@vzn/vx 0.0.652 → 0.0.653

package/src/orchestrator/sandbox-fix.ts

@@ -6,7 +6,7 @@
 import { lstatSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import type { SandboxViolation } from '../exec/index.js'
+import { MOUNT_WILDCARDS, type SandboxViolation } from '../exec/index.js'
 import type { TaskOutcome } from '../graph/index.js'
 import { isLiteralPattern } from '../util/index.js'
 import { credentialStorePaths } from './sandbox-request.js'
@@ -26,8 +26,8 @@ function isCredential(abs: string): boolean {
 }
 
 /**
- * A path as a grant spells it: project-relative inside the project, `~/…`
- * under home, else absolute.
+ * A path as a grant names it, unescaped: project-relative inside the
+ * project, `~/…` under home, else absolute.
  */
 function grantPath(abs: string, projectDir: string): string {
   const rel = path.relative(projectDir, abs)
@@ -37,6 +37,26 @@ function grantPath(abs: string, projectDir: string): string {
   return abs.startsWith(home + path.sep) ? `~/${abs.slice(home.length + 1)}` : abs
 }
 
+/**
+ * The grant that allows `abs`, spelled as the sandbox reads it: a bracket
+ * escaped, since `pages/[id].tsx` is a class that grants `pages/i.tsx`,
+ * and applying the fix failed the run again on the same read. A path no
+ * grant can name alone (a `*`, `?` or backslash; on Linux a write with a
+ * bracket too: sandbox-binds.ts) is granted as the directory above it.
+ */
+function grantFor(abs: string, projectDir: string, kind: 'read' | 'write'): string {
+  const raw = grantPath(abs, projectDir)
+  const wild = raw.search(
+    kind === 'write' && process.platform === 'linux' ? MOUNT_WILDCARDS : /[*?]/,
+  )
+  const bad = Math.min(...[wild, raw.indexOf('\\')].filter((i) => i >= 0))
+  const at = bad === Infinity ? raw : raw.slice(0, raw.lastIndexOf('/', bad) + 1) || '.'
+  return at.replace(/[[\]]/g, '\\$&')
+}
+
+/** A project path as `inputs.files` names it: each task-glob wildcard escaped. */
+const taskGlobOf = (rel: string): string => rel.replace(/[*?{}[\]\\]/g, '\\$&')
+
 /**
  * A write grant covers the top directory the write landed in: granting
  * `dist/a.js` alone fails the run again on `dist/b.js`. Not when the task
@@ -45,7 +65,7 @@ function grantPath(abs: string, projectDir: string): string {
  */
 function writeGrant(grant: string, isDir: boolean, inputs: readonly string[]): string {
   const slash = grant.indexOf('/')
-  const exact = isDir ? `${grant}/` : grant
+  const exact = isDir && !grant.endsWith('/') ? `${grant}/` : grant
   if (grant.startsWith('~/') || path.isAbsolute(grant) || slash === -1) return exact
   const top = grant.slice(0, slash)
   return inputs.some((g) => readsDir(g, top)) ? exact : `${top}/`
@@ -68,12 +88,18 @@ function keyedBy(globs: readonly string[]): (rel: string) => boolean {
   return (rel) => take.some((g) => g.match(rel)) && !drop.some((g) => g.match(rel))
 }
 
