@depup/nx 23.1.2-depup.1 → 23.2.0-depup.0

package/dist/src/plugins/js/lock-file/utils/pnpm-normalizer.d.ts

@@ -14,6 +14,7 @@ export declare function loadPnpmHoistedDepsDefinition(): any;
  * Parsing and mapping logic from pnpm lockfile `read` function
  */
 export declare function parseAndNormalizePnpmLockfile(content: string): Lockfile;
+export declare function extractMainLockfileDocument(content: string): string;
 /**
  * Mapping and writing logic from pnpm lockfile `write` function
  */

package/dist/src/plugins/js/lock-file/utils/pnpm-normalizer.js

@@ -8,6 +8,7 @@ exports.isV5Syntax = isV5Syntax;
 exports.usesLeadingDash = usesLeadingDash;
 exports.loadPnpmHoistedDepsDefinition = loadPnpmHoistedDepsDefinition;
 exports.parseAndNormalizePnpmLockfile = parseAndNormalizePnpmLockfile;
+exports.extractMainLockfileDocument = extractMainLockfileDocument;
 exports.stringifyToPnpmYaml = stringifyToPnpmYaml;
 const node_fs_1 = require("node:fs");
 const semver_1 = require("semver");
@@ -48,10 +49,11 @@ function parseAndNormalizePnpmLockfile(content) {
 // https://github.com/pnpm/pnpm/blob/main/lockfile/fs/src/yamlDocuments.ts
 const YAML_DOCUMENT_START = '---\n';
 const YAML_DOCUMENT_SEPARATOR = '\n---\n';
-// pnpm 11 writes a two-document lockfile when `managePackageManagerVersions` is
-// enabled: the first document holds package-manager metadata, and the second
-// holds the workspace lockfile. Mirror pnpm's own positional extraction so we
-// always read the workspace document.
+// pnpm 11 writes a two-document lockfile when `shouldPersistLockfile` holds
+// (the package manager came from `devEngines`, or declares major 12 or above):
+// the first document holds package-manager metadata, and the second holds the
+// workspace lockfile. Mirror pnpm's own positional extraction so we always read
+// the workspace document.
 // https://github.com/pnpm/pnpm/blob/main/lockfile/fs/src/yamlDocuments.ts
 function extractMainLockfileDocument(content) {
     // Lockfiles written on Windows may use CRLF line endings, which would never
@@ -667,7 +669,6 @@ function normalizeLockfile(lockfile, opts) {
     if (!lockfileToSave.pnpmfileChecksum) {
         delete lockfileToSave.pnpmfileChecksum;
     }
-    delete lockfileToSave['catalogs'];
     return lockfileToSave;
 }
 const ROOT_KEYS = [

package/dist/src/plugins/js/utils/register.d.ts

@@ -23,6 +23,17 @@ import type { CompilerOptions } from 'typescript';
  * Throws if neither `@swc-node/register` nor `ts-node` is installed.
  */
 export declare function forceRegisterEsmLoader(): void;
+/**
+ * Effective `TS_NODE_COMPILER_OPTIONS` value for `ts-node/esm`. CommonJS emit
+ * can never work for the true-ESM loads the loader exists for (`import.meta`
+ * fails with TS1343), and CommonJS-format files are deferred to the `require`
+ * pipeline untouched, so `module`/`moduleResolution` are forced to `nodenext`
+ * over any inherited value. Values that are not a JSON object pass through
+ * unchanged for ts-node to handle.
+ *
+ * Exported so the merge semantics can be exercised directly in unit tests.
+ */
+export declare function resolveTsNodeEsmCompilerOptions(raw: string | undefined): string;
 /**
  * Source of a minimal ESM resolution hook that rewrites TypeScript NodeNext
  * `.js`/`.mjs`/`.cjs` relative specifiers to their `.ts`/`.mts`/`.cts` sources.

