@ohos-ports/nx 23.2.0-beta.0 → 23.2.1-beta.0

package/dist/src/command-line/migrate/agentic/definitions.js

@@ -1,148 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_DEFINITIONS = exports.opencodeDefinition = exports.codexDefinition = exports.claudeCodeDefinition = void 0;
-exports.getAgentDefinition = getAgentDefinition;
-const os_1 = require("os");
-const path_1 = require("path");
-const types_1 = require("./types");
-// --- Claude Code ---------------------------------------------------------
-function claudeCodeWellKnownPaths() {
-    if (process.platform === 'win32') {
-        const home = process.env.USERPROFILE;
-        return home ? [(0, path_1.join)(home, '.local', 'bin', 'claude.exe')] : [];
-    }
-    return [(0, path_1.join)((0, os_1.homedir)(), '.claude', 'local', 'claude')];
-}
-/**
- * The run directory names Nx will interpolate into a permission rule. A rule
- * is a gitignore pattern, which reads `*?[]\` as syntax, and `--allowedTools`
- * splits its value on commas and spaces, so a name carrying any of those
- * would change what the rule authorizes rather than what it names. Run
- * directory names derive from a migration's own version string, which nothing
- * upstream constrains to this alphabet. The leading character rejects `.`
- * and `..`.
- */
-const RULE_SAFE_RUN_DIR_NAME = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
-/**
- * Pre-authorizes the handoff write. Claude Code's default permission mode
- * asks before a file write it has no allow rule for, so without this every
- * step ends on an approval prompt for Nx's own handoff scratch.
- *
- * The rule reaches one run's handoffs and nothing else. Its own run
- * directory also holds state Nx wrote and reads back, and the sibling
- * directories belong to other runs, including an orchestrated run whose
- * handoffs decide how its steps settle. `Edit` is the only tool name file
- * rules are matched against, and it covers creating the file as well as
- * correcting one already written. Prefix-less patterns resolve against the
- * session cwd, pinned to the workspace root below.
- *
- * Returns null for a name it cannot express, which costs the approval prompt
- * this exists to avoid. That beats widening the rule, and nothing narrower is
- * available: Claude Code has no escape for a literal path.
- */
-function claudeCodeHandoffAllowedTools(runDirName) {
-    if (!RULE_SAFE_RUN_DIR_NAME.test(runDirName)) {
-        return null;
-    }
-    return `Edit(${types_1.MIGRATE_RUNS_RELATIVE_DIR}/${runDirName}/${types_1.HANDOFFS_DIR_NAME}/**)`;
-}
-function claudeCodeBuildInteractive(ctx) {
-    const allowedTools = claudeCodeHandoffAllowedTools(ctx.runDirName);
-    return {
-        // `--allowedTools` is variadic (space/comma separated): a positional
-        // placed right after its value gets swallowed as another rule. The rules
-        // must stay in one comma-joined element with a non-variadic flag
-        // (`--system-prompt`) between them and the user prompt.
-        args: [
-            ...(allowedTools ? ['--allowedTools', allowedTools] : []),
-            '--system-prompt',
-            ctx.systemContext,
-            ctx.userPrompt,
-        ],
-        cwd: ctx.workspaceRoot,
-    };
-}
-exports.claudeCodeDefinition = {
-    id: 'claude-code',
-    displayName: 'Claude Code',
-    binaryNames: ['claude'],
-    wellKnownPaths: claudeCodeWellKnownPaths,
-    buildInteractive: claudeCodeBuildInteractive,
-};
-// --- OpenAI Codex --------------------------------------------------------
-function codexWellKnownPaths() {
-    return [];
-}
-// No handoff permission flag: codex's default sandbox already allows writes
-// inside the cwd tree without prompting, and a user-hardened read-only config
-// is a deliberate choice we don't override.
-function codexBuildInteractive(ctx) {
-    return {
-        args: ['-c', `developer_instructions=${ctx.systemContext}`, ctx.userPrompt],
-        cwd: ctx.workspaceRoot,
-    };
-}
-exports.codexDefinition = {
-    id: 'codex',
-    displayName: 'OpenAI Codex',
-    binaryNames: ['codex'],
-    wellKnownPaths: codexWellKnownPaths,
-    buildInteractive: codexBuildInteractive,
-};
-// --- OpenCode ------------------------------------------------------------
-const OPENCODE_TRANSIENT_AGENT_NAME = 'nx-migrate';
-function opencodeWellKnownPaths() {
-    if (process.platform === 'win32') {
-        return [];
-    }
-    const candidates = [];
-    const home = (0, os_1.homedir)();
-    const installDir = process.env.OPENCODE_INSTALL_DIR;
-    const xdgBinDir = process.env.XDG_BIN_DIR;
-    if (installDir) {
-        candidates.push((0, path_1.join)(installDir, 'opencode'));
-    }
-    if (xdgBinDir) {
-        candidates.push((0, path_1.join)(xdgBinDir, 'opencode'));
-    }
-    candidates.push((0, path_1.join)(home, 'bin', 'opencode'));
-    candidates.push((0, path_1.join)(home, '.opencode', 'bin', 'opencode'));
-    return candidates;
-}
-// No handoff permission config: opencode's `edit` permission defaults to
-// allow, and injecting one would clobber (not merge with) a user's own
-// permission patterns.
-function opencodeBuildInteractive(ctx) {
-    const config = {
-        agent: {
-            [OPENCODE_TRANSIENT_AGENT_NAME]: { prompt: ctx.systemContext },
-        },
-    };
-    return {
-        args: [
-            '--agent',
-            OPENCODE_TRANSIENT_AGENT_NAME,
-            '--prompt',
-            ctx.userPrompt,
-        ],
-        env: { OPENCODE_CONFIG_CONTENT: JSON.stringify(config) },
-        cwd: ctx.workspaceRoot,
-    };
-}
-exports.opencodeDefinition = {
-    id: 'opencode',
-    displayName: 'OpenCode',
-    binaryNames: ['opencode'],
-    wellKnownPaths: opencodeWellKnownPaths,
-    buildInteractive: opencodeBuildInteractive,
-};
-// --- Registry ------------------------------------------------------------
-exports.AGENT_DEFINITIONS = [
-    exports.claudeCodeDefinition,
-    exports.codexDefinition,
-    exports.opencodeDefinition,
-];
-const byId = new Map(exports.AGENT_DEFINITIONS.map((definition) => [definition.id, definition]));
-function getAgentDefinition(id) {
-    return byId.get(id);
-}

