@vzn/vx 0.0.651 → 0.0.653

package/src/exec/sandbox-runtime.ts

@@ -44,6 +44,7 @@ import {
   writeFileSync,
 } from 'node:fs'
 import { mkdir, unlink } from 'node:fs/promises'
+import { createConnection } from 'node:net'
 import type { SandboxConfig } from '../config.js'
 import {
   armTimeout,
@@ -62,12 +63,14 @@ import {
   type RunResult,
 } from './runner.js'
 import { TaskPipes } from './pipes.js'
+import { startTaskProxy, type TaskProxy } from './task-proxy.js'
 import { watchTree } from './proc-sample.js'
 import {
   BUN_GLOB_WILDCARDS,
   ESSENTIAL_ENV,
   executablePath,
   helperEnv,
+  holdSecret,
   taskShell,
   grantPrefix,
   isTmpdirRefusal,
@@ -81,9 +84,11 @@ import {
   bindableReads,
   bindableWrites,
   buildCustomConfig,
+  linkedWriteBinds,
   readOnlyMasks,
   scratchWrites,
   widenedEntries,
+  withLinkedWrites,
 } from './sandbox-binds.js'
 import {
   atOrUnder,
@@ -109,6 +114,7 @@ import {
 } from './sandbox-violations.js'
 import {
   closeSignalChannel,
+  groupAlive,
   killTree,
   releaseGroup,
   signalThrough,
@@ -664,6 +670,124 @@ function hostHelpers(): { dirs: string[]; files: string[] } {
   return { dirs: unique(dirs), files: files.map(toRealPath) }
 }
 
+/**
+ * What a hermetic task reads outside the workspace without naming it: the
+ * programs vx and the runtime run around its command (the runtime's bash,
+ * the task shell, setsid, strace, env, socat, the seccomp helper, and the
+ * grep and sleep its network wait runs) and what the
+ * loader maps for them. Anything else outside the workspace is the task's
+ * to grant. Learned once per PATH: the files a host's shell links are
+ * fixed for the process.
+ */
+interface HermeticReads {
+  /** What is denied: `/`, spelled as the runtime can mount it. */
+  deny: string[]
+  allow: string[]
+}
+let hermeticMemo: { path: string; reads: Promise<HermeticReads> } | undefined
+function hermeticReads(): Promise<HermeticReads> {
+  const PATH = process.env['PATH'] ?? ''
+  if (hermeticMemo?.path !== PATH) hermeticMemo = { path: PATH, reads: learnHermeticReads() }
+  return hermeticMemo.reads
+}
+
+async function learnHermeticReads(): Promise<HermeticReads> {
+  return { deny: rootDenies(), allow: await hermeticAllows() }
+}
+
+/**
+ * `/` as the runtime can deny it. Given `/`, it lays a tmpfs over every
+ * entry of the root, and bwrap cannot mount one on a link: a merged-/usr
+ * host's `/sbin -> usr/sbin` failed every hermetic task. A link at the
+ * root leads into a directory denied here, so it is left as it is. `/proc`,
+ * `/dev` and `/sys` are the runtime's own mounts; macOS denies by path, so
+ * `/` stands.
+ */
+function rootDenies(): string[] {
+  if (process.platform !== 'linux') return ['/']
+  const skip = new Set(['proc', 'dev', 'sys'])
+  return readdirSync('/', { withFileTypes: true })
+    .filter((e) => !skip.has(e.name) && !e.isSymbolicLink())
+    .map((e) => `/${e.name}`)
+}
+
+async function hermeticAllows(): Promise<string[]> {
+  const programs: string[] = []
+  for (const name of ['bash', 'setsid', 'strace', 'env', 'socat', 'grep', 'sleep']) {
+    try {
+      programs.push(executablePath(name))
+    } catch {
+      // The runtime's dependency check names a missing one.
+    }
+  }
+  programs.push(taskShell())
+  if (process.platform === 'darwin') {
+    // dyld and the shared cache every macOS binary maps.
+    return unique([...programs.flatMap(bothSpellings), '/usr/lib', '/System'])
+  }
+  const { getApplySeccompBinaryPath } =
+    await import('@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.js')
+  const seccomp = getApplySeccompBinaryPath(undefined)
+  if (seccomp) programs.push(seccomp)
+  const files = [...programs]
+  // The loader and the libraries each program links, by `ldd`'s answer.
+  let ldd: string
+  try {
+    ldd = executablePath('ldd')
+  } catch {
+    throw new UserError(
+      'exec.sandbox.hermetic: no `ldd` on PATH, so vx cannot tell which libraries the ' +
+        "task's shell needs — install it (glibc's libc-bin), or drop hermetic",
+    )
+  }
+  const r = Bun.spawnSync({ cmd: [ldd, ...programs], stdout: 'pipe', stderr: 'ignore' })
+  for (const m of r.stdout.toString().matchAll(/(\/\S+)\s+\(0x/g)) files.push(m[1]!)
+  return unique(files.flatMap(bothSpellings))
+}
+
+/**
+ * Every spelling the loader walks from `p` to its file: a link (the
+ * loader's `/lib64/ld-linux-x86-64.so.2` is one, then `/usr/lib64`'s is
+ * another) is bound as the file it reaches, so each hop needs its own
+ * grant, named under its directory's real path, where the mount lands.
+ */
+function bothSpellings(p: string): string[] {
+  const hops: string[] = []
+  for (let at = p; hops.length < 40;) {
+    const here = path.join(toRealPath(path.dirname(at)), path.basename(at))
+    hops.push(here)
+    let next: string
+    try {
+      if (!lstatSync(here).isSymbolicLink()) break
+      next = path.resolve(path.dirname(here), readlinkSync(here))
+    } catch {
+      break
+    }
+    at = next
+  }
+  return hops
+}
+
+/**
+ * The runtime's own sockets a hermetic task's command reaches: the write
+ * observer's and the network proxy's, under the host's temp directory.
+ * The runtime binds each before the read denies, so the deny's tmpfs over
+ * that directory hid them (`connect …/srt-obs-…: No such file`), and no
+ * call names the observer's. They are read off the wrap, once per run
+ * each: the observer listens after the runtime starts, so a later wrap may
+ * name one the first did not.
+ */
+const runtimeOwn = new Set<string>()
+function runtimeBinds(wrapped: string): string[] {
+  const tmp = toRealPath(os.tmpdir()) + path.sep
+  const out: string[] = []
+  for (const m of wrapped.matchAll(/--bind (?:'([^']*)'|(\S+)) (?:'([^']*)'|(\S+))/g)) {
+    const from = m[1] ?? m[2]!
+    if (from === (m[3] ?? m[4]) && from.startsWith(tmp)) out.push(from)
+  }
+  return out
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -815,16 +939,14 @@ function assertDomains(
  * @param opts.allowedDomains every domain any sandboxed task in this run
  * declared. SRT's filtering proxy is per-RUN and reads its allowlist from
  * this call, never from the per-task config, so the union is the only
- * place a domain list can take effect. Per-task precision survives where
- * it matters: a task that declared none is never handed the proxy port.
+ * place a domain list can take effect; each task's own front
+ * (`ownProxy`) narrows it to the task's list.
  */
 export async function initSandbox(opts?: {
   allowedDomains?: readonly string[]
   /**
-   * Every domain any sandboxed task of the run denies. The proxy is the
-   * run's, so a deny refuses it for every task, as the allowlist is the
-   * union's; before B-21 the list was always empty and a `deny.network`
-   * refused nothing.
+   * Every domain any sandboxed task of the run denies, checked here and
+   * never handed to the run's proxy: each task's front refuses its own.
    */
   deniedDomains?: readonly string[]
   /**
@@ -853,7 +975,9 @@ export async function initSandbox(opts?: {
   const config: Parameters<typeof SandboxManager.initialize>[0] = {
     network: {
       allowedDomains: [...(opts?.allowedDomains ?? [])],
-      deniedDomains: [...(opts?.deniedDomains ?? [])],
+      // Each task's own front refuses its own denies; the run's proxy
+      // refusing the union denied one task's host to every task.
+      deniedDomains: [],
       ...(opts?.allowAllUnixSockets === true ? { allowAllUnixSockets: true } : {}),
     },
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
@@ -862,6 +986,8 @@ export async function initSandbox(opts?: {
     ...(scopedDenyScan ? scopedScanConfig() : {}),
     ...bundledJavaAgent(),
   }
+  runAllowed = config.network.allowedDomains
+  runAllowsHosts = runAllowed.length > 0
   const wasUp = srtUp
   if (!wasUp) await unlinkStaleMuxSockets()
   const listening = srtCleanupAdopted ? undefined : cleanupListeners()
@@ -886,6 +1012,11 @@ export async function initSandbox(opts?: {
   // reload of exactly these fields; the proxy and the wrapper read them
   // through getters, so the run's config is what every task sees.
   SandboxManager.updateConfig(config)
+  // The proxy's session token rides into a networked task's env
+  // (CLOUDSDK_PROXY_PASSWORD, the proxy URLs' password): a task printing
+  // its env put it in the terminal, the cached log and `vx last --log`.
+  const token = SandboxManager.getProxyAuthToken()
+  if (token !== undefined) holdSecret(token)
 }
 