+/** The task proxy's refusals an `allow.network` entry cannot lift (task-proxy.ts). */
+const REFUSED_ANYWAY = /\((?:host is on the deny list|malformed host)\)$/
+
 function kindOf(v: SandboxViolation): Kind | undefined {
   const can = v.ignorable ?? []
   if (can.length === 1) return can[0]
-  // Linux reports a refused `openat` as either: the flags the parse drops
-  // decide. A file the host has was hidden from a read; one it lacks was
-  // being created.
+  // Linux reports a refused `openat` as either: its flags decide. Judged by
+  // the host alone, `cat optional.cfg` of a file it lacks was named a
+  // write, and the grant made vx create an empty one.
+  if (v.opened !== undefined) return v.opened
+  // A probe (`access`) names no flags: a file the host has was hidden from
+  // a read; one it lacks was being created.
   if (can.includes('read') && can.includes('write') && v.path !== undefined)
     return lstatSync(v.path, { throwIfNoEntry: false }) !== undefined ? 'read' : 'write'
   return undefined
@@ -103,22 +129,24 @@ export function sandboxFix(
     if (v.hint === true || v.target === undefined) continue
     const kind = kindOf(v)
     if (kind === undefined) continue
+    // A host the deny list holds, or a malformed one, no allow grant admits.
+    if (kind === 'network' && REFUSED_ANYWAY.test(v.line)) continue
     if (kind === 'network') fix.network.add(v.target.replace(/:\d+$/, ''))
     else if (kind === 'systemInfo') fix.systemInfo.add(v.target)
     else if (v.path === undefined) continue
     else if (isCredential(v.path)) fix.withheld.add(grantPath(v.path, projectDir))
     else if (kind === 'read') {
-      const grant = grantPath(v.path, projectDir)
-      fix.read.add(grant)
+      const rel = grantPath(v.path, projectDir)
+      fix.read.add(grantFor(v.path, projectDir, 'read'))
       // The link the task opened lies in a directory the sandbox lacks: the
       // target alone stays unreachable, and the fix named it again forever.
-      if (v.via !== undefined) fix.read.add(grantPath(v.via, projectDir))
-      if (keyed !== undefined && inProject(grant) && !keyed(grant)) fix.inputs.add(grant)
+      if (v.via !== undefined) fix.read.add(grantFor(v.via, projectDir, 'read'))
+      if (keyed !== undefined && inProject(rel) && !keyed(rel)) fix.inputs.add(taskGlobOf(rel))
     } else {
       const isDir =
         v.line.startsWith('mkdir') ||
         lstatSync(v.path, { throwIfNoEntry: false })?.isDirectory() === true
-      fix.write.add(writeGrant(grantPath(v.path, projectDir), isDir, inputs ?? []))
+      fix.write.add(writeGrant(grantFor(v.path, projectDir, 'write'), isDir, inputs ?? []))
     }
   }
   const out: SandboxFix = {}

package/src/orchestrator/sandbox-request.ts

@@ -3,10 +3,11 @@
 // (bwrap cannot bind a path that does not exist). Shared by the cached path
 // (through the executor) and the persistent path (spawned in execute-task).
 
-import { existsSync } from 'node:fs'
+import { existsSync, readdirSync } from 'node:fs'
 import { lstat, mkdir, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
+import { repoFacts, repoRootOf } from '../cache/index.js'
 import type { ExecConfig } from '../config.js'
 import {
   bindableWrites,
@@ -24,7 +25,7 @@ import {
   type SandboxViolation,
 } from '../exec/index.js'
 import type { TaskNode } from '../graph/index.js'
-import { grantPrefix, relPosix, UserError } from '../util/index.js'
+import { grantPrefix, relPosix, restorableOutput, UserError } from '../util/index.js'
 
