@vzn/vx 0.0.651 → 0.0.653

package/src/util/secret-mask.ts

@@ -36,8 +36,11 @@ export function secretNamed(name: string): boolean {
 /**
  * A URL's password (`postgres://app:<pw>@db/app`): a credential whatever
  * the variable is named, so `DATABASE_URL` and `REDIS_URL` printed it.
+ * Split as WHATWG splits it: the userinfo ends at the LAST `@` before the
+ * path, query or fragment, and the user name at its first `:`, so either
+ * may hold an `@` (`app:p@ss@db` printed `p@ss` whole).
  */
-const URL_PASSWORD = /[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s/@]+)@/gi
+const URL_PASSWORD = /[a-z][a-z0-9+.-]*:\/\/[^\s:/?#]*:([^\s/?#]+)@/gi
 
 /**
  * Values shorter than this are not masked: `KEY=1` would mask every `1`
@@ -260,6 +263,59 @@ export interface TaskEnvSecrets {
   readonly secret?: readonly string[]
 }
 
+/**
+ * Each stream's run of adjacent non-empty chunks joined, with `mask`
+ * applied to each stream's text as a whole: a value is masked where it
+ * starts and its rest dropped from the runs it reaches. The live stream
+ * masks chunk by chunk and lets a held piece go after a pause, so a value
+ * written in two pieces reached the capture in two chunks, and a write to
+ * the other stream between them made them two runs. A hit replays each
+ * stream to its own descriptor, so `vx run > log` joined them again.
+ */
+export function maskStreams(
+  chunks: ReadonlyArray<{ text: string; err: boolean }>,
+  mask: SecretMask | undefined,
+): Array<{ text: string; err: boolean }> {
+  if (mask === undefined) return chunks.filter((c) => c.text.length > 0)
+  const runs: Array<{ text: string; err: boolean }> = []
+  for (const c of chunks) {
+    if (c.text.length === 0) continue
+    const last = runs.at(-1)
+    if (last !== undefined && last.err === c.err) last.text += c.text
+    else runs.push({ text: c.text, err: c.err })
+  }
+  for (const err of [false, true]) {
+    const own = runs.filter((r) => r.err === err)
+    const spans = mask.spans(own.map((r) => r.text).join(''))
+    if (spans.length === 0) continue
+    let at = 0
+    let i = 0
+    for (const r of own) {
+      const end = at + r.text.length
+      let text = ''
+      let from = at
+      for (; i < spans.length && spans[i]![0] < end; i++) {
+        const [s, e] = spans[i]!
+        if (s >= from) text += r.text.slice(from - at, s - at) + MASKED
+        from = Math.max(from, Math.min(e, end))
+        // A value that runs past this run is cut from the next one too.
+        if (e > end) break
+      }
+      r.text = text + r.text.slice(from - at)
+      at = end
+    }
+  }
+  // A run emptied whole leaves its neighbours, the other stream, adjacent.
+  const kept: typeof runs = []
+  for (const r of runs) {
+    if (r.text.length === 0) continue
+    const last = kept.at(-1)
+    if (last !== undefined && last.err === r.err) last.text += r.text
+    else kept.push(r)
+  }
+  return kept
+}
+
 /**
  * `mask.stream()` driving `emit`: what it holds back (a tail that could
  * begin a value) is emitted `idleMs` after the last chunk when none

package/src/util/settle.ts

@@ -27,6 +27,22 @@ export function teardownTimeoutMs(): number {
   return testTimerMs('TEARDOWN_TIMEOUT', DEFAULT_TIMEOUT_MS, true)
 }
 
+/**
+ * Grace after the direct child exits before we abort the stdout/stderr readers.
+ * The pipe reaches EOF only when EVERY write-end fd is closed, so a task that
+ * backgrounds a process inheriting fd 1/2 (`server & echo up` — `execWrap`
+ * leaves compound commands as `sh -c`, so `sh` exits while the grandchild holds
+ * the pipe) never EOFs. On a clean exit with no lingering writer the pipe EOFs
+ * at once, so the readers win this race immediately and normal tasks pay
+ * nothing; only a stuck reader waits out the grace. Residual buffered output is
+ * bounded by the OS pipe buffer (streamToString drains continuously DURING the
+ * run), so this is far longer than any real drain needs. What the leftover
+ * process writes after the bound is lost, and `POST_EXIT_CUT_LINE`
+ * (exec/runner.ts) says so.
+ * A runtime probe's drain is bounded the same (cache/inputs.ts).
+ */
+export const POST_EXIT_DRAIN_MS = 250
+
 /**
  * The SIGTERM→SIGKILL grace a run grants a child that ignores SIGTERM:
  * the one-shot timeout escalation (`exec/runner.ts`),
@@ -51,7 +67,8 @@ export function killGraceMs(defaultMs: number): number {
 export async function settleWithin(p: Promise<unknown>, ms: number): Promise<boolean> {
   let timer: ReturnType<typeof setTimeout> | undefined
   const deadline = new Promise<false>((resolve) => {
-    timer = setTimeout(() => resolve(false), ms)
+    // A delay past a 32-bit int fires at 1 ms: the longest the timer holds instead.
+    timer = setTimeout(() => resolve(false), Math.min(ms, MAX_TIMEOUT_MS))
   })
   try {
     return (await Promise.race([p.then(() => true), deadline])) !== false

package/src/util/size.ts

@@ -70,10 +70,20 @@ export function formatBytes(n: number): string {
   return `${v.toFixed(0)} PB`
 }
 
-/** Bytes under `p` on disk, links not followed; 0 when it is missing. */
+/** Bytes under `p` on disk, links not followed; 0 when missing, and for a directory this user cannot list. */
 export function treeBytes(p: string): number {
   const st = lstatSync(p, { throwIfNoEntry: false })
   if (st === undefined) return 0
   if (!st.isDirectory()) return st.size
-  return readdirSync(p).reduce((n, e) => n + treeBytes(path.join(p, e)), 0)
+  let names: string[]
+  try {
+    names = readdirSync(p)
+  } catch (err) {
+    // A directory this user cannot list (another user's store, a task's
+    // 0700 output) is a size nobody here can read, not a failed report.
+    const code = (err as NodeJS.ErrnoException).code
+    if (code === 'EACCES' || code === 'EPERM') return 0
+    throw err
+  }
+  return names.reduce((n, e) => n + treeBytes(path.join(p, e)), 0)
 }

package/src/util/tail.ts

@@ -32,8 +32,11 @@ export function createTail(): Tail {
   return { chunks: [], chars: 0, dropped: 0 }
 }
 
-export function appendTail(t: Tail, chunk: string, limit = PERSISTENT_TAIL_CHARS): void {
+export function appendTail(t: Tail, chunk: string, cap = PERSISTENT_TAIL_CHARS): void {
   if (chunk.length === 0) return
+  // Every bound below is `chars > limit`, which NaN never is: a NaN cap
+  // kept everything, the unbounded heap this exists to prevent.
+  const limit = Number.isNaN(cap) ? 0 : cap
   t.chunks.push(chunk)
   t.chars += chunk.length
   // Evict WHOLE chunks from the head — no concatenation until the flush

package/src/util/write-file.ts

@@ -1,14 +1,43 @@
-import { lstatSync, readlinkSync, writeFileSync } from 'node:fs'
-import { mkdir, open, rename, rm } from 'node:fs/promises'
+import { lstatSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs'
+import { lstat, mkdir, open, rename, rm } from 'node:fs/promises'
 import path from 'node:path'
 import { UserError } from './errors.js'
 
