@vzn/vx 0.0.646 → 0.0.649

package/src/exec/runner.ts

@@ -8,11 +8,13 @@ import type { Pointer } from 'bun:ffi'
 import { closeSync, existsSync, readFileSync } from 'node:fs'
 import { constants as osConstants } from 'node:os'
 import {
+  formatBytes,
   shellArgv,
   isExecutableMissing,
   isOutOfFds,
   killGraceMs,
   OUT_OF_FDS_HINT,
+  helperEnv,
   type SecretMask,
 } from '../util/index.js'
 import {
@@ -35,10 +37,11 @@ export interface RunResult {
   durationMs: number
   stdout: string
   stderr: string
-  /** The signal that killed the child, if any (Bun's `signalCode`).
+  /** The signal that killed the child, if any (Bun's `signalCode`): its
+   *  name, or its number when it has none (Linux's real-time signals).
    *  SIGINT/SIGTERM here means a Ctrl-C / shutdown teardown — the
    *  orchestrator reverts such a task to aborted, not failed. */
-  signal?: string
+  signal?: string | number
   /** True when vx's own `timeout` timer fired and SIGTERMed the child.
    *  Distinguishes a timeout (a real `failed`) from a Ctrl-C shutdown
    *  SIGTERM (which the orchestrator reverts to `aborted`). */
@@ -106,12 +109,8 @@ export interface RunOptions {
 type Fd = 'inherit' | 'ignore' | 'pipe' | number
 
 /** A child's descriptors 0–2: vx's own for a task that holds the terminal. */
-function taskStdio(
-  terminal: boolean | undefined,
-  stdin: 'ignore' | 'pipe',
-  pipes: TaskPipes,
-): [Fd, Fd, Fd] {
-  return terminal === true ? ['inherit', 'inherit', 'inherit'] : [stdin, ...pipes.stdio]
+function taskStdio(terminal: boolean | undefined, pipes: TaskPipes): [Fd, Fd, Fd] {
+  return terminal === true ? ['inherit', 'inherit', 'inherit'] : [pipes.stdin, ...pipes.stdio]
 }
 
 const O_NONBLOCK = 0o4000
@@ -180,6 +179,14 @@ function realPipes(): Int32Array | undefined {
   return fds
 }
 
+/** One pipe, `[read, write]`, both close-on-exec, or undefined as {@link realPipes}. */
+function heldPipe(): Int32Array | undefined {
+  const calls = linuxPipeCalls()
+  if (calls === null) return undefined
+  const fds = new Int32Array(2)
+  return calls.pipe2(calls.ptr(fds), O_CLOEXEC) === 0 ? fds : undefined
+}
+
 /**
  * A task's stdout and stderr. Bun's `'pipe'` is a socketpair, and Linux
  * opens `/dev/stdout` through `/proc/self/fd/1`, which a socket refuses
@@ -188,25 +195,35 @@ function realPipes(): Int32Array | undefined {
  * Linux vx makes the pipes (`pipe2` through `bun:ffi`) and hands the child
  * the write ends. macOS opens `/dev/fd/N` as a dup of the descriptor,
  * which a socket allows, so Bun's pipe stays there.
+ *
+ * `held`: stdin is a pipe vx keeps open and never writes (a persistent
+ * task's, schema.md), for the same reason: `cat /dev/stdin` on Bun's
+ * socketpair failed with ENXIO instead of blocking. Otherwise `'ignore'`.
  */
 export class TaskPipes {
+  /** Descriptor 0 for `Bun.spawn`'s `stdio`. */
+  readonly stdin: number | 'pipe' | 'ignore'
   /** Descriptors 1 and 2 for `Bun.spawn`'s `stdio`. */
   readonly stdio: readonly [number | 'pipe', number | 'pipe']
   readonly #read: readonly number[]
+  readonly #stdinWrite: number | undefined
 
-  constructor(terminal?: boolean) {
+  constructor(terminal?: boolean, held?: boolean) {
     const fds = terminal === true ? undefined : realPipes()
     this.stdio = fds === undefined ? ['pipe', 'pipe'] : [fds[1]!, fds[3]!]
     this.#read = fds === undefined ? [] : [fds[0]!, fds[2]!]
+    const inFds = held === true && terminal !== true ? heldPipe() : undefined
+    this.stdin = held !== true ? 'ignore' : inFds === undefined ? 'pipe' : inFds[0]!
+    this.#stdinWrite = inFds?.[1]
   }
 
