@vzn/vx 0.0.645 → 0.0.648

package/src/exec/sandbox-runtime.ts

@@ -37,6 +37,7 @@ import {
   readFileSync,
   readlinkSync,
   realpathSync,
+  renameSync,
   rmSync,
   statSync,
   unlinkSync,
@@ -47,11 +48,13 @@ import type { SandboxConfig } from '../config.js'
 import {
   armTimeout,
   drainOrAbort,
+  lineEnds,
   POST_EXIT_CUT_LINE,
   shellQuote,
   withForwardArgs,
   signalExitCode,
   stopSignal,
+  SANDBOXED_TASK,
   spawnFailureText,
   streamToString,
   resourceUsageToCpuRss,
@@ -59,8 +62,10 @@ import {
   type CaptureConfig,
   type RunResult,
 } from './runner.js'
+import { watchTree } from './proc-sample.js'
 import {
   BUN_GLOB_WILDCARDS,
+  ESSENTIAL_ENV,
   executablePath,
   helperEnv,
   taskShell,
@@ -68,6 +73,7 @@ import {
   isTmpdirRefusal,
   procfsIsOwn,
   TMPDIR_HINT,
+  ui,
   UserError,
   xxh3hex,
 } from '../util/index.js'
@@ -205,6 +211,7 @@ async function probeUncached(weakerNested: boolean): Promise<SandboxAvailability
 function applyPolicyHere(): SandboxAvailability {
   const proc = Bun.spawnSync({
     cmd: ['sandbox-exec', '-p', '(version 1)(allow default)', '/usr/bin/true'],
+    env: helperEnv(),
     stdout: 'ignore',
     stderr: 'pipe',
   })
@@ -230,12 +237,25 @@ function applyPolicyHere(): SandboxAvailability {
  * the loader).
  */
 export function unavailableReason(exitCode: number | null, stderr: string): string {
-  const hint = stderr.includes('uid_map')
-    ? " — the runtime's seccomp helper cannot create its nested user namespace here (root inside a container, or a kernel that forbids nested user namespaces): run as a non-root user, or set `sandbox.weakerWhenNested: true` on every sandboxed task"
-    : ''
+  const hint = stderr.includes('capability-restricted')
+    ? // Ubuntu 25.04+ confines bwrap with this AppArmor profile (2026-10-23).
+      " — AppArmor's bwrap-userns-restrict profile strips the capabilities of the seccomp helper's nested user namespace: replace it with a profile for /usr/bin/bwrap that grants `userns,` (https://discourse.ubuntu.com/t/58007)"
+    : stderr.includes('uid_map')
+      ? " — the runtime's seccomp helper cannot create its nested user namespace here (root inside a container, or a kernel that forbids nested user namespaces): run as a non-root user, or set `sandbox.weakerWhenNested: true` on every sandboxed task"
+      : ''
   return `a sandboxed \`true\` failed (exit ${exitCode}): ${stderr.slice(0, 200)}${hint}`
 }
 
+/** vx's values of the variables every task gets (`ESSENTIAL_ENV`). */
+function essentialEnv(): Record<string, string> {
+  const env: Record<string, string> = {}
+  for (const name of ESSENTIAL_ENV) {
+    const value = process.env[name]
+    if (value !== undefined) env[name] = value
+  }
+  return env
+}
+
 async function trySandboxedTrue(
   SandboxManager: SrtModule['SandboxManager'],
   weakerNested: boolean,
@@ -248,6 +268,8 @@ async function trySandboxedTrue(
     )
     const proc = Bun.spawn([taskShell(), '-c', wrapped], {
       argv0: 'sh',
+      // What a task gets of vx's env: the probe is a sandboxed `true`.
+      env: essentialEnv(),
       stdout: 'ignore',
       stderr: 'pipe',
       stdin: 'ignore',
@@ -445,10 +467,41 @@ function trackTaskTmpdir(dir: string): void {
   if (tmpdirExitHooked) return
   tmpdirExitHooked = true
   process.on('exit', () => {
-    for (const d of liveTaskTmpdirs) rmSync(d, { recursive: true, force: true })
+    for (const d of liveTaskTmpdirs) removeTaskTmpdir(d)
   })
 }
 