package/dist/src/plugins/js/utils/register.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NODENEXT_ESM_RESOLVER_SOURCE = void 0;
 exports.forceRegisterEsmLoader = forceRegisterEsmLoader;
+exports.resolveTsNodeEsmCompilerOptions = resolveTsNodeEsmCompilerOptions;
 exports.nodeNextEsmResolveHook = nodeNextEsmResolveHook;
 exports.ensureNodeNextEsmResolverRegistered = ensureNodeNextEsmResolverRegistered;
 exports.ensureCjsResolverPatched = ensureCjsResolverPatched;
@@ -65,12 +66,6 @@ function ensureEsmLoaderRegistered(opts) {
         }
         return;
     }
-    // ts-node reads compilerOptions from this env var. Setting nodenext
-    // module/resolution avoids surprises when ts-node is the chosen loader.
-    process.env.TS_NODE_COMPILER_OPTIONS ??= JSON.stringify({
-        moduleResolution: 'nodenext',
-        module: 'nodenext',
-    });
     // Prefer @swc-node/register/esm (faster) over ts-node/esm.
     const swcEsm = tryResolveLoader('@swc-node/register/esm');
     const tsNodeEsm = tryResolveLoader('ts-node/esm');
@@ -87,9 +82,48 @@ function ensureEsmLoaderRegistered(opts) {
         logger_1.logger.warn((0, logger_1.stripIndent)(`${logger_1.NX_PREFIX} Registering ESM TypeScript loader ${loaderName}. All subsequent ESM imports in this process will go through it - native Node.js TypeScript stripping is forfeited for the dynamic-import path.`));
     }
     const url = require('node:url');
+    if (!swcEsm) {
+        // ts-node/esm reads TS_NODE_COMPILER_OPTIONS from its hooks thread, which
+        // snapshots process.env only when the first hook in the process registers,
+        // possibly long before this call. A registered setter module runs on the
+        // hooks thread itself, so the value lands there without mutating this
+        // process's env (which an existing hooks thread would never see, and
+        // child processes would inherit).
+        module.register('data:text/javascript,' +
+            encodeURIComponent(`process.env.TS_NODE_COMPILER_OPTIONS = ${JSON.stringify(resolveTsNodeEsmCompilerOptions(process.env.TS_NODE_COMPILER_OPTIONS))};`));
+    }
     module.register(url.pathToFileURL(loaderPath));
     isTsEsmLoaderRegistered = true;
 }
+/**
+ * Effective `TS_NODE_COMPILER_OPTIONS` value for `ts-node/esm`. CommonJS emit
+ * can never work for the true-ESM loads the loader exists for (`import.meta`
+ * fails with TS1343), and CommonJS-format files are deferred to the `require`
+ * pipeline untouched, so `module`/`moduleResolution` are forced to `nodenext`
+ * over any inherited value. Values that are not a JSON object pass through
+ * unchanged for ts-node to handle.
+ *
+ * Exported so the merge semantics can be exercised directly in unit tests.
+ */
+function resolveTsNodeEsmCompilerOptions(raw) {
+    if (raw === undefined) {
+        return JSON.stringify({ moduleResolution: 'nodenext', module: 'nodenext' });
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            !Array.isArray(parsed)) {
+            return JSON.stringify({
+                ...parsed,
+                module: 'nodenext',
+                moduleResolution: 'nodenext',
+            });
+        }
+    }
+    catch { }
+    return raw;
+}
 /**
  * Source of a minimal ESM resolution hook that rewrites TypeScript NodeNext
  * `.js`/`.mjs`/`.cjs` relative specifiers to their `.ts`/`.mts`/`.cts` sources.

package/dist/src/project-graph/plugins/get-plugins.d.ts

@@ -1,9 +1,27 @@
-import { NxJsonConfiguration } from '../../config/nx-json';
+import { NxJsonConfiguration, PluginConfiguration } from '../../config/nx-json';
 import type { LoadedNxPlugin } from './loaded-nx-plugin';
 export interface SeparatedPlugins {
     specifiedPlugins: LoadedNxPlugin[];
     defaultPlugins: LoadedNxPlugin[];
 }
+/** Exported for tests: the fallback latch is process-scoped by design. */
+export declare function resetIsolationFallbackForTesting(): void;
+/**
+ * Loads a plugin in a worker, falling back to this process when the worker's
+ * socket was refused.
+ *
+ * Isolation is preferred: it is what keeps two plugins with conflicting
+ * TypeScript versions or module-level state apart. But a sandbox that has not
+ * been told about the Nx socket root refuses the worker's socket, and failing
+ * the whole command over that is worse than running the plugins here. The
+ * fallback is narrow on purpose. It needs a failure to start or reach the
+ * worker, plus either a detectable sandbox or the worker's own EPERM/EACCES
+ * exit code under an AI agent — the second arm is what covers an agent whose
+ * sandbox sets no variable `isSandbox()` reads. A plugin that loaded and then
+ * threw is rethrown, because rerunning it in-process would bury its actual
+ * error.
+ */
+export declare const loadingMethod: (plugin: PluginConfiguration, root: string, index?: number) => Promise<readonly [Promise<LoadedNxPlugin>, () => void]>;
 /**
  * Returns all plugins (specified + default) as a flat list.
  * Specified plugins come first, followed by default plugins.
@@ -21,5 +39,13 @@ export declare function getPlugins(nxJson: NxJsonConfiguration, root?: string):
  */
 export declare function getPluginsSeparated(nxJson: NxJsonConfiguration, root?: string): Promise<SeparatedPlugins>;
 export declare function getOnlyDefaultPlugins(root?: string): Promise<LoadedNxPlugin[]>;
+/**
+ * The plugins from an in-flight load (whose workers may already be forked) or
+ * the last committed one, without triggering a load. Undefined when neither
+ * exists or plugins were cleaned up. After a plugins-config change the
+ * committed set can be the previous, already-disposed one until the new load
+ * commits, so callers must tolerate a disposed worker.
+ */
+export declare function getPluginsIfLoadedOrLoading(): Promise<LoadedNxPlugin[]> | undefined;
 export declare function cleanupPlugins(): void;
 export declare function reasonToError(reason: unknown): Error;

