     (root-anchored, boundary-ignoring outputs), or has no cache block
   //     and a sandbox write grant elsewhere in the workspace, or may rewrite
-  //     a file the workspace fingerprint folds (a root `pnpm install`): every
-  //     key folds that digest, taken once per run.
+  //     a root file a plugin claims (a root `pnpm install`): every key folds
+  //     what the claimant took from it, once per run.
   //   - rewritersById / unfoldedById: the projects of every upstream CACHED
   //     task that may rewrite its own inputs in place (a formatter declaring
   //     no outputs; `commandWriteReach`), and the subset this task's key does
@@ -93,7 +94,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   //     unfolded dependency covered is still uncovered here: its key is not
   //     in this one.
   //   - wsRewriters: the same for a cached rewriter whose reach is every
-  //     project (a write grant elsewhere in the workspace, or a fingerprinted
+  //     project (a write grant elsewhere in the workspace, or a claimed root
   //     file, `mayWriteFingerprint`); one this key does not fold makes it
   //     preliminary. A dependency this key folds needs no pass-through here:
   //     a keyed task with such a rewriter unfolded is unstable itself, and
@@ -175,14 +176,17 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
         ;(wide ??= projects.empty()).add(depNode.projectName)
       } else if (reach === 'workspace') wsOutputUpstream = true
       const cached = depNode.config.cache !== undefined
-      if (!cached && mayWriteFingerprint(depNode, args.workspaceRoot)) wsOutputUpstream = true
+      if (!cached && mayWriteFingerprint(depNode, args.workspaceRoot, args.claimedFiles))
+        wsOutputUpstream = true
       if (!anyUnfolded) continue
       // The cached twin: a formatter rewriting its own input ahead of a
       // reader that folds no key of it replayed seed B's build under seed A
       // on the fourth run, the same way (item 750).
       const rewrites = cached ? commandWriteReach(depNode, args.workspaceRoot) : 'none'
       const rewritesWs =
-        cached && (rewrites === 'workspace' || mayWriteFingerprint(depNode, args.workspaceRoot))
+        cached &&
+        (rewrites === 'workspace' ||
+          mayWriteFingerprint(depNode, args.workspaceRoot, args.claimedFiles))
       const rewritersOfDep = rewritersById.get(dep)
       const wsRewriterOfDep = wsRewriters.has(dep)
       if (
@@ -239,7 +243,6 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
             node,
             upstream,
             workspaceRoot: args.workspaceRoot,
-            workspaceFingerprint: args.workspaceFingerprint,
             cache: args.cache,
             forwardArgs: args.forwardArgs,
             nestedProjectDirs: args.nestedDirsByProject.get(node.projectName) ?? [],
@@ -256,7 +259,6 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
       node,
       upstream,
       workspaceRoot: args.workspaceRoot,
-      workspaceFingerprint: args.workspaceFingerprint,
       cache: args.cache,
       forwardArgs: args.forwardArgs,
       nestedProjectDirs: args.nestedDirsByProject.get(node.projectName) ?? [],
@@ -339,7 +341,7 @@ export function probesAfterWrites(
   }
   if (!anyProbe) return late
   // A sandbox with no write grant still writes the declared outputs. A
-  // fingerprinted file is only writable where `commandWriteReach` is not
+  // claimed root file is only writable where `commandWriteReach` is not
   // 'none' already (`mayWriteFingerprint`).
   const writers = new Set<string>()
   for (const n of nodes.values()) {
@@ -469,7 +471,7 @@ export function dependsOnSiblingOutputs(
     if (inputs === undefined || outputs.length === 0) return true
     // An output the reader's own `!` inputs take back whole is not in its
     // key: `['**/*', '!dist/**']` beside a `dist/**` producer keys the same
-    // before and after it, which is what `rules.upfrontKeys` asks a config
+    // before and after it, which is what `run.rules.upfrontKeys` asks a config
     // to write (X-54).
     const back = inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
     const reach = back.length === 0 ? outputs : outputs.filter((o) => !outputTakenBack(o, back))

package/src/orchestrator/status-line.ts

@@ -5,7 +5,7 @@
 // ordinary write erases the status display first, writes its content,
 // then redraws, so the display can never interleave with task output.
 