package/dist/src/command-line/migrate/agentic/detect-installed.d.ts

@@ -1,10 +0,0 @@
-import { AgentDefinition, DetectedInstalledAgent } from './types';
-/**
- * Probes each given agent definition for an installed binary on the user's
- * machine. PATH is checked first via `which` (which handles Windows PATHEXT),
- * then the per-agent well-known fallback paths. Probes run in parallel.
- *
- * Returns only the agents that were found, preserving the order of the input
- * `definitions` argument for callers that rely on it for picker presentation.
- */
-export declare function detectInstalledAgents(definitions: readonly AgentDefinition[]): Promise<DetectedInstalledAgent[]>;

package/dist/src/command-line/migrate/agentic/detect-installed.js

@@ -1,68 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectInstalledAgents = detectInstalledAgents;
-const tslib_1 = require("tslib");
-const promises_1 = require("fs/promises");
-const which_1 = tslib_1.__importDefault(require("which"));
-const logger_1 = require("../../../utils/logger");
-async function isExecutable(path) {
-    try {
-        await (0, promises_1.access)(path, promises_1.constants.X_OK);
-        return true;
-    }
-    catch (err) {
-        // EACCES on an existing path means "this looks installed but we can't
-        // execute it" — surface so the user can answer "why isn't my agent
-        // detected?" without grep-debugging the filesystem.
-        const code = err?.code;
-        if (code && code !== 'ENOENT') {
-            logger_1.logger.verbose(`Agent detection: cannot probe ${path} (${code}).`);
-        }
-        return false;
-    }
-}
-async function findOnPath(binaryNames) {
-    for (const name of binaryNames) {
-        // `{ nothrow: true }` avoids the throw-per-missing-binary overhead;
-        // EACCES on existing-but-unexecutable paths is handled by `isExecutable`.
-        const found = await (0, which_1.default)(name, { nothrow: true });
-        if (typeof found === 'string') {
-            return found;
-        }
-    }
-    return null;
-}
-async function detectOne(definition) {
-    const onPath = await findOnPath(definition.binaryNames);
-    if (onPath) {
-        return {
-            id: definition.id,
-            displayName: definition.displayName,
-            binary: onPath,
-            source: 'path',
-        };
-    }
-    for (const candidate of definition.wellKnownPaths()) {
-        if (await isExecutable(candidate)) {
-            return {
-                id: definition.id,
-                displayName: definition.displayName,
-                binary: candidate,
-                source: 'well-known',
-            };
-        }
-    }
-    return null;
-}
-/**
- * Probes each given agent definition for an installed binary on the user's
- * machine. PATH is checked first via `which` (which handles Windows PATHEXT),
- * then the per-agent well-known fallback paths. Probes run in parallel.
- *
- * Returns only the agents that were found, preserving the order of the input
- * `definitions` argument for callers that rely on it for picker presentation.
- */
-async function detectInstalledAgents(definitions) {
-    const results = await Promise.all(definitions.map(detectOne));
-    return results.filter((result) => result !== null);
-}