 /**
@@ -920,6 +1051,7 @@ export async function resetSandbox(): Promise<void> {
 
 function srtDown(): void {
   srtUp = false
+  runtimeOwn.clear()
   perTaskRun = undefined
   availabilityCache.clear()
   straceAvailableCache = undefined
@@ -1098,6 +1230,8 @@ export interface ResolvedSandboxConfig {
    * no mount holds them. `scratchWrites` decides which still cover a write.
    */
   pendingWrites?: readonly string[]
+  /** Linux: write grants spelled through a link in the project, bound there too (`linkedWriteBinds`). */
+  linkedWrites?: readonly { readonly link: string; readonly target: string }[]
   network?: true | readonly string[]
   denyNetwork?: readonly string[]
   systemInfo?: readonly string[]
@@ -1108,6 +1242,8 @@ export interface ResolvedSandboxConfig {
   gitConfig?: boolean
   weakerWhenNested?: boolean
   weakerNetworkIsolation?: boolean
+  /** Reads outside the workspace are refused too (`hermeticReads`). */
+  hermetic?: boolean
   /** macOS: the walls a glob grant reaches, by kind (`darwinWallRules`). */
   wallsReached?: { read: readonly string[]; write: readonly string[] }
   ignore?: {
@@ -1193,6 +1329,31 @@ function assertWriteStaysHome(grant: string, real: string, projectDir: string):
   )
 }
 