package/dist/src/project-graph/plugins/get-plugins.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadingMethod = void 0;
+exports.resetIsolationFallbackForTesting = resetIsolationFallbackForTesting;
 exports.getPlugins = getPlugins;
 exports.getPluginsSeparated = getPluginsSeparated;
 exports.getOnlyDefaultPlugins = getOnlyDefaultPlugins;
+exports.getPluginsIfLoadedOrLoading = getPluginsIfLoadedOrLoading;
 exports.cleanupPlugins = cleanupPlugins;
 exports.reasonToError = reasonToError;
 const node_path_1 = require("node:path");
@@ -13,6 +16,11 @@ const in_process_loader_1 = require("./in-process-loader");
 const isolation_1 = require("./isolation");
 const resolve_plugin_1 = require("./resolve-plugin");
 const enabled_1 = require("./isolation/enabled");
+const isolated_plugin_1 = require("./isolation/isolated-plugin");
+const sandbox_socket_hint_1 = require("../../daemon/sandbox-socket-hint");
+const is_sandbox_1 = require("../../utils/is-sandbox");
+const native_1 = require("../../native");
+const output_1 = require("../../utils/output");
 const transpiler_1 = require("./transpiler");
 /**
  * Stuff for specified NX Plugins.
@@ -28,9 +36,90 @@ let cleanupSpecifiedPlugins;
 // it's still the registered load when it finishes, so a slow older load can't
 // clobber a newer one's result (two recomputes can overlap).
 let pendingSeparatedPlugins;
-const loadingMethod = (plugin, root, index) => (0, enabled_1.isIsolationEnabled)()
-    ? (0, isolation_1.loadIsolatedNxPlugin)(plugin, root, index)
-    : (0, in_process_loader_1.loadNxPlugin)(plugin, root, index);
+/**
+ * Set once a worker has been refused in this process, and read by every later
+ * plugin: nothing about a second attempt can succeed once the first has been
+ * refused for a reason that belongs to the sandbox.
+ *
+ * It does not stop the spawns of the plugins already in flight. Callers load
+ * plugins concurrently, so all of them are past the entry check before the
+ * first worker dies; what the latch guarantees is that the advice is printed
+ * once rather than once per plugin, and that anything loaded after the refusal
+ * skips the worker entirely.
+ *
+ * Process-scoped rather than persisted: the refusal describes the environment
+ * Nx is running in, so it must not follow the workspace into a plain terminal.
+ */
+let isolationRefusedInThisProcess = false;
+/** Exported for tests: the fallback latch is process-scoped by design. */
+function resetIsolationFallbackForTesting() {
+    isolationRefusedInThisProcess = false;
+}
+/**
+ * Loads a plugin in a worker, falling back to this process when the worker's
+ * socket was refused.
+ *
+ * Isolation is preferred: it is what keeps two plugins with conflicting
+ * TypeScript versions or module-level state apart. But a sandbox that has not
+ * been told about the Nx socket root refuses the worker's socket, and failing
+ * the whole command over that is worse than running the plugins here. The
+ * fallback is narrow on purpose. It needs a failure to start or reach the
+ * worker, plus either a detectable sandbox or the worker's own EPERM/EACCES
+ * exit code under an AI agent — the second arm is what covers an agent whose
+ * sandbox sets no variable `isSandbox()` reads. A plugin that loaded and then
+ * threw is rethrown, because rerunning it in-process would bury its actual
+ * error.
+ */
+const loadingMethod = async (plugin, root, index) => {
+    if (!(0, enabled_1.isIsolationEnabled)() || isolationRefusedInThisProcess) {
+        return (0, in_process_loader_1.loadNxPlugin)(plugin, root, index);
+    }
+    const [isolatedPlugin, cleanup] = await (0, isolation_1.loadIsolatedNxPlugin)(plugin, root, index);
+    // Awaited here rather than handed on, because the worker failure surfaces on
+    // this promise and the fallback has to happen before the caller sees it.
+    try {
+        return [Promise.resolve(await isolatedPlugin), cleanup];
+    }
+    catch (e) {
+        // Proof, kept separate from policy. The errno the worker saw is what makes
+        // the message certain; whether that errno is also grounds for degrading is a
+        // different question, and conflating them made the warning assert a sandbox
+        // for agents the hint itself declines to name.
+        const provenRefusal = (0, isolated_plugin_1.isPluginWorkerSocketRefusal)(e);
