@vzn/vx 0.0.86 → 0.0.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "An open, extensible monorepo task runner.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.86",
-    "@vzn/vx-linux-arm64": "0.0.86",
-    "@vzn/vx-darwin-x64": "0.0.86",
-    "@vzn/vx-darwin-arm64": "0.0.86"
+    "@vzn/vx-linux-x64": "0.0.88",
+    "@vzn/vx-linux-arm64": "0.0.88",
+    "@vzn/vx-darwin-x64": "0.0.88",
+    "@vzn/vx-darwin-arm64": "0.0.88"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -1127,10 +1127,35 @@ export class Cache implements CacheLayer {
    */
   async ingest(hash: string, body: Blob | Response, meta: IngestMeta): Promise<void> {
     const tmpPath = this.tempPath(hash)
+    // The compressed bytes are bounded too, before the decode's ceiling ever
+    // sees them: a remote body that never ends (a hostile or broken server)
+    // was written to the temp until the disk was full (L-5). No artifact
+    // under the ceiling compresses past zstd's own bound on it.
+    const cap = this.artifactCeiling + (this.artifactCeiling >> 8) + 64 * 1024
+    const past = (): CorruptArtifactError =>
+      new CorruptArtifactError(
+        hash,
+        `remote body runs past ${cap} bytes (the artifact ceiling's bound)`,
+      )
     try {
-      // Split only for the typings: Bun.write's Response and Blob overloads
-      // do not accept their union.
-      await (body instanceof Response ? Bun.write(tmpPath, body) : Bun.write(tmpPath, body))
+      if (body instanceof Blob) {
+        if (body.size > cap) throw past()
+        await Bun.write(tmpPath, body)
+      } else if (Number(body.headers.get('content-length') ?? 0) > cap) {
+        throw past()
+      } else {
+        let n = 0
+        const counted = body.body?.pipeThrough(
+          new TransformStream<Uint8Array, Uint8Array>({
+            transform(chunk, controller) {
+              n += chunk.byteLength
+              if (n > cap) controller.error(past())
+              else controller.enqueue(chunk)
+            },
+          }),
+        )
+        await Bun.write(tmpPath, new Response(counted ?? null))
+      }
     } catch (err) {
       await unlink(tmpPath).catch(() => undefined)
       throw err

package/src/exec/executor.ts

@@ -142,9 +142,11 @@ export interface ExecuteRequest {
   /**
    * Aborted when the run stops (Ctrl-C, SIGTERM, SIGHUP or an embedder's
    * `RunOptions.signal`) or when `timeoutMs` elapses. An executor ends its
-   * work and returns; core waits for `execute`, and a child an executor
-   * spawned is not one core can reach (H-10, H-12). A non-zero exit after
-   * the timeout's abort is recorded `timedOut`.
+   * work and returns: a child an executor spawned is not one core can
+   * reach (H-10, H-12). A non-zero exit after the timeout's abort is
+   * recorded `timedOut`. Core waits the kill grace (`VX_KILL_GRACE_MS`,
+   * 2 s) after the abort, then settles the attempt without `execute` and
+   * abandons it (H-14).
    */
   readonly signal?: AbortSignal
   /** See `RunOptions.liveChildren`: the run's SIGINT/SIGTERM registry. */

package/src/exec/index.ts

@@ -30,7 +30,7 @@ export {
 export { type DeniedCall } from './sandbox-violations.js'
 export { isMountableLiteral, MOUNT_WILDCARDS, toRealPath } from './sandbox-paths.js'
 export { bindableWrites, punchWalls } from './sandbox-binds.js'
-export { localExecutor } from './local-executor.js'
+export { isLocalExecutor, localExecutor } from './local-executor.js'
 export { holdGroups, killTree, untilGroupsGone } from './kill-tree.js'
 export {
   assertExecuteResult,

package/src/exec/local-executor.ts

@@ -8,9 +8,20 @@ import { runCommand } from './runner.js'
 import { runSandboxed } from './sandbox-runtime.js'
 import type { TaskExecutor } from './executor.js'
 