+/**
+ * Remove a task's temp directory; never throws. The task may leave it
+ * unremovable: a read-only directory in it (EACCES), or a straggler still
+ * writing (ENOTEMPTY). Thrown, either failed a task that had passed, as a
+ * worker fault under dte. A read-only one is made writable and the remove
+ * retried; what still stands is left to the exit hook's last try.
+ */
+function removeTaskTmpdir(dir: string): boolean {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      rmSync(dir, { recursive: true, force: true })
+      return true
+    } catch {
+      if (attempt === 2) return false
+      ownerWritable(dir)
+    }
+  }
+}
+
+/** Give the owner write and search on every directory under `dir`, which a recursive remove needs. */
+function ownerWritable(dir: string): void {
+  try {
+    const st = lstatSync(dir)
+    if (!st.isDirectory()) return
+    if ((st.mode & 0o700) !== 0o700) chmodSync(dir, (st.mode & 0o7777) | 0o700)
+    for (const name of readdirSync(dir)) ownerWritable(path.join(dir, name))
+  } catch {
+    // gone, or not this user's: the retry says
+  }
+}
+
 /** Whether SRT is up in this process — set by `initSandbox`, cleared by `resetSandbox`. */
 let srtUp = false
 /**
@@ -595,6 +648,22 @@ function noScanCommand(): string {
   return file
 }
 
+/**
+ * vx's executables the runtime spawns OUTSIDE the sandbox (the no-op scan,
+ * the socat wrapper), as directories every task is walled from, and the
+ * files a task still runs (the wrapper is its side of the proxy bridge
+ * too), granted back read-only. They live in the OS temp dir, and where
+ * that is one every task may write (SRT binds `/tmp/claude` writable into
+ * each), a task rewrote the no-op and the next wrap ran it unsandboxed.
+ */
+function hostHelpers(): { dirs: string[]; files: string[] } {
+  const files = [...socatWrappers].filter(([bare, w]) => w !== bare).map(([, w]) => w)
+  const dirs = [...(noScan === undefined ? [] : [noScan]), ...files].map((f) =>
+    toRealPath(path.dirname(f)),
+  )
+  return { dirs: unique(dirs), files: files.map(toRealPath) }
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -604,13 +673,93 @@ function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
     // SRT's dependency check says so
   }
   try {
-    paths.socatPath = executablePath('socat')
+    paths.socatPath = envCutSocat(executablePath('socat'))
   } catch {
     // SRT's dependency check says so
   }
   return paths
 }
 
+/**
+ * socat behind a wrapper that `exec`s it with the essential env only.
+ * SRT spawns its host bridge (`socat UNIX-LISTEN:… TCP:localhost:…`) with
+ * no `env`, so it held vx's whole environment for the run, readable from
+ * its `/proc/<pid>/environ` by any unsandboxed task beside it, the hole
+ * `hideEnvFromTasks` closes for vx itself. SRT takes no env for it, and
+ * narrowing `process.env` around `initialize` would hand a task spawned
+ * meanwhile the narrowed one. The same path runs socat inside the
+ * sandbox, so the wrapper keeps `SOCAT_DEFAULT_LISTEN_IP` (`hostHasIpv6`).
+ * It lives in this user's own 0700 directory, named by its content, and
+ * no exit hook removes it: SRT's dependency check reads the path its live
+ * config holds, and a per-process one an emitted `exit` reaped left the
+ * next probe "socat not executable" while the process went on (B-93's
+ * shape). A host where it cannot run (`/tmp` mounted noexec) keeps the
+ * bare socat.
+ */
+const socatWrappers = new Map<string, string>()
+function envCutSocat(socat: string): string {
+  const known = socatWrappers.get(socat)
+  // One stat per init: a wrapper someone removed is made again.
+  if (known !== undefined && (known === socat || existsSync(known))) return known
+  let wrapper = socat
+  try {
+    const keep = [...ESSENTIAL_ENV, 'SOCAT_DEFAULT_LISTEN_IP']
+      .map((n) => `\${${n}+"${n}=$${n}"}`)
+      .join(' ')
+    const body = `#!/bin/sh\nexec ${shellQuote(executablePath('env'))} -i ${keep} ${shellQuote(socat)} "$@"\n`
+    const file = ownWrapper(body)
+    if (
+      Bun.spawnSync([file, '-V'], { env: helperEnv(), stdout: 'ignore', stderr: 'ignore' })
+        .exitCode === 0
+    ) {
+      wrapper = file
+    }
+  } catch {
+    // no private directory or no `env`: the bare socat, as before
+  }
+  socatWrappers.set(socat, wrapper)
+  return wrapper
+}
+
+/**
+ * `body` as an executable in `vx-socat-<uid>/` under the OS temp dir,
+ * written once (to a temp, then renamed, so a process beside this one
+ * never runs half of it) and checked byte for byte before it is used.
+ * Anything else at the names (another owner, group or other bits, a
+ * link, other bytes) is refused.
+ */
+function ownWrapper(body: string): string {
+  const uid = process.getuid!()
+  const dir = path.join(os.tmpdir(), `vx-socat-${uid}`)
+  try {
+    mkdirSync(dir, { mode: 0o700 })
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+  }
+  const d = lstatSync(dir)
+  if (!d.isDirectory() || d.uid !== uid || (d.mode & 0o077) !== 0) {
+    throw new Error(`${dir} is not this user's own directory`)
+  }
+  const file = path.join(dir, `socat-${xxh3hex(body).slice(0, 16)}`)
+  const ok = (): boolean => {
+    const f = lstatSync(file, { throwIfNoEntry: false })
+    return (
+      f !== undefined &&
+      f.isFile() &&
+      f.uid === uid &&
+      (f.mode & 0o777) === 0o500 &&
+      readFileSync(file, 'utf8') === body
+    )
+  }
+  if (ok()) return file
+  const tmp = `${file}.${process.pid}`
+  rmSync(tmp, { force: true })
+  writeFileSync(tmp, body, { mode: 0o500, flag: 'wx' })
+  renameSync(tmp, file)
+  if (!ok()) throw new Error(`${file} is not this user's wrapper`)
+  return file
+}
+
 /**
  * Whether this Linux host speaks IPv6. SRT's in-sandbox network bridge is
  * `socat TCP-LISTEN:3128`, and socat 1.8 opens that as an IPv6 socket: on
@@ -1165,6 +1314,12 @@ export interface SandboxViolation {
   hint?: true
   /** Absolute, when `target` is a path at all. */
   path?: string
+  /**
+   * Linux: the directory holding a link on the path the task opened, not
+   * in the sandbox, so the link was not there: a grant of `path` alone
+   * leaves it hidden.
+   */
+  via?: string
   ignorable?: readonly ('read' | 'write' | 'network' | 'systemInfo')[]
 }
 
@@ -1279,6 +1434,9 @@ async function wrapIn(
     baselines.cwd,
   )
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  const helpers = hostHelpers()
+  customConfig!.filesystem!.denyRead!.push(...helpers.dirs)
+  customConfig!.filesystem!.allowRead!.push(...helpers.files)
   if (process.platform === 'linux' && !cwdMounted(baselines.cwd, customConfig!.filesystem!)) {
     customConfig!.filesystem!.denyRead!.push(baselines.cwd)
   }
@@ -1323,7 +1481,10 @@ async function wrapIn(
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
       : { command: taggedCommand, forwards: false, traced: false }
+  // The tag leads: SRT keys a record by the wrap's first 100 characters,
+  // and the proxy wait below is the same 190 for every networked task.
   const inner = [
+    process.platform === 'linux' ? `: 'vx-${tag}';` : '',
     ports.length > 0 ? portBridgeInner(ports, tag) : '',
     process.platform === 'linux' && args.config.network !== undefined ? PROXY_BRIDGE_WAIT : '',
     grouped.command,
@@ -1503,7 +1664,10 @@ function ownGroupCommand(
  * What strace stops on: the reads, the execs and access probes (a refused
  * `./gen.sh || fallback` passed unreported), and what moves or makes a
  * process's cwd. Not the stat family: a stop per stat cost oxlint 19% and
- * `git status` 30%, where the execs and probes cost nothing measurable.
+ * `git status` 30%, where the execs and probes cost nothing measurable, and
+ * vx's own no-op run 69% (pr-bench, 495 → 835 ms, 2026-10-23). So a tool
+ * that stats before it opens, as Ubuntu 26's cat (uutils) does, refused
+ * nothing the trace sees.
  */
 const TRACED_CALLS =
   'trace=openat,execve,?access,faccessat,?faccessat2,chdir,fchdir,clone,?clone3,?fork,?vfork'
@@ -1603,7 +1767,8 @@ function seatbeltSpells(grant: string, kind: 'read' | 'write', name: boolean): b
   const at = name ? m.index : m.index + m[0].length - 2
   if (!warnedUnspellable.has(`${kind} ${grant}`)) {
     warnedUnspellable.add(`${kind} ${grant}`)
-    process.stderr.write(
+    ui.say(
+      'warn',
       `[vx] sandbox: the ${kind} grant ${grant} names a literal ${grant[at + (name ? 0 : 1)]}, ` +
         `which the macOS sandbox reads as a pattern and cannot spell as a name, so it is not ` +
         `granted. Rename it, or grant the directory above it: ` +
@@ -1831,7 +1996,8 @@ function spawnHostBridges(ports: readonly number[], tag: string): void {
  */
 export function releaseBridges(tag: string): void {
   const tmp = taskTmpdir(tag)
-  if (liveTaskTmpdirs.delete(tmp)) rmSync(tmp, { recursive: true, force: true })
+  // One that will not go stays tracked, for the exit hook.
+  if (liveTaskTmpdirs.has(tmp) && removeTaskTmpdir(tmp)) liveTaskTmpdirs.delete(tmp)
   if (liveServers.delete(tag)) {
     // A server's wrap stays counted until it stops: one stopped server
     // kept every later task's stubs in the workspace until the reset.
@@ -1878,11 +2044,25 @@ const TRACER_RETRY_LINE =
  * declared, so a second run redoes, not doubles, it.
  */
 export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRunResult> {
-  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce(args)
+  // Whether the first attempt's output, both streams, ended mid-line: the
+  // notice starts its own line (it read `…/strace: bare[vx] the sandbox's…`).
+  let midLine = false
+  const seen =
+    (on: ((chunk: string) => void) | undefined) =>
+    (chunk: string): void => {
+      if (chunk.length > 0) midLine = !chunk.endsWith('\n')
+      on?.(chunk)
+    }
+  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce({
+    ...args,
+    onStdout: seen(args.onStdout),
+    onStderr: seen(args.onStderr),
+  })
   // A stopping run has killed the children it holds; a retry would be one
   // spawned after that kill.
   if (!tracerFailed || args.signal?.aborted === true) return first
-  args.onStderr?.(TRACER_RETRY_LINE)
+  const notice = (midLine ? '\n' : '') + TRACER_RETRY_LINE
+  args.onStderr?.(notice)
   // `timeout` bounds the task's whole run (schema.md), so the retry gets
   // what the first attempt left of it, not a fresh window.
   const {
@@ -1898,7 +2078,7 @@ export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRun
     ...second,
     durationMs: first.durationMs + second.durationMs,
     stdout: first.stdout + second.stdout,
-    stderr: first.stderr + TRACER_RETRY_LINE + second.stderr,
+    stderr: first.stderr + notice + second.stderr,
   }
 }
 
@@ -2051,7 +2231,7 @@ async function runSandboxedOnce(
       rmSync(straceLog, { force: true })
       liveTempFiles.delete(straceLog)
     }
-    const stderr = spawnFailureText(err, args.cwd, 'sandboxed task')
+    const stderr = spawnFailureText(err, args.cwd, SANDBOXED_TASK, wrapped)
     args.onStderr?.(stderr)
     releaseBridges(tag)
     takeRecords()
@@ -2074,6 +2254,7 @@ async function runSandboxedOnce(
 