+        // An agent is required alongside the errno, so a refusal on an ordinary
+        // workstation still surfaces rather than silently losing isolation.
+        if (!(0, isolated_plugin_1.isPluginWorkerStartupFailure)(e) ||
+            !((provenRefusal && (0, native_1.isAiAgent)()) || (0, is_sandbox_1.isSandbox)())) {
+            throw e;
+        }
+        cleanup();
+        // Read and set in one synchronous step. Concurrently loaded plugins each
+        // arrive here with their own failure, so testing the latch after setting it
+        // is what keeps the advice to one copy.
+        const alreadyRefused = isolationRefusedInThisProcess;
+        isolationRefusedInThisProcess = true;
+        if (!alreadyRefused) {
+            output_1.output.warn({
+                // Names what Nx observed, not what it infers. `isAiAgent()` is broader
+                // than the agents `sandboxSpecificRemedy` will name a setting for, so a
+                // title asserting a sandbox could sit above a body that deliberately
+                // does not.
+                title: provenRefusal
+                    ? 'Nx was denied permission to create a plugin worker socket. Running plugins in the main process instead.'
+                    : 'Could not start a plugin worker. Running plugins in the main process instead.',
+                bodyLines: [
+                    'Plugins that expect isolation may misbehave, and this is slower than a worker.',
+                    // `certain` on the errno alone. Reaching here via `isSandbox()` proves
+                    // only that a worker died before it connected, which denied permission
+                    // explains but so does an OOM kill or a broken install.
+                    ...(0, sandbox_socket_hint_1.sandboxSocketHint)({ certain: provenRefusal }),
+                ],
+            });
+        }
+        return (0, in_process_loader_1.loadNxPlugin)(plugin, root, index);
+    }
+};
+exports.loadingMethod = loadingMethod;
 /**
  * Returns all plugins (specified + default) as a flat list.
  * Specified plugins come first, followed by default plugins.
@@ -146,6 +235,22 @@ async function getOnlyDefaultPlugins(root = workspace_root_1.workspaceRoot) {
     loadedDefaultPluginsHash = hash;
     return result;
 }
+/**
+ * The plugins from an in-flight load (whose workers may already be forked) or
+ * the last committed one, without triggering a load. Undefined when neither
+ * exists or plugins were cleaned up. After a plugins-config change the
+ * committed set can be the previous, already-disposed one until the new load
+ * commits, so callers must tolerate a disposed worker.
+ */
+function getPluginsIfLoadedOrLoading() {
+    const separated = pendingSeparatedPlugins
+        ? pendingSeparatedPlugins.promise
+        : cachedSeparatedPlugins;
+    if (!separated) {
+        return undefined;
+    }
+    return Promise.resolve(separated).then(({ specifiedPlugins, defaultPlugins }) => specifiedPlugins.concat(defaultPlugins));
+}
 function cleanupPlugins() {
     cleanupSpecifiedPlugins?.();
     cleanupDefaultPlugins?.();
@@ -165,7 +270,7 @@ async function loadDefaultNxPlugins(root = workspace_root_1.workspaceRoot) {
     const cleanupFunctions = [];
     const results = await Promise.allSettled(plugins.map(async (plugin) => {
         performance.mark(`Load Nx Plugin: ${plugin} - start`);
-        const [loadedPluginPromise, cleanup] = await loadingMethod(plugin, root);
+        const [loadedPluginPromise, cleanup] = await (0, exports.loadingMethod)(plugin, root);
         cleanupFunctions.push(cleanup);
         const res = await loadedPluginPromise;
         performance.mark(`Load Nx Plugin: ${plugin} - end`);
@@ -226,7 +331,7 @@ async function loadSpecifiedNxPlugins(pluginsConfigurations, root = workspace_ro
     const results = await Promise.allSettled(pluginsConfigurations.map(async (plugin, index) => {
         const pluginPath = typeof plugin === 'string' ? plugin : plugin.plugin;
         performance.mark(`Load Nx Plugin: ${pluginPath} - start`);
-        const [loadedPluginPromise, cleanup] = await loadingMethod(plugin, root, index);
+        const [loadedPluginPromise, cleanup] = await (0, exports.loadingMethod)(plugin, root, index);
         cleanupFunctions.push(cleanup);
         const res = await loadedPluginPromise;
         performance.mark(`Load Nx Plugin: ${pluginPath} - end`);

package/dist/src/project-graph/plugins/isolation/enabled.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isIsolationEnabled = isIsolationEnabled;
 const native_1 = require("../../../native");
-const is_sandbox_1 = require("../../../utils/is-sandbox");
 function isIsolationEnabled() {
     // Explicitly enabled, regardless of further conditions
     if (process.env.NX_ISOLATE_PLUGINS === 'true') {
@@ -12,9 +11,7 @@ function isIsolationEnabled() {
     // Explicitly disabled
     process.env.NX_ISOLATE_PLUGINS === 'false' ||
         // Isolation is disabled on WASM builds currently.
-        native_1.IS_WASM ||
-        // Isolation is disabled in sandbox environments (AI agents, etc.)
-        (0, is_sandbox_1.isSandbox)()) {
+        native_1.IS_WASM) {
         return false;
     }
     // Default value

package/dist/src/project-graph/plugins/isolation/isolated-plugin.d.ts

@@ -61,3 +61,19 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     private registerProcessMetrics;
 }
 export declare function getPluginWorkerSocketId(): string;
+/**
+ * Marks a failure to *start or reach* a worker, as distinct from a plugin that
+ * loaded and then threw. Only the former can be retried in-process: swallowing
+ * the latter would rerun a plugin that already failed on its own merits and
+ * bury the real error.
+ */
+export declare const PLUGIN_WORKER_STARTUP_FAILURE: unique symbol;
+/**
+ * Set when the worker exited with the socket-refused code. Narrower than
+ * {@link PLUGIN_WORKER_STARTUP_FAILURE}, which covers every way a worker can
+ * fail to come up, and is what lets the caller degrade on a refusal without
+ * also degrading for an OOM kill or a broken install.
+ */
+export declare const PLUGIN_WORKER_SOCKET_REFUSED: unique symbol;
+export declare function isPluginWorkerStartupFailure(error: unknown): boolean;
+export declare function isPluginWorkerSocketRefusal(error: unknown): boolean;

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -1,16 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IsolatedPlugin = void 0;
+exports.PLUGIN_WORKER_SOCKET_REFUSED = exports.PLUGIN_WORKER_STARTUP_FAILURE = exports.IsolatedPlugin = void 0;
 exports.getPluginWorkerSocketId = getPluginWorkerSocketId;
+exports.isPluginWorkerStartupFailure = isPluginWorkerStartupFailure;
+exports.isPluginWorkerSocketRefusal = isPluginWorkerSocketRefusal;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const net_1 = require("net");
 const path = require("path");
 const logger_1 = require("../../../daemon/logger");
+const sandbox_socket_hint_1 = require("../../../daemon/sandbox-socket-hint");
+const socket_refused_exit_code_1 = require("../../../utils/socket-refused-exit-code");
 const socket_utils_1 = require("../../../daemon/socket-utils");
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
 const typescript_1 = require("../../../plugins/js/utils/typescript");
 const installation_directory_1 = require("../../../utils/installation-directory");
+const is_sandbox_1 = require("../../../utils/is-sandbox");
 const logger_2 = require("../../../utils/logger");
 const progress_topics_1 = require("../../../utils/progress-topics");
 const wait_for_socket_connection_1 = require("../../../utils/wait-for-socket-connection");
@@ -53,7 +58,17 @@ class IsolatedPlugin {
         this.responseHandlers = new Map();
         this.exitHandler = null;
         this.handleSocketData = (raw) => {
-            const message = (0, consume_messages_from_socket_1.parseMessage)(raw);
+            let message;
+            try {
+                message = (0, consume_messages_from_socket_1.parseMessage)(raw);
+            }
+            catch (e) {
+                // Runs inside a synchronous socket 'data' callback, so a throw here
+                // becomes an uncaughtException in the host process rather than a failed
+                // plugin call.
+                logger_2.logger.error(`[plugin-client] "${this.name}" sent a message that could not be parsed: ${e instanceof Error ? e.message : e}\nReceived: ${(0, consume_messages_from_socket_1.describeMessage)(raw)}`);
+                return;
+            }
             if ((0, messaging_1.isPluginWorkerNotification)(message)) {
                 handlePluginWorkerNotification(message);
                 return;
@@ -95,7 +110,13 @@ class IsolatedPlugin {
             this.responseHandlers.clear();
         };
         worker.on('exit', this.exitHandler);
-        socket.on('data', (0, consume_messages_from_socket_1.consumeMessagesFromSocket)(this.handleSocketData));
+        socket.on('data', (0, consume_messages_from_socket_1.consumeMessagesFromSocket)(this.handleSocketData, (err) => {
+            // Nothing else settles the pending hook promises on a framing
+            // failure, so surface it the same way a dead worker would.
+            this.exitHandler?.();
+            socket.destroy();
+            console.error(err.message);
+        }));
         return this.sendLoadMessage();
     }
     /**
@@ -351,11 +372,7 @@ async function startPluginWorker(name) {
         ...process.env,
         ...(isWorkerTypescript
             ? {
-                TS_NODE_PROJECT: path.join(__dirname, '../../../../tsconfig.lib.json'),
-                TS_NODE_COMPILER_OPTIONS: JSON.stringify({
-                    moduleResolution: 'node',
-                    module: 'commonjs',
-                }),
+                SWC_NODE_PROJECT: path.join(__dirname, '../../../../tsconfig.lib.json'),
             }
             : {}),
     };
@@ -371,7 +388,9 @@ async function startPluginWorker(name) {
         // Spawn the worker with the same resolve conditions Nx uses for plugin
         // entries so the plugin's transitive workspace imports resolve to source.
         ...(0, typescript_1.getPluginResolveConditionNodeArgs)(),
-        ...(isWorkerTypescript ? ['--require', 'ts-node/register'] : []),
+        // swc transpiles without type-checking: ~7x faster to boot, and this is
+        // paid once per worker spawn.
+        ...(isWorkerTypescript ? ['--require', '@swc-node/register'] : []),
         workerPath,
         ipcPath,
         name,
@@ -413,7 +432,19 @@ async function connectToWorker(worker, ipcPath, name) {
     // rather than burning through attempts against a dead socket.
     worker.once('exit', (code) => {
         if (!abortController.signal.aborted) {
-            earlyExitError = new Error(`Plugin worker for "${name}" exited with code ${code} before the connection was established.`);
+            // The worker sets this code only after an EPERM/EACCES on its own bind,
+            // so it is proof of a refusal rather than an inference from the
+            // environment — the only evidence available under an agent whose sandbox
+            // sets no variable `isSandbox()` reads.
+            const refused = code === socket_refused_exit_code_1.SOCKET_REFUSED_EXIT_CODE;
+            earlyExitError = markWorkerStartupFailure(new Error([
+                `Plugin worker for "${name}" exited with code ${code} before the connection was established.`,
+                // The worker's own stderr may be lost with the process, so the
+                // cause and the fix are repeated here.
+                ...(refused || (0, is_sandbox_1.isSandbox)()
+                    ? (0, sandbox_socket_hint_1.sandboxSocketHint)({ certain: refused })
+                    : []),
+            ].join('\n')), refused);
             abortController.abort();
         }
     });
@@ -429,7 +460,34 @@ async function connectToWorker(worker, ipcPath, name) {
     if (earlyExitError) {
         throw earlyExitError;
     }
-    throw new Error(`Failed to start plugin worker for plugin ${name}`);
+    throw markWorkerStartupFailure(new Error(`Failed to start plugin worker for plugin ${name}`));
+}
+/**
+ * Marks a failure to *start or reach* a worker, as distinct from a plugin that
+ * loaded and then threw. Only the former can be retried in-process: swallowing
+ * the latter would rerun a plugin that already failed on its own merits and
+ * bury the real error.
+ */
+exports.PLUGIN_WORKER_STARTUP_FAILURE = Symbol.for('nx.pluginWorkerStartupFailure');
+/**
+ * Set when the worker exited with the socket-refused code. Narrower than
+ * {@link PLUGIN_WORKER_STARTUP_FAILURE}, which covers every way a worker can
+ * fail to come up, and is what lets the caller degrade on a refusal without
+ * also degrading for an OOM kill or a broken install.
+ */
+exports.PLUGIN_WORKER_SOCKET_REFUSED = Symbol.for('nx.pluginWorkerSocketRefused');
+function markWorkerStartupFailure(error, refused = false) {
+    error[exports.PLUGIN_WORKER_STARTUP_FAILURE] = true;
+    if (refused) {
+        error[exports.PLUGIN_WORKER_SOCKET_REFUSED] = true;
+    }
+    return error;
+}
+function isPluginWorkerStartupFailure(error) {
+    return Boolean(error?.[exports.PLUGIN_WORKER_STARTUP_FAILURE]);
+}
+function isPluginWorkerSocketRefusal(error) {
+    return Boolean(error?.[exports.PLUGIN_WORKER_SOCKET_REFUSED]);
 }
 function getTypeName(u) {
     if (u === null)

package/dist/src/project-graph/plugins/isolation/messaging.js

@@ -6,7 +6,6 @@ exports.isPluginWorkerResult = isPluginWorkerResult;
 exports.consumeMessage = consumeMessage;
 exports.sendMessageOverSocket = sendMessageOverSocket;
 const socket_utils_1 = require("../../../daemon/socket-utils");
-const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
 const workspace_root_1 = require("../../../utils/workspace-root");
 const NOTIFICATION_TYPES = [
     'emitLog',
@@ -84,6 +83,5 @@ async function consumeMessage(socket, raw, handlers) {
 function sendMessageOverSocket(socket, message) {
     // Stamped here rather than in each constructor, mirroring the daemon.
     message.workspaceRoot = workspace_root_1.workspaceRoot;
-    socket.write((0, socket_utils_1.serialize)(message));
-    socket.write(consume_messages_from_socket_1.MESSAGE_END_SEQ);
+    (0, socket_utils_1.sendMessage)(socket, message);
 }

package/dist/src/project-graph/plugins/isolation/plugin-worker.js

@@ -14,6 +14,10 @@ const fs_1 = require("fs");
 const net_1 = require("net");
 const analytics_1 = require("../../../analytics");
 const daemon_environment_1 = require("../../../daemon/client/daemon-environment");
+const sandbox_socket_hint_1 = require("../../../daemon/sandbox-socket-hint");
+const permission_errors_1 = require("../../../utils/permission-errors");
+const socket_refused_exit_code_1 = require("../../../utils/socket-refused-exit-code");
+const is_sandbox_1 = require("../../../utils/is-sandbox");
 require("../../../utils/perf-logging");
 const environment = process.env;
 (0, analytics_1.startAnalytics)();
@@ -88,7 +92,8 @@ const server = (0, net_1.createServer)((socket) => {
                         exclude: plugin.exclude,
                         createNodesPattern: plugin.createNodes?.[0],
                         hasCreateDependencies: 'createDependencies' in plugin && !!plugin.createDependencies,
-                        hasProcessProjectGraph: 'processProjectGraph' in plugin && !!plugin.processProjectGraph,
+                        hasProcessProjectGraph: 'processProjectGraph' in plugin &&
+                            !!plugin.processProjectGraph,
                         hasCreateMetadata: 'createMetadata' in plugin && !!plugin.createMetadata,
                         hasPreTasksExecution: 'preTasksExecution' in plugin && !!plugin.preTasksExecution,
                         hasPostTasksExecution: 'postTasksExecution' in plugin && !!plugin.postTasksExecution,
@@ -117,6 +122,13 @@ const server = (0, net_1.createServer)((socket) => {
                 (0, daemon_environment_1.applyDaemonEnvFromClient)(env);
             }),
         });
+    }, (err) => {
+        // The host link cannot resynchronize. Exit so the host's 'exit' handler
+        // rejects the pending hooks instead of waiting on a reply that the
+        // framing failure guarantees will never arrive.
+        console.error(err.message);
+        socket.destroy();
+        process.exit(1);
     }));
     // When the host disconnects, clean up and exit.
     socket.on('end', () => {
@@ -132,7 +144,16 @@ server.on('error', (err) => {
     // Without this the host only sees "exited before the connection was
     // established"; the errno distinguishes a denied bind from EADDRINUSE.
     console.error(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) failed to listen on ${socketPath}: ${err.message}`);
-    process.exit(1);
+    // A bind can fail for reasons permission does not explain (EADDRINUSE from a
+    // leftover socket, ENOENT from a reaped socket dir), so print the hint only
+    // when the errno proves a refusal or the environment says a sandbox is here.
+    const refusedByOs = (0, permission_errors_1.isPermissionDenied)(err);
+    if (refusedByOs || (0, is_sandbox_1.isSandbox)()) {
+        console.error((0, sandbox_socket_hint_1.sandboxSocketHint)({ certain: refusedByOs }).join('\n'));
+    }
+    // The host cannot see this errno, and stderr may be lost with the process, so
+    // the exit code is what tells it a refusal happened rather than a crash.
+    process.exit(refusedByOs ? socket_refused_exit_code_1.SOCKET_REFUSED_EXIT_CODE : 1);
 });
 // A worker killed without its 'end' handler leaves the socket behind. Colliding
 // takes a recycled host pid landing on the same counter *and* the same 4 random

package/dist/src/project-graph/project-graph.js

@@ -14,12 +14,14 @@ const analytics_1 = require("../analytics");
 const nx_json_1 = require("../config/nx-json");
 const client_1 = require("../daemon/client/client");
 const is_on_daemon_1 = require("../daemon/is-on-daemon");
+const sandbox_socket_hint_1 = require("../daemon/sandbox-socket-hint");
 const tmp_dir_1 = require("../daemon/tmp-dir");
 const native_1 = require("../native");
 const cache_directory_1 = require("../utils/cache-directory");
 const call_sites_1 = require("../utils/call-sites");
 const delayed_spinner_1 = require("../utils/delayed-spinner");
 const fileutils_1 = require("../utils/fileutils");
+const is_sandbox_1 = require("../utils/is-sandbox");
 const logger_1 = require("../utils/logger");
 const output_1 = require("../utils/output");
 const strip_indents_1 = require("../utils/strip-indents");
@@ -376,15 +378,38 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
             }
             if (e.internalDaemonError) {
                 const errorLogFile = (0, tmp_dir_1.writeDaemonLogs)(e.message);
+                const sandboxed = (0, is_sandbox_1.isSandbox)();
                 output_1.output.warn({
                     title: `Nx Daemon was not able to compute the project graph.`,
                     bodyLines: [
                         `Log file with the error: ${errorLogFile}`,
+                        // Inline rather than left to the log file, which an agent will
+                        // not open. This branch covers every internal daemon error,
+                        // including ones a sandbox cannot explain, so the issue link stays
+                        // either way.
+                        ...(sandboxed ? (0, sandbox_socket_hint_1.sandboxSocketHint)() : []),
                         `Please file an issue at https://github.com/nrwl/nx`,
-                        'Nx Daemon is going to be disabled until you run "nx reset".',
+                        sandboxed
+                            ? 'Nx Daemon is disabled for this command.'
+                            : 'Nx Daemon is going to be disabled until you run "nx reset".',
                     ],
                 });
-                (0, tmp_dir_1.markDaemonAsDisabled)(e.message);
+                // A sandbox refusal describes the environment, not the workspace. The
+                // on-disk marker would follow the checkout into an ordinary terminal
+                // and survive the user fixing their allowlist, since only `nx reset`
+                // clears it.
+                if (sandboxed) {
+                    (0, tmp_dir_1.disableDaemonForThisProcess)(e.message);
+                }
+                else {
+                    (0, tmp_dir_1.markDaemonAsDisabled)(e.message);
+                }
+                // Both writes are only read through `isDaemonDisabled()`, which
+                // `enabled()` consults once and then memoizes. Without clearing that,
+                // every later daemon consumer in this process — task hashing, workspace
+                // context, sync generators — starts the daemon again and waits out the
+                // full connect budget, under a warning saying it is off.
+                client_1.daemonClient.reset();
                 return buildProjectGraphAndSourceMapsWithoutDaemon();
             }
             handleProjectGraphError(opts, e);

package/dist/src/project-graph/utils/project-configuration/project-nodes-manager.d.ts

@@ -4,6 +4,13 @@ export { validateProject } from './target-normalization';
 export declare function mergeProjectConfigurationIntoRootMap(projectRootMap: Record<string, ProjectConfiguration>, project: ProjectConfiguration, configurationSourceMaps?: ConfigurationSourceMaps, sourceInformation?: SourceInformation, skipTargetNormalization?: boolean, deferSpreadsWithoutBase?: boolean): {
     nameChanged: boolean;
 };
+/**
+ * The existing target names a glob-pattern target key merges onto. This maps
+ * atomized targets to the glob pattern the same way targetDefaults does.
+ * Returns an empty array for a non-glob key or a pattern matching nothing;
+ * the merge treats those as literal target names.
+ */
+export declare function findMatchingTargetNames(pattern: string, targetNames: string[]): string[];
 export declare function readProjectConfigurationsFromRootMap(projectRootMap: Record<string, ProjectConfiguration>): Record<string, ProjectConfiguration>;
 export declare function createRootMap(projectRootMap: Record<string, ProjectConfiguration>): Record<string, string>;
 /**