   /**
-   * Close vx's copies of the write ends once the spawn has returned or
-   * thrown: the child holds its own, and one left here is a writer the
-   * reader's EOF would wait for.
+   * Close vx's copies of the child's ends once the spawn has returned or
+   * thrown: the child holds its own, and a write end left here is a writer
+   * the reader's EOF would wait for.
    */
   spawned(): void {
-    for (const fd of this.stdio) if (typeof fd === 'number') closeSync(fd)
+    for (const fd of [this.stdin, ...this.stdio]) if (typeof fd === 'number') closeSync(fd)
   }
 
   /** The child's stdout and stderr. */
@@ -231,6 +248,16 @@ export class TaskPipes {
   close(): void {
     for (const fd of this.#read) closeSync(fd)
   }
+
+  /**
+   * Close the held stdin's write end, once the child has exited and its
+   * output has ended. Not with the output alone: a server that sends it
+   * to a log (`exec >log 2>&1`) ended its streams at once, read stdin EOF
+   * and exited.
+   */
+  closeStdin(): void {
+    if (this.#stdinWrite !== undefined) closeSync(this.#stdinWrite)
+  }
 }
 
 /**
@@ -245,14 +272,30 @@ export class TaskPipes {
 function keepTerminalModes(): (() => void) | undefined {
   const saved = stty('-g')
   if (saved === undefined) return undefined
-  return () => {
+  const restore = (): void => {
+    if (!owed.delete(restore)) return
     if (stty('-g') !== saved) stty(saved)
   }
+  owed.add(restore)
+  return restore
+}
+
+/** The modes of every task still holding the terminal, owed back on its exit. */
+const owed = new Set<() => void>()
+
+/**
+ * Put the terminal back now for every task still holding it: vx is
+ * exiting without waiting for them (a second signal, signals.ts), so the
+ * restore on each task's exit never runs.
+ */
+export function restoreTerminalModes(): void {
+  for (const restore of [...owed]) restore()
 }
 
 function stty(arg: string): string | undefined {
   try {
     const out = Bun.spawnSync(['stty', arg], {
+      env: helperEnv(),
       stdio: ['inherit', 'pipe', 'ignore'],
       detached: true,
     })
@@ -279,10 +322,13 @@ export function shellQuote(arg: string): string {
  * `<<X` in a comment or quotes opens no heredoc, and a quote in a body
  * opens nothing (X-110).
  */
-function shellShape(command: string): { comment: number; body: boolean[] } {
+function shellShape(command: string): { comment: number; body: boolean[]; subshell: boolean } {
   const lines = command.split('\n')
   const body = lines.map(() => false)
   const pending: Array<{ delim: string; tabs: boolean }> = []
+  // Per open `(`: does it open a subshell, not `$(`, `$((`, `<(` or `f()`.
+  const parens: boolean[] = []
+  let subshell = false
   let quote = ''
   let comment = -1
   let atWordStart = true
@@ -330,17 +376,32 @@ function shellShape(command: string): { comment: number; body: boolean[] } {
       continue
     }
     if (c === '<' && command[i - 1] !== '<') {
-      const m = /^<<(-?)[ \t]*\\?(['"]?)([A-Za-z_]\w*)\2/.exec(command.slice(i, i + 256))
-      if (m !== null) {
-        pending.push({ delim: m[3]!, tabs: m[1] === '-' })
+      // The delimiter is a whole word, quotes removed: `<<END-OF` and
+      // `<<'a b'` end at `END-OF` and `a b`. One opening with a digit is
+      // left alone, for `$((x<<2))`.
+      const m = /^<<(-?)[ \t]*((?:[^\s;&|()<>'"\\]|\\.|'[^']*'|"(?:[^"\\]|\\.)*")+)/.exec(
+        command.slice(i, i + 256),
+      )
+      if (m !== null && !/^\d/.test(m[2]!)) {
+        const delim = m[2]!.replace(/'([^']*)'|"((?:[^"\\]|\\.)*)"|\\(.)/g, (_, s, d, e) =>
+          s !== undefined ? s : d !== undefined ? d.replace(/\\(.)/g, '$1') : e,
+        )
+        pending.push({ delim, tabs: m[1] === '-' })
         i += m[0].length - 1
         atWordStart = false
         continue
       }
     }
+    if (c === '(') {
+      const prev = command[i - 1] ?? ''
+      parens.push(!/[$<>\w]/.test(prev) && !(prev === '(' && parens.at(-1) === false))
+    } else if (c === ')') {
+      const opened = parens.pop()
+      if (i === command.length - 1) subshell = opened === true
+    }
     atWordStart = /[\s;&|()<>]/.test(c)
   }
-  return { comment, body }
+  return { comment, body, subshell }
 }
 