package/dist/src/command-line/migrate/agentic/handoff-gitignore.d.ts

@@ -1,61 +0,0 @@
-/**
- * Both the agentic runner and the orchestrator write per-run scratch under
- * `.nx/migrate-runs/<run-id>/`: handoff files in both cases, plus the durable
- * run state and its plan snapshots for the orchestrator. The v23 migration
- * `23-0-0-add-migrate-runs-to-git-ignore` adds `.nx/migrate-runs` to
- * `.gitignore`; in its declared slot (typically late) earlier per-migration
- * commits would absorb the scratch into the user-visible diff.
- *
- * Two paths cover the leak, with no overlap:
- *
- *   1. HOIST: `sortMigrations`, which `executeMigrations` applies, sorts the
- *      v23 migration to position 0 when it is in the queue, so it runs first
- *      through the normal runner with its own log line and commit. A
- *      single-migration worker run needs no hoisting: the requested migration
- *      is the entire queue.
- *
- *   2. INLINE FALLBACK, this function. When the migration is NOT in the queue
- *      AND the highest target version is < v23 (intra-pre-v23 `--agentic`
- *      run) it will never run, so apply its body inline against an `FsTree`
- *      and commit it as a standalone preflight commit (or leave it in the
- *      working tree under `--no-create-commits`).
- *
- * Not in the queue AND target >= v23 means the user is already past v23. They
- * had the entry historically; if it is gone, that is a conscious removal we
- * respect.
- */
-export declare function applyAgenticHandoffGitignoreFallback({ migrations, installedNxVersion, effectiveCreateCommits, commitPrefix, root, applyWhenPlanned, commitStandalone, }: {
-    migrations: ReadonlyArray<{
-        package: string;
-        name: string;
-    }>;
-    /**
-     * The version of `nx` currently installed in the workspace. After
-     * `nx migrate latest` runs (the step before `--run-migrations`), this is
-     * the target nx version. We use it as the v23 cutoff instead of walking
-     * the migration list: any third-party plugin migration with a `23.x`
-     * version is irrelevant to whether `nx` itself crossed v23.
-     */
-    installedNxVersion: string;
-    effectiveCreateCommits: boolean;
-    commitPrefix: string;
-    root: string;
-    /**
-     * Apply the entry even when the hoisted migration is in the plan. The
-     * classic loop can defer to that migration because its run scratch appears
-     * only after migration 1 has run; the orchestrator creates its run dir at
-     * init, before any migration, so it needs the entry immediately. A planned
-     * migration also means the missing entry is not a conscious removal, so the
-     * v23 cutoff does not apply.
-     */
-    applyWhenPlanned?: boolean;
-    /**
-     * Commit the applied entry as its own preflight commit (the default). The
-     * orchestrator suppresses this: it applies the fallback before its init
-     * checkpoint so the checkpoint's `git add -A` cannot sweep in older
-     * scratch, and in that ordering a standalone commit here would carry the
-     * user's pre-existing changes along with the entry. The checkpoint that
-     * follows captures both instead.
-     */
-    commitStandalone?: boolean;
-}): Promise<void>;

