@vzn/vx 0.0.87 → 0.0.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.87",
+  "version": "0.0.89",
   "description": "An open, extensible monorepo task runner.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.87",
-    "@vzn/vx-linux-arm64": "0.0.87",
-    "@vzn/vx-darwin-x64": "0.0.87",
-    "@vzn/vx-darwin-arm64": "0.0.87"
+    "@vzn/vx-linux-x64": "0.0.89",
+    "@vzn/vx-linux-arm64": "0.0.89",
+    "@vzn/vx-darwin-x64": "0.0.89",
+    "@vzn/vx-darwin-arm64": "0.0.89"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/cache.ts

@@ -1127,10 +1127,35 @@ export class Cache implements CacheLayer {
    */
   async ingest(hash: string, body: Blob | Response, meta: IngestMeta): Promise<void> {
     const tmpPath = this.tempPath(hash)
+    // The compressed bytes are bounded too, before the decode's ceiling ever
+    // sees them: a remote body that never ends (a hostile or broken server)
+    // was written to the temp until the disk was full (L-5). No artifact
+    // under the ceiling compresses past zstd's own bound on it.
+    const cap = this.artifactCeiling + (this.artifactCeiling >> 8) + 64 * 1024
+    const past = (): CorruptArtifactError =>
+      new CorruptArtifactError(
+        hash,
+        `remote body runs past ${cap} bytes (the artifact ceiling's bound)`,
+      )
     try {
-      // Split only for the typings: Bun.write's Response and Blob overloads
-      // do not accept their union.
-      await (body instanceof Response ? Bun.write(tmpPath, body) : Bun.write(tmpPath, body))
+      if (body instanceof Blob) {
+        if (body.size > cap) throw past()
+        await Bun.write(tmpPath, body)
+      } else if (Number(body.headers.get('content-length') ?? 0) > cap) {
+        throw past()
+      } else {
+        let n = 0
+        const counted = body.body?.pipeThrough(
+          new TransformStream<Uint8Array, Uint8Array>({
+            transform(chunk, controller) {
+              n += chunk.byteLength
+              if (n > cap) controller.error(past())
+              else controller.enqueue(chunk)
+            },
+          }),
+        )
+        await Bun.write(tmpPath, new Response(counted ?? null))
+      }
     } catch (err) {
       await unlink(tmpPath).catch(() => undefined)
       throw err

package/src/cli/select.ts

@@ -353,7 +353,9 @@ export async function pickTask(
     }
   }
   if (entries.length === 0) {
-    process.stderr.write(`vx run: no tasks declared in any project\n`)
+    process.stderr.write(
+      'vx run: no tasks declared in any project; declare one under `tasks` in a vx.config, or run `vx init` to write them from package.json scripts\n',
+    )
     return null
   }
   const out = io.output ?? process.stdout

package/src/cli/why.ts

@@ -181,7 +181,9 @@ export async function whyCmd(args: readonly string[]): Promise<number> {
 
     const why = whyDidThisRerun(db, runId, taskId)
     if (!why.found) {
-      throw new UserError(`vx why: run ${runId} has no row for ${taskId}`)
+      throw new UserError(
+        `vx why: run ${runId} has no row for ${taskId}; \`vx last --list\` shows the recorded runs, \`vx last <runId>\` what one ran`,
+      )
     }
     const diff = cacheKeyDiff(db, runId, taskId)
 