 /**
@@ -372,6 +433,21 @@ export function withForwardArgs(command: string, args: readonly string[] | undef
     // ran the args as a command of their own: `--watch: not found`. Kept
     // when an odd run of backslashes ends it: that escapes what follows.
     const escaped = (/\\+$/.exec(trimmed)?.[0].length ?? 0) % 2 === 1
+    // So did one that ends in a lone `;` or `&` (or a case arm's `;;`): the
+    // args go before it. An escaped one (find's `-exec … \;`) is a word,
+    // and takes them after.
+    const sep = /(?:^|[^;&|<>\\])(?:\\\\)*(;;|[;&])$/.exec(trimmed)?.[1]
+    // After a compound command's closer they were a syntax error
+    // (`(cmd) --fix`, `fi --fix`): they go to the last command inside it.
+    // A closer word counts only where a command starts, after a separator.
+    const closer = shape.subshell
+      ? ')'
+      : /(?:^|[^\\])(?:\\\\)*[;&\n][ \t]*(fi|done|esac|\})$/.exec(trimmed)?.[1]
+    const end = sep ?? closer
+    if (end !== undefined) {
+      const head = trimmed.slice(0, -end.length).trimEnd()
+      return `${withForwardArgs(head, args)}${trimmed.slice(head.length)}`
+    }
     return `${escaped ? command : trimmed} ${quoted}`
   }
   // A comment-only last line after a commented line: the args go before
@@ -433,6 +509,28 @@ const SHELL_BUILTINS = new Set([
   'let',
   'declare',
   'typeset',
+  // The rest of bash's builtins, as `compgen -b` lists them.
+  'bg',
+  'bind',
+  'caller',
+  'compgen',
+  'complete',
+  'compopt',
+  'dirs',
+  'disown',
+  'enable',
+  'fc',
+  'fg',
+  'getopts',
+  'help',
+  'history',
+  'logout',
+  'mapfile',
+  'popd',
+  'pushd',
+  'readarray',
+  'shopt',
+  'suspend',
   // bash's reserved words that may open a one-line command; macOS's `sh`
   // is bash, and `exec [[ … ]]` there is "exec: [[: not found".
   '[[',
@@ -484,11 +582,13 @@ export function execWord(command: string): string | undefined {
 
 /**
  * POSIX shells report signal death as 128 + signal number (SIGTERM →
- * 143, SIGKILL → 137). Bun gives us the signal NAME; `os.constants`
- * maps it to the platform-correct number. Unknown names fall back to
- * 130 (128 + SIGINT).
+ * 143, SIGKILL → 137). Bun gives the signal's NAME, or since 1.4.4 its
+ * number when the signal has no name; `os.constants` maps a name to
+ * the platform-correct number. Unknown names fall back to 130 (128 +
+ * SIGINT).
  */
-export function signalExitCode(signal: string): number {
+export function signalExitCode(signal: string | number): number {
+  if (typeof signal === 'number') return 128 + signal
   const num = (osConstants.signals as Partial<Record<string, number>>)[signal]
   return num === undefined ? 130 : 128 + num
 }
@@ -607,9 +707,38 @@ const POST_EXIT_DRAIN_MS = 250
  * run; the line makes the loss visible.
  */
 export const POST_EXIT_CUT_LINE =
-  `\n[vx] output after the task's shell exited was cut: a process it left running ` +
+  `[vx] output after the task's shell exited was cut: a process it left running ` +
   `still held its stdout/stderr ${POST_EXIT_DRAIN_MS} ms later\n`
 
