@vzn/vx 0.0.95 → 0.0.96

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.95",
+  "version": "0.0.96",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.95",
-    "@vzn/vx-linux-arm64": "0.0.95",
-    "@vzn/vx-darwin-x64": "0.0.95",
-    "@vzn/vx-darwin-arm64": "0.0.95"
+    "@vzn/vx-linux-x64": "0.0.96",
+    "@vzn/vx-linux-arm64": "0.0.96",
+    "@vzn/vx-darwin-x64": "0.0.96",
+    "@vzn/vx-darwin-arm64": "0.0.96"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cache/tar-stream.ts

@@ -174,8 +174,10 @@ export async function* tarEntries(stream: ReadableStream<Uint8Array>): AsyncGene
     const size = pendingSize ?? octal(h, 124, 12)
     const mtimeMs = octal(h, 136, 12) * 1000
     const padded = Math.ceil(size / BLOCK) * BLOCK
-    const magic = field(h, 257, 6)
-    const prefix = magic.startsWith('ustar') ? field(h, 345, 155) : ''
+    // POSIX `ustar\0` only: old GNU's `ustar  ` keeps atime and ctime at
+    // 345, and `-G` fills them, so a prefix read there named every entry
+    // `<atime>…/<name>`.
+    const prefix = field(h, 257, 6) === 'ustar' ? field(h, 345, 155) : ''
     const rawName = field(h, 0, 100)
     let name = pendingPath ?? (prefix ? `${prefix}/${rawName}` : rawName)
     pendingPath = undefined

package/src/cli/show.ts

@@ -83,7 +83,7 @@ export async function showCmd(args: readonly string[]): Promise<number> {
   const bareTask = projectName !== undefined && taskName === undefined && !byName.has(projectName)
   const scope = projectName === undefined || bareTask ? 'all' : [projectName]
 
-  const projects = await loadCliProjects(root, metas, scope)
+  const projects = await loadCliProjects(root, metas, scope, { noCreate: true })
 
   if (parsed.target === undefined) {
     process.stdout.write(renderList(root, metas, projects, parsed.format))

package/src/cli/watch.ts

@@ -16,6 +16,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { xxh3 } from '../util/index.js'
 import { parseRunArgs, resolveRunOptions, type RunArgs } from './run.js'
+import { seeHelp } from './help.js'
 import {
   fingerprintClaims,
   forwardedSignal,
@@ -96,7 +97,9 @@ export async function watchCmd(args: readonly string[]): Promise<number> {
     return 1
   }
   if (parsed.tasks.length === 0) {
-    process.stderr.write(`vx watch: missing task name\n`)
+    process.stderr.write(
+      `vx watch: missing task name (vx watch <task>, e.g. vx watch build)${seeHelp('watch')}\n`,
+    )
     return 1
   }
 

package/src/cli/workspace-config.ts

@@ -88,6 +88,12 @@ export interface CliLoadOptions {
   cacheDir?: string
   /** `--frozen`: configs come from `vx-lock.json`, not evaluation. */
   frozen?: boolean
+  /**
+   * A reading verb (`vx show`) makes nothing on disk (item 900): with no
+   * cache directory yet, it evaluates without the cache rather than
+   * create one.
+   */
+  noCreate?: boolean
 }
 
 /**
@@ -113,8 +119,11 @@ export async function loadCliProjects(
   // glob could select live what the run then treats otherwise.
   const lock = opts.frozen === true ? await readLockfile(workspaceRoot) : null
   if (opts.frozen === true && lock === null) throw new UserError(FROZEN_WITHOUT_LOCK)
-  const cache = new Cache(cacheDir, { read: true, write: true }, workspaceRoot)
-  noteSchemaReset(cache, warnToStderr)
+  const cache =
+    opts.noCreate === true && !existsSync(cacheDir)
+      ? null
+      : new Cache(cacheDir, { read: true, write: true }, workspaceRoot)
+  if (cache !== null) noteSchemaReset(cache, warnToStderr)
   try {
     const loaded = await loadProjects({
       workspaceRoot,
@@ -125,15 +134,18 @@ export async function loadCliProjects(
       seeds: scope,
       closure: false,
       lock,
-      evalCache: {
-        store: cache,
-        workspaceRoot,
-        workspaceFingerprint: await computeWorkspaceFingerprint(workspaceRoot),
-      },
+      evalCache:
+        cache === null
+          ? undefined
+          : {
+              store: cache,
+              workspaceRoot,
+              workspaceFingerprint: await computeWorkspaceFingerprint(workspaceRoot),
+            },
       warn: warnToStderr,
     })
     return loaded.projects
   } finally {
-    cache.close()
+    cache?.close()
   }
 }

package/src/exec/sandbox-runtime.ts

@@ -678,15 +678,19 @@ export function resolveSandboxConfig(
     r.weakerNetworkIsolation = cfg.weakerNetworkIsolation
   }
   if (cfg.ignore !== undefined) {
-    // Relative patterns anchor at the project dir; `~` ones are taken as
-    // written. A pattern is not a path, but its literal head is: both
+    // Relative patterns anchor at the project dir, `~` ones at the home
+    // directory, as a grant's are (a `~` pattern kept as written matched no
+    // recorded path). A pattern is not a path, but its literal head is: both
     // producers record where a denial LANDS, so the head is canonicalized
     // like every other side of the policy. Anchored at a project reached
     // through a link (macOS's `/var`), no pattern matched and the denial it
     // named failed the task (B-2).
     const anchor = (pat: string): string => {
-      if (pat.startsWith('~')) return pat
-      const abs = path.isAbsolute(pat) ? pat : path.join(projectDir, pat)
+      const abs = pat.startsWith('~')
+        ? path.join(os.homedir(), pat.slice(1))
+        : path.isAbsolute(pat)
+          ? pat
+          : path.join(projectDir, pat)
       const wild = abs.search(BUN_GLOB_WILDCARDS)
       const head = wild === -1 ? abs : abs.slice(0, abs.lastIndexOf(path.sep, wild)) || path.sep
       return toRealPath(head) + abs.slice(head.length)
@@ -906,10 +910,11 @@ function ownGroupCommand(
   // the tracer attached, so one it inherited (the watcher, SRT's network
   // bridges) that exits first sent the command on untraced, and under
   // `--seccomp-bpf` its `execve` failed ENOSYS. A fresh fork has none.
-  // An async list starts with SIGINT and SIGQUIT ignored, and a shell
-  // cannot trap what it was started ignoring: SRT's bash may put them
-  // back before the `exec` (dash may not), so a task's `trap … INT` hears
-  // vx's cancellation as it does untraced.
+  // POSIX lets an async list start with SIGINT and SIGQUIT ignored, and a
+  // shell cannot trap what it was started ignoring: bash 5.2 ignores them
+  // for a backgrounded simple command (the first cut here, whose task's
+  // `trap … INT` never fired) but not for a brace group, so the `trap -`
+  // is for a bash that does; SRT's bash may put them back (dash may not).
   const tracer = [
     executablePath('strace'),
     '-DD',