+const locals = new WeakSet<TaskExecutor>()
+
+/**
+ * Whether `executor` is core's own. By identity: a plugin may name its
+ * executor 'local', and core bounds a plugin's `execute` after an abort,
+ * which the local one (it SIGKILLs its own group) never needs.
+ */
+export function isLocalExecutor(executor: TaskExecutor): boolean {
+  return locals.has(executor)
+}
+
 /** The local executor. Accepts every task. */
 export function localExecutor(): TaskExecutor {
-  return {
+  const executor: TaskExecutor = {
     name: 'local',
     async execute(req) {
       const common = {
@@ -38,4 +49,6 @@ export function localExecutor(): TaskExecutor {
       })
     },
   }
+  locals.add(executor)
+  return executor
 }

package/src/exec/sandbox-runtime.ts

@@ -538,6 +538,8 @@ export interface ResolvedSandboxConfig {
   gitConfig?: boolean
   weakerWhenNested?: boolean
   weakerNetworkIsolation?: boolean
+  /** macOS: the walls a glob grant reaches, by kind (`darwinWallRules`). */
+  wallsReached?: { read: readonly string[]; write: readonly string[] }
   ignore?: {
     read?: readonly string[]
     write?: readonly string[]
@@ -645,6 +647,11 @@ export function resolveSandboxConfig(
       walls,
     ),
   }
+  if (process.platform === 'darwin') {
+    const read = wallsGlobsReach(r.allowRead, walls)
+    const write = wallsGlobsReach(r.allowWrite, walls)
+    if (read.length + write.length > 0) r.wallsReached = { read, write }
+  }
   if (a.network !== undefined) r.network = a.network
   if (cfg.deny?.network !== undefined) r.denyNetwork = cfg.deny.network
   if (a.systemInfo !== undefined) r.systemInfo = a.systemInfo
@@ -788,7 +795,10 @@ export async function wrapSandboxedCommand(
     ports.length > 0 ? `${portBridgeInner(ports, tag)} ${grouped.command}` : grouped.command
   let wrapped = await SandboxManager.wrapWithSandbox(inner, undefined, customConfig)
   if (process.platform === 'darwin') {
-    const rules = macProfileRules(args.config)
+    const rules = [
+      ...macProfileRules(args.config),
+      ...darwinWallRules(args.config, baselines.allowRead),
+    ]
     if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
   }
   // Linux: the shell execs bwrap, so bwrap is the spawn itself and its
@@ -1528,7 +1538,54 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  * that broke it learned so from its OWN tool. Measured, one task per
  * spelling, each writing files it declares:
  *
- *   write: ['g/**']         ok — collapsed to the directory
+ *   write: ['g/**
+ * The walls a glob grant can reach: each one under (or at) a glob's
+ * literal head. On Linux `expandGrants` drops such a hit before the bind
+ * (B-1); seatbelt matches a glob as a path regex, with no hit to drop.
+ */
+function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
+  const heads = grants
+    .filter((g) => !isMountableLiteral(g))
+    .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
+  return walls.filter((w) =>
+    heads.some((h) => w === h || w.startsWith(h === path.sep ? h : h + path.sep)),
+  )
+}
+
+/**
+ * macOS: the walls a glob grant reaches, denied at the profile's tail
+ * (SBPL is last-match-wins). SRT re-emits a wall's deny after the allows
+ * only under a LITERAL allow, so a root project's `read: ['**\/*.ts']`
+ * read nested projects' sources its key excludes — item 1010's stale hit,
+ * by glob, on darwin (B-12). A literal grant at or inside the wall, the
+ * task's or a baseline's (a linked dependency), is carved out: on Linux
+ * too it binds. Reads deny the data, not the metadata, as SRT's own wall
+ * denies do: a walk may still stat the directory.
+ */
+export function darwinWallRules(
+  c: Pick<ResolvedSandboxConfig, 'wallsReached' | 'allowRead' | 'allowWrite'>,
+  baseAllowRead: readonly string[],
+): string[] {
+  const rules: string[] = []
+  const deny = (op: string, walls: readonly string[], literals: readonly string[]): void => {
+    for (const w of walls) {
+      const at = `(subpath "${sbplResolvedPath(w, 'wall')}")`
+      const kept = literals
+        .filter((l) => isMountableLiteral(l) && (l === w || l.startsWith(w + path.sep)))
+        .map((l) => `(require-not (subpath "${sbplResolvedPath(l, 'grant')}"))`)
+      rules.push(
+        kept.length === 0
+          ? `(deny ${op} ${at})`
+          : `(deny ${op} (require-all ${at} ${kept.join(' ')}))`,
+      )
+    }
+  }
+  deny('file-read-data', c.wallsReached?.read ?? [], [...c.allowRead, ...baseAllowRead])
+  deny('file-write*', c.wallsReached?.write ?? [], c.allowWrite)
+  return rules
+}
+
+/**']         ok — collapsed to the directory
  *   write: ['g/a.txt']      ok — a literal is widened to its directory
  *   write: ['g/*']          FAILED: `bash: g/a.txt: Read-only file system`
  *   write: ['g/*.txt']      FAILED, same