+/**
+ * A task's two output callbacks, wrapped to learn whether its output so far
+ * ends mid-line, so a line vx adds after it (`POST_EXIT_CUT_LINE`) breaks
+ * the line only then: a newline always before it printed a blank line under
+ * the task's last line. An absent callback stays absent (nothing decodes).
+ */
+export function lineEnds(
+  onStdout?: (chunk: string) => void,
+  onStderr?: (chunk: string) => void,
+): {
+  onStdout?: (chunk: string) => void
+  onStderr?: (chunk: string) => void
+  /** `text` on a line of its own. */
+  own(text: string): string
+} {
+  let mid = false
+  const track =
+    (f: (chunk: string) => void) =>
+    (chunk: string): void => {
+      if (chunk.length > 0) mid = !chunk.endsWith('\n')
+      f(chunk)
+    }
+  return {
+    ...(onStdout && { onStdout: track(onStdout) }),
+    ...(onStderr && { onStderr: track(onStderr) }),
+    own: (text) => (mid ? `\n${text}` : text),
+  }
+}
+
 /**
  * After the direct child has exited, wait for the stdout/stderr readers to
  * reach EOF — but bound it: an orphaned grandchild holding the pipe open would
@@ -669,8 +798,11 @@ export class PersistentReadyError extends Error {
 }
 
 export interface PersistentSpawn {
-  /** Underlying Bun subprocess so the orchestrator can SIGTERM it later. */
-  child: ReturnType<typeof Bun.spawn>
+  /**
+   * Underlying Bun subprocess so the orchestrator can SIGTERM it later;
+   * undefined when the spawn itself failed and `ready` has rejected.
+   */
+  child: ReturnType<typeof Bun.spawn> | undefined
   /**
    * Resolves once the task is considered "ready":
    *   - immediately on successful spawn when no `readyWhen` is given,
@@ -726,7 +858,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const readyRe = opts.readyWhen !== undefined ? new RegExp(opts.readyWhen) : undefined
 
   let child: ReturnType<typeof Bun.spawn>
-  const pipes = new TaskPipes(opts.terminal)
+  const pipes = new TaskPipes(opts.terminal, true)
   const restoreModes = opts.terminal === true ? keepTerminalModes() : undefined
   try {
     const signalFd = opts.signalChannel === true
@@ -748,7 +880,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
           // The one-shot spawn below keeps 'ignore', so a task that reads
           // stdin can never hang CI.
           stdio: [
-            ...taskStdio(opts.terminal, 'pipe', pipes),
+            ...taskStdio(opts.terminal, pipes),
             ...(signalFd ? ['pipe' as const] : []),
             ...(guard === undefined ? [] : [guard]),
           ],
@@ -767,9 +899,15 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
     }
   } catch (err) {
     pipes.close()
-    const message = err instanceof Error ? err.message : String(err)
+    pipes.closeStdin()
+    // Bun names `sh` in the ENOENT a missing directory gives too.
+    // The command the shell was handed, a sandbox's wrap included.
+    const message =
+      isExecutableMissing(err) && !existsSync(opts.cwd)
+        ? `its working directory ${opts.cwd} does not exist`
+        : spawnErrorReason(err, opts.signalChannel === true ? SANDBOXED_TASK : 'task', opts.command)
     return {
-      child: undefined as unknown as ReturnType<typeof Bun.spawn>,
+      child: undefined,
       ready: Promise.reject(
         new PersistentReadyError(`failed to spawn persistent task: ${message}`, 'spawn'),
       ),
@@ -874,6 +1012,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   const readers = Promise.all([consumeChunks(stdout, false), consumeChunks(stderr, true)]).finally(
     () => pipes.close(),
   )
+  void Promise.allSettled([readers, child.exited]).then(() => pipes.closeStdin())
 
   opts.liveChildren?.add(child)
   opts.onSpawn?.(child.pid)
@@ -934,7 +1073,7 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
     }
     // A clean exit is ready: a setup step (migrate, seed, a `docker
     // compose up --wait`) has done its work, and what it started, if
-    // anything, is torn down with the run (M 2026-10-22).
+    // anything, is torn down with the run (2026-10-22).
     if (code === 0) markReady()
     if (readyAt === undefined && gaveUpAt === undefined) {
       rejectReady(
@@ -959,21 +1098,57 @@ export function runPersistent(opts: PersistentOptions): PersistentSpawn {
   }
 }
 