 /**
- * Refuses a `file` that is a symlink: a repo can carry `vx.config.ts ->
- * /anywhere`, and a write through it lands outside the workspace. Called
- * before the first of a set of writes, so a refusal leaves none half-made.
+ * Refuses a `file` whose directory resolves outside `root`: a repo can
+ * carry `.vx -> ../anywhere` (or `plugins -> ...`), and checking only the
+ * file's own name wrote through it. The nearest directory that exists is
+ * asked; one not made yet is made under it.
  */
-export function refuseSymlink(file: string): void {
+function refuseOutside(file: string, root: string): void {
+  const top = realpathSync(root)
+  for (let at = path.dirname(file); ; at = path.dirname(at)) {
+    let real: string
+    try {
+      real = realpathSync(at)
+    } catch {
+      // quiet: not made yet (or a dangling link mkdir cannot make through)
+      if (at === path.dirname(at)) return
+      continue
+    }
+    const rel = path.relative(top, real)
+    if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      throw new UserError(
+        `refusing to write ${file}: ${at} resolves to ${real}, outside the workspace; remove the link and run again`,
+      )
+    }
+    return
+  }
+}
+
+/**
+ * Refuses a `file` that is a symlink, or whose directory resolves outside
+ * `root`: a repo can carry `vx.config.ts -> /anywhere`, and a write
+ * through it lands outside the workspace. Called before the first of a
+ * set of writes, so a refusal leaves none half-made.
+ */
+export function refuseSymlink(file: string, root: string): void {
+  refuseOutside(file, root)
   let link: string
   try {
     if (!lstatSync(file).isSymbolicLink()) return
@@ -22,13 +51,61 @@ export function refuseSymlink(file: string): void {
   )
 }
 
+/**
+ * A rename over a directory (EISDIR) as a refusal naming `shown`, not a
+ * stack trace; any other error as it was.
+ */
+function directoryInTheWay(err: unknown, shown: string): unknown {
+  return (err as NodeJS.ErrnoException | null)?.code === 'EISDIR'
+    ? new UserError(`cannot write ${shown}: a directory stands there; remove it and run again`)
+    : err
+}
+
+/** A file to write: its path, its bytes, and the name a refusal shows. */
+export interface PendingWrite {
+  file: string
+  text: string
+  shown: string
+}
+
+/**
+ * Writes each file to a temp beside it, then renames them all over their
+ * names: a reader never sees half a file, and a refusal (one outside
+ * `root`, as `refuseSymlink`'s) leaves every file
+ * as it was, not one new beside one old (`vx lock` said it wrote nothing
+ * while the config lock held the edit). A refusal names the file the user
+ * knows, never its temp.
+ */
+export async function writeAllOrNone(files: readonly PendingWrite[], root: string): Promise<void> {
+  for (const f of files) refuseOutside(f.file, root)
+  const tag = `.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
+  let at = 0
+  try {
+    for (; at < files.length; at++) await Bun.write(files[at]!.file + tag, files[at]!.text)
+    // A rename over a directory fails only after the ones before it landed.
+    for (at = 0; at < files.length; at++)
+      if ((await lstat(files[at]!.file).catch(() => null))?.isDirectory())
+        throw Object.assign(new Error('directory'), { code: 'EISDIR' })
+    for (at = 0; at < files.length; at++) await rename(files[at]!.file + tag, files[at]!.file)
+  } catch (err) {
+    // Best effort: where the write was refused the temp cannot be named
+    // either (ENOTDIR), and that must not replace the refusal itself.
+    await Promise.all(files.map((f) => rm(f.file + tag, { force: true }).catch(() => {})))
+    const f = files[Math.min(at, files.length - 1)]!
+    const e = err as NodeJS.ErrnoException
+    if (typeof e.message === 'string') e.message = e.message.split(f.file + tag).join(f.file)
+    if (e.path === f.file + tag) e.path = f.file
+    throw directoryInTheWay(err, f.shown)
+  }
+}
+
 /**
  * Writes `text` to `file`, never through a link: a temp beside it, made
  * with O_EXCL, renamed over it. A rename replaces a link put there after
- * the check, never its target.
+ * the check, never its target. Refused outside `root` (`refuseSymlink`).
  */
-export async function writeNoFollow(file: string, text: string): Promise<void> {
-  refuseSymlink(file)
+export async function writeNoFollow(file: string, text: string, root: string): Promise<void> {
+  refuseSymlink(file, root)
   await mkdir(path.dirname(file), { recursive: true })
   const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
   try {