package/src/exec/sandbox-runtime.ts

@@ -538,6 +538,8 @@ export interface ResolvedSandboxConfig {
   gitConfig?: boolean
   weakerWhenNested?: boolean
   weakerNetworkIsolation?: boolean
+  /** macOS: the walls a glob grant reaches, by kind (`darwinWallRules`). */
+  wallsReached?: { read: readonly string[]; write: readonly string[] }
   ignore?: {
     read?: readonly string[]
     write?: readonly string[]
@@ -645,6 +647,11 @@ export function resolveSandboxConfig(
       walls,
     ),
   }
+  if (process.platform === 'darwin') {
+    const read = wallsGlobsReach(r.allowRead, walls)
+    const write = wallsGlobsReach(r.allowWrite, walls)
+    if (read.length + write.length > 0) r.wallsReached = { read, write }
+  }
   if (a.network !== undefined) r.network = a.network
   if (cfg.deny?.network !== undefined) r.denyNetwork = cfg.deny.network
   if (a.systemInfo !== undefined) r.systemInfo = a.systemInfo
@@ -788,7 +795,10 @@ export async function wrapSandboxedCommand(
     ports.length > 0 ? `${portBridgeInner(ports, tag)} ${grouped.command}` : grouped.command
   let wrapped = await SandboxManager.wrapWithSandbox(inner, undefined, customConfig)
   if (process.platform === 'darwin') {
-    const rules = macProfileRules(args.config)
+    const rules = [
+      ...macProfileRules(args.config),
+      ...darwinWallRules(args.config, baselines.allowRead),
+    ]
     if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
   }
   // Linux: the shell execs bwrap, so bwrap is the spawn itself and its
@@ -1528,7 +1538,54 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
  * that broke it learned so from its OWN tool. Measured, one task per
  * spelling, each writing files it declares:
  *
- *   write: ['g/**']         ok — collapsed to the directory
+ *   write: ['g/**
+ * The walls a glob grant can reach: each one under (or at) a glob's
+ * literal head. On Linux `expandGrants` drops such a hit before the bind
+ * (B-1); seatbelt matches a glob as a path regex, with no hit to drop.
+ */
+function wallsGlobsReach(grants: readonly string[], walls: readonly string[]): string[] {
+  const heads = grants
+    .filter((g) => !isMountableLiteral(g))
+    .map((g) => path.dirname(g.slice(0, g.search(MOUNT_WILDCARDS))))
+  return walls.filter((w) =>
+    heads.some((h) => w === h || w.startsWith(h === path.sep ? h : h + path.sep)),
+  )
+}
+
+/**
+ * macOS: the walls a glob grant reaches, denied at the profile's tail
+ * (SBPL is last-match-wins). SRT re-emits a wall's deny after the allows
+ * only under a LITERAL allow, so a root project's `read: ['**\/*.ts']`
+ * read nested projects' sources its key excludes — item 1010's stale hit,
+ * by glob, on darwin (B-12). A literal grant at or inside the wall, the
+ * task's or a baseline's (a linked dependency), is carved out: on Linux
+ * too it binds. Reads deny the data, not the metadata, as SRT's own wall
+ * denies do: a walk may still stat the directory.
+ */
+export function darwinWallRules(
+  c: Pick<ResolvedSandboxConfig, 'wallsReached' | 'allowRead' | 'allowWrite'>,
+  baseAllowRead: readonly string[],
+): string[] {
+  const rules: string[] = []
+  const deny = (op: string, walls: readonly string[], literals: readonly string[]): void => {
+    for (const w of walls) {
+      const at = `(subpath "${sbplResolvedPath(w, 'wall')}")`
+      const kept = literals
+        .filter((l) => isMountableLiteral(l) && (l === w || l.startsWith(w + path.sep)))
+        .map((l) => `(require-not (subpath "${sbplResolvedPath(l, 'grant')}"))`)
+      rules.push(
+        kept.length === 0
+          ? `(deny ${op} ${at})`
+          : `(deny ${op} (require-all ${at} ${kept.join(' ')}))`,
+      )
+    }
+  }
+  deny('file-read-data', c.wallsReached?.read ?? [], [...c.allowRead, ...baseAllowRead])
+  deny('file-write*', c.wallsReached?.write ?? [], c.allowWrite)
+  return rules
+}
+
+/**']         ok — collapsed to the directory
  *   write: ['g/a.txt']      ok — a literal is widened to its directory
  *   write: ['g/*']          FAILED: `bash: g/a.txt: Read-only file system`
  *   write: ['g/*.txt']      FAILED, same

package/src/workspace/migrate-scripts.ts

@@ -140,13 +140,16 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
     if (runnable.length === 0) continue
     const hasBuild = names.includes('build')
     const has = (n: string): boolean => names.includes(n)
+    // Lifecycle hooks are npm's, not tasks anyone runs by name, and a hook
+    // of a script that exists rides inside that script's command.
+    const isTask = (n: string): boolean => {
+      if (!has(n) || LIFECYCLE.test(n)) return false
+      const hookOf = /^(pre|post)(.+)$/.exec(n)
+      return hookOf === null || !has(hookOf[2]!) || LIFECYCLE.test(hookOf[2]!)
+    }
     const tasks: GeneratedTask[] = []
     for (const name of names) {
-      // Lifecycle hooks are npm's, not tasks anyone runs by name.
-      if (LIFECYCLE.test(name)) continue
-      // A hook of a script that exists rides inside that script's command.
-      const hookOf = /^(pre|post)(.+)$/.exec(name)
-      if (hookOf !== null && has(hookOf[2]!) && !LIFECYCLE.test(hookOf[2]!)) continue
+      if (!isTask(name)) continue
 
       const todos: string[] = []
       const own = scripts[name] as string
@@ -155,7 +158,10 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
       // package manager and never ride inside a task — `pack` stays alone.
       const hook = (h: string): boolean => has(h) && !LIFECYCLE.test(h)
       const hooks = [`pre${name}`, `post${name}`].filter(hook)
-      if (delegate !== null && has(delegate) && delegate !== name && hooks.length === 0) {
+      // A group over a script that is no task (`setup: npm run prepare`)
+      // named a task nothing defines, and the run `vx init` suggested
+      // refused the config (D-12).
+      if (delegate !== null && isTask(delegate) && delegate !== name && hooks.length === 0) {
         // A group: no exec, the graph runs the target. `npm test` calling
         // `vitest` through `npm run test:unit` is two tasks, not a subprocess.
         const task: Record<string, unknown> = { dependsOn: [delegate] }