+/** `spawnFailureText`'s `what` for a sandboxed task: its command is the sandbox's wrap of the task's. */
+export const SANDBOXED_TASK = 'sandboxed task'
+
 /**
  * What a task's frame says when `Bun.spawn` itself threw. The text goes
  * through `onStderr` AND onto the result: the orchestrator retains no
  * stderr (execute-task's capture), so a reason that only sat on the result
  * reached nobody — a box without `sh` showed "failed (exit 127)" under a
  * bare `$ <command>` and nothing else (2026-09-16). An ENOENT with the
- * working directory in place is the shell; Bun's own text names the rest.
+ * working directory in place is the shell, without it the directory; Bun's
+ * own text names the rest.
  */
-export function spawnFailureText(err: unknown, cwd: string, what = 'task'): string {
-  if (isExecutableMissing(err) && existsSync(cwd)) {
-    return `\n[vx] vx runs each task with sh -c: failed to spawn 'sh' (working dir: ${cwd}). Install a POSIX sh and re-run.\n`
+export function spawnFailureText(
+  err: unknown,
+  cwd: string,
+  what = 'task',
+  command?: string,
+): string {
+  if (isExecutableMissing(err)) {
+    // Bun names `sh` in the ENOENT a missing directory gives too.
+    return existsSync(cwd)
+      ? `[vx] vx runs each task with sh -c: failed to spawn 'sh' (working dir: ${cwd}). Install a POSIX sh and re-run.\n`
+      : `[vx] failed to spawn ${what}: its working directory ${cwd} does not exist\n`
   }
+  return `[vx] failed to spawn ${what}: ${spawnErrorReason(err, what, command)}\n`
+}
+
+/** Bun's text for a spawn that threw, and the way out when the limit hit is a known one. */
+function spawnErrorReason(err: unknown, what: string, command: string | undefined): string {
   const message = err instanceof Error ? err.message : String(err)
-  const hint = isOutOfFds(err) ? ` — ${OUT_OF_FDS_HINT}` : ''
-  return `\n[vx] failed to spawn ${what}: ${message}${hint}\n`
+  const hint = isOutOfFds(err)
+    ? ` — ${OUT_OF_FDS_HINT}`
+    : command !== undefined && (err as NodeJS.ErrnoException | undefined)?.code === 'E2BIG'
+      ? ` — ${argTooLongHint(command, what === SANDBOXED_TASK)}`
+      : ''
+  return `${message}${hint}`
+}
+
+/**
+ * A task's command, the args after `--` folded in, is ONE argument to
+ * `sh -c`, and Linux caps one argument at 128 KiB (MAX_ARG_STRLEN), far
+ * below the argv total: a file list forwarded to a linter failed with a
+ * bare E2BIG, which reads as "too many files" and names no way out.
+ */
+function argTooLongHint(command: string, wrapped: boolean): string {
+  const kib = Math.ceil(Buffer.byteLength(command) / 1024)
+  const what = wrapped ? "with the args after -- and the sandbox's wrap" : 'with the args after --'
+  return (
+    `the command, ${what}, is ${kib} KiB, and one argument to sh -c may hold at ` +
+    `most 128 KiB on Linux: pass a long list through a file the tool reads (xargs, a response file)`
+  )
 }
 