   args.liveChildren?.add(proc)
   args.onSpawn?.(proc.pid)
+  const watch = process.platform === 'linux' ? watchTree(proc.pid) : undefined
   const timeout = armTimeout(proc, args.timeoutMs)
   const armedAt = Date.now()
   const ac = new AbortController()
@@ -2081,8 +2262,9 @@ async function runSandboxedOnce(
   let partial = ''
   let straceSpoke = false
   const [out, err] = pipes.streams(proc)
+  const ends = lineEnds(args.onStdout, args.onStderr)
   const streams = Promise.all([
-    streamToString(out, args.onStdout, ac.signal, args.capture?.stdout ?? true),
+    streamToString(out, ends.onStdout, ac.signal, args.capture?.stdout ?? true),
     streamToString(
       err,
       (chunk) => {
@@ -2091,7 +2273,7 @@ async function runSandboxedOnce(
         const lines = (partial + chunk).split('\n')
         partial = (lines.pop() ?? '').slice(0, 512)
         if (lines.some((l) => STRACE_OWN_ERROR.test(l))) straceSpoke = true
-        args.onStderr?.(chunk)
+        ends.onStderr?.(chunk)
       },
       ac.signal,
       args.capture?.stderr ?? true,
@@ -2102,18 +2284,23 @@ async function runSandboxedOnce(
   // aborts at once, otherwise drainOrAbort bounds the post-exit drain.
   await proc.exited
   const ranMs = Date.now() - armedAt
+  const looked = watch?.stop()
   await timeout.settle()
   let cut = false
   if (timeout.timedOut()) ac.abort()
   else cut = await drainOrAbort(streams, ac)
   const [stdout, streamed] = await streams
-  if (cut) args.onStderr?.(POST_EXIT_CUT_LINE)
-  const stderr = cut ? streamed + POST_EXIT_CUT_LINE : streamed
+  const cutLine = ends.own(POST_EXIT_CUT_LINE)
+  if (cut) args.onStderr?.(cutLine)
+  const stderr = cut ? streamed + cutLine : streamed
   args.liveChildren?.delete(proc)
   releaseGroup(proc)
   closeSignalChannel(proc)
   releaseBridges(tag)
-  const exitCode = proc.exitCode ?? (proc.signalCode ? signalExitCode(proc.signalCode) : 1)
+  const exited = proc.exitCode ?? (proc.signalCode ? signalExitCode(proc.signalCode) : 1)
+  // A timeout is a failure, whatever the child said: one that traps the
+  // TERM and exits 0 reported success to every executor built on this.
+  const exitCode = exited === 0 && timeout.timedOut() ? signalExitCode('SIGTERM') : exited
 
   // macOS: read the violation store keyed by our tagged command.
   //
@@ -2132,8 +2319,8 @@ async function runSandboxedOnce(
   // DROPPED by the unified log under pressure, not delayed. Reporting on
   // macOS is therefore lossy-by-OS under load; ENFORCEMENT is unaffected
   // (every observed loss still denied the read and failed the child).
-  // EVERY record SRT's store saw for this command, unfiltered (owner,
-  // 2026-09-05). A sandboxed task that fails must say what it was denied;
+  // EVERY record SRT's store saw for this command, unfiltered
+  // (2026-09-05). A sandboxed task that fails must say what it was denied;
   // deciding on the user's behalf that a record was "just traversal" is how
   // a failure ends up with an empty violations section and no explanation.
   const records = takeRecords()
@@ -2148,7 +2335,7 @@ async function runSandboxedOnce(
   // below (`refusedWrites`).
   const macViolations = process.platform === 'darwin' ? records : []
   // No settle window: the store is read once, right after the child exits
-  // (owner, 2026-09-05). It cost 300ms on EVERY clean sandboxed task — the
+  // (2026-09-05). It cost 300ms on EVERY clean sandboxed task — the
   // full budget, since a task with nothing to report can only prove that by
   // waiting — against 26ms for one that reports something and breaks out
   // early. Measured: clean `echo` 331ms sandboxed vs 16ms plain.
@@ -2268,7 +2455,7 @@ async function runSandboxedOnce(
     stdout,
     stderr,
     violations,
-    ...(proc.signalCode ? { signal: proc.signalCode } : {}),
+    ...(typeof proc.signalCode === 'string' ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
     ...(cut ? { leftRunning: true } : {}),
     // Linux: the task's CPU and peak never reach this wait. bwrap runs it
@@ -2276,10 +2463,14 @@ async function runSandboxedOnce(
     // processes used is not folded into bwrap's usage: a 500 ms busy loop
     // read 2 ms under it and 510 without the flag, and the peak read was
     // vx's own high-water mark, inherited at exec (a sandboxed `true` from a
-    // 300 MB vx: 353 MB; B-3). Nothing is reported rather than a number
-    // that is someone else's. macOS's `sandbox-exec` execs the command, so
-    // its usage is the task's.
-    ...(process.platform === 'linux' ? {} : resourceUsageToCpuRss(proc.resourceUsage())),
+    // 300 MB vx: 353 MB; B-3). So the tree is looked at while it runs
+    // (`watchTree`); a task over before the first look reports nothing.
+    // macOS's `sandbox-exec` execs the command, so its usage is the task's.
+    ...(process.platform !== 'linux'
+      ? resourceUsageToCpuRss(proc.resourceUsage())
+      : looked === undefined
+        ? {}
+        : { cpuMs: looked.cpuMs, peakRssBytes: looked.rssBytes }),
     ranMs,
     tracerFailed:
       straceLog !== undefined &&
@@ -2847,7 +3038,8 @@ function writeGrantMatchedNothing(grant: string, within: string): void {
   // As a committed config spells them (B-97): the absolute path held only
   // on the machine that printed it, as in `outsideWritesHint`.
   const dir = grantSpelled(grantPrefix(grant), within)
-  process.stderr.write(
+  ui.say(
+    'warn',
     `[vx] sandbox: the write grant ${jsString(grantSpelled(grant, within))} matches nothing ` +
       `yet, and a read grant mounts its directory read-only, so a file the task creates under ` +
       `it will fail with "Read-only file system". A bind mount covers what exists when the ` +
@@ -2883,6 +3075,7 @@ function straceState(): Promise<{ form: false | 'plain' | 'seccomp'; why: string
 async function probeStrace(): Promise<{ form: false | 'plain' | 'seccomp'; why: string }> {
   try {
     const p = Bun.spawn([executablePath('strace'), '--version'], {
+      env: helperEnv(),
       stdout: 'pipe',
       stderr: 'ignore',
     })
@@ -2956,7 +3149,7 @@ async function traceRefusal(
       '--',
       executablePath('true'),
     ],
-    { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe' },
+    { stdin: 'ignore', stdout: 'ignore', stderr: 'pipe', env: helperEnv() },
   )
   const err = await new Response(p.stderr).text()
   const line = err.split('\n').find((l) => STRACE_OWN_ERROR.test(l))
@@ -2969,7 +3162,8 @@ let warnedNoTrace = false
 function warnUntraced(why: string): void {
   if (warnedNoTrace) return
   warnedNoTrace = true
-  process.stderr.write(
+  ui.say(
+    'warn',
     `[vx] sandbox: ${why}, so sandboxed tasks run without the report of the reads the sandbox denied; ` +
       `the sandbox still enforces\n`,
   )