package/dist/src/command-line/migrate/agentic/handoff-gitignore.js

@@ -1,78 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyAgenticHandoffGitignoreFallback = applyAgenticHandoffGitignoreFallback;
-const tslib_1 = require("tslib");
-const semver_1 = require("semver");
-const pc = tslib_1.__importStar(require("picocolors"));
-const add_migrate_runs_to_git_ignore_1 = tslib_1.__importDefault(require("../../../migrations/update-23-0-0/add-migrate-runs-to-git-ignore"));
-const tree_1 = require("../../../generators/tree");
-const git_utils_1 = require("../../../utils/git-utils");
-const logger_1 = require("../../../utils/logger");
-const types_1 = require("./types");
-/**
- * Both the agentic runner and the orchestrator write per-run scratch under
- * `.nx/migrate-runs/<run-id>/`: handoff files in both cases, plus the durable
- * run state and its plan snapshots for the orchestrator. The v23 migration
- * `23-0-0-add-migrate-runs-to-git-ignore` adds `.nx/migrate-runs` to
- * `.gitignore`; in its declared slot (typically late) earlier per-migration
- * commits would absorb the scratch into the user-visible diff.
- *
- * Two paths cover the leak, with no overlap:
- *
- *   1. HOIST: `sortMigrations`, which `executeMigrations` applies, sorts the
- *      v23 migration to position 0 when it is in the queue, so it runs first
- *      through the normal runner with its own log line and commit. A
- *      single-migration worker run needs no hoisting: the requested migration
- *      is the entire queue.
- *
- *   2. INLINE FALLBACK, this function. When the migration is NOT in the queue
- *      AND the highest target version is < v23 (intra-pre-v23 `--agentic`
- *      run) it will never run, so apply its body inline against an `FsTree`
- *      and commit it as a standalone preflight commit (or leave it in the
- *      working tree under `--no-create-commits`).
- *
- * Not in the queue AND target >= v23 means the user is already past v23. They
- * had the entry historically; if it is gone, that is a conscious removal we
- * respect.
- */
-async function applyAgenticHandoffGitignoreFallback({ migrations, installedNxVersion, effectiveCreateCommits, commitPrefix, root, applyWhenPlanned = false, commitStandalone = true, }) {
-    if (migrations.some(types_1.isHandoffGitignoreMigration)) {
-        if (!applyWhenPlanned) {
-            // The queue runs it itself: hoisted to the front by the sort comparator
-            // in a full run, or as the single requested migration in a worker run.
-            return;
-        }
-    }
-    else if ((0, semver_1.major)(installedNxVersion) >= 23) {
-        // User is past v23. Respect their `.gitignore` state — if the entry
-        // is missing, that's a conscious removal.
-        return;
-    }
-    const tree = new tree_1.FsTree(root, false);
-    await (0, add_migrate_runs_to_git_ignore_1.default)(tree);
-    const changes = tree.listChanges();
-    if (changes.length === 0) {
-        // Migration body short-circuited (no `.gitignore`, Lerna without nx.json,
-        // or the entry is already covered by an existing pattern).
-        return;
-    }
-    (0, tree_1.flushChanges)(root, changes);
-    logger_1.logger.info(pc.dim(`- Added ${types_1.MIGRATE_RUNS_RELATIVE_DIR} to .gitignore so this run's scratch state is ignored.`));
-    if (!effectiveCreateCommits || !commitStandalone)
-        return;
-    if (!(0, git_utils_1.hasUncommittedChanges)(root))
-        return;
-    try {
-        const sha = (0, git_utils_1.tryCommitChanges)(`${commitPrefix}add ${types_1.MIGRATE_RUNS_RELATIVE_DIR} to .gitignore`, root, [types_1.MIGRATE_RUNS_RELATIVE_DIR]);
-        if (sha) {
-            logger_1.logger.info(pc.dim(`  Commit: ${sha}`));
-        }
-        // `null` return = commit landed but `git rev-parse HEAD` raced. The
-        // diff cleared from the working tree; nothing more to say.
-    }
-    catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        logger_1.logger.info(pc.yellow(`Could not create the agentic preflight commit:\n${reason}\n` +
-            `The .gitignore change remains in the working tree; commit it manually or it will be absorbed into the first per-migration commit.`));
-    }
-}

package/dist/src/command-line/migrate/agentic/handoff.d.ts

@@ -1,69 +0,0 @@
-import { HandoffFile } from './types';
-/** Returns the run directory for a given workspace + run id (target version). */
-export declare function runDirPath(workspaceRoot: string, runId: string): string;
-/** The version-derived run id: the highest target version in the plan. */
-export declare function resolveAgenticRunId(migrations: ReadonlyArray<{
-    version: string;
-}>): string;
-/**
- * `mkdir -p` with a contextual error wrapper. Without this, the raw
- * ENOSPC/EACCES/EROFS surfaces with no indication of which directory the
- * migrate orchestrator was trying to create.
- */
-export declare function mkdirSafely(dir: string, purpose: string): void;
-/**
- * Wipes any prior contents for this run id and recreates an empty directory.
- *
- * Scope of the wipe is intentionally narrow (only `<run-id>/`) so that handoff
- * artifacts from prior runs targeting different versions remain on disk for
- * inspection.
- */
-export declare function initRunDir(workspaceRoot: string, runId: string): string;
-/**
- * Absolute path of the handoff file for a migration step within a run, under
- * the run directory's `handoffs/` subtree: the pre-authorized write scope
- * stops there, so a handoff placed anywhere else costs an approval prompt.
- * The package's scope (if any) becomes a real subdirectory so the package name
- * stays readable; two packages can ship a migration with the same name without
- * colliding because they land in different package subdirectories. Each
- * segment is sanitized so the path is always writable on every platform.
- */
-export declare function stepHandoffPath(runDir: string, migration: {
-    package: string;
-    name: string;
-}): string;
-export type HandoffReadFailureReason = 'missing' | 'read-error' | 'parse-error' | 'shape-mismatch';
-export type HandoffReadResult = {
-    ok: true;
-    handoff: HandoffFile;
-} | {
-    ok: false;
-    reason: HandoffReadFailureReason;
-    detail?: string;
-};
-/**
- * Reads and validates a handoff file written by an agent. Returns a tagged
- * result so callers (the in-loop poller and the post-exit resolver) can
- * distinguish "file not yet written" from "file written but garbage" — the
- * latter is surfaced to the user instead of being collapsed into the same
- * generic ambiguous-outcome prompt.
- */
-export declare function readHandoffWithReason(filePath: string): HandoffReadResult;
-/**
- * Convenience wrapper preserving the original null-on-any-failure contract.
- * Used by the polling loop (`waitForValidHandoff`) where every failure mode
- * is "keep waiting" — the file may be missing, mid-write, or being rewritten.
- */
-export declare function readHandoff(filePath: string): HandoffFile | null;
-/**
- * Polls for a valid handoff file. Resolves once `readHandoff` accepts the
- * file's contents. Used to detect when the agent has finished its work so the
- * orchestrator can close the agent's session without depending on the agent
- * exiting on its own.
- *
- * Rejects with the abort reason when `options.signal` is aborted.
- */
-export declare function waitForValidHandoff(handoffFilePath: string, options?: {
-    intervalMs?: number;
-    signal?: AbortSignal;
-}): Promise<void>;