 export async function runCommand(opts: RunOptions): Promise<RunResult> {
@@ -989,10 +1164,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
         ...SH_ARGV0,
         cwd: opts.cwd,
         env: opts.env as Record<string, string>,
-        stdio: [
-          ...taskStdio(opts.terminal, 'ignore', pipes),
-          ...(guard === undefined ? [] : [guard]),
-        ],
+        stdio: [...taskStdio(opts.terminal, pipes), ...(guard === undefined ? [] : [guard])],
         // Its own session and process group, so a kill reaches what it
         // forked (kill-tree.ts). A terminal handed over is not this
         // session's controlling one, so no read stops the group.
@@ -1001,7 +1173,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
     )
   } catch (err) {
     pipes.close()
-    const stderr = spawnFailureText(err, opts.cwd)
+    const stderr = spawnFailureText(err, opts.cwd, 'task', fullCommand)
     opts.onStderr?.(stderr)
     return { exitCode: 127, durationMs: Date.now() - start, stdout: '', stderr, spawnFailed: true }
   } finally {
@@ -1013,9 +1185,10 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   const timeout = armTimeout(proc, opts.timeoutMs)
   const ac = new AbortController()
   const [out, err] = pipes.streams(proc)
+  const ends = lineEnds(opts.onStdout, opts.onStderr)
   const streams = Promise.all([
-    streamToString(out, opts.onStdout, ac.signal, opts.capture?.stdout ?? true),
-    streamToString(err, opts.onStderr, ac.signal, opts.capture?.stderr ?? true),
+    streamToString(out, ends.onStdout, ac.signal, opts.capture?.stdout ?? true),
+    streamToString(err, ends.onStderr, ac.signal, opts.capture?.stderr ?? true),
   ]).finally(() => pipes.close())
   // Gate on the child's own exit, not on stream EOF: an orphaned grandchild
   // can keep the pipe open past the child's exit (a timeout SIGTERM leaves the
@@ -1030,17 +1203,21 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
   if (timeout.timedOut()) ac.abort()
   else cut = await drainOrAbort(streams, ac)
   const [stdout, streamed] = await streams
-  if (cut) opts.onStderr?.(POST_EXIT_CUT_LINE)
-  const stderr = cut ? streamed + POST_EXIT_CUT_LINE : streamed
+  const cutLine = ends.own(POST_EXIT_CUT_LINE)
+  if (cut) opts.onStderr?.(cutLine)
+  const stderr = cut ? streamed + cutLine : streamed
   opts.liveChildren?.delete(proc)
   releaseGroup(proc)
-  const exitCode = proc.exitCode ?? (proc.signalCode ? signalExitCode(proc.signalCode) : 1)
+  const exited = proc.exitCode ?? (proc.signalCode ? signalExitCode(proc.signalCode) : 1)
+  // A timeout is a failure, whatever the child said: one that traps the
+  // TERM and exits 0 reported success to every executor built on this.
+  const exitCode = exited === 0 && timeout.timedOut() ? signalExitCode('SIGTERM') : exited
   return {
     exitCode,
     durationMs: Date.now() - start,
     stdout,
     stderr,
-    ...(proc.signalCode ? { signal: proc.signalCode } : {}),
+    ...(proc.signalCode != null ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
     ...(cut ? { leftRunning: true } : {}),
     ...resourceUsageToCpuRss(proc.resourceUsage(), rssFloorFor),
@@ -1105,9 +1282,6 @@ function rssFloorFor(peak: number): number {
 export const CAPTURE_HEAD_CHARS = 8 * 1024 * 1024
 export const CAPTURE_TAIL_CHARS = 8 * 1024 * 1024
 
-const mib = (n: number): string => `${(n / (1024 * 1024)).toFixed(1)} MiB`
-const size = (n: number): string => (n < 1024 * 1024 ? `${n / 1024} KiB` : mib(n))
-
 /** The line that stands where the dropped middle was. */
 export function droppedOutputLine(
   dropped: number,
@@ -1115,8 +1289,9 @@ export function droppedOutputLine(
   tailChars = CAPTURE_TAIL_CHARS,
 ): string {
   return (
-    `\n[vx] ${mib(dropped)} of output not kept — vx keeps the first ${size(headChars)} ` +
-    `and the last ${size(tailChars)} of a task's output\n`
+    // In vx's own units: a fixed MiB tier printed a few KiB dropped as `0.0 MiB`.
+    `\n[vx] ${formatBytes(dropped)} of output not kept — vx keeps the first ${formatBytes(headChars)} ` +
+    `and the last ${formatBytes(tailChars)} of a task's output\n`
   )
 }
 
@@ -1135,7 +1310,12 @@ export function maskCaptured(text: string, secrets: SecretMask): string {
   return head + text.slice(at, end) + tail
 }
 