package/src/exec/sandbox-violations.ts

@@ -8,6 +8,7 @@ import { existsSync, lstatSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import { bindableReads, bindableWrites } from './sandbox-binds.js'
+import { printable } from '../util/index.js'
 import type {
   ResolvedSandboxConfig,
   SandboxedRunArgs,
@@ -50,17 +51,30 @@ const DIRFD = '(?:AT_FDCWD|\\d+)(?:<(.*?)>)?, '
 // The rest of the call: an `execve`'s argv strings may hold a `)`
 // (`sh -c "f()"`), so it reads to the result at the line's end.
 const ARGS = '.*'
+// The result, at the line's end: an argv string may hold `) = -1 ENOENT`
+// itself, and a call that succeeded read as denied.
+const FAILED = '\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)(?: \\([^)]*\\))?\\s*$'
 const STRACE_DONE_RE = new RegExp(
-  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}${ARGS}\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}${ARGS}\\)${FAILED}`,
 )
 const STRACE_UNFINISHED_RE = new RegExp(
   `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}${ARGS}<unfinished`,
 )
-const STRACE_RESUMED_RE = new RegExp(
-  `^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
-)
-/** The calls that ask whether a path is there rather than read it. */
-const PROBES = new Set(['execve', 'faccessat2', 'faccessat', 'access', 'statx', 'newfstatat'])
+const STRACE_RESUMED_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?${FAILED}`)
+/**
+ * The calls that ask whether a path is there rather than read it. A
+ * `chdir` creates nothing: one into a directory the host lacks (`mkdir -p`
+ * after its refused mkdir) was judged a write, and the fix named a file.
+ */
+const PROBES = new Set([
+  'execve',
+  'faccessat2',
+  'faccessat',
+  'access',
+  'statx',
+  'newfstatat',
+  'chdir',
+])
 /** A resumed call that SUCCEEDED — clears the pending entry, emits nothing. */
 const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>`)
 /**
@@ -331,6 +345,9 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
   return out
 }
 