package/dist/src/command-line/migrate/agentic/handoff.js

@@ -1,193 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runDirPath = runDirPath;
-exports.resolveAgenticRunId = resolveAgenticRunId;
-exports.mkdirSafely = mkdirSafely;
-exports.initRunDir = initRunDir;
-exports.stepHandoffPath = stepHandoffPath;
-exports.readHandoffWithReason = readHandoffWithReason;
-exports.readHandoff = readHandoff;
-exports.waitForValidHandoff = waitForValidHandoff;
-const fs_1 = require("fs");
-const path_1 = require("path");
-const semver_1 = require("semver");
-const version_utils_1 = require("../version-utils");
-const types_1 = require("./types");
-/** Returns the run directory for a given workspace + run id (target version). */
-function runDirPath(workspaceRoot, runId) {
-    return (0, path_1.join)(workspaceRoot, types_1.MIGRATE_RUNS_RELATIVE_DIR, runId);
-}
-/** The version-derived run id: the highest target version in the plan. */
-function resolveAgenticRunId(migrations) {
-    return (0, semver_1.rsort)(migrations.map((m) => (0, version_utils_1.normalizeVersion)(m.version)))[0];
-}
-/**
- * `mkdir -p` with a contextual error wrapper. Without this, the raw
- * ENOSPC/EACCES/EROFS surfaces with no indication of which directory the
- * migrate orchestrator was trying to create.
- */
-function mkdirSafely(dir, purpose) {
-    try {
-        (0, fs_1.mkdirSync)(dir, { recursive: true });
-    }
-    catch (err) {
-        const code = err?.code;
-        // `{ cause }` preserves the original ErrnoException so callers can read
-        // `.cause.code`/`.cause.path`/`.cause.syscall` for targeted remediation.
-        // Without it the only signal beyond the formatted message would be the
-        // code string we splice in below.
-        throw new Error(`Could not create ${purpose} at ${dir}${code ? ` (${code})` : ''}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-    }
-}
-/**
- * Wipes any prior contents for this run id and recreates an empty directory.
- *
- * Scope of the wipe is intentionally narrow (only `<run-id>/`) so that handoff
- * artifacts from prior runs targeting different versions remain on disk for
- * inspection.
- */
-function initRunDir(workspaceRoot, runId) {
-    const dir = runDirPath(workspaceRoot, runId);
-    (0, fs_1.rmSync)(dir, { recursive: true, force: true });
-    mkdirSafely(dir, 'nx migrate run directory');
-    return dir;
-}
-// Windows reserved device names fail to open even with an extension —
-// a migration named `CON` would otherwise produce a `CON.json` that the
-// agent can't write to.
-const WINDOWS_RESERVED_NAMES = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
-/**
- * The bare `.` / `..` check must come first — otherwise a malformed migration
- * name of exactly `..` would let the handoff write escape the run directory.
- */
-function sanitizeSegment(value) {
-    if (value === '.' || value === '..')
-        return '_';
-    let sanitized = value.replace(/[\x00-\x1f<>:"/\\|?*]/g, '_');
-    // Windows forbids trailing dots/spaces on file/directory names.
-    sanitized = sanitized.replace(/[. ]+$/, '');
-    if (WINDOWS_RESERVED_NAMES.test(sanitized)) {
-        sanitized = `_${sanitized}`;
-    }
-    return sanitized || '_';
-}
-/**
- * Absolute path of the handoff file for a migration step within a run, under
- * the run directory's `handoffs/` subtree: the pre-authorized write scope
- * stops there, so a handoff placed anywhere else costs an approval prompt.
- * The package's scope (if any) becomes a real subdirectory so the package name
- * stays readable; two packages can ship a migration with the same name without
- * colliding because they land in different package subdirectories. Each
- * segment is sanitized so the path is always writable on every platform.
- */
-function stepHandoffPath(runDir, migration) {
-    return (0, path_1.join)(runDir, types_1.HANDOFFS_DIR_NAME, ...migration.package.split('/').map(sanitizeSegment), `${sanitizeSegment(migration.name)}.json`);
-}
-/**
- * Reads and validates a handoff file written by an agent. Returns a tagged
- * result so callers (the in-loop poller and the post-exit resolver) can
- * distinguish "file not yet written" from "file written but garbage" — the
- * latter is surfaced to the user instead of being collapsed into the same
- * generic ambiguous-outcome prompt.
- */
-function readHandoffWithReason(filePath) {
-    let raw;
-    try {
-        raw = (0, fs_1.readFileSync)(filePath, 'utf-8');
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === 'ENOENT')
-            return { ok: false, reason: 'missing' };
-        return {
-            ok: false,
-            reason: 'read-error',
-            detail: err instanceof Error ? err.message : String(err),
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            reason: 'parse-error',
-            detail: err instanceof Error ? err.message : String(err),
-        };
-    }
-    if (!parsed ||
-        typeof parsed !== 'object' ||
-        Array.isArray(parsed) ||
-        typeof parsed.summary !== 'string') {
-        return { ok: false, reason: 'shape-mismatch' };
-    }
-    const obj = parsed;
-    const status = obj.status;
-    const summary = obj.summary;
-    if (status !== 'success' && status !== 'failed') {
-        return { ok: false, reason: 'shape-mismatch' };
-    }
-    // Null-prototype object guards against a prototype-pollution gadget:
-    // JSON.parse materializes `__proto__` as an own enumerable property, and
-    // a rest-spread would carry it through to wherever extras gets merged.
-    const extras = Object.create(null);
-    for (const key of Object.keys(obj)) {
-        if (key === 'status' || key === 'summary')
-            continue;
-        extras[key] = obj[key];
-    }
-    const handoff = { status, summary: summary };
-    if (Object.keys(extras).length > 0) {
-        handoff.extras = extras;
-    }
-    return { ok: true, handoff };
-}
-/**
- * Convenience wrapper preserving the original null-on-any-failure contract.
- * Used by the polling loop (`waitForValidHandoff`) where every failure mode
- * is "keep waiting" — the file may be missing, mid-write, or being rewritten.
- */
-function readHandoff(filePath) {
-    const result = readHandoffWithReason(filePath);
-    return result.ok ? result.handoff : null;
-}
-/**
- * Polls for a valid handoff file. Resolves once `readHandoff` accepts the
- * file's contents. Used to detect when the agent has finished its work so the
- * orchestrator can close the agent's session without depending on the agent
- * exiting on its own.
- *
- * Rejects with the abort reason when `options.signal` is aborted.
- */
-function waitForValidHandoff(handoffFilePath, options = {}) {
-    const intervalMs = options.intervalMs ?? 500;
-    const { signal } = options;
-    return new Promise((resolve, reject) => {
-        if (signal?.aborted) {
-            reject(signal.reason ?? new Error('aborted'));
-            return;
-        }
-        let timer;
-        const onAbort = () => {
-            if (timer)
-                clearTimeout(timer);
-            signal?.removeEventListener('abort', onAbort);
-            reject(signal.reason ?? new Error('aborted'));
-        };
-        const tick = () => {
-            if (signal?.aborted) {
-                onAbort();
-                return;
-            }
-            if (readHandoff(handoffFilePath) !== null) {
-                signal?.removeEventListener('abort', onAbort);
-                resolve();
-                return;
-            }
-            timer = setTimeout(tick, intervalMs);
-        };
-        signal?.addEventListener('abort', onAbort);
-        timer = setTimeout(tick, intervalMs);
-    });
-}