 /**
  * Arm the sandbox runtime for a run, lazily: only when at least one task
@@ -186,7 +187,8 @@ export function prepareSandbox(nodes: Iterable<SandboxedNode>): SandboxArmer | n
  *
  * The other is the outputs of the tasks its key folds
  * (`dependencyOutputs`, 2026-11-06): an edge the user drew, whose files
- * this key already answers for, so the read can replay nothing stale.
+ * this key already answers for, so the read can replay nothing stale —
+ * only the files the outputs take, never what lies beside them.
  */
 export async function sandboxRequestFor(
   node: Pick<TaskNode, 'projectDir'>,
@@ -203,6 +205,10 @@ export async function sandboxRequestFor(
   cacheDir?: string,
   /** The dependencies' outputs it may read (`dependencyReads`): absolute paths. */
   dependencyOutputs: readonly string[] = [],
+  /** The heads walked for them (`dependencyReads`): a refused read under one is reported. */
+  dependencyReported: readonly string[] = [],
+  /** The projects nested in a keyed one, by its dir (keyed-projects.ts `nestedDirsOf`). */
+  nestedOf: (projectDir: string) => readonly string[] = () => [],
 ): Promise<SandboxRequest> {
   // The runtime reads a path holding a bracket as a pattern: on Linux it
   // mounts no such write path (B-60); seatbelt's rules compile it as a
@@ -233,18 +239,28 @@ export async function sandboxRequestFor(
         `it mounts none of the project — rename the directory, or run the task without exec.sandbox`,
     )
   }
-  const depDirs = [
-    path.join(node.projectDir, 'node_modules'),
-    path.join(workspaceRoot, 'node_modules'),
-  ]
   // A workspace dependency is a SYMLINK in `node_modules` pointing at a
   // sibling project, so granting `node_modules` grants a link whose
   // target is outside it. That target is a dependency, not a reach-out:
   // no project config should have to name a sibling to import what its
   // own `package.json` depends on (2026-09-05) — when the key
   // moves with it.
-  const links = await linkedDeps(depDirs, node.projectDir, workspaceRoot, keyed)
-  depDirs.push(...links.granted, ...dependencyOutputs)
+  const links = await linkedDeps(node.projectDir, workspaceRoot, keyed)
+  // A granted package is bound whole, and its nested projects with it,
+  // whose files its key never folds (a glob stops at a nested project):
+  // an edit there was a stale hit. Walled unless the key answers for them
+  // too; reported, as a withheld package is.
+  const linkedWalls =
+    keyed === undefined
+      ? []
+      : links.keyedGranted
+          .flatMap(nestedOf)
+          .filter((d) => !keyed.has(d))
+          .map(toRealPath)
+  const depDirs = [
+    ...links.granted.flatMap((g) => punchWalls(g, linkedWalls)),
+    ...dependencyOutputs,
+  ]
   // bwrap cannot --bind a path that does not exist: the bind silently
   // becomes a no-op and writes to it appear to succeed but never land.
   // Pre-create what the task said it will write — after the grants are
@@ -253,8 +269,10 @@ export async function sandboxRequestFor(
   // The repository's and vx's own walls are sealed: no write grant may
   // reach inside them either. A nested project is not: a grant into it is
   // as explicit as one into a sibling.
+  const git = outsideGit(workspaceRoot)
   const sealed = [
     path.join(workspaceRoot, '.git'),
+    ...git.dirs,
     path.join(workspaceRoot, '.vx', 'cache'),
     ...(cacheDir !== undefined &&
     toRealPath(cacheDir).startsWith(toRealPath(workspaceRoot) + path.sep)
@@ -293,7 +311,10 @@ export async function sandboxRequestFor(
     // readable (tools need `~/.cache`), but a dependency the task runs
     // could copy a key into an output the cache shares (L-41).
     baseDenyRead: [
-      ...(process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot]),
+      ...(process.platform === 'darwin'
+        ? [workspaceRoot, ...walls, ...linkedWalls]
+        : [workspaceRoot, ...git.dirs]),
+      ...(await gitTrees(workspaceRoot, git.trees, config.allowWrite)),
       ...(await credentialStores(workspaceRoot, config.allowWrite)),
       ...(await vxStores(workspaceRoot, config.allowWrite, cacheDir)),
     ],
@@ -307,48 +328,148 @@ export async function sandboxRequestFor(
     reportWithin: node.projectDir,
     // …and of a dependency withheld above: the task reached for it
     // through its own `node_modules`, and that read is the stale hit the
-    // withholding exists to stop, not the wall.
-    reportLinked: links.withheld.map((w) => w.dir),
+    // withholding exists to stop, not the wall. So is one of a granted
+    // package's nested project walled above.
+    // So is a read beside a dependency's outputs, under the head its glob
+    // walked: a file no key answers for (`dependencyReads`).
+    reportLinked: [
+      ...links.withheld.map((w) => w.dir),
+      ...linkedWalls,
+      ...dependencyReported.map(toRealPath),
+    ],
     config,
     ...(keyed === undefined ? {} : { keyed: [...keyed] }),
     ...(dependencyOutputs.length === 0 ? {} : { dependencyReads: [...dependencyOutputs] }),
+    ...(dependencyReported.length === 0 ? {} : { dependencyReported: [...dependencyReported] }),
   }
   return { sandbox: request, placeholders, withheld: links.withheld }
 }
 