package/src/orchestrator/execute-task.ts

@@ -22,6 +22,7 @@ import {
   releaseBridges,
   wrapSandboxedCommand,
   signalExitCode,
+  isLocalExecutor,
   type CaptureConfig,
   type ExecuteRequest,
   assertExecuteResult,
@@ -32,7 +33,9 @@ import {
   PersistentReadyError,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { relPosix, span } from '../util/index.js'
+import { killGraceMs, relPosix, span } from '../util/index.js'
+import { SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
+import { executorLabel } from './plugin-host.js'
 import {
   mayWriteFingerprint,
   type Placeholder,
@@ -493,6 +496,49 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     return stop.signal
   }
+  // An executor that ignores `signal` held its task, and so the run, past
+  // the stop and past `exec.timeout` (H-14). Once the signal aborts it has
+  // the kill grace the local executor gives a process group; then core
+  // settles the attempt without it and says so. Its work is abandoned: core
+  // cannot reach what it started.
+  function boundAfterAbort(
+    running: Promise<unknown>,
+    signal: AbortSignal | undefined,
+  ): Promise<unknown> {
+    if (signal === undefined || isLocalExecutor(args.executor)) return running
+    const started = Date.now()
+    let graceTimer: ReturnType<typeof setTimeout> | undefined
+    let onAbort: (() => void) | undefined
+    const abandoned = new Promise<ExecuteResult>((resolve) => {
+      onAbort = (): void => {
+        const graceMs = killGraceMs(SIGNAL_SHUTDOWN_GRACE_MS)
+        graceTimer = setTimeout(() => {
+          const why = timeoutFired ? `timeout (${effectiveTimeout}ms)` : 'stop'
+          log.taskStderr(
+            node,
+            `vx: ${executorLabel(args.executor)} did not return within ${graceMs}ms of the ${why}; abandoned\n`,
+          )
+          const reason: unknown = signal.reason
+          resolve({
+            exitCode: signalExitCode(reason === 'SIGINT' ? 'SIGINT' : 'SIGTERM'),
+            durationMs: Date.now() - started,
+            stdout: '',
+            stderr: '',
+            violations: [],
+            ...(timeoutFired ? { timedOut: true } : {}),
+          })
+        }, graceMs)
+      }
+      if (signal.aborted) onAbort()
+      else signal.addEventListener('abort', onAbort, { once: true })
+    })
+    // The abandoned call may still settle, or reject, later: nobody awaits it.
+    running.catch(() => {})
+    return Promise.race([running, abandoned]).finally(() => {
+      clearTimeout(graceTimer)
+      if (onAbort !== undefined) signal.removeEventListener('abort', onAbort)
+    })
+  }
 