+/** Distinct calls `parseStraceViolations` judges between yields to the event loop. */
+const JUDGED_PER_TURN = 500
+
 export async function parseStraceViolations(
   logPath: string,
   args: SandboxedRunArgs,
@@ -386,19 +403,29 @@ export async function parseStraceViolations(
   }
 
   const seen = new Set<string>()
+  const judged = new Set<string>()
   const out: SandboxViolation[] = []
   for (const { syscall, rawPath, errno, dir, read } of deniedCalls(
     text,
     baselines.cwd,
     widened.size > 0,
   )) {
+    // A suite's log repeats a call by the thousand, each judged by sync
+    // stats: a test shard's 44,788 calls held the event loop 2.9 s, and a
+    // DTE worker that quiet for two heartbeats was lost (main, 2026-10-25).
+    // Each call is judged once, and the loop yields between batches.
+    const call = `${syscall}\0${rawPath}\0${dir}\0${errno}\0${read}`
+    if (judged.has(call)) continue
+    judged.add(call)
+    if (judged.size % JUDGED_PER_TURN === 0) await new Promise((r) => setImmediate(r))
     const lexical = absolutize(rawPath, dir ?? baselines.cwd)
     const abs = toRealPath(lexical)
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
-    if (isUnderAny(abs, allowAbs) && !hiddenByLink(lexical, abs, mounted, denyAnchors)) continue
+    const via = lexical === abs ? undefined : hiddenLink(lexical, abs, mounted, denyAnchors)
+    if (isUnderAny(abs, allowAbs) && via === undefined) continue
     if (underGlob(abs, pendingWrites)) continue
     if (read === true && !undeclared(abs)) continue
     // A hidden path answers ENOENT, as a missing one does: a probe
@@ -409,17 +436,20 @@ export async function parseStraceViolations(
     const key = `${syscall}|${abs}`
     if (seen.has(key)) continue
     seen.add(key)
+    // The line is printed verbatim, and the trace's `\033` is decoded: a
+    // denied file named `ESC ]0;…` retitled the terminal.
+    const [said, real] = [printable(rawPath), printable(abs)]
     out.push(
       read === true
         ? {
-            line: `${syscall}(${rawPath}) read under a write grant's directory, granted no read  [${abs}]`,
+            line: `${syscall}(${said}) read under a write grant's directory, granted no read  [${real}]`,
             timestamp: new Date(),
             target: abs,
             path: abs,
             ignorable: ['read'],
           }
         : {
-            line: `${syscall}(${rawPath}) = -1 ${errno}  [${abs}]`,
+            line: `${syscall}(${said}) = -1 ${errno}  [${real}]`,
             timestamp: new Date(),
             target: abs,
             path: abs,
@@ -427,6 +457,7 @@ export async function parseStraceViolations(
             // does not keep, and `access` may ask either — so either list
             // can silence it.
             ignorable: ['read', 'write'],
+            ...(via === undefined ? {} : { via }),
           },
     )
   }
@@ -434,8 +465,10 @@ export async function parseStraceViolations(
 }
 
 /**
- * A granted file the task could not open because a link on the path it
- * opened is not in the sandbox. A grant is mounted at its real path and
+ * The directory holding a link on the path the task opened, when that
+ * directory is not in the sandbox, so the link is not there either: what
+ * a fix must grant beside the target. A granted file the task could not
+ * open this way was dropped as granted. A grant is mounted at its real path and
  * bwrap mounts no link, so `read: ['config.json']` over `config.json ->
  * conf/real.json` bound the target and left the name the task opens out;
  * judged by its real path, the ENOENT was granted and dropped, and a tool
@@ -444,26 +477,25 @@ export async function parseStraceViolations(
  * is missing outside the sandbox too, and outside the deny anchor the
  * host is mounted, links and all.
  */
-function hiddenByLink(
+function hiddenLink(
   lexical: string,
   real: string,
   mounted: Set<string>,
   anchors: readonly string[],
-): boolean {
-  if (lexical === real || !existsSync(real)) return false
+): string | undefined {
+  if (!existsSync(real)) return undefined
   let at = lexical
-  const links: string[] = []
   for (let up = path.dirname(at); up !== at; at = up, up = path.dirname(at)) {
     try {
-      if (lstatSync(at).isSymbolicLink()) links.push(at)
+      if (!lstatSync(at).isSymbolicLink()) continue
     } catch {
       // Not on the host by this spelling: no link to judge here.
+      continue
     }
+    const holder = toRealPath(up)
+    if (anchors.some((a) => atOrUnder(holder, a)) && !isUnderAny(holder, mounted)) return holder
   }
-  return links.some((l) => {
-    const holder = toRealPath(path.dirname(l))
-    return anchors.some((a) => atOrUnder(holder, a)) && !isUnderAny(holder, mounted)
-  })
+  return undefined
 }
 
 /**