 /**
- * The paths a sandboxed task may read of its dependencies' declared
- * outputs (`readableDeps`): each output glob's fixed head, or, for a glob
- * with none (`*.tsbuildinfo`), the files it matches now, so a root-level
- * output never grants the dependency's whole project. Asked when the task
- * runs, after its dependencies ran or were restored: a head that names
- * nothing is left out, as bwrap binds no missing path.
+ * What a sandboxed task may read of its dependencies' declared outputs
+ * (`readableDeps`): the files their globs take now (`restorableOutput`, so
+ * a `!` entry takes one back), a directory whole where every file under it
+ * is one. Binding each glob's head whole granted every file beside the
+ * outputs too (an untracked `gen/notes.txt` under `gen/**\/*.js`), which no
+ * key answers for: an edit to it replayed the old result as a hit. Asked
+ * when the task runs, after its dependencies ran or were restored.
+ *
+ * `reported` are the heads walked: a refused read under one is a file
+ * beside the outputs, reported as a violation. A glob with no head
+ * (`*.tsbuildinfo`) reports nothing, since its head is the dependency's
+ * whole project, whose sources its key folds.
  */
 export async function dependencyReads(
   deps: readonly TaskNode[],
   workspaceRoot: string,
-): Promise<string[]> {
+): Promise<DependencyReads> {
   const reads = new Set<string>()
+  const reported = new Set<string>()
+  const bytesBy = new Map<string, number>()
+  let total = 0
   for (const dep of deps) {
     const outputs = dep.config.outputs
     if (outputs === undefined) continue
-    const globs = [
-      ...outputs.files.map((g) => [dep.projectDir, g] as const),
-      ...(outputs.workspaceFiles ?? []).map((g) => [workspaceRoot, g] as const),
-    ]
-    for (const [base, glob] of globs) {
-      if (glob.startsWith('!')) continue
-      const head = grantPrefix(glob)
-      if (head !== '' && head !== '.') {
+    const add = (p: string): void => {
+      if (reads.has(p)) return
+      reads.add(p)
+      total += bindBytes(p)
+      bytesBy.set(dep.id, (bytesBy.get(dep.id) ?? 0) + bindBytes(p))
+    }
+    const scopes = [
+      [dep.projectDir, outputs.files, 'project'],
+      [workspaceRoot, outputs.workspaceFiles ?? [], 'workspace'],
+    ] as const
+    for (const [base, globs, scope] of scopes) {
+      const isOutput = restorableOutput(globs, scope)
+      for (const glob of globs) {
+        if (glob.startsWith('!')) continue
+        const head = grantPrefix(glob)
+        if (head === '' || head === '.') {
+          for await (const f of new Bun.Glob(glob).scan({ cwd: base, onlyFiles: true, dot: true }))
+            if (isOutput(f)) add(path.join(base, f))
+          continue
+        }
         const abs = path.join(base, head)
-        if (existsSync(abs)) reads.add(abs)
-        continue
+        const found = await outputBinds(abs, head, isOutput)
+        if (found === undefined) continue
+        found.binds.forEach(add)
+        if (found.dir) reported.add(abs)
       }
-      for await (const f of new Bun.Glob(glob).scan({ cwd: base, onlyFiles: true, dot: true }))
-        reads.add(path.join(base, f))
     }
   }
-  return [...reads]
+  if (total > DEPENDENCY_BIND_BYTES) {
+    const most = [...bytesBy].sort((a, b) => b[1] - a[1]).map(([id]) => id)
+    throw new UserError(
+      `exec.sandbox: the outputs of ${most.slice(0, 3).join(', ')} lie among other files, so ` +
+        `the sandbox would bind ${reads.size} of them one by one, more than its command line ` +
+        `holds — declare the files beside them outputs too (a whole \`dir/**\`), or move them ` +
+        `out of the output directory`,
+    )
+  }
+  return { reads: [...reads], reported: [...reported] }
+}
+
+/**
+ * How much of the sandbox's command line the dependency binds may take.
+ * Each is `--ro-bind <path> <path>` on Linux, and the whole wrap is one
+ * argument to `sh -c`, which holds at most 128 KiB: 1,000 output files
+ * bound one by one under a 100-character path failed the spawn with E2BIG
+ * (206 KiB). What is left is the wrap's own and the command's.
+ */
+const DEPENDENCY_BIND_BYTES = 64 * 1024
+
+/** The bytes one read bind adds to the wrap: its path twice, quoted, and the flag. */
+function bindBytes(p: string): number {
+  return 2 * Buffer.byteLength(p) + 16
+}
+
+/** `dependencyReads`: the paths to bind, and the heads whose refused reads are reported. */
+export interface DependencyReads {
+  readonly reads: readonly string[]
+  readonly reported: readonly string[]
+}
+
+/**
+ * The binds that grant exactly the outputs at `abs` (`rel` from the
+ * dependency's base): itself when it is a file `isOutput` takes or a
+ * directory every file under it is, else its children's binds. `whole`
+ * says it was bound itself; `undefined` is a missing path. A link is a
+ * leaf: bound alone it would grant its target, which may be no output, so
+ * it is granted only inside a directory bound whole.
+ */
+async function outputBinds(
+  abs: string,
+  rel: string,
+  isOutput: (rel: string) => boolean,
+): Promise<{ binds: string[]; whole: boolean; dir: boolean } | undefined> {
+  const st = await lstat(abs).catch(() => undefined)
+  if (st === undefined) return undefined
+  if (st.isDirectory()) return { ...outputDirBinds(abs, rel, isOutput), dir: true }
+  const whole = isOutput(rel)
+  return { binds: whole && !st.isSymbolicLink() ? [abs] : [], whole, dir: false }
+}
+
+/** `outputBinds` for a directory. */
+function outputDirBinds(
+  abs: string,
+  rel: string,
+  isOutput: (rel: string) => boolean,
+): { binds: string[]; whole: boolean } {
+  const binds: string[] = []
+  let whole = true
+  for (const e of readdirSync(abs, { withFileTypes: true })) {
+    const childRel = `${rel}/${e.name}`
+    const childAbs = `${abs}/${e.name}`
+    if (e.isDirectory()) {
+      const child = outputDirBinds(childAbs, childRel, isOutput)
+      binds.push(...child.binds)
+      whole &&= child.whole
+    } else if (isOutput(childRel)) {
+      if (!e.isSymbolicLink()) binds.push(childAbs)
+    } else whole = false
+  }
+  return { binds: whole ? [abs] : binds, whole }
 }
 
 /**
@@ -383,8 +504,10 @@ export interface WithheldLink {
 }
 
 /**
- * Where the workspace links in `dirs` actually point, split into what the
- * task is granted and what it is not.
+ * The project's and the workspace root's `node_modules`, and where the
+ * workspace links in them actually point, split into what the task is
+ * granted and what it is not. A `node_modules` that is itself a link is
+ * judged by its target, as a link inside one is.
  *
  * One level deep, plus one level inside a `@scope/` directory — the shape
  * a package manager writes — and then the same in the `node_modules` of
@@ -405,16 +528,43 @@ export interface WithheldLink {
  * outside the root lies outside the deny anchor, so granting it is a no-op
  * either way. Every side of every comparison is canonical: a target always
  * is, and a directory under a root reached through a link (macOS's `/var`)
- * is not.
+ * is not. `keyedGranted` names each granted keyed project as `keyed` does.
  */
 async function linkedDeps(
-  dirs: readonly string[],
   projectDir: string,
   workspaceRoot: string,
   keyed: ReadonlySet<string> | undefined,
-): Promise<{ granted: string[]; withheld: WithheldLink[] }> {
+): Promise<{ granted: string[]; withheld: WithheldLink[]; keyedGranted: string[] }> {
   const [self, root] = await Promise.all([realpath(projectDir), realpath(workspaceRoot)])
-  const realDirs = dirs.map(toRealPath)
+  const git = path.join(root, '.git')
+  // A target holding the project hands it back whole; one holding or
+  // inside `.git` hands over the repository, which no key folds.
+  const walled = (target: string): boolean =>
+    atOrUnder(self, target) || atOrUnder(git, target) || atOrUnder(target, git)
+  // Canonical keyed dir -> the dir as vx holds it.
+  const keyedDirs =
+    keyed === undefined
+      ? undefined
+      : new Map(await Promise.all([...keyed].map(async (d) => [await realpath(d), d] as const)))
+  const grants = (target: string): boolean =>
+    keyedDirs === undefined || !atOrUnder(target, root) || keyedDirs.has(target)
+  // The two implicit `node_modules`, each granted as itself only where it
+  // really is. One that is itself a link (`ln -s .. node_modules`) bound
+  // its target whole: the workspace root, a sibling or `.git`, and an edit
+  // there was a stale hit. Its target is judged as a workspace link's is.
+  const granted: string[] = []
+  const realDirs: string[] = []
+  const outward: Array<[target: string, link: string]> = []
+  for (const [dir, own] of [
+    [path.join(projectDir, 'node_modules'), path.join(self, 'node_modules')],
+    [path.join(workspaceRoot, 'node_modules'), path.join(root, 'node_modules')],
+  ] as const) {
+    const target = await realpath(dir).catch(() => own)
+    if (target === own) {
+      granted.push(dir)
+      realDirs.push(own)
+    } else outward.push([target, dir])
+  }
   const scan = async (dir: string, scope: string): Promise<Array<[string, string, string]>> => {
     const found: Array<[target: string, link: string, name: string]> = []
     const entries = await readdir(dir, { withFileTypes: true }).catch(() => [])
@@ -425,7 +575,7 @@ async function linkedDeps(
         if (
           target !== undefined &&
           !realDirs.some((d) => atOrUnder(target, d)) &&
-          !atOrUnder(self, target)
+          !walled(target)
         ) {
           found.push([target, full, scope + e.name])
         }
@@ -435,20 +585,26 @@ async function linkedDeps(
     }
     return found
   }
-  const keyedDirs =
-    keyed === undefined ? undefined : new Set(await Promise.all([...keyed].map((d) => realpath(d))))
-  const grants = (target: string): boolean =>
-    keyedDirs === undefined || !atOrUnder(target, root) || keyedDirs.has(target)
-  // Merged in `dirs` order, so the link a hint names is the project's own
-  // when both have one. A granted package is scanned in turn: pnpm and
-  // Bun link a dependency's own workspace dependencies only under ITS
-  // `node_modules`, so `app -> ui -> core` left core hidden and the import
-  // of ui failed with ENOENT, unreported.
+  // Merged in order, the project's `node_modules` first, so the link a hint
+  // names is the project's own when both have one. A granted package is
+  // scanned in turn: pnpm and Bun link a dependency's own workspace
+  // dependencies only under ITS `node_modules`, so `app -> ui -> core` left
+  // core hidden and the import of ui failed with ENOENT, unreported.
   const targets = new Map<string, { link: string; name: string }>()
-  let frontier: Array<[nodeModules: string, owner: string | undefined]> = dirs.map((d) => [
+  let frontier: Array<[nodeModules: string, owner: string | undefined]> = granted.map((d) => [
     d,
     undefined,
   ])
+  for (const [target, link] of outward) {
+    if (realDirs.some((d) => atOrUnder(target, d))) granted.push(link)
+    else if (!walled(target) && !targets.has(target)) {
+      targets.set(target, { link, name: relPosix(root, target) })
+      if (grants(target)) {
+        realDirs.push(target)
+        frontier.push([target, undefined])
+      }
+    }
+  }
   while (frontier.length > 0) {
     const next: typeof frontier = []
     const scans = await Promise.all(frontier.map(([d]) => scan(d, '')))
@@ -464,11 +620,14 @@ async function linkedDeps(
     }
     frontier = next
   }
-  const granted: string[] = []
   const withheld: WithheldLink[] = []
+  const keyedGranted: string[] = []
   for (const [target, { link, name }] of targets) {
-    if (grants(target)) granted.push(target)
-    else
+    if (grants(target)) {
+      granted.push(target)
+      const dir = keyedDirs?.get(target)
+      if (dir !== undefined) keyedGranted.push(dir)
+    } else
       withheld.push({
         dir: target,
         name,
@@ -476,7 +635,7 @@ async function linkedDeps(
         link: relPosix(workspaceRoot, link),
       })
   }
-  return { granted, withheld }
+  return { granted, withheld, keyedGranted }
 }
 
