@vzn/vx 0.0.98 → 0.0.100

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.98",
+  "version": "0.0.100",
   "description": "A fast, correct task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.98",
-    "@vzn/vx-linux-arm64": "0.0.98",
-    "@vzn/vx-darwin-x64": "0.0.98",
-    "@vzn/vx-darwin-arm64": "0.0.98"
+    "@vzn/vx-linux-x64": "0.0.100",
+    "@vzn/vx-linux-arm64": "0.0.100",
+    "@vzn/vx-darwin-x64": "0.0.100",
+    "@vzn/vx-darwin-arm64": "0.0.100"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/cli/show.ts

@@ -70,7 +70,12 @@ export async function showCmd(args: readonly string[]): Promise<number> {
         ? parsed.target
         : parsed.target.slice(0, hashAt)
   const taskName = hashAt === -1 ? undefined : parsed.target!.slice(hashAt + 1)
-  if (taskName === '') throw new UserError(`missing task name after '#' in "${parsed.target}"`)
+  if (taskName === '') {
+    const list = projectName === '' ? 'vx show' : `vx show ${projectName}`
+    throw new UserError(
+      `vx show: missing task name after '#' in "${parsed.target}" (${list} lists the tasks)`,
+    )
+  }
   if (projectName !== undefined && (taskName !== undefined || byName.has(projectName))) {
     if (!byName.has(projectName)) {
       throw new UserError(

package/src/cli/upgrade.ts

@@ -105,11 +105,15 @@ export function releaseAsset(release: unknown, name: string): ReleaseAsset {
       typeof a === 'object' && a !== null && (a as { name?: unknown }).name === name,
   )
   if (asset === undefined) {
-    throw new UserError(`vx upgrade: release ${tag} has no asset ${name} for this platform`)
+    throw new UserError(
+      `vx upgrade: release ${tag} has no asset ${name} for this platform — nothing replaced; npm install -g @vzn/vx@latest installs it instead`,
+    )
   }
   const url = asset.browser_download_url
   if (typeof url !== 'string' || url.length === 0) {
-    throw new UserError(`vx upgrade: release ${tag} names no download for ${name}`)
+    throw new UserError(
+      `vx upgrade: release ${tag} names no download for ${name} — nothing replaced; npm install -g @vzn/vx@latest installs it instead`,
+    )
   }
   const digest = asset.digest
   const m = typeof digest === 'string' ? /^sha256:([0-9a-f]{64})$/i.exec(digest) : null
@@ -217,13 +221,15 @@ export async function replaceBinary(
 ): Promise<void> {
   const res = await fetchOrRefuse(url, { redirect: 'follow' }, 'download the release asset')
   if (!res.ok) {
-    throw new UserError(`vx upgrade: download failed (${res.status}) — ${url}`)
+    throw new UserError(
+      `vx upgrade: download failed (${res.status}) — ${url} — nothing replaced; re-run`,
+    )
   }
   const bytes = new Uint8Array(
     await readOrRefuse(() => res.arrayBuffer(), url, 'download the release asset'),
   )
   if (bytes.byteLength === 0) {
-    throw new UserError(`vx upgrade: empty download — ${url}`)
+    throw new UserError(`vx upgrade: empty download — ${url} — nothing replaced; re-run`)
   }
   const got = new Bun.CryptoHasher('sha256').update(bytes).digest('hex')
   if (got !== sha256.toLowerCase()) {

package/src/exec/sandbox-runtime.ts

@@ -340,7 +340,18 @@ function unlinkOnExit(file: string): void {
  * that names it outright still reaches it.
  */
 function taskTmpdir(tag: string): string {
-  return path.join(sandboxTmpdir(), `vx-task-${process.pid}-${tag}`)
+  return path.join(taskTmpRoot(), `vx-task-${process.pid}-${tag}`)
+}
+
+/**
+ * The parent of every task's own temp directory, walled off from every
+ * sandboxed task, each granted its own directory inside: SRT binds its
+ * whole temp dir writable into every task, so a task listed and read what
+ * a concurrent one kept in its TMPDIR, or replaced its port bridge's
+ * socket (L-10).
+ */
+function taskTmpRoot(): string {
+  return path.join(sandboxTmpdir(), 'vx-tasks')
 }
 
 const liveTaskTmpdirs = new Set<string>()
@@ -799,6 +810,11 @@ export async function wrapSandboxedCommand(
 
   const baselines = canonicalBaselines(args)
   const customConfig = buildCustomConfig(args, baselines)
+  customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  customConfig!.filesystem!.allowWrite!.push(toRealPath(tmp))
+  // Seatbelt re-allows a read inside a denied region only by name; on Linux
+  // a read grant over a write path would remount it read-only.
+  if (process.platform === 'darwin') customConfig!.filesystem!.allowRead!.push(toRealPath(tmp))
   // Linux: the ports a list grants are bridged out of the task's network
   // namespace. The task's side of each bridge is a socat in front of the
   // user command, so it goes INTO the sandboxed command; the host side is
@@ -972,7 +988,7 @@ export function bridgedPorts(c: Pick<ResolvedSandboxConfig, 'localBinding'>): nu
 
 /** Where a bridge's unix socket lives: the sandbox tmpdir, bound read-write on both sides. */
 export function portBridgeSocket(tag: string, port: number): string {
-  return path.join(sandboxTmpdir(), `vx-port-${tag}-${port}.sock`)
+  return path.join(taskTmpdir(tag), `vx-port-${tag}-${port}.sock`)
 }
 
 /**

package/src/workspace/migration.ts

@@ -357,7 +357,13 @@ function renderConfigFile(
   if (p.importLines.length > 0) lines.push(...p.importLines)
   lines.push('', 'export default {', '  tasks: {')
   for (const t of p.tasks) {
-    for (const todo of t.todos) lines.push(`    // TODO(vx-migrate): ${todo}`)
+    // A reason can quote a manifest's own text (an Nx `env` key), and a
+    // line break there ended the comment: the rest was code in the file
+    // the next run evaluates (D-21). Each line stays inside the comment.
+    for (const todo of t.todos) {
+      const [first, ...rest] = todo.split(/\r\n|[\n\r\u2028\u2029]/)
+      lines.push(`    // TODO(vx-migrate): ${first}`, ...rest.map((l) => `    //   ${l}`))
+    }
     if (t.task === null) continue // skipped target — the TODO above explains
     // `__proto__: {…}` in a literal SETS the prototype, quoted or not, and
     // the run refused the config (item 1033); a computed key is a property.