package/dist/src/command-line/migrate/agentic/inception.d.ts

@@ -1,9 +0,0 @@
-/**
- * Returns true when `nx migrate` is itself being run from inside another AI
- * agent's terminal session. Used to short-circuit the agentic flow so we never
- * spawn an inner agent inside an outer agent.
- *
- * Native `isAiAgent()` covers all supported agents (Claude Code, Cursor,
- * OpenCode, Codex, Gemini, Replit) via parent-process env-var sniffing.
- */
-export declare function isInsideAgent(): boolean;

package/dist/src/command-line/migrate/agentic/inception.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isInsideAgent = isInsideAgent;
-const native_1 = require("../../../native");
-/**
- * Returns true when `nx migrate` is itself being run from inside another AI
- * agent's terminal session. Used to short-circuit the agentic flow so we never
- * spawn an inner agent inside an outer agent.
- *
- * Native `isAiAgent()` covers all supported agents (Claude Code, Cursor,
- * OpenCode, Codex, Gemini, Replit) via parent-process env-var sniffing.
- */
-function isInsideAgent() {
-    return (0, native_1.isAiAgent)();
-}

package/dist/src/command-line/migrate/agentic/print-dropped-agent-context.d.ts

@@ -1,17 +0,0 @@
-export interface DroppedAgentContextInput {
-    migration: {
-        package: string;
-        name: string;
-        prompt?: string;
-    };
-    agentContext: string[];
-}
-export declare function formatDroppedAgentContextForOuterAgent(input: DroppedAgentContextInput): string;
-export declare function escapeXmlAttr(value: string): string;
-/**
- * Both the classic loop and the single-migration worker call this only under
- * `agentic.kind === 'inside-agent'`. Under `enabled` the inner agent step
- * consumes `agentContext` through the prompt builders; under `disabled` the
- * run is human-driven and agent-targeted context is only noise.
- */
-export declare function printDroppedAgentContextForOuterAgent(input: DroppedAgentContextInput): void;