 /**
@@ -610,9 +769,11 @@ function wallOff(
   const home = toRealPath(workspaceRoot)
   for (const bind of bindableWrites(config.allowWrite)) {
     // A bind outside the workspace is the user's own path (`/tmp/x`,
-    // `~/.cache/y`), spelled there on purpose; only one inside is judged.
-    if (!atOrUnder(bind, home)) continue
-    const wall = walls.find((w) => atOrUnder(w, bind)) ?? sealed.find((w) => atOrUnder(bind, w))
+    // `~/.cache/y`), spelled there on purpose; only one inside is judged,
+    // and one reaching the repository's git dir outside it (`outsideGit`).
+    const wall = atOrUnder(bind, home)
+      ? (walls.find((w) => atOrUnder(w, bind)) ?? sealed.find((w) => atOrUnder(bind, w)))
+      : sealed.find((w) => !atOrUnder(w, home) && (atOrUnder(w, bind) || atOrUnder(bind, w)))
     if (wall === undefined) continue
     throw new UserError(
       `exec.sandbox.allow.write: the grant binding ${bind} would make ${wall} writable — another ` +
@@ -695,10 +856,26 @@ export const CREDENTIAL_STORES = [
   '.config/gh',
   '.docker/config.json',
   '.netrc',
+  // git's credential store, at its home and at its XDG default.
   '.git-credentials',
+  '.config/git/credentials',
   '.npmrc',
+  // Yarn's: Berry's, and classic's `_authToken`.
   '.yarnrc.yml',
+  '.yarnrc',
+  // pnpm's global rc, which `pnpm config set` writes a token to.
+  '.config/pnpm/rc',
+  'Library/Preferences/pnpm/rc',
   '.pypirc',
+  '.config/composer/auth.json',
+  '.composer/auth.json',
+  '.config/glab-cli',
+  '.config/github-copilot',
+  '.s3cfg',
+  '.oci',
+  '.cache/huggingface/token',
+  '.huggingface/token',
+  '.kaggle/kaggle.json',
   // Registry and service tokens of the same kind: Bun's global bunfig
   // (`[install.scopes]` tokens) at either of its homes, Cargo's, RubyGems'.
   '.bunfig.toml',
@@ -734,14 +911,16 @@ export const CREDENTIAL_STORES = [
 ]
 