-import { paint, type ColorSupport } from './colors.js'
+import { paint, type ColorSupport } from '../util/index.js'
 import { formatTaskRow, paintIdParts, TIME_COL } from './framed-output.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
@@ -26,6 +26,8 @@ export interface StatusStream {
    * TTY) means the region is never drawn anyway.
    */
   columns?: number
+  /** Terminal height in rows, read per draw as `columns` is. */
+  rows?: number
 }
 
 export interface OutputWriter {
@@ -137,14 +139,37 @@ export function createOutputWriter(
    * it. Reachable only on a TTY whose winsize ioctl fails, since a non-TTY
    * disables the region outright.
    */
-  const regionRows = (lines: readonly string[]): number => {
+  const lineRows = (line: string): number => {
     const cols = stream.columns
-    if (cols === undefined || cols <= 0) return lines.length
+    if (cols === undefined || cols <= 0) return 1
+    return Math.max(1, Math.ceil(Bun.stringWidth(line) / cols))
+  }
+  const regionRows = (lines: readonly string[]): number => {
     let rows = 0
-    for (const line of lines) rows += Math.max(1, Math.ceil(Bun.stringWidth(line) / cols))
+    for (const line of lines) rows += lineRows(line)
     return rows
   }
 
+  /**
+   * The leading lines that fit the terminal's height, one row spared.
+   * Cursor-up stops at the top of the screen, and a row that scrolled into
+   * the scrollback is out of the erase's reach: a region taller than the
+   * terminal left its top behind on every redraw, one stacked block per tick
+   * (VS Code's short panel, 2026-10-14). The first line always shows.
+   */
+  const fitted = (lines: readonly string[]): readonly string[] => {
+    const height = stream.rows
+    if (height === undefined || height <= 0) return lines
+    let rows = 0
+    let n = 0
+    for (const line of lines) {
+      rows += lineRows(line)
+      if (n > 0 && rows > height - 1) break
+      n++
+    }
+    return n === lines.length ? lines : lines.slice(0, n)
+  }
+
   // Erase sequence for whatever is currently shown. A single row keeps
   // the exact legacy bytes (ESC[2K\r); anything taller moves to its
   // top row and clears to end of screen.
@@ -155,9 +180,10 @@ export function createOutputWriter(
     // only repeat these bytes.
     cancelTrailing()
     const erase = shown ? eraseSeq() : CLEAR
-    stream.write(erase + current!.join('\n'))
+    const lines = fitted(current!)
+    stream.write(erase + lines.join('\n'))
     shown = true
-    shownRows = regionRows(current!)
+    shownRows = regionRows(lines)
     lastDraw = now()
   }
   const set = (lines: readonly string[], o: { force?: boolean }): void => {
@@ -246,6 +272,8 @@ export interface StatusRegionState {
   blocks?: ReadonlyMap<string, number>
   /** The running task at the head of the longest unfinished chain. */
   critical?: string
+  /** A running task's usual duration from history; its row shows it. */
+  expected?: ReadonlyMap<string, number>
   /**
    * Ready persistent tasks (dev servers …) whose children keep
    * running after their outcome lands. Pinned until runEnd — the
@@ -349,13 +377,14 @@ export function formatStatusRegion(
     const notes: string[] = []
     if (s.critical === slot.id && busy > 1) notes.push(paint(WARN, 'critical path', colors))
     if (waiting > 0) notes.push(dim(`blocks ${waiting}`))
+    const usual = s.expected?.get(slot.id)
     lines.push(
       formatTaskRow(
         ' ',
         Math.max(0, s.nowMs - slot.startedMs),
         'running',
         ACCENT,
-        '',
+        usual === undefined ? '' : formatExpected(usual),
         '',
         paintPinnedId(slot.id, colors),
         colors,
@@ -370,3 +399,16 @@ export function formatStatusRegion(
   lines.push(...s.summaryLines)
   return lines
 }
+
+/**
+ * A running task's usual duration, fixed while the elapsed time counts up
+ * toward it (M, 2026-10-14): `~5.2s`, `~42s`, `~2m 05s`. Fits the cache
+ * column below 100 minutes.
+ */
+function formatExpected(ms: number): string {
+  if (ms < 1000) return `~${Math.round(ms)}ms`
+  if (ms < 9950) return `~${(ms / 1000).toFixed(1)}s`
+  const s = Math.round(ms / 1000)
+  if (s < 60) return `~${s}s`
+  return `~${Math.floor(s / 60)}m ${String(s % 60).padStart(2, '0')}s`
+}