   // When the task started, as a ns offset from run start — captured for
   // EVERY outcome (hits included) so the run-detail timeline reflects when
@@ -722,8 +768,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // no other trace. Rethrown unchanged — the scheduler still classifies it,
     // and still prints it plainly for a UserError.
     const endExec = span('miss: execute')
-    let res = await args.executor
-      .execute(req)
+    let res = await boundAfterAbort(args.executor.execute(req), req.signal)
       .then((r: unknown) => {
         assertExecuteResult(args.executor.name, node.id, r)
         return r

package/src/orchestrator/local-shortcircuit.ts

@@ -199,7 +199,6 @@ function restoreTierExclusions(nodes: Map<string, TaskNode>, workspaceRoot: stri
   if (prefixes.length === 0) return out
   const reaches = (dir: string): boolean =>
     dir === '' ||
-    dir === '.' ||
     prefixes.some((p) => p === dir || p.startsWith(`${dir}/`) || dir.startsWith(`${p}/`))
   const dependants = new Map<string, string[]>()
   for (const node of nodes.values()) {

package/src/orchestrator/metrics.ts

@@ -241,58 +241,24 @@ export function getInvocation(db: Database, runId: string): InvocationDetail | n
 
 export interface ListInvocationsArgs {
   limit?: number
-  branch?: string
-  ci?: boolean
-  tagKey?: string
-  tagValue?: string
 }
 
 /**
- * List `vx run` invocations newest-first from the `invocations` header table
- * with optional branch / ci / tag filters. Reading the dedicated header table
- * (vs the old `GROUP BY run_id` over `runs`) is lossless — git/ci/tag context
- * survives. Accepts a bare `number` for the limit (back-compat with the old
- * `listInvocations(db, 50)` signature).
+ * List `vx run` invocations newest-first from the `invocations` header table.
+ * Reading the dedicated header table (vs the old `GROUP BY run_id` over
+ * `runs`) is lossless — git/ci/tag context survives.
  */
-export function listInvocations(
-  db: Database,
-  args: ListInvocationsArgs | number = {},
-): InvocationDetail[] {
-  const opts: ListInvocationsArgs = typeof args === 'number' ? { limit: args } : args
-  const limit = clampInt(opts.limit ?? 50, 1, 500)
-  const where: string[] = []
-  const params: (string | number)[] = []
-  if (opts.branch !== undefined) {
-    where.push('branch = ?')
-    params.push(opts.branch)
-  }
-  if (opts.ci !== undefined) {
-    where.push('ci = ?')
-    params.push(opts.ci ? 1 : 0)
-  }
-  if (opts.tagKey !== undefined && opts.tagValue !== undefined) {
-    // The tags column is a JSON object {"k":"v"}; a LIKE over the serialized
-    // pair is adequate at this table's scale (see the design doc).
-    where.push('tags LIKE ?')
-    params.push(`%${jsonPairFragment(opts.tagKey, opts.tagValue)}%`)
-  }
-  const clause = where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''
+export function listInvocations(db: Database, args: ListInvocationsArgs = {}): InvocationDetail[] {
+  const limit = clampInt(args.limit ?? 50, 1, 500)
   const rows = db
     .query(
-      `SELECT ${INVOCATION_COLUMNS} FROM invocations ${clause}
+      `SELECT ${INVOCATION_COLUMNS} FROM invocations
        ORDER BY rowid DESC LIMIT ?`,
     )
-    .all(...params, limit) as InvocationRawRow[]
+    .all(limit) as InvocationRawRow[]
   return rows.map(mapInvocation)
 }
 
-/** The `"key":"value"` fragment as it appears in `JSON.stringify({k:v})`. */
-function jsonPairFragment(key: string, value: string): string {
-  const k = JSON.stringify(key).slice(1, -1)
-  const v = JSON.stringify(value).slice(1, -1)
-  return `"${k}":"${v}"`
-}
-
 export interface RunDetail {
   runId: string
   startedAt: number