-const DROPPED_LINE = /^\n\[vx\] [\d.]+ MiB of output not kept — /
+const DROPPED_LINE = /^\n\[vx\] [\d.]+ [KMGTP]?B of output not kept — /
+
+/** Whether `chunk` is the line a `BoundedCapture` puts where its dropped middle was. */
+export function isDroppedOutputChunk(chunk: CapturedChunk): boolean {
+  return !chunk.err && DROPPED_LINE.test(chunk.text)
+}
 
 const isHighSurrogate = (code: number): boolean => code >= 0xd800 && code <= 0xdbff
 
@@ -1200,6 +1380,25 @@ export class BoundedCapture {
     }
   }
 
+  /**
+   * The same output under tighter bounds. What this capture already
+   * dropped is counted in the new one's dropped line: pushed through
+   * `chunks()`, the old line fell into the new middle with its count.
+   * `through` maps each side's chunks before the new cut (the store's
+   * mask), so the cut cannot split a value first.
+   */
+  rebound(
+    headChars: number,
+    tailChars: number,
+    through: (chunks: CapturedChunk[]) => CapturedChunk[] = (c) => c,
+  ): BoundedCapture {
+    const to = new BoundedCapture(headChars, tailChars)
+    for (const c of through(this.head)) to.push(c.text, c.err)
+    for (const c of through(this.tail)) to.push(c.text, c.err)
+    to.dropped += this.dropped
+    return to
+  }
+
   /** The kept chunks in arrival order, the dropped middle named on stdout. */
   chunks(): CapturedChunk[] {
     return this.dropped === 0

package/src/exec/sandbox-binds.ts

@@ -14,6 +14,7 @@ import {
   unique,
 } from './sandbox-paths.js'
 import type { SandboxedRunArgs } from './sandbox-runtime.js'
+import { ui } from '../util/index.js'
 
 type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
 
@@ -200,7 +201,8 @@ export function punchWritePaths(readPath: string, writePaths: readonly string[])
   }
   if (linked.length > 0 && !warnedSymlinkPunch.has(readPath)) {
     warnedSymlinkPunch.add(readPath)
-    process.stderr.write(
+    ui.say(
+      'warn',
       `[vx] sandbox: a write grant under ${readPath} makes its ${linked.length} symlinked ` +
         `entr${linked.length === 1 ? 'y' : 'ies'} (${linked
           .slice(0, 3)
@@ -232,7 +234,8 @@ function holdsGlobChar(grant: string): boolean {
   if (at === -1) return false
   if (!warnedGlob.has(grant)) {
     warnedGlob.add(grant)
-    process.stderr.write(
+    ui.say(
+      'warn',
       `[vx] sandbox: the write grant ${grant} holds ${globChar(grant[at]!)}, and the Linux ` +
         `sandbox mounts no write path that does, so a write under it is refused. Grant the ` +
         `directory above it instead: ${grant.slice(0, grant.lastIndexOf(path.sep, at) + 1)}\n`,
@@ -264,7 +267,8 @@ export function bindableReads(paths: readonly string[]): string[] {
     if (at === -1) return true
     if (!warnedGlob.has(grant)) {
       warnedGlob.add(grant)
-      process.stderr.write(
+      ui.say(
+        'warn',
         `[vx] sandbox: the read grant ${grant} holds ${globChar(grant[at]!)}, which the Linux ` +
           `sandbox ${grant[at] === '\\' ? 'cannot resolve' : 'reads as a pattern that also matches its siblings'}, so it is not granted. ` +
           `Rename it, or grant the directory above it: ` +

package/src/exec/sandbox-paths.ts

@@ -12,7 +12,7 @@ import path from 'node:path'
  * own set), which also counts `{}`: `write: ['g/{a,b}.txt']` is a
  * LITERAL to the sandbox, gets a placeholder file, and is widened to its
  * directory like any other file-shaped grant — measured ok, and pinned in
- * `tests/sandbox-runtime.unsafe.test.ts`. Counting the brace here would
+ * `tests/sandbox-lifecycle.unsafe.test.ts`. Counting the brace here would
  * move that spelling into the scan, which finds nothing before the task has
  * written, and turn a working grant into `Read-only file system`. The two
  * predicates answer different questions: whether a declaration must be