@depup/nx 23.1.3-depup.0 → 23.2.0-depup.0

package/README.md

@@ -13,10 +13,10 @@ npm install @depup/nx
 
 | Field | Value |
 |-------|-------|
-| Original | [nx](https://www.npmjs.com/package/nx) @ 23.1.3 |
-| Processed | 2026-09-01 |
+| Original | [nx](https://www.npmjs.com/package/nx) @ 23.2.0 |
+| Processed | 2026-09-02 |
 | Smoke test | failed |
-| Deps updated | 70 |
+| Deps updated | 71 |
 
 ## Dependency Changes
 
@@ -52,9 +52,9 @@ npm install @depup/nx
 | dotenv-expand | 12.0.3 | ^1000.0.0 |
 | ejs | 5.0.1 | ^6.0.1 |
 | emoji-regex | 8.0.0 | ^10.6.0 |
-| enquirer | 2.3.6 | ^2.4.1 |
 | es-object-atoms | 1.1.1 | ^1.1.2 |
 | escape-string-regexp | 1.0.5 | ^5.0.0 |
+| fast-wrap-ansi | 0.2.0 | ^0.2.2 |
 | figures | 3.2.0 | ^6.1.0 |
 | flat | 5.0.2 | ^6.0.1 |
 | has-flag | 4.0.0 | ^5.0.1 |
@@ -82,6 +82,7 @@ npm install @depup/nx
 | run-applescript | 7.0.0 | ^7.1.0 |
 | semver | 7.8.4 | ^7.8.5 |
 | signal-exit | 3.0.7 | ^4.1.0 |
+| sisteransi | 1.0.5 | ^2.0.0 |
 | smol-toml | 1.6.1 | ^1.8.0 |
 | string-width | 4.2.3 | ^8.2.2 |
 | strip-ansi | 6.0.1 | ^7.2.0 |

package/changes.json

@@ -120,10 +120,6 @@
       "from": "8.0.0",
       "to": "^10.6.0"
     },
-    "enquirer": {
-      "from": "2.3.6",
-      "to": "^2.4.1"
-    },
     "es-object-atoms": {
       "from": "1.1.1",
       "to": "^1.1.2"
@@ -132,6 +128,10 @@
       "from": "1.0.5",
       "to": "^5.0.0"
     },
+    "fast-wrap-ansi": {
+      "from": "0.2.0",
+      "to": "^0.2.2"
+    },
     "figures": {
       "from": "3.2.0",
       "to": "^6.1.0"
@@ -240,6 +240,10 @@
       "from": "3.0.7",
       "to": "^4.1.0"
     },
+    "sisteransi": {
+      "from": "1.0.5",
+      "to": "^2.0.0"
+    },
     "smol-toml": {
       "from": "1.6.1",
       "to": "^1.8.0"
@@ -281,6 +285,6 @@
       "to": "^22.0.0"
     }
   },
-  "timestamp": "2026-09-01T00:42:01.327Z",
-  "totalUpdated": 70
+  "timestamp": "2026-09-02T16:11:25.939Z",
+  "totalUpdated": 71
 }

package/dist/bin/init-local.js

@@ -6,7 +6,7 @@ const perf_hooks_1 = require("perf_hooks");
 const nx_commands_1 = require("../src/command-line/nx-commands");
 const strip_indents_1 = require("../src/utils/strip-indents");
 const client_1 = require("../src/daemon/client/client");
-const enquirer_1 = require("enquirer");
+const prompt_helpers_1 = require("../src/utils/prompt-helpers");
 const output_1 = require("../src/utils/output");
 const analytics_1 = require("../src/analytics");
 /**
@@ -136,11 +136,9 @@ async function ensureNxConsoleInstalledViaDaemon() {
             ],
         });
         try {
-            const { shouldInstallNxConsole } = await (0, enquirer_1.prompt)({
-                type: 'confirm',
-                name: 'shouldInstallNxConsole',
+            const shouldInstallNxConsole = await (0, prompt_helpers_1.confirmationPrompt)({
                 message: 'Install Nx Console? (you can uninstall anytime)',
-                initial: true,
+                onCancel: () => false,
             });
             // Set preference and install if user said yes
             const result = await client_1.daemonClient.setNxConsolePreferenceAndInstall(shouldInstallNxConsole);

package/dist/bin/nx.js

@@ -209,6 +209,7 @@ function resolveNx(workspace) {
 function isNxCloudCommand(command) {
     const nxCloudCommands = [
         'start-ci-run',
+        'start-nx-agents',
         'start-agent',
         'stop-all-agents',
         'complete-ci-run',

package/dist/src/adapter/ngcli-adapter.js

@@ -31,6 +31,7 @@ const executor_utils_1 = require("../command-line/run/executor-utils");
 const plugins_1 = require("../project-graph/plugins");
 const schema_utils_1 = require("../config/schema-utils");
 const handle_import_1 = require("../utils/handle-import");
+const prompt_helpers_1 = require("../utils/prompt-helpers");
 const target_merging_1 = require("../project-graph/utils/project-configuration/target-merging");
 function getProjectGraph() {
     try {
@@ -653,8 +654,66 @@ function createPromptProvider() {
                     return { ...question, type: definition.type };
             }
         });
-        return require('enquirer').prompt(questions);
+        // Angular hands over a whole form at once; clack asks one question at a
+        // time, so they are run in order and the answers reassembled.
+        return (async () => {
+            const answers = {};
+            for (const question of questions) {
+                answers[question.name] = await askSchematicQuestion(question);
+            }
+            return answers;
+        })();
     };
+    async function askSchematicQuestion(question) {
+        const validate = question.validate
+            ? (value) => {
+                const result = question.validate(value);
+                if (result === true)
+                    return undefined;
+                return typeof result === 'string' ? result : 'Invalid value';
+            }
+            : undefined;
+        const choices = (question.choices ?? []).map((c) => typeof c === 'string' ? { value: c } : { value: c.name, label: c.message });
+        switch (question.type) {
+            case 'confirm':
+                return (0, prompt_helpers_1.confirmationPrompt)({
+                    message: question.message,
+                    initial: question.initial !== false,
+                });
+            case 'select':
+                return (0, prompt_helpers_1.selectPrompt)({
+                    message: question.message,
+                    choices,
+                    initial: question.initial,
+                });
+            case 'multiselect':
+                return (0, prompt_helpers_1.multiselectPrompt)({
+                    message: question.message,
+                    choices,
+                    initialValues: question.initial,
+                });
+            case 'numeral': {
+                // No numeric prompt; the answer is parsed back so callers still get a
+                // number rather than the typed string.
+                const answer = await (0, prompt_helpers_1.textPrompt)({
+                    message: question.message,
+                    initialValue: question.initial === undefined
+                        ? undefined
+                        : String(question.initial),
+                    validate: (value) => value !== '' && !Number.isNaN(Number(value))
+                        ? validate?.(value)
+                        : 'Please enter a number',
+                });
+                return Number(answer);
+            }
+            default:
+                return (0, prompt_helpers_1.textPrompt)({
+                    message: question.message,
+                    initialValue: question.initial,
+                    validate,
+                });
+        }
+    }
 }
 async function runMigration(root, packageName, migrationName, projects, isVerbose, projectGraph) {
     const logger = (0, exports.getLogger)(isVerbose);

package/dist/src/ai/constants.d.ts

@@ -29,3 +29,18 @@ export declare const nxMcpTomlHeader = "[mcp_servers.\"nx-mcp\"]";
  * For Nx < 22, uses 'nx-mcp'
  */
 export declare function getNxMcpTomlConfig(nxVersion: string): string;
+/**
+ * The Nx runtime roots as they belong in a *committed* sandbox allowlist.
+ *
+ * `~/.nx` is the literal tilde rather than an expanded `NX_HOME_TMP_DIR`: the
+ * sandbox expands it per user, which is the property that makes the entry worth
+ * committing at all. An absolute home would pin the file to whoever ran the
+ * generator.
+ *
+ * Both are listed because socket resolution walks a chain — `/tmp/.nx` first,
+ * `~/.nx` when a peer already owns the shared container. Allowing only the first
+ * leaves every user on a machine where someone else got there first silently
+ * uncovered. Windows resolves `NX_TMP_DIR` to a machine-specific `%TMP%` and has
+ * no sandbox to configure, so the POSIX root is the one that belongs here.
+ */
+export declare const NX_ALLOWLIST_ROOTS: readonly ["/tmp/.nx", '~/.nx'];

package/dist/src/ai/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.nxMcpTomlHeader = exports.analyticsDomain = exports.getAgentRulesWrapped = exports.rulesRegex = exports.nxRulesMarkerCommentEnd = exports.nxRulesMarkerCommentDescription = exports.nxRulesMarkerCommentStart = void 0;
+exports.NX_ALLOWLIST_ROOTS = exports.nxMcpTomlHeader = exports.analyticsDomain = exports.getAgentRulesWrapped = exports.rulesRegex = exports.nxRulesMarkerCommentEnd = exports.nxRulesMarkerCommentDescription = exports.nxRulesMarkerCommentStart = void 0;
 exports.agentsMdPath = agentsMdPath;
 exports.geminiMdPath = geminiMdPath;
 exports.parseGeminiSettings = parseGeminiSettings;
@@ -13,6 +13,7 @@ exports.getNxMcpTomlConfig = getNxMcpTomlConfig;
 const path_1 = require("path");
 const semver_1 = require("semver");
 const fileutils_1 = require("../utils/fileutils");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const get_agent_rules_1 = require("./set-up-ai-agents/get-agent-rules");
 function agentsMdPath(root) {
     return (0, path_1.join)(root, 'AGENTS.md');
@@ -74,3 +75,18 @@ command = "npx"
 args = ${args}
 `;
 }
+/**
+ * The Nx runtime roots as they belong in a *committed* sandbox allowlist.
+ *
+ * `~/.nx` is the literal tilde rather than an expanded `NX_HOME_TMP_DIR`: the
+ * sandbox expands it per user, which is the property that makes the entry worth
+ * committing at all. An absolute home would pin the file to whoever ran the
+ * generator.
+ *
+ * Both are listed because socket resolution walks a chain — `/tmp/.nx` first,
+ * `~/.nx` when a peer already owns the shared container. Allowing only the first
+ * leaves every user on a machine where someone else got there first silently
+ * uncovered. Windows resolves `NX_TMP_DIR` to a machine-specific `%TMP%` and has
+ * no sandbox to configure, so the POSIX root is the one that belongs here.
+ */
+exports.NX_ALLOWLIST_ROOTS = [nx_tmp_dir_1.NX_TMP_DIR_POSIX, '~/.nx'];

package/dist/src/ai/set-up-ai-agents/set-up-ai-agents.js

@@ -7,9 +7,11 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const semver_1 = require("semver");
 const smol_toml_1 = tslib_1.__importDefault(require("smol-toml"));
-const format_changed_files_with_prettier_if_available_1 = require("../../generators/internal-utils/format-changed-files-with-prettier-if-available");
+const format_changed_files_1 = require("../../generators/internal-utils/format-changed-files");
 const generate_files_1 = require("../../generators/utils/generate-files");
 const json_1 = require("../../generators/utils/json");
+const nx_json_1 = require("../../generators/utils/nx-json");
+const analytics_enabled_1 = require("../../utils/analytics-enabled");
 const native_1 = require("../../native");
 const package_json_1 = require("../../utils/package-json");
 const package_manager_1 = require("../../utils/package-manager");
@@ -71,6 +73,8 @@ function normalizeOptions(options) {
 async function setupAiAgentsGeneratorImpl(tree, options) {
     const hasAgent = (agent) => options.agents.includes(agent);
     const nxVersion = (0, installed_nx_version_1.getInstalledNxVersion)() ?? getDeclaredNxVersionOrDefault();
+    const analyticsEnabled = (0, analytics_enabled_1.isAnalyticsEnabled)((0, nx_json_1.readNxJson)(tree));
+    let addedAnalyticsDomain = false;
     const agentsMd = (0, constants_1.agentsMdPath)(options.directory);
     // write AGENTS.md for most agents
     if (hasAgent('cursor') ||
@@ -87,6 +91,9 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
         if (!tree.exists(claudeSettingsPath)) {
             (0, json_1.writeJson)(tree, claudeSettingsPath, {});
         }
+        const allowedDomains = (0, json_1.readJson)(tree, claudeSettingsPath).sandbox?.network?.allowedDomains;
+        addedAnalyticsDomain =
+            analyticsEnabled && !allowedDomains?.includes(constants_1.analyticsDomain);
         (0, json_1.updateJson)(tree, claudeSettingsPath, (json) => ({
             ...json,
             extraKnownMarketplaces: {
@@ -103,17 +110,41 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
                 ...json.enabledPlugins,
                 'nx@nx-claude-plugins': true,
             },
-            // Allow Nx analytics requests through Claude Code's sandbox network filter
+            // Allow Nx unix socket usage (daemon, plugin workers, forked processes)
+            // through Claude Code's sandbox, and analytics requests when the
+            // workspace has them on. Nx also copies its native binary into a cache
+            // under the same fixed tmp root before loading it, so the read/write
+            // grants cover that too. The root is a fixed /tmp path on macOS and
+            // Linux, so these entries are machine-independent and safe to commit.
             sandbox: {
                 ...json.sandbox,
+                filesystem: {
+                    ...json.sandbox?.filesystem,
+                    allowRead: withEntries(json.sandbox?.filesystem?.allowRead, ...constants_1.NX_ALLOWLIST_ROOTS),
+                    // Covers the whole tmp root, not just the socket dir: the native
+                    // binary cache lives under it too, and without the cache a running
+                    // daemon keeps an open handle on the binding inside node_modules,
+                    // which blocks reinstalling or rebuilding dependencies. What keeps
+                    // users apart is not this allowlist but the 0700 per-uid directories
+                    // Nx verifies on every use (see ensureOwnedPrivateDir).
+                    allowWrite: withEntries(json.sandbox?.filesystem?.allowWrite, ...constants_1.NX_ALLOWLIST_ROOTS),
+                },
                 network: {
                     ...json.sandbox?.network,
-                    allowedDomains: json.sandbox?.network?.allowedDomains?.includes(constants_1.analyticsDomain)
-                        ? json.sandbox.network.allowedDomains
-                        : [
-                            ...(json.sandbox?.network?.allowedDomains ?? []),
-                            constants_1.analyticsDomain,
-                        ],
+                    // Egress follows the workspace's analytics opt-in (#36663). The
+                    // socket grant does not: Nx needs its sockets either way.
+                    ...(analyticsEnabled
+                        ? {
+                            allowedDomains: withEntries(json.sandbox?.network?.allowedDomains, constants_1.analyticsDomain),
+                        }
+                        : {}),
+                    // Covers binding as well as connecting, so a fresh daemon, a plugin
+                    // worker and a forked task can each create their own socket under
+                    // these roots. Deliberately scoped rather than `allowAllUnixSockets`,
+                    // which grants connect access to every socket on the machine —
+                    // including the Docker and SSH-agent sockets — and grants nothing
+                    // extra for creating Nx's own.
+                    allowUnixSockets: withEntries(json.sandbox?.network?.allowUnixSockets, ...constants_1.NX_ALLOWLIST_ROOTS),
                 },
             },
         }));
@@ -234,11 +265,20 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
     (0, ignore_1.addEntryToGitIgnore)(tree, (0, path_1.join)(options.directory, '.gitignore'), '.nx/polygraph');
     (0, ignore_1.addEntryToGitIgnore)(tree, (0, path_1.join)(options.directory, '.gitignore'), '.claude/worktrees');
     (0, ignore_1.addEntryToGitIgnore)(tree, (0, path_1.join)(options.directory, '.gitignore'), '.claude/settings.local.json');
-    await (0, format_changed_files_with_prettier_if_available_1.formatChangedFilesWithPrettierIfAvailable)(tree);
+    await (0, format_changed_files_1.formatChangedFiles)(tree);
     // we use the check variable to determine if we should actually make changes or just report what would be changed
     return async (check = false) => {
         const messages = [];
         const errors = [];
+        if (addedAnalyticsDomain) {
+            messages.push({
+                title: `Allowed ${constants_1.analyticsDomain} through Claude Code's sandbox network filter`,
+                bodyLines: [
+                    `Nx sends analytics there because this workspace sets "analytics": true in nx.json.`,
+                    `Set it to false to opt out, then remove the domain from .claude/settings.json.`,
+                ],
+            });
+        }
         if (hasAgent('copilot')) {
             try {
                 if ((await (0, native_1.isEditorInstalled)(0 /* SupportedEditor.VSCode */)) &&
@@ -300,6 +340,14 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
         };
     };
 }
+/**
+ * The user's existing entries in their original order, plus any of `values`
+ * they do not already have. A Set does the deduping, so re-running the
+ * generator is a no-op rather than a growing list.
+ */
+function withEntries(existing, ...values) {
+    return [...new Set([...(existing ?? []), ...values])];
+}
 function writeAgentRules(tree, path, writeNxCloudRules) {
     if (!tree.exists(path)) {
         // File doesn't exist - create with h1 header (standalone content)

package/dist/src/ai/utils.d.ts

@@ -18,3 +18,16 @@ export declare function getAgentConfigurations(agentsToConsider: Agent[], worksp
     disabledAgents: AgentConfiguration[];
 }>;
 export declare function configureAgents(agents: Agent[], workspaceRoot: string, useLatest?: boolean): Promise<void>;
+/**
+ * Explains a permission error thrown while writing agent configuration files.
+ *
+ * The errno alone does not identify the cause. Agent harnesses (e.g. Claude
+ * Code) deny writes to their own settings files from sandboxed shell commands,
+ * so `nx configure-ai-agents` run through an agent's bash tool fails with EPERM
+ * where the same command succeeds in a terminal — but a root-owned
+ * `.claude/settings.json` left by an earlier `sudo nx`, or a read-only
+ * checkout, produces the same errno with an unrelated remedy. The sandbox
+ * explanation is therefore only offered where a sandbox or an agent is
+ * actually detected, and the underlying message is kept either way.
+ */
+export declare function agentConfigWriteBlockedLines(error: unknown): string[];

package/dist/src/ai/utils.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentDisplayMap = exports.supportedAgents = void 0;
 exports.getAgentConfigurations = getAgentConfigurations;
 exports.configureAgents = configureAgents;
+exports.agentConfigWriteBlockedLines = agentConfigWriteBlockedLines;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const path_1 = require("path");
@@ -10,6 +11,7 @@ const configuration_1 = require("../config/configuration");
 const tree_1 = require("../generators/tree");
 const native_1 = require("../native");
 const fileutils_1 = require("../utils/fileutils");
+const is_sandbox_1 = require("../utils/is-sandbox");
 const nx_cloud_utils_1 = require("../utils/nx-cloud-utils");
 const output_1 = require("../utils/output");
 const constants_1 = require("./constants");
@@ -215,3 +217,30 @@ async function configureAgents(agents, workspaceRoot, useLatest) {
     modificationResults.messages.forEach((message) => output_1.output.log(message));
     modificationResults.errors.forEach((error) => output_1.output.error(error));
 }
+/**
+ * Explains a permission error thrown while writing agent configuration files.
+ *
+ * The errno alone does not identify the cause. Agent harnesses (e.g. Claude
+ * Code) deny writes to their own settings files from sandboxed shell commands,
+ * so `nx configure-ai-agents` run through an agent's bash tool fails with EPERM
+ * where the same command succeeds in a terminal — but a root-owned
+ * `.claude/settings.json` left by an earlier `sudo nx`, or a read-only
+ * checkout, produces the same errno with an unrelated remedy. The sandbox
+ * explanation is therefore only offered where a sandbox or an agent is
+ * actually detected, and the underlying message is kept either way.
+ */
+function agentConfigWriteBlockedLines(error) {
+    const err = error;
+    const target = err?.path ?? 'an agent configuration file';
+    return [
+        `Writing ${target} failed: ${err?.message ?? 'permission denied'}`,
+        ...((0, is_sandbox_1.isSandbox)() || (0, native_1.isAiAgent)()
+            ? [
+                "Agent sandboxes protect their own settings files from writes made by sandboxed shell commands, so this command cannot finish when run through an agent's bash tool.",
+                'To complete the AI agent setup, run `nx configure-ai-agents` from a regular terminal and relaunch the agent harness.',
+            ]
+            : [
+                'Check the ownership and mode of that path: an earlier `sudo nx` run or a read-only checkout produces this.',
+            ]),
+    ];
+}

package/dist/src/analytics/analytics.js

@@ -10,6 +10,7 @@ exports.argsToQueryString = argsToQueryString;
 exports.flushAnalytics = flushAnalytics;
 const tslib_1 = require("tslib");
 const nx_json_1 = require("../config/nx-json");
+const analytics_enabled_1 = require("../utils/analytics-enabled");
 const workspace_root_1 = require("../utils/workspace-root");
 const versions_1 = require("../utils/versions");
 const native_1 = require("../native");
@@ -59,7 +60,7 @@ async function startAnalytics() {
     // on any failure, continue without telemetry.
     try {
         const nxJson = (0, nx_json_1.readNxJson)(workspace_root_1.workspaceRoot);
-        if (!isAnalyticsEnabled(nxJson)) {
+        if (!(0, analytics_enabled_1.isAnalyticsEnabled)(nxJson)) {
             return;
         }
         const workspaceId = (0, workspace_id_1.generateWorkspaceId)(workspace_root_1.workspaceRoot, nxJson);
@@ -235,9 +236,6 @@ function getPackageManagerInfo() {
         version: (0, package_manager_1.getPackageManagerVersion)(pm),
     };
 }
-function isAnalyticsEnabled(nxJson) {
-    return nxJson?.analytics === true;
-}
 // Mix workspace id in: shared Docker images (Gitpod, Cypress, etc.) bake
 // in /etc/machine-id, so machine-id alone collapses many users into one.
 async function getTelemetryUserId(workspaceId) {

package/dist/src/command-line/completion/command-object.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.yargsCompletionCommand = void 0;
-const enquirer_1 = require("enquirer");
+const prompt_helpers_1 = require("../../utils/prompt-helpers");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -69,18 +69,13 @@ async function pickShellsInteractively() {
         process.exit(1);
     }
     const detected = detectAvailableShells();
-    const answer = (await (0, enquirer_1.prompt)({
-        type: 'multiselect',
-        name: 'shells',
+    return await (0, prompt_helpers_1.multiselectPrompt)({
         message: 'Install nx completion for which shell(s)?',
-        choices: SHELL_CHOICES.map((name) => ({
-            name,
-            value: name,
-            // Pre-check shells we can detect on this machine.
-            enabled: detected.has(name),
-        })),
-    }));
-    return answer.shells ?? [];
+        choices: SHELL_CHOICES,
+        // Pre-select shells we can detect on this machine.
+        initialValues: SHELL_CHOICES.filter((name) => detected.has(name)),
+        onCancel: () => [],
+    });
 }
 /** Best-effort detect-which-shells-the-user-has. Pre-checks the multiselect.
  *  Signals: $SHELL basename, presence of conventional rc files, $PSModulePath

package/dist/src/command-line/configure-ai-agents/configure-ai-agents.js

@@ -3,13 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureAiAgentsHandler = configureAiAgentsHandler;
 exports.configureAiAgentsHandlerImpl = configureAiAgentsHandlerImpl;
 const tslib_1 = require("tslib");
-const enquirer_1 = require("enquirer");
+const prompt_helpers_1 = require("../../utils/prompt-helpers");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const pc = tslib_1.__importStar(require("picocolors"));
 const constants_1 = require("../../ai/constants");
 const detect_ai_agent_1 = require("../../ai/detect-ai-agent");
 const utils_1 = require("../../ai/utils");
+const permission_errors_1 = require("../../utils/permission-errors");
 const client_1 = require("../../daemon/client/client");
 const package_json_1 = require("../../utils/package-json");
 const output_1 = require("../../utils/output");
@@ -63,8 +64,10 @@ async function configureAiAgentsHandler(args, inner = false) {
     await resetDaemonAgentStatus();
 }
 async function configureAiAgentsHandlerImpl(options) {
-    // Node 24 has stricter readline behavior, and enquirer is not checking for closed state
-    // when invoking operations, thus you get an ERR_USE_AFTER_CLOSE error.
+    // Node 24's stricter readline throws ERR_USE_AFTER_CLOSE when a prompt
+    // library operates on a closed interface. Added for enquirer, which nx no
+    // longer uses; verify against Node 24 before removing.
+    // TODO(v24): drop if @clack/prompts proves not to need it.
     process.on('uncaughtException', (error) => {
         if (error &&
             typeof error === 'object' &&
@@ -158,7 +161,7 @@ async function configureAiAgentsHandlerImpl(options) {
                     ...partiallyConfiguredAgents,
                     ...outOfDateAgents,
                     ...nonConfiguredAgents,
-                ].map((a) => getAgentChoiceForPrompt(a).message),
+                ].map((a) => getAgentChoiceForPrompt(a).label),
             });
             process.exit(1);
         }
@@ -212,10 +215,18 @@ async function configureAiAgentsHandlerImpl(options) {
             }
             catch (e) {
                 configSpinner.fail('Failed to configure AI agents');
-                output_1.output.error({
-                    title: 'Error details:',
-                    bodyLines: [e.message],
-                });
+                if ((0, permission_errors_1.isPermissionDenied)(e)) {
+                    output_1.output.error({
+                        title: 'Nx was not permitted to write the AI agent configuration',
+                        bodyLines: (0, utils_1.agentConfigWriteBlockedLines)(e),
+                    });
+                }
+                else {
+                    output_1.output.error({
+                        title: 'Error details:',
+                        bodyLines: [e.message],
+                    });
+                }
                 process.exit(1);
             }
         }
@@ -239,26 +250,22 @@ async function configureAiAgentsHandlerImpl(options) {
     }
     // Interactive mode (or non-interactive with explicit --agents)
     const allAgentChoices = [];
-    const preselectedIndices = [];
-    let currentIndex = 0;
+    const preselectedAgents = [];
     // Partially configured agents first (highest priority)
     partiallyConfiguredAgents.forEach((a) => {
         allAgentChoices.push(getAgentChoiceForPrompt(a));
-        preselectedIndices.push(currentIndex);
-        currentIndex++;
+        preselectedAgents.push(a.name);
     });
     // Outdated agents second
     for (const a of fullyConfiguredAgents) {
         if (a.outdated) {
             allAgentChoices.push(getAgentChoiceForPrompt(a));
-            preselectedIndices.push(currentIndex);
-            currentIndex++;
+            preselectedAgents.push(a.name);
         }
     }
     // Non-configured agents last
     nonConfiguredAgents.forEach((a) => {
         allAgentChoices.push(getAgentChoiceForPrompt(a));
-        currentIndex++;
     });
     if (allAgentChoices.length === 0) {
         output_1.output.success({
@@ -270,18 +277,13 @@ async function configureAiAgentsHandlerImpl(options) {
     let selectedAgents;
     if (options.interactive !== false) {
         try {
-            selectedAgents = (await (0, enquirer_1.prompt)({
-                type: 'multiselect',
-                name: 'agents',
+            selectedAgents = await (0, prompt_helpers_1.multiselectPrompt)({
                 message: 'Which AI agents would you like to configure? (space to select, enter to confirm)',
                 choices: allAgentChoices,
-                initial: preselectedIndices,
+                initialValues: preselectedAgents,
                 required: true,
-                footer: function () {
-                    const focused = this.focused;
-                    return pc.dim(`  ${getAgentFooterDescription(focused.agentConfiguration)}`);
-                },
-            })).agents;
+                onCancel: () => process.exit(1),
+            });
         }
         catch {
             process.exit(1);
@@ -289,7 +291,7 @@ async function configureAiAgentsHandlerImpl(options) {
     }
     else {
         // non-interactive with explicit --agents: configure all requested
-        selectedAgents = allAgentChoices.map((a) => a.name);
+        selectedAgents = allAgentChoices.map((a) => a.value);
     }
     if (selectedAgents?.length === 0) {
         output_1.output.log({
@@ -317,10 +319,18 @@ async function configureAiAgentsHandlerImpl(options) {
     }
     catch (e) {
         configSpinner.fail('Failed to set up AI agents');
-        output_1.output.error({
-            title: 'Error details:',
-            bodyLines: [e.message],
-        });
+        if ((0, permission_errors_1.isPermissionDenied)(e)) {
+            output_1.output.error({
+                title: 'Nx was not permitted to write the AI agent configuration',
+                bodyLines: (0, utils_1.agentConfigWriteBlockedLines)(e),
+            });
+        }
+        else {
+            output_1.output.error({
+                title: 'Error details:',
+                bodyLines: [e.message],
+            });
+        }
         process.exit(1);
     }
 }
@@ -388,10 +398,11 @@ function getAgentChoiceForPrompt(agent) {
     const partiallyConfigured = agent.mcp !== agent.rules;
     const needsUpdate = partiallyConfigured || agent.outdated;
     return {
-        name: agent.name,
-        message: needsUpdate
+        value: agent.name,
+        label: needsUpdate
             ? `${agent.displayName} (update available)`
             : agent.displayName,
+        hint: getAgentFooterDescription(agent),
         agentConfiguration: agent,
     };
 }