 /**
- * Each store's path: under `home`, and again where `$XDG_CONFIG_HOME` or
- * `$XDG_DATA_HOME` moves a `.config` or `.local/share` one. A task sees
- * both, so a CLI reads its login there. A relative value is no XDG path.
+ * Each store's path: under `home`, and again where `$XDG_CONFIG_HOME`,
+ * `$XDG_DATA_HOME` or `$XDG_CACHE_HOME` moves a `.config`, `.local/share`
+ * or `.cache` one. A task sees all three, so a CLI reads its login there.
+ * A relative value is no XDG path.
  */
 export function credentialStorePaths(home: string): string[] {
   const moved = [
     ['.config/', process.env['XDG_CONFIG_HOME']],
     ['.local/share/', process.env['XDG_DATA_HOME']],
+    ['.cache/', process.env['XDG_CACHE_HOME']],
   ] as const
   const out = new Set(CREDENTIAL_STORES.map((rel) => path.join(home, rel)))
   for (const rel of CREDENTIAL_STORES)
@@ -795,6 +974,54 @@ async function vxStores(
   return (await Promise.all(stores.map((p) => denyAround(p, writes)))).flat()
 }
 
+/** The repository's git dirs and other work trees outside the workspace (`outsideGit`). */
+interface OutsideGit {
+  /** The git dir and the common dir: denied and sealed, as `<workspaceRoot>/.git` is. */
+  dirs: string[]
+  /** The top-level above the workspace, a linked worktree's main checkout: denied around it. */
+  trees: string[]
+}
+
+/**
+ * What of the repository lies outside the workspace. A workspace below
+ * the git top-level, or in a linked worktree (vx-dte's `local()` workers),
+ * keeps its git dirs there, and only `<workspaceRoot>/.git` was walled: a
+ * task read any project's committed bytes with `git --git-dir`, and a
+ * worktree's main checkout directly, into an output no key answered for.
+ * A tree holding home stays readable: a dotfiles repository at `~` would
+ * deny `~/.cache` with it, and its git dir alone is walled.
+ * Read from `repoFacts`, the memo the run's git enumeration filled.
+ */
+function outsideGit(workspaceRoot: string): OutsideGit {
+  const facts = repoFacts(workspaceRoot)
+  if (facts === null) return { dirs: [], trees: [] }
+  const root = toRealPath(workspaceRoot)
+  const common = toRealPath(path.resolve(root, facts.commonDir))
+  const dirs = [...new Set([toRealPath(facts.gitDir), common])].filter(
+    (d) => !atOrUnder(d, root) && !atOrUnder(root, d),
+  )
+  const home = toRealPath(process.env['HOME'] || homedir())
+  // A common dir named `.git` sits in the main checkout; a bare one has none.
+  const main = path.basename(common) === '.git' ? [path.dirname(common)] : []
+  const trees = [...new Set([repoRootOf(root, facts.prefix), ...main])].filter(
+    (t) => !atOrUnder(t, root) && !atOrUnder(home, t),
+  )
+  return { dirs, trees }
+}
+
+/**
+ * Each tree denied around the workspace and the task's write grants: the
+ * top-level's other contents are another workspace's, not this one's.
+ */
+async function gitTrees(
+  workspaceRoot: string,
+  trees: readonly string[],
+  writes: readonly string[],
+): Promise<string[]> {
+  const keep = [toRealPath(workspaceRoot), ...writes]
+  return (await Promise.all(trees.map((t) => denyAround(t, keep)))).flat()
+}
+
 /** `dir` denied, or its entries no write grant lies under or at when one is inside it. */
 async function denyAround(dir: string, writes: readonly string[]): Promise<string[]> {
   const inside = writes.filter((w) => atOrUnder(w, dir))