+/**
+ * Linux: a literal write grant spelled through a link in the project
+ * (`gen/` over `gen -> real`), as the task names it: the project's real
+ * directory with the grant's own components, links unresolved. The grant
+ * binds at its real path and bwrap mounts no link, so without a second
+ * bind there the task met "Directory nonexistent", or, under a read
+ * grant of the project, the link bound read-only over the same directory
+ * ("Read-only file system"). Seatbelt judges the resolved path, so macOS
+ * needs none.
+ */
+function linkSpelling(
+  grant: string,
+  real: string,
+  projectDir: string,
+): { link: string; target: string } | undefined {
+  if (process.platform !== 'linux' || grant.startsWith('~') || path.isAbsolute(grant)) return
+  // `gen/**` is the directory whole (`expandGrants`).
+  const whole = /\/\*\*(?:\/\*)?$/
+  const lexical = path.resolve(projectDir, grant.replace(whole, ''))
+  const target = real.replace(whole, '')
+  if (!atOrUnder(lexical, projectDir) || !isMountableLiteral(target)) return
+  const link = path.join(toRealPath(projectDir), path.relative(projectDir, lexical))
+  return link === target ? undefined : { link, target }
+}
+
 /** Where `p` lands through every link on it, a dangling last one included. */
 function throughLinks(p: string, hops = 0): string {
   if (hops > 40) return p
@@ -1227,12 +1388,15 @@ export function resolveSandboxConfig(
   }
   const a = cfg.allow ?? {}
   const pending: string[] = []
+  const linked: Array<{ link: string; target: string }> = []
   const r: ResolvedSandboxConfig = {
     allowRead: expandGrants((a.read ?? []).map(resolve), walls),
     allowWrite: expandGrants(
       (a.write ?? []).map((p) => {
         const real = resolve(p)
         assertWriteStaysHome(p, real, projectDir)
+        const link = linkSpelling(p, real, projectDir)
+        if (link !== undefined) linked.push(link)
         // A directory a write glob matches is writable whole, as Linux's
         // bind of the hit makes it: `<glob>/**` collapses below into the
         // glob and its subtree. SRT compiles a glob as an exact regex, so
@@ -1249,6 +1413,7 @@ export function resolveSandboxConfig(
     ),
   }
   if (pending.length > 0) r.pendingWrites = pending
+  if (linked.length > 0) r.linkedWrites = linked
   if (process.platform === 'darwin') {
     const read = wallsGlobsReach(r.allowRead, walls)
     const write = wallsGlobsReach(r.allowWrite, walls)
@@ -1266,6 +1431,7 @@ export function resolveSandboxConfig(
   if (cfg.weakerNetworkIsolation !== undefined) {
     r.weakerNetworkIsolation = cfg.weakerNetworkIsolation
   }
+  if (cfg.hermetic === true) r.hermetic = true
   if (cfg.ignore !== undefined) {
     // Relative patterns anchor at the project dir, `~` ones at the home
     // directory, as a grant's are (a `~` pattern kept as written matched no
@@ -1320,6 +1486,11 @@ export interface SandboxViolation {
    * leaves it hidden.
    */
   via?: string
+  /**
+   * Linux: what a refused `openat`'s flags asked for; for an `openat2`,
+   * whose flags no record names, a read.
+   */
+  opened?: 'read' | 'write'
   ignorable?: readonly ('read' | 'write' | 'network' | 'systemInfo')[]
 }
 
@@ -1434,6 +1605,11 @@ async function wrapIn(
     baselines.cwd,
   )
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  if (args.config.hermetic === true) {
+    const reads = await hermeticReads()
+    customConfig!.filesystem!.denyRead!.push(...reads.deny)
+    customConfig!.filesystem!.allowRead!.push(...reads.allow, ...runtimeOwn)
+  }
   const helpers = hostHelpers()
   customConfig!.filesystem!.denyRead!.push(...helpers.dirs)
   customConfig!.filesystem!.allowRead!.push(...helpers.files)
@@ -1482,11 +1658,13 @@ async function wrapIn(
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
       : { command: taggedCommand, forwards: false, traced: false }
   // The tag leads: SRT keys a record by the wrap's first 100 characters,
-  // and the proxy wait below is the same 190 for every networked task.
+  // and the proxy wait below is the same 190 for every task.
   const inner = [
     process.platform === 'linux' ? `: 'vx-${tag}';` : '',
     ports.length > 0 ? portBridgeInner(ports, tag) : '',
-    process.platform === 'linux' && args.config.network !== undefined ? PROXY_BRIDGE_WAIT : '',
+    process.platform === 'linux' && SandboxManager.getLinuxHttpSocketPath() !== undefined
+      ? PROXY_BRIDGE_WAIT
+      : '',
     grouped.command,
   ]
     .filter((part) => part !== '')
@@ -1502,6 +1680,29 @@ async function wrapIn(
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
   )
+  if (process.platform === 'linux' && args.config.hermetic === true) {
+    const own = runtimeBinds(wrapped).filter((p) => !runtimeOwn.has(p))
+    if (own.length > 0) {
+      for (const p of own) runtimeOwn.add(p)
+      customConfig!.filesystem!.allowRead!.push(...own)
+      wrapped = await wrapForTask(
+        SandboxManager,
+        inner,
+        literalReadPaths(customConfig),
+        ports.length > 0 || asksUnixSockets(args.config),
+        args.config.gitConfig === true,
+      )
+    }
+  }
+  if (runAllowsHosts) {
+    try {
+      wrapped = await ownProxy(SandboxManager, wrapped, inner, tag, args.config)
+    } catch (err) {
+      releaseBridges(tag)
+      afterCommand(SandboxManager)
+      throw err
+    }
+  }
   if (process.platform === 'darwin') {
     const rules = [
       ...macProfileRules(args.config),
@@ -1534,7 +1735,7 @@ async function wrapIn(
     )
     wrapped =
       (gitGranted ? 'GIT_DISCOVERY_ACROSS_FILESYSTEM=${GIT_DISCOVERY_ACROSS_FILESYSTEM-1} ' : '') +
-      `exec ${readOnlyMasks(wrapped, scratch)}`
+      `exec ${readOnlyMasks(withLinkedWrites(wrapped, linkedWriteBinds(args.config.linkedWrites)), scratch)}`
   }
   if (process.platform === 'linux' && !hostHasIpv6())
     wrapped = `SOCAT_DEFAULT_LISTEN_IP=4 ${wrapped}`
@@ -1661,16 +1862,23 @@ function ownGroupCommand(
 }
 
 /**
- * What strace stops on: the reads, the execs and access probes (a refused
- * `./gen.sh || fallback` passed unreported), and what moves or makes a
- * process's cwd. Not the stat family: a stop per stat cost oxlint 19% and
- * `git status` 30%, where the execs and probes cost nothing measurable, and
+ * What strace stops on: the reads (`openat`, and `open`, musl's open():
+ * traced as openat alone, a sibling under a widened write grant was read
+ * unreported and cached; arm64 has no `open`; an `openat2` never reaches
+ * strace, SRT's write observer takes each one first: `refusedWrites`),
+ * the execs and access probes (a refused
+ * `./gen.sh || fallback` passed unreported), `readlink` (git hashes a link
+ * by its target string: `readlink cfg > out.txt` under a widened grant
+ * cached `v1` and replayed it after `cfg` pointed at `v2`; a stop costs
+ * ~9 µs, 37 ms on 2,000 links, below the A/A noise on oxlint and vx), and
+ * what moves or makes a process's cwd. Not the stat family: a stop per
+ * stat cost oxlint 19% and `git status` 30%, where the execs and probes cost nothing measurable, and
  * vx's own no-op run 69% (pr-bench, 495 → 835 ms, 2026-10-23). So a tool
  * that stats before it opens, as Ubuntu 26's cat (uutils) does, refused
  * nothing the trace sees.
  */
 const TRACED_CALLS =
-  'trace=openat,execve,?access,faccessat,?faccessat2,chdir,fchdir,clone,?clone3,?fork,?vfork'
+  'trace=openat,?open,execve,?access,faccessat,?faccessat2,?readlink,?readlinkat,chdir,fchdir,clone,?clone3,?fork,?vfork'
 
 /** The descriptor an in-sandbox strace writes its trace to (`ownGroupCommand`). */
 const TRACE_FD = 5
@@ -1817,10 +2025,88 @@ export function bridgedPorts(c: Pick<ResolvedSandboxConfig, 'localBinding'>): nu
  * command, until both listen in the task's network namespace, read off
  * /proc/net (IPv4 or IPv6, state 0A). Bounded at ~5 s: a bridge that never
  * listens leaves the command to meet the refusal it met before.
+ *
+ * Every task the run's bridge reaches waits, not only one that lists a
+ * network: one that lists none dials the same proxy, which refuses and
+ * names the host, and that refusal fails it. Waited for only by networked
+ * tasks, it met the closed port instead under load, swallowed the error
+ * and passed with nothing reported (2026-11-06). The wait costs ~4 ms, the
+ * socat's own start.
  */
 const PROXY_BRIDGE_WAIT =
   "( i=0; until grep -qsE ':0C38 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6 && grep -qsE ':0438 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6; do [ $i -ge 500 ] && break; i=$((i+1)); sleep 0.01; done );"
 
+/** Each networked task's own proxy front, by tag, closed when its bridges go. */
+const taskProxies = new Map<string, TaskProxy>()
+/** Whether the run's proxy allows any host: one that allows none refuses every task alike, front or not. */
+let runAllowsHosts = false
+/** The run's union: what a `network: true` task's front allows. */
+let runAllowed: readonly string[] = []
+
+/**
+ * A networked task's own proxy front (task-proxy.ts). The runtime's proxy
+ * is the run's and filters by the union of every task's lists, so a task
+ * reached a host only another task of the run declared. The front judges
+ * by this task's own lists and passes what it allows on to the run's
+ * proxy. Linux: it listens on a socket in the task's tmpdir, bound over
+ * the runtime's bridge socket, so the task's side dials the same path.
+ * macOS: it listens on a loopback port of its own, and the task's proxy
+ * variables and profile name that port in place of the run's, so the
+ * profile refuses the run's. A task that lists no network gets a front
+ * that refuses every host; `network: true` gets one that allows the
+ * run's union. Each front refuses only its own task's denies. Fails closed: a task the front cannot take does not run.
+ */
+async function ownProxy(
+  SandboxManager: SrtModule['SandboxManager'],
+  wrapped: string,
+  inner: string,
+  tag: string,
+  config: ResolvedSandboxConfig,
+): Promise<string> {
+  const port = SandboxManager.getProxyPort()
+  const token = SandboxManager.getProxyAuthToken()
+  const linux = process.platform === 'linux'
+  const bridge = linux ? SandboxManager.getLinuxHttpSocketPath() : undefined
+  const bind = bridge === undefined ? undefined : `--bind ${bridge} ${bridge}`
+  const runPort = new RegExp(`localhost:${port}(?!\\d)`, 'g')
+  const handed =
+    port !== undefined &&
+    token !== undefined &&
+    (linux ? bind !== undefined && wrapped.includes(bind) : runPort.test(wrapped))
+  // A task that lists no network is handed the run's proxy too when another
+  // task of the run lists some; it gets a front that refuses every host.
+  if (!handed) {
+    if (config.network === undefined) return wrapped
+    throw new Error('sandbox: the runtime gave this networked task no proxy to replace')
+  }
+  const socket = path.join(taskTmpdir(tag), 'vx-net.sock')
+  const key = Buffer.from(inner.slice(0, 100)).toString('base64')
+  const front = await startTaskProxy({
+    endpoint: linux ? socket : 0,
+    allowed:
+      config.network === true
+        ? runAllowed
+        : config.network === undefined
+          ? []
+          : (config.network as string[]),
+    denied: config.denyNetwork ?? [],
+    runProxyPort: port!,
+    token: token!,
+    encodedCommand: key,
+    refused: (line) => collecting.get(key)?.push({ line, timestamp: new Date() }),
+  })
+  taskProxies.set(tag, front)
+  if (!linux) return wrapped.replace(runPort, `localhost:${front.port}`)
+  // After the root's read-only bind, which would mask a bind made before it
+  // with the host's own file: the runtime's socket, reachable as itself.
+  const own = `--bind ${socket} ${bridge}`
+  const root = ' --ro-bind / / '
+  const at = wrapped.indexOf(root)
+  return at === -1
+    ? wrapped.replace(bind!, own)
+    : `${wrapped.slice(0, at + root.length)}${own} ${wrapped.slice(at + root.length)}`
+}
+
 /** Where a bridge's unix socket lives: the sandbox tmpdir, bound read-write on both sides. */
 export function portBridgeSocket(tag: string, port: number): string {
   return path.join(taskTmpdir(tag), `vx-port-${tag}-${port}.sock`)
@@ -1934,8 +2220,8 @@ async function hostBridgesListen(ports: readonly number[], tag: string): Promise
   if (!procfsIsOwn()) return
   const want = ports.map((p) => `0100007F:${p.toString(16).toUpperCase().padStart(4, '0')}`)
   const procs = hostBridges.get(tag)?.procs ?? []
-  const until = Date.now() + 5_000
-  while (Date.now() < until && procs.every((p) => p.exitCode === null)) {
+  const until = performance.now() + 5_000
+  while (performance.now() < until && procs.every((p) => p.exitCode === null)) {
     let table: string
     try {
       table = readFileSync('/proc/net/tcp', 'utf8')
@@ -2004,6 +2290,12 @@ export function releaseBridges(tag: string): void {
     afterCommand(srtLoaded!.SandboxManager)
     if (liveServers.size === 0 && resetDeferred) void resetSandbox().catch(() => {})
   }
+  const front = taskProxies.get(tag)
+  if (front !== undefined) {
+    taskProxies.delete(tag)
+    // quiet: a front that will not close holds only its own socket, gone with the tmpdir
+    void front.close().catch(() => undefined)
+  }
   const bridges = hostBridges.get(tag)
   if (bridges === undefined) return
   hostBridges.delete(tag)
@@ -2028,6 +2320,22 @@ export function releaseBridges(tag: string): void {
 const TRACER_RETRY_LINE =
   "[vx] the sandbox's tracer (strace) failed on its own; running the task again\n"
 
+/** What a task's output says when a mount went away as bwrap set the sandbox up. */
+const MOUNT_RACE_RETRY_LINE =
+  '[vx] a mount went away as the sandbox was set up; running the task again\n'
+
+/**
+ * bwrap's own refusal of a mount gone between its read of the mount table
+ * and its remount: a container runtime's transient mount under /tmp
+ * (`/newroot/tmp/containerd-mount…`, a `docker build` beside the task on
+ * CI). The command never started. Or a path the wrap walls, gone before
+ * bwrap mounts on it: bwrap makes the mount point anew under a read-only
+ * parent (`Can't mkdir /tmp/vx-noscan-0: Read-only file system`, the no-scan
+ * directory removed by another process).
+ */
+const BWRAP_MOUNT_GONE =
+  /^bwrap: Can't (?:.*: No such file or directory|mkdir .*: Read-only file system)$/
+
 /**
  * Run a single task wrapped in the sandbox. Caller must have called
  * `initSandbox()` first.
@@ -2053,20 +2361,21 @@ export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRun
       if (chunk.length > 0) midLine = !chunk.endsWith('\n')
       on?.(chunk)
     }
-  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce({
+  const { tracerFailed, mountGone, ranMs, ...first } = await runSandboxedOnce({
     ...args,
     onStdout: seen(args.onStdout),
     onStderr: seen(args.onStderr),
   })
   // A stopping run has killed the children it holds; a retry would be one
   // spawned after that kill.
-  if (!tracerFailed || args.signal?.aborted === true) return first
-  const notice = (midLine ? '\n' : '') + TRACER_RETRY_LINE
+  if (!(tracerFailed || mountGone) || args.signal?.aborted === true) return first
+  const notice = (midLine ? '\n' : '') + (mountGone ? MOUNT_RACE_RETRY_LINE : TRACER_RETRY_LINE)
   args.onStderr?.(notice)
   // `timeout` bounds the task's whole run (schema.md), so the retry gets
   // what the first attempt left of it, not a fresh window.
   const {
     tracerFailed: _again,
+    mountGone: _gone,
     ranMs: _ran,
     ...second
   } = await runSandboxedOnce(
@@ -2088,18 +2397,21 @@ let collectorOn = false
 
 /**
  * Start collecting SRT's store records for `command`; the returned function
- * stops and hands them over. The store is a 100-record ring the whole run
- * shares, and on Linux its write observer reports every write any task
+ * stops and hands them over, with `settle` once every record the task's
+ * Linux observer (`observer`, its socket) sent is read. The store is a
+ * 100-record ring the whole run shares, and on Linux its write observer
+ * reports every write any task
  * makes, so a refused write followed by 150 declared ones was gone before
  * the task's exit read it (B-7). One subscription takes each record as it
  * arrives and keeps it only for a command still running. SRT keys a record
  * by the base64 of the command's first 100 characters
  * (`encodeSandboxedCommand`, not exported).
  */
-function collectRecords(
+export function collectRecords(
   store: ReturnType<SrtModule['SandboxManager']['getSandboxViolationStore']>,
   command: string,
-): () => SandboxViolation[] {
+  observer: string | undefined,
+): (settle: boolean) => Promise<SandboxViolation[]> {
   if (!collectorOn) {
     collectorOn = true
     let seen = store.getTotalCount()
@@ -2115,12 +2427,44 @@ function collectRecords(
   const key = Buffer.from(command.slice(0, 100)).toString('base64')
   const list: SandboxViolation[] = []
   collecting.set(key, list)
-  return () => {
+  return async (settle) => {
+    if (settle && observer !== undefined) await observerCaughtUp(observer)
     collecting.delete(key)
     return list
   }
 }
 
+/**
+ * The Unix socket SRT's Linux write observer listens on, from the command
+ * it wrapped (`--setenv SRT_OBSERVE_SOCK <path>`); none when the listener
+ * failed or on macOS.
+ */
+function observerSocket(wrapped: string): string | undefined {
+  return /--setenv SRT_OBSERVE_SOCK (?:'([^']*)'|(\S+))/.exec(wrapped)?.slice(1).find(Boolean)
+}
+
+/**
+ * Resolves once SRT has read every record sent to `socket` before the call.
+ * A task's observer sends its records before the task exits, but they are
+ * read when this process gets to that connection: a fixed count of event
+ * loop turns after the exit (2) lost 4 of 24 refusals on a loaded CI
+ * worker. So a connection of ours goes in after them: the kernel queues
+ * connections in order, so SRT accepts it no earlier than the task's, and
+ * the task's bytes were already there when it did. SRT's server is not
+ * half-open, so it ends ours once it reads our end, and that end coming
+ * back means the task's bytes were read first. A socket that is gone
+ * answers at once with an error.
+ */
+function observerCaughtUp(socket: string): Promise<void> {
+  return new Promise((resolve) => {
+    const conn = createConnection(socket)
+    conn.on('connect', () => conn.end())
+    conn.on('error', () => resolve())
+    conn.on('close', () => resolve())
+    conn.resume()
+  })
+}
+
 /**
  * strace's own message, a line of a traced task's stderr. strace names
  * itself by its argv[0], the absolute path vx runs it by
@@ -2140,8 +2484,9 @@ const STRACE_OWN_ERROR = /^(?:[^\s:]*\/)?strace: /
  */
 async function runSandboxedOnce(
   args: SandboxedRunArgs,
-): Promise<SandboxedRunResult & { tracerFailed: boolean; ranMs: number }> {
-  const start = Date.now()
+): Promise<SandboxedRunResult & { tracerFailed: boolean; mountGone: boolean; ranMs: number }> {
+  // Elapsed time, not wall time: see runCommand.
+  const start = performance.now()
   const { SandboxManager } = await loadSrt()
   // Linux: SRT's store sees only writes (below), so read denials need
   // the command traced and the trace parsed for denied syscalls. The trace
@@ -2149,7 +2494,7 @@ async function runSandboxedOnce(
   // share a stream. Skipped when strace isn't on PATH — bwrap still
   // enforces structurally; we just lose the structured violation list.
   //
-  // We trace `openat`, the read itself, plus `execve` and the access
+  // We trace the opens, the read itself, plus `execve` and the access
   // probes (`TRACED_CALLS`). Not `statx` / `newfstatat`: a stop per stat
   // is a tax on every stat-heavy task. A probe's ENOENT counts only where
   // the host has the path (`parseStraceViolations`), so a PATH walk past
@@ -2167,29 +2512,34 @@ async function runSandboxedOnce(
   // one gets the slow form rather than no detection.
   const useStrace = await wantsStraceDetection()
   // Before the spawn: what the task creates under a widened grant is its own.
-  const widened = useStrace ? widenedEntries(args.config.allowWrite) : undefined
+  const widened = widenedEntries(args.config.allowWrite)
   const { wrapped, tag, srtCommand, baselines, scratch, forwardsSignals, traced } =
     await wrapSandboxedCommand({
       ...args,
       ...(useStrace ? { trace: useStrace } : {}),
-      ...(widened !== undefined && widened.size > 0 ? { tracePaths: true } : {}),
+      ...(useStrace && widened.size > 0 ? { tracePaths: true } : {}),
     })
-  const takeRecords = collectRecords(SandboxManager.getSandboxViolationStore(), srtCommand)
+  const takeRecords = collectRecords(
+    SandboxManager.getSandboxViolationStore(),
+    srtCommand,
+    observerSocket(wrapped),
+  )
   // A stop that landed during the awaits above leaves nothing to kill yet:
   // spawned now, the task ran after the teardown swept the run's children.
   if (args.signal?.aborted === true) {
     releaseBridges(tag)
-    takeRecords()
+    void takeRecords(false)
     afterCommand(SandboxManager)
     const signal = stopSignal(args.signal.reason)
     return {
       exitCode: signalExitCode(signal),
-      durationMs: Date.now() - start,
+      durationMs: Math.round(performance.now() - start),
       stdout: '',
       stderr: '',
       signal,
       violations: [],
       tracerFailed: false,
+      mountGone: false,
       ranMs: 0,
     }
   }
@@ -2231,19 +2581,20 @@ async function runSandboxedOnce(
       rmSync(straceLog, { force: true })
       liveTempFiles.delete(straceLog)
     }
-    const stderr = spawnFailureText(err, args.cwd, SANDBOXED_TASK, wrapped)
+    const stderr = spawnFailureText(err, args.cwd, SANDBOXED_TASK, wrapped, args.env)
     args.onStderr?.(stderr)
     releaseBridges(tag)
-    takeRecords()
+    void takeRecords(false)
     afterCommand(SandboxManager)
     return {
       exitCode: 127,
-      durationMs: Date.now() - start,
+      durationMs: Math.round(performance.now() - start),
       stdout: '',
       stderr,
       spawnFailed: true,
       violations: [],
       tracerFailed: false,
+      mountGone: false,
       ranMs: 0,
     }
   } finally {
@@ -2256,11 +2607,12 @@ async function runSandboxedOnce(
   args.onSpawn?.(proc.pid)
   const watch = process.platform === 'linux' ? watchTree(proc.pid) : undefined
   const timeout = armTimeout(proc, args.timeoutMs)
-  const armedAt = Date.now()
+  const armedAt = performance.now()
   const ac = new AbortController()
   // The unfinished last line of stderr, and whether a line was strace's.
   let partial = ''
   let straceSpoke = false
+  let mountGone = false
   const [out, err] = pipes.streams(proc)
   const ends = lineEnds(args.onStdout, args.onStderr)
   const streams = Promise.all([
@@ -2273,6 +2625,7 @@ async function runSandboxedOnce(
         const lines = (partial + chunk).split('\n')
         partial = (lines.pop() ?? '').slice(0, 512)
         if (lines.some((l) => STRACE_OWN_ERROR.test(l))) straceSpoke = true
+        if (lines.some((l) => BWRAP_MOUNT_GONE.test(l))) mountGone = true
         ends.onStderr?.(chunk)
       },
       ac.signal,
@@ -2283,7 +2636,7 @@ async function runSandboxedOnce(
   // OR a clean exit that backgrounds a process) can't hang the run — timeout
   // aborts at once, otherwise drainOrAbort bounds the post-exit drain.
   await proc.exited
-  const ranMs = Date.now() - armedAt
+  const ranMs = Math.round(performance.now() - armedAt)
   const looked = watch?.stop()
   await timeout.settle()
   let cut = false
@@ -2294,6 +2647,9 @@ async function runSandboxedOnce(
   const cutLine = ends.own(POST_EXIT_CUT_LINE)
   if (cut) args.onStderr?.(cutLine)
   const stderr = cut ? streamed + cutLine : streamed
+  // As runCommand: a leftover holding no pipe is still in the group. Under
+  // Linux's pid namespace it died with the command; macOS keeps it.
+  const left = cut || groupAlive(proc)
   args.liveChildren?.delete(proc)
   releaseGroup(proc)
   closeSignalChannel(proc)
@@ -2324,15 +2680,9 @@ async function runSandboxedOnce(
   // (2026-09-05). A sandboxed task that fails must say what it was denied;
   // deciding on the user's behalf that a record was "just traversal" is how
   // a failure ends up with an empty violations section and no explanation.
-  // Linux: the write observer's records reach the store over a Unix socket
-  // this process serves, not with the child's exit. The observer sent them
-  // before the task exited, but a task that ends quickly is seen to exit
-  // in the turn its connection is accepted, before it is read: a turn to
-  // accept and a turn to read take them in (40 fast refused mkdirs at
-  // once: 38 of 200 unreported, 33 with one turn, none with two).
-  if (process.platform === 'linux')
-    for (let turn = 0; turn < 2; turn++) await new Promise((r) => setImmediate(r))
-  const records = takeRecords()
+  // Linux: the write observer's records arrive over a socket, not with the
+  // exit; `takeRecords(true)` waits until all it sent are read.
+  const records = await takeRecords(true)
   // Read as is on darwin only. Since SRT 0.0.75 the store is fed on Linux
   // too, by the seccomp helper's write observer — but SRT judges those
   // reports against the GLOBAL `filesystem.allowWrite` from `initialize`
@@ -2378,6 +2728,7 @@ async function runSandboxedOnce(
             bindableWrites(args.config.allowWrite),
             scratch,
             [...baselines.allowRead, ...bindableReads(args.config.allowRead)],
+            { entries: widened, granted: args.config.allowWrite },
           ),
           ...refusedConnections(records.map((v) => v.line)),
         ]
@@ -2453,20 +2804,22 @@ async function runSandboxedOnce(
       config: args.config,
       skip: [taskTmpRoot()],
     })
-    if (hidden.length > 0) violations.push(hiddenReadsHint(hidden, args.reportWithin))
+    if (hidden.length > 0)
+      violations.push(hiddenReadsHint(hidden, baselines.denyRead, args.reportWithin))
   }
 
   afterCommand(SandboxManager)
 
   return {
     exitCode,
-    durationMs: Date.now() - start,
+    durationMs: Math.round(performance.now() - start),
     stdout,
     stderr,
     violations,
     ...(typeof proc.signalCode === 'string' ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
-    ...(cut ? { leftRunning: true } : {}),
+    ...(timeout.sigkilled() ? { killedAfterGrace: true } : {}),
+    ...(left ? { leftRunning: true } : {}),
     // Linux: the task's CPU and peak never reach this wait. bwrap runs it
     // in a pid namespace (`--unshare-pid`), and what the namespace's
     // processes used is not folded into bwrap's usage: a 500 ms busy loop
@@ -2481,6 +2834,7 @@ async function runSandboxedOnce(
         ? {}
         : { cpuMs: looked.cpuMs, peakRssBytes: looked.rssBytes }),
     ranMs,
+    mountGone: exitCode !== 0 && (mountGone || BWRAP_MOUNT_GONE.test(partial)),
     tracerFailed:
       straceLog !== undefined &&
       !timeout.timedOut() &&
@@ -2510,15 +2864,7 @@ function outsideWritesHint(
 ): SandboxViolation {
   const shown = paths.slice(0, 5).join(', ')
   const more = paths.length > 5 ? ` and ${paths.length - 5} more` : ''
-  const home = toRealPath(os.homedir())
-  const dir = path.dirname(paths[0]!)
-  // In the workspace, from the project, as a committed config spells it:
-  // the absolute path held only on the machine that printed it.
-  const spelled = walled.some((w) => atOrUnder(dir, toRealPath(w)))
-    ? path.relative(toRealPath(within), dir) || '.'
-    : atOrUnder(dir, home)
-      ? `~${dir.slice(home.length)}`
-      : dir
+  const spelled = grantSpelling(path.dirname(paths[0]!), walled, within)
   const refused =
     `vx: the sandbox refused writes outside the project, which are not reported as ` +
     `violations: ${shown}${more}.`
@@ -2584,19 +2930,52 @@ function hostTempRoots(): string[] {
   return [...new Set(['/tmp', '/var/tmp', os.tmpdir()].map(toRealPath))]
 }
 
-function hiddenReadsHint(paths: readonly string[], within: string): SandboxViolation {
+/**
+ * The hint for reads the wall hid outside the project. A path under a
+ * deny entry other than the ones holding the project (a credential store
+ * or its link's target, vx's own store, the repository's git data outside
+ * the workspace) is walled on purpose and never the suggested grant: an
+ * agent applies a suggestion as given, and `cat ~/.npmrc` was told to
+ * grant `../../home/.npmrc`.
+ */
+function hiddenReadsHint(
+  paths: readonly string[],
+  walled: readonly string[],
+  within: string,
+): SandboxViolation {
   const shown = paths.slice(0, 5).join(', ')
   const more = paths.length > 5 ? ` and ${paths.length - 5} more` : ''
+  const project = toRealPath(within)
+  const deny = walled.map(toRealPath)
+  const grantable = paths.find((p) => !deny.some((w) => atOrUnder(p, w) && !atOrUnder(project, w)))
+  const said =
+    `vx: the sandbox hid paths outside the project that exist on this machine, which are ` +
+    `not reported as violations: ${shown}${more}.`
   return {
     timestamp: new Date(),
     hint: true,
     line:
-      `vx: the sandbox hid paths outside the project that exist on this machine, which are ` +
-      `not reported as violations: ${shown}${more}. If the task reads one, grant it, e.g. ` +
-      `\`allow: { read: [${jsString(path.relative(toRealPath(within), paths[0]!))}] }\`.`,
+      grantable === undefined
+        ? `${said} They are walled on purpose, so vx suggests no grant for them.`
+        : `${said} If the task reads one, grant it, e.g. ` +
+          `\`allow: { read: [${jsString(grantSpelling(grantable, walled, within))}] }\`.`,
   }
 }
 
+/**
+ * A path as a committed config spells its grant: from the project inside
+ * the walls (the absolute path holds only on the machine that printed
+ * it), `~/…` under home, else absolute.
+ */
+function grantSpelling(p: string, walled: readonly string[], within: string): string {
+  const home = toRealPath(os.homedir())
+  return walled.some((w) => atOrUnder(p, toRealPath(w)))
+    ? path.relative(toRealPath(within), p) || '.'
+    : atOrUnder(p, home)
+      ? `~${p.slice(home.length)}`
+      : p
+}
+
 /**
  * Is `dir` inside a path the sandbox granted for reading? bwrap binds and
  * seatbelt rules are both prefix-based, so a grant covers the subtree.
@@ -2634,7 +3013,7 @@ function sbplToken(value: string, field: string): string {
  *
  * `systemInfo` has no SRT field at any level. The rest DO have fields,
  * but SRT reads `network.allowLocalBinding` / `allowUnixSockets` /
- * `allowMachLookup` off the config given to `initialize()` and never off
+ * `allowMachLookup` / `enableWeakerNetworkIsolation` off the config given to `initialize()` and never off
  * the per-call one (`sandbox-manager.js` getters, 0.0.75 and 0.0.76) — so a per-task
  * grant passed there is silently dropped. vx is per-task by definition,
  * so it emits them itself. The rule text mirrors SRT's own.
@@ -2657,6 +3036,9 @@ export function macProfileRules(c: ResolvedSandboxConfig): string[] {
     rules.push('(allow network-inbound (local ip "*:*"))')
     rules.push('(allow network-outbound (remote ip "localhost:*"))')
   }
+  if (c.weakerNetworkIsolation === true) {
+    rules.push('(allow mach-lookup (global-name "com.apple.trustd.agent"))')
+  }
   if (c.unixSockets === true) {
     rules.push('(allow system-socket (socket-domain AF_UNIX))')
     rules.push('(allow network-bind (local unix-socket (path-regex #"^/")))')