@ohos-ports/nx 23.2.1-beta.0 → 23.3.0-beta.0

package/dist/src/daemon/message-types/task-history.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECORD_TASK_RUNS = exports.GET_ESTIMATED_TASK_TIMINGS = exports.GET_FLAKY_TASKS = void 0;
+exports.isHandleGetFlakyTasksMessage = isHandleGetFlakyTasksMessage;
+exports.isHandleGetEstimatedTaskTimings = isHandleGetEstimatedTaskTimings;
+exports.isHandleWriteTaskRunsToHistoryMessage = isHandleWriteTaskRunsToHistoryMessage;
+exports.GET_FLAKY_TASKS = 'GET_FLAKY_TASKS';
+exports.GET_ESTIMATED_TASK_TIMINGS = 'GET_ESTIMATED_TASK_TIMINGS';
+exports.RECORD_TASK_RUNS = 'RECORD_TASK_RUNS';
+function isHandleGetFlakyTasksMessage(message) {
+    return (typeof message === 'object' &&
+        message !== null &&
+        'type' in message &&
+        message['type'] === exports.GET_FLAKY_TASKS);
+}
+function isHandleGetEstimatedTaskTimings(message) {
+    return (typeof message === 'object' &&
+        message !== null &&
+        'type' in message &&
+        message['type'] === exports.GET_ESTIMATED_TASK_TIMINGS);
+}
+function isHandleWriteTaskRunsToHistoryMessage(message) {
+    return (typeof message === 'object' &&
+        message !== null &&
+        'type' in message &&
+        message['type'] === exports.RECORD_TASK_RUNS);
+}

package/dist/src/daemon/message-types/ultracache-configuration-version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * One stored version of a commit's Ultracache configurations: what crosses
+ * the socket in place of the handle.
+ */
+export interface UltracacheConfigurationVersion {
+    commit: string;
+    fetchedAt: number;
+}

package/dist/src/daemon/message-types/ultracache-configuration-version.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/daemon/message-types/update-workspace-context.d.ts

@@ -0,0 +1,8 @@
+export declare const UPDATE_WORKSPACE_CONTEXT: 'UPDATE_WORKSPACE_CONTEXT';
+export type HandleUpdateWorkspaceContextMessage = {
+    type: typeof UPDATE_WORKSPACE_CONTEXT;
+    createdFiles: string[];
+    updatedFiles: string[];
+    deletedFiles: string[];
+};
+export declare function isHandleUpdateWorkspaceContextMessage(message: unknown): message is HandleUpdateWorkspaceContextMessage;

package/dist/src/daemon/message-types/update-workspace-context.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPDATE_WORKSPACE_CONTEXT = void 0;
+exports.isHandleUpdateWorkspaceContextMessage = isHandleUpdateWorkspaceContextMessage;
+exports.UPDATE_WORKSPACE_CONTEXT = 'UPDATE_WORKSPACE_CONTEXT';
+function isHandleUpdateWorkspaceContextMessage(message) {
+    return (typeof message === 'object' &&
+        message !== null &&
+        'type' in message &&
+        message['type'] === exports.UPDATE_WORKSPACE_CONTEXT);
+}

package/dist/src/daemon/sandbox-socket-hint.d.ts

@@ -0,0 +1,27 @@
+export interface SandboxSocketHintOptions {
+    /**
+     * Pass `true` only when an errno proves the operating system refused the
+     * socket (`EPERM`/`EACCES` on a bind or connect). Most callers reach this
+     * hint holding a failure that denied permission only explains — a worker
+     * that died before it reported anything, an internal daemon error — and for
+     * those the lead line offers the cause rather than asserting it.
+     */
+    certain?: boolean;
+}
+/**
+ * Guidance for a unix socket Nx was not allowed to use. The lead line names
+ * denied permission, which is the part Nx can observe; a sandbox is the most
+ * common source but not the only one, so which remedy applies is left to the
+ * list rather than decided in the first sentence.
+ *
+ * Every sandbox-shaped line — the `configure-ai-agents` remediation, the
+ * per-agent setting, the knowledge base link — is dropped unless a sandbox is
+ * actually running. A root-owned socket dir on a plain workstation reaches this
+ * hint too, and there the permission line is the whole truth, so it is stated
+ * outright rather than offered as the one item of a list.
+ *
+ * Lives in its own module (rather than the daemon client) so that plugin
+ * workers and the plugin host can use it without pulling in the daemon
+ * client's module-level `DaemonClient` singleton.
+ */
+export declare function sandboxSocketHint({ certain, }?: SandboxSocketHintOptions): string[];

package/dist/src/daemon/sandbox-socket-hint.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sandboxSocketHint = sandboxSocketHint;
+const native_1 = require("../native");
+const is_sandbox_1 = require("../utils/is-sandbox");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
+/**
+ * The containers a sandbox has to allow, best first — not the directory finally
+ * used. Socket resolution walks a chain and the winning tier depends on what it
+ * could establish, so naming one root would be wrong wherever the other was
+ * picked. These are also the paths an allowlist entry covers: everything Nx
+ * binds lives beneath them.
+ *
+ * The home root is shown as the literal `~/.nx` rather than expanded, because a
+ * committed allowlist entry has to expand per user to be worth sharing.
+ *
+ * A configured NX_SOCKET_DIR overrides the chain entirely, so it is named on its
+ * own — pointing someone at the default roots when their sockets are somewhere
+ * else is worse than saying nothing. `||` rather than `??` matches how
+ * `tmp-dir` reads it: an empty value means unset.
+ *
+ * Read from `utils/nx-tmp-dir` rather than from `daemon/tmp-dir`, whose module
+ * scope establishes directories and resolves a socket tier on import. Plugin
+ * workers print this hint, and must not pay that to do it.
+ */
+function socketRoots() {
+    const configured = process.env.NX_SOCKET_DIR || process.env.NX_DAEMON_SOCKET_DIR;
+    if (configured) {
+        return configured;
+    }
+    return [nx_tmp_dir_1.NX_TMP_DIR, nx_tmp_dir_1.NX_HOME_TMP_DIR ? '~/.nx' : undefined]
+        .filter(Boolean)
+        .join(' or ');
+}
+/**
+ * Guidance for a unix socket Nx was not allowed to use. The lead line names
+ * denied permission, which is the part Nx can observe; a sandbox is the most
+ * common source but not the only one, so which remedy applies is left to the
+ * list rather than decided in the first sentence.
+ *
+ * Every sandbox-shaped line — the `configure-ai-agents` remediation, the
+ * per-agent setting, the knowledge base link — is dropped unless a sandbox is
+ * actually running. A root-owned socket dir on a plain workstation reaches this
+ * hint too, and there the permission line is the whole truth, so it is stated
+ * outright rather than offered as the one item of a list.
+ *
+ * Lives in its own module (rather than the daemon client) so that plugin
+ * workers and the plugin host can use it without pulling in the daemon
+ * client's module-level `DaemonClient` singleton.
+ */
+function sandboxSocketHint({ certain = false, } = {}) {
+    const roots = socketRoots();
+    const sandboxRemedy = sandboxSpecificRemedy(roots, certain);
+    const lead = certain
+        ? `Nx was denied permission to use its unix socket under ${roots}.`
+        : `Nx could not use its unix socket under ${roots}. Denied permission on that directory is a common cause.`;
+    const permissionRemedy = `Get permission to create sockets under ${roots}, or set NX_SOCKET_DIR to a directory you do have permission for.`;
+    if (sandboxRemedy.length === 0) {
+        return [lead, permissionRemedy];
+    }
+    return [
+        lead,
+        'To fix this, do one of the following:',
+        // Only Claude Code: the generator's `sandbox` block sits inside
+        // `hasAgent('claude')`, so offering this to a Codex or Copilot CLI user
+        // sends them to a command that writes nothing they need.
+        ...((0, native_1.detectAiAgent)() === 'claude'
+            ? [
+                '  - Run `nx configure-ai-agents` to write the sandbox allowances Nx needs. Agent sandboxes usually block writes to their own settings file, so this may have to be run from a regular terminal rather than through the agent.',
+            ]
+            : []),
+        ...sandboxRemedy.map((remedy) => `  - ${remedy}`),
+        `  - ${permissionRemedy}`,
+        'See https://nx.dev/docs/kb/nx-sandbox-unix-sockets for details.',
+    ];
+}
+/**
+ * The per-agent form of "allow sockets under these roots", or nothing at all
+ * when nothing indicates a sandbox.
+ *
+ * A detected agent is not itself that indication: every Claude Code session sets
+ * `CLAUDECODE`, but only a sandboxed one sets `SANDBOX_RUNTIME` (measured on
+ * 2.1.248 with `sandbox.enabled` both ways). What counts is `isSandbox()`, or —
+ * for a *known* agent — an errno proving the socket was refused. Copilot CLI
+ * needs that second arm: its sandbox sets no variable `isSandbox()` reads
+ * (measured on 1.0.80, where a bind under both roots is refused while `$TMPDIR`
+ * succeeds), so the errno is the only evidence Nx ever gets. An unknown
+ * environment gets no such benefit, because there a refusal is just a refusal —
+ * a root-owned socket dir left by `sudo nx` reads identically.
+ *
+ * The agent then decides *which* setting to name, because each sandbox gates
+ * socket creation on something different and a single generic sentence sends at
+ * least one of them to a setting that does not exist:
+ *
+ * - Claude Code gates on the path allowlist. A scoped `allowUnixSockets` entry
+ *   covers binding as well as connecting, so it is sufficient and preferable to
+ *   `allowAllUnixSockets`, which opens every socket on the machine.
+ * - Codex gates on `network_access` instead, and has no path-scoped socket
+ *   setting. `writable_roots` alone does not unblock a bind. That grant is a
+ *   broad one, so the line says what it costs rather than presenting it as
+ *   equivalent to the scoped entries.
+ * - Copilot CLI gates on the path like Claude, but reads its sandbox policy
+ *   only from the user-level settings file, so this is the one agent
+ *   `configure-ai-agents` cannot configure by writing into the workspace.
+ *
+ * Any other agent, or none, leaves the setting unknown, so the fallback can only
+ * describe the grant.
+ */
+function sandboxSpecificRemedy(roots, certain) {
+    const sandboxed = (0, is_sandbox_1.isSandbox)();
+    const agent = (0, native_1.detectAiAgent)();
+    const knownAgent = agent === 'claude' || agent === 'codex' || agent === 'copilot-cli';
+    if (knownAgent && !sandboxed && !certain) {
+        return [];
+    }
+    switch (agent) {
+        case 'claude':
+            return [
+                `Add ${roots} to \`sandbox.network.allowUnixSockets\` and to \`sandbox.filesystem.allowRead\`/\`allowWrite\` in \`.claude/settings.json\`. The scoped entry covers creating sockets, not only connecting to them.`,
+            ];
+        case 'copilot-cli':
+            return [
+                `Add ${roots} to \`sandbox.userPolicy.filesystem.readwritePaths\` in \`~/.copilot/settings.json\`. Copilot CLI reads sandbox policy only from that user-level file, so a copy committed to the workspace has no effect.`,
+            ];
+        case 'codex':
+            return [
+                `In \`~/.codex/config.toml\`, set \`sandbox_workspace_write.network_access\` to true and add ${roots} to \`sandbox_workspace_write.writable_roots\`. Codex has no setting that scopes sockets to a path, and \`network_access\` also grants general network access, so this is a broader grant than the other agents need.`,
+            ];
+        default:
+            return sandboxed
+                ? [
+                    `Allow your sandbox to create unix sockets under ${roots}, not only connect to them, and grant read and write on those directories.`,
+                ]
+                : [];
+    }
+}

package/dist/src/daemon/server/client-socket-context.d.ts

@@ -0,0 +1,23 @@
+import type { Socket } from 'net';
+import { ProgressTopic } from '../../utils/progress-topics';
+import { EmitLogLevel } from '../message-types/streaming-messages';
+export declare function subscribeClientToTopic(socket: Socket, topic: ProgressTopic): void;
+export declare function unsubscribeClientFromTopic(socket: Socket, topic: ProgressTopic): void;
+export declare function getTopicSubscribers(topic: ProgressTopic): Set<Socket>;
+export declare function assertOnDaemon(helperName: string): void;
+/**
+ * Writes a streaming message over the given socket using the daemon's
+ * configured serialization format, length-prefixed like any other message.
+ * Errors are logged to the daemon's stdout (redirected to the daemon
+ * log) rather than propagated — a disconnected client shouldn't tear
+ * down the current request handler or other subscribers.
+ */
+export declare function writeStreamingMessage(socket: Socket, payload: unknown, description: string): void;
+/**
+ * Broadcasts a progress message to every client currently subscribed to
+ * the given topic. No-op when there are no subscribers.
+ *
+ * Must only be invoked from inside the Nx daemon process.
+ */
+export declare function sendProgressMessageToTopic(topic: ProgressTopic, message: string): void;
+export declare function sendEmitLogMessageToTopic(topic: ProgressTopic, message: string, level: EmitLogLevel): void;

package/dist/src/daemon/server/client-socket-context.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.subscribeClientToTopic = subscribeClientToTopic;
+exports.unsubscribeClientFromTopic = unsubscribeClientFromTopic;
+exports.getTopicSubscribers = getTopicSubscribers;
+exports.assertOnDaemon = assertOnDaemon;
+exports.writeStreamingMessage = writeStreamingMessage;
+exports.sendProgressMessageToTopic = sendProgressMessageToTopic;
+exports.sendEmitLogMessageToTopic = sendEmitLogMessageToTopic;
+const is_on_daemon_1 = require("../is-on-daemon");
+const logger_1 = require("../logger");
+const streaming_messages_1 = require("../message-types/streaming-messages");
+const socket_utils_1 = require("../socket-utils");
+const topicSubscribers = new Map();
+function subscribeClientToTopic(socket, topic) {
+    let subscribers = getTopicSubscribers(topic);
+    if (!subscribers) {
+        subscribers = new Set();
+        topicSubscribers.set(topic, subscribers);
+    }
+    subscribers.add(socket);
+}
+function unsubscribeClientFromTopic(socket, topic) {
+    const subscribers = getTopicSubscribers(topic);
+    if (!subscribers)
+        return;
+    subscribers.delete(socket);
+}
+function getTopicSubscribers(topic) {
+    const subscribers = topicSubscribers.get(topic);
+    if (!subscribers) {
+        const set = new Set();
+        topicSubscribers.set(topic, set);
+        return set;
+    }
+    return subscribers;
+}
+function assertOnDaemon(helperName) {
+    if (!(0, is_on_daemon_1.isOnDaemon)()) {
+        throw new Error(`${helperName} can only be called from the Nx daemon process.`);
+    }
+}
+/**
+ * Writes a streaming message over the given socket using the daemon's
+ * configured serialization format, length-prefixed like any other message.
+ * Errors are logged to the daemon's stdout (redirected to the daemon
+ * log) rather than propagated — a disconnected client shouldn't tear
+ * down the current request handler or other subscribers.
+ */
+function writeStreamingMessage(socket, payload, description) {
+    try {
+        logger_1.serverLogger.log('Streaming message to client:', description);
+        (0, socket_utils_1.sendMessage)(socket, payload, undefined, (err) => {
+            if (err) {
+                console.log(`Streaming message write error (client likely disconnