@depup/nx 23.2.1-depup.8 → 23.3.0-depup.0

package/dist/src/utils/http-client.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpError = void 0;
+exports.createHttpClient = createHttpClient;
+exports.httpRequest = httpRequest;
+const stream_1 = require("stream");
+class HttpError extends Error {
+    constructor(response) {
+        // Same message copy axios used, in case consumers match on it
+        super(`Request failed with status code ${response.status}`);
+        this.response = response;
+        this.name = 'HttpError';
+        this.status = response.status;
+    }
+}
+exports.HttpError = HttpError;
+function createHttpClient(defaults = {}) {
+    const merge = (config = {}) => ({
+        ...defaults,
+        ...config,
+        headers: {
+            ...toLowerCaseKeys(defaults.headers),
+            ...toLowerCaseKeys(config.headers),
+        },
+    });
+    return {
+        request: (url, config) => httpRequest(url, merge(config)),
+        get: (url, config) => httpRequest(url, merge({ ...config, method: 'GET' })),
+        post: (url, data, config) => httpRequest(url, merge({ ...config, method: 'POST', data })),
+    };
+}
+async function httpRequest(url, config = {}) {
+    const fullUrl = buildFullUrl(url, config);
+    const { fetchImpl, dispatcher } = resolveFetch();
+    // Lowercase keys so differently-cased duplicates override instead of
+    // sending both values
+    const headers = toLowerCaseKeys(config.headers);
+    let body;
+    if (config.data !== undefined) {
+        body = JSON.stringify(config.data);
+        headers['content-type'] ??= 'application/json';
+    }
+    const controller = new AbortController();
+    if (config.signal) {
+        if (config.signal.aborted) {
+            controller.abort(config.signal.reason);
+        }
+        else {
+            config.signal.addEventListener('abort', () => controller.abort(config.signal.reason), { once: true });
+        }
+    }
+    const timer = config.timeout
+        ? setTimeout(() => controller.abort(new DOMException(`Request timed out after ${config.timeout}ms`, 'TimeoutError')), config.timeout)
+        : null;
+    let res;
+    try {
+        res = await fetchImpl(fullUrl, {
+            method: config.method ?? 'GET',
+            headers,
+            body,
+            redirect: 'follow',
+            signal: controller.signal,
+            ...(dispatcher ? { dispatcher } : {}),
+        });
+    }
+    catch (e) {
+        if (timer)
+            clearTimeout(timer);
+        throw e;
+    }
+    const responseHeaders = Object.fromEntries(res.headers.entries());
+    if (config.responseType === 'stream') {
+        if (!res.ok) {
+            try {
+                throw new HttpError({
+                    status: res.status,
+                    headers: responseHeaders,
+                    data: await parseResponseData(res),
+                });
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+        // The headers timeout ends here; the body gets a per-chunk inactivity
+        // guard instead, so slow-but-progressing downloads survive
+        if (timer)
+            clearTimeout(timer);
+        return {
+            status: res.status,
+            headers: responseHeaders,
+            data: (res.body
+                ? guardStreamStall(stream_1.Readable.fromWeb(res.body), config.timeout)
+                : stream_1.Readable.from([])),
+        };
+    }
+    try {
+        const data = await parseResponseData(res);
+        if (!res.ok) {
+            throw new HttpError({
+                status: res.status,
+                headers: responseHeaders,
+                data,
+            });
+        }
+        return { status: res.status, headers: responseHeaders, data };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function parseResponseData(res) {
+    const text = await res.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function toLowerCaseKeys(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        result[key.toLowerCase()] = value;
+    }
+    return result;
+}
+function buildFullUrl(url, config) {
+    let fullUrl = url;
+    if (config.baseURL && !/^https?:\/\//i.test(url)) {
+        // Concatenate rather than `new URL(url, base)` so a base with a path
+        // prefix (e.g. on-prem Nx Cloud) is preserved
+        fullUrl =
+            config.baseURL.replace(/\/+$/, '') + '/' + url.replace(/^\/+/, '');
+    }
+    if (config.params) {
+        const search = new URLSearchParams();
+        for (const [key, value] of Object.entries(config.params)) {
+            if (value !== null && value !== undefined) {
+                search.append(key, String(value));
+            }
+        }
+        const queryString = search.toString();
+        if (queryString) {
+            fullUrl += (fullUrl.includes('?') ? '&' : '?') + queryString;
+        }
+    }
+    return fullUrl;
+}
+/**
+ * Destroys the stream if no data arrives for `timeout` ms. Resets per chunk,
+ * so slow-but-progressing downloads survive while stalls still abort.
+ */
+function guardStreamStall(source, timeout) {
+    if (!timeout)
+        return source;
+    const out = new stream_1.PassThrough();
+    let timer;
+    const arm = () => {
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+            const error = new DOMException(`Response stalled for ${timeout}ms`, 'TimeoutError');
+            source.destroy(error);
+            out.destroy(error);
+        }, timeout);
+    };
+    arm();
+    source.on('data', arm);
+    source.on('end', () => clearTimeout(timer));
+    source.on('close', () => clearTimeout(timer));
+    source.on('error', (e) => {
+        clearTimeout(timer);
+        out.destroy(e);
+    });
+    source.pipe(out);
+    return out;
+}
+let envProxyAgent;
+function resolveFetch() {
+    // Native fetch ignores HTTP(S)_PROXY env vars, which axios honored; route
+    // through undici's EnvHttpProxyAgent (also handles NO_PROXY) when they are set
+    const allProxy = process.env.all_proxy || process.env.ALL_PROXY;
+    const httpProxy = process.env.http_proxy || process.env.HTTP_PROXY || allProxy;
+    const httpsProxy = process.env.https_proxy || process.env.HTTPS_PROXY || allProxy;
+    if (httpProxy || httpsProxy) {
+        const undici = require('undici');
+        envProxyAgent ??= new undici.EnvHttpProxyAgent({ httpProxy, httpsProxy });
+        return { fetchImpl: undici.fetch, dispatcher: envProxyAgent };
+    }
+    return { fetchImpl: fetch };
+}

package/dist/src/utils/installed-nx-version.js

@@ -4,8 +4,6 @@ exports.getInstalledVersion = getInstalledVersion;
 exports.getInstalledNxVersion = getInstalledNxVersion;
 exports.getInstalledLegacyNrwlWorkspaceVersion = getInstalledLegacyNrwlWorkspaceVersion;
 exports.getInstalledPackageGroup = getInstalledPackageGroup;
-const tslib_1 = require("tslib");
-const node_module_1 = tslib_1.__importStar(require("node:module"));
 const fileutils_1 = require("./fileutils");
 const package_json_1 = require("./package-json");
 const workspace_root_1 = require("./workspace-root");
@@ -15,15 +13,11 @@ const installation_directory_1 = require("./installation-directory");
  * resolver. The resolver always reflects the workspace's `node_modules`/PnP
  * store rather than whichever copy happens to be loaded in the current process
  * (e.g. the temp `nx@latest` install used by the migrate bootstrap). See
- * nrwl/nx#35444 and `resolvePackageJsonWithoutCachePollution` below.
+ * nrwl/nx#35444 and `resolveWithoutCachePollution`.
  */
 function readInstalledPackageJson(packageName) {
-    const path = resolvePackageJsonWithoutCachePollution(packageName, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot));
-    if (!path) {
-        return null;
-    }
     try {
-        return (0, fileutils_1.readJsonFile)(path);
+        return (0, fileutils_1.readJsonFile)((0, package_json_1.resolveWithoutCachePollution)(`${packageName}/package.json`, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot)));
     }
     catch {
         return null;
@@ -71,43 +65,3 @@ function getInstalledPackageGroup(packageName) {
     }
     return set;
 }
-/**
- * Resolve `<packageName>/package.json` via Node's CJS resolver while
- * neutralising both ways `require.resolve(req, { paths })` can lie about
- * the `paths` argument:
- *
- *   1. Process-wide `Module._pathCache` — swapped out for the duration of
- *      the call, so any cache entries written are discarded and any
- *      previously-poisoned entries are not read. Without this, an
- *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
- *      install used by the daemon's AI-agents and console-status checks)
- *      can poison the cache key this call uses and make us read the temp
- *      path instead of the workspace path.
- *
- *   2. Package self-reference — when a file inside package `nx` calls
- *      `require.resolve('nx/...')`, Node returns that calling package's
- *      own file regardless of `paths`. We avoid that by issuing the
- *      resolve from a `createRequire` rooted at a synthetic path that is
- *      outside any package, so the resolver has no "self" to reference
- *      and must honour `paths`.
- *
- * Node's single-threaded synchronous execution means `require.resolve` does
- * not yield, so no other code in the process can observe the swapped cache.
- */
-function resolvePackageJsonWithoutCachePollution(packageName, requirePaths) {
-    // `_pathCache` is an internal Node API not exposed in @types/node.
-    const realCache = node_module_1.default._pathCache;
-    node_module_1.default._pathCache = Object.create(null);
-    try {
-        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
-        return detachedRequire.resolve(`${packageName}/package.json`, {
-            paths: requirePaths,
-        });
-    }
-    catch {
-        return null;
-    }
-    finally {
-        node_module_1.default._pathCache = realCache;
-    }
-}

package/dist/src/utils/json-diff.d.ts

@@ -13,6 +13,8 @@ export interface JsonChange extends Change {
     };
 }
 export declare function isJsonChange(change: Change): change is JsonChange;
+/**
+ * The changes from `lhs` to `rhs`: every path whose value was deleted or
+ * modified, containers included, then every added path.
+ */
 export declare function jsonDiff(lhs: any, rhs: any): JsonChange[];
-export declare function walkJsonTree(json: any, currPath: string[], visitor: (path: string[], value: any) => boolean): void;
-export declare function deepEquals(a: any, b: any): boolean;

package/dist/src/utils/json-diff.js

@@ -3,8 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JsonDiffType = void 0;
 exports.isJsonChange = isJsonChange;
 exports.jsonDiff = jsonDiff;
-exports.walkJsonTree = walkJsonTree;
-exports.deepEquals = deepEquals;
+const native_1 = require("../native");
 var JsonDiffType;
 (function (JsonDiffType) {
     JsonDiffType["Deleted"] = "JsonPropertyDeleted";
@@ -16,97 +15,10 @@ function isJsonChange(change) {
         change.type === JsonDiffType.Deleted ||
         change.type === JsonDiffType.Modified);
 }
+/**
+ * The changes from `lhs` to `rhs`: every path whose value was deleted or
+ * modified, containers included, then every added path.
+ */
 function jsonDiff(lhs, rhs) {
-    const result = [];
-    const seenInLhs = new Set();
-    walkJsonTree(lhs, [], (path, lhsValue) => {
-        seenInLhs.add(hashArray(path));
-        const rhsValue = getJsonValue(path, rhs);
-        if (rhsValue === undefined) {
-            result.push({
-                type: JsonDiffType.Deleted,
-                path,
-                value: {
-                    lhs: lhsValue,
-                    rhs: undefined,
-                },
-            });
-        }
-        else if (!deepEquals(lhsValue, rhsValue)) {
-            result.push({
-                type: JsonDiffType.Modified,
-                path,
-                value: {
-                    lhs: lhsValue,
-                    rhs: rhsValue,
-                },
-            });
-        }
-        return typeof lhsValue === 'object' || Array.isArray(lhsValue);
-    });
-    walkJsonTree(rhs, [], (path, rhsValue) => {
-        const addedInRhs = !seenInLhs.has(hashArray(path));
-        if (addedInRhs) {
-            result.push({
-                type: JsonDiffType.Added,
-                path,
-                value: {
-                    lhs: undefined,
-                    rhs: rhsValue,
-                },
-            });
-        }
-        return typeof rhsValue === 'object' || Array.isArray(rhsValue);
-    });
-    return result;
-}
-// Depth-first walk down JSON tree.
-function walkJsonTree(json, currPath, visitor) {
-    if (!json || typeof json !== 'object') {
-        return;
-    }
-    Object.keys(json).forEach((key) => {
-        const path = currPath.concat([key]);
-        const shouldContinue = visitor(path, json[key]);
-        if (shouldContinue) {
-            walkJsonTree(json[key], path, visitor);
-        }
-    });
-}
-function hashArray(ary) {
-    return JSON.stringify(ary);
-}
-function getJsonValue(path, json) {
-    let curr = json;
-    for (const k of path) {
-        curr = curr[k];
-        if (curr === undefined) {
-            break;
-        }
-    }
-    return curr;
-}
-function deepEquals(a, b) {
-    if (a === b) {
-        return true;
-    }
-    // Values do not need to be checked for deep equality and the above is false
-    if (
-    // Values are different types
-    typeof a !== typeof b ||
-        // Values are the same type but not an object or array
-        (typeof a !== 'object' && !Array.isArray(a)) ||
-        // Objects are the same type, objects or arrays, but do not have the same number of keys
-        Object.keys(a).length !== Object.keys(b).length) {
-        return false;
-    }
-    // Values need to be checked for deep equality
-    return Object.entries(a).reduce((equal, [key, aValue]) => {
-        // Skip other keys if it is already not equal.
-        if (!equal) {
-            return equal;
-        }
-        // Traverse the object
-        return deepEquals(aValue, b[key]);
-    }, true);
+    return ((0, native_1.diffJson)(JSON.stringify(lhs ?? null), JSON.stringify(rhs ?? null)) ?? []);
 }

package/dist/src/utils/min-release-age/packument.js

@@ -17,7 +17,7 @@ function toArray(value) {
  */
 async function fetchRegistryMetadata(pkg) {
     const raw = await (0, package_manager_1.packageRegistryView)(pkg, '', ['--json']);
-    const parsed = JSON.parse(raw);
+    const parsed = (0, package_manager_1.parseRegistryViewJson)(raw);
     const time = parsed.time ?? null;
     if (time) {
         // The time map carries 'created'/'modified' alongside versions; they are

package/dist/src/utils/nx-cloud-utils.d.ts

@@ -1,4 +1,6 @@
 import { NxJsonConfiguration } from '../config/nx-json';
 export declare function isNxCloudDisabled(nxJson: NxJsonConfiguration): boolean;
 export declare function isNxCloudUsed(nxJson: NxJsonConfiguration): boolean;
+/** Whether nx.json connects the workspace to Nx Cloud, ignoring the env. */
+export declare function isNxCloudConfigured(nxJson: NxJsonConfiguration): boolean;
 export declare function getNxCloudUrl(nxJson: NxJsonConfiguration): string;

package/dist/src/utils/nx-cloud-utils.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isNxCloudDisabled = isNxCloudDisabled;
 exports.isNxCloudUsed = isNxCloudUsed;
+exports.isNxCloudConfigured = isNxCloudConfigured;
 exports.getNxCloudUrl = getNxCloudUrl;
 function isNxCloudDisabled(nxJson) {
     return process.env.NX_NO_CLOUD === 'true' || nxJson.neverConnectToCloud;
@@ -12,7 +13,11 @@ function isNxCloudUsed(nxJson) {
     }
     return (!!process.env.NX_CLOUD_AUTH_TOKEN ||
         !!process.env.NX_CLOUD_ACCESS_TOKEN ||
-        !!nxJson.nxCloudAccessToken ||
+        isNxCloudConfigured(nxJson));
+}
+/** Whether nx.json connects the workspace to Nx Cloud, ignoring the env. */
+function isNxCloudConfigured(nxJson) {
+    return (!!nxJson.nxCloudAccessToken ||
         !!nxJson.nxCloudId ||
         !!Object.values(nxJson.tasksRunnerOptions ?? {}).find((r) => r.runner == '@nrwl/nx-cloud' || r.runner == 'nx-cloud'));
 }

package/dist/src/utils/output.d.ts

@@ -12,14 +12,33 @@ export type CollapsibleTaskStatus = Extract<TaskStatus, 'success' | 'local-cache
  * routed, the two behave identically.
  */
 export declare function isStaticOutputStyle(outputStyle: string | undefined): boolean;
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+export declare function printsTaskOutput(outputStyle: string | undefined): boolean;
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style

package/dist/src/utils/output.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.output = void 0;
 exports.isStaticOutputStyle = isStaticOutputStyle;
+exports.printsTaskOutput = printsTaskOutput;
 exports.printsFullTaskOutput = printsFullTaskOutput;
 exports.isLogGroupingEnabled = isLogGroupingEnabled;
 exports.shouldGroupBatchOutput = shouldGroupBatchOutput;
@@ -23,14 +24,35 @@ const GH_GROUP_SUFFIX = '::endgroup::';
 function isStaticOutputStyle(outputStyle) {
     return outputStyle === 'static' || outputStyle === 'static-failures-only';
 }
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+function printsTaskOutput(outputStyle) {
+    return outputStyle !== 'summary';
+}
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style
@@ -43,8 +65,9 @@ function isStaticOutputStyle(outputStyle) {
  * ever being consulted — including for the continuous tasks that must stream.
  */
 function printsFullTaskOutput(args) {
-    return (!!args.verbose ||
-        (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only');
+    return (printsTaskOutput(args.outputStyle) &&
+        (!!args.verbose ||
+            (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only'));
 }
 /**
  * Whether task output should be wrapped in collapsible log groups. Grouping

package/dist/src/utils/package-json.d.ts

@@ -143,6 +143,31 @@ export declare function readModulePackageJson(moduleSpecifier: string, requirePa
     packageJson: PackageJson;
     path: string;
 };
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+export declare function resolveWithoutCachePollution(request: string, requirePaths: string[]): string;
 export declare function installPackageToTmp(pkg: string, requiredVersion: string, packageManager: PackageManager): {
     tempDir: string;
     cleanup: () => void;

package/dist/src/utils/package-json.js

@@ -8,12 +8,15 @@ exports.getTagsFromPackageJson = getTagsFromPackageJson;
 exports.readTargetsFromPackageJson = readTargetsFromPackageJson;
 exports.readModulePackageJsonWithoutFallbacks = readModulePackageJsonWithoutFallbacks;
 exports.readModulePackageJson = readModulePackageJson;
+exports.resolveWithoutCachePollution = resolveWithoutCachePollution;
 exports.installPackageToTmp = installPackageToTmp;
 exports.installPackageToTmpAsync = installPackageToTmpAsync;
 exports.getDependencyVersionFromPackageJson = getDependencyVersionFromPackageJson;
+const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const fs_1 = require("fs");
+const node_module_1 = tslib_1.__importStar(require("node:module"));
 const path_1 = require("path");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const tmp_1 = require("tmp");
@@ -169,9 +172,7 @@ function readTargetsFromPackageJson(packageJson, nxJson, projectRoot, workspaceR
  * @returns package json contents and path
  */
 function readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths = (0, installation_directory_1.getNxRequirePaths)()) {
-    const packageJsonPath = require.resolve(`${moduleSpecifier}/package.json`, {
-        paths: requirePaths,
-    });
+    const packageJsonPath = resolveWithoutCachePollution(`${moduleSpecifier}/package.json`, requirePaths);
     const packageJson = (0, fileutils_1.readJsonFile)(packageJsonPath);
     return {
         path: packageJsonPath,
@@ -200,9 +201,7 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
             readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths));
     }
     catch {
-        const entryPoint = require.resolve(moduleSpecifier, {
-            paths: requirePaths,
-        });
+        const entryPoint = resolveWithoutCachePollution(moduleSpecifier, requirePaths);
         let moduleRootPath = (0, path_1.dirname)(entryPoint);
         packageJsonPath = (0, path_1.join)(moduleRootPath, 'package.json');
         while (!(0, fs_1.existsSync)(packageJsonPath)) {
@@ -219,6 +218,42 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
         path: packageJsonPath,
     };
 }
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+function resolveWithoutCachePollution(request, requirePaths) {
+    // `_pathCache` is an internal Node API not exposed in @types/node.
+    const realCache = node_module_1.default._pathCache;
+    node_module_1.default._pathCache = Object.create(null);
+    try {
+        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
+        return detachedRequire.resolve(request, { paths: requirePaths });
+    }
+    finally {
+        node_module_1.default._pathCache = realCache;
+    }
+}
 /**
  * Prepares all necessary information for installing a package to a temporary directory.
  * This is used by both sync and async installation functions.
@@ -244,11 +279,18 @@ function preparePackageInstallation(pkg, requiredVersion, packageManager) {
     // npm needs `--legacy-peer-deps` rather than `--omit=peer`: npm marks a package
     // as a peer if anything in the tree peer-depends on it, so `--omit=peer` also
     // prunes packages that are real dependencies. Bun's `--omit=peer` does not.
+    //
+    // pnpm has no plain flag for it. Up to 11 it takes `--config.<setting>`;
+    // pnpm 12 gave `--config` a meaning of its own and takes the setting from
+    // the environment instead.
     const skipPeerDependenciesFlags = {
         npm: '--legacy-peer-deps',
         bun: '--omit=peer',
         pnpm: '--config.auto-install-peers=false',
     };
+    const skipPeerDependenciesEnv = packageManager === 'pnpm'
+        ? { PNPM_CONFIG_AUTO_INSTALL_PEERS: 'false' }
+        : {};
     const installCommand = [
         pmCommands.addDev,
         `${pkg}@${requiredVersion}`,
@@ -266,6 +308,7 @@ function preparePackageInstallation(pkg, requiredVersion, packageManager) {
         env: {
             ...process.env,
             YARN_ENABLE_SCRIPTS: 'false',
+            ...skipPeerDependenciesEnv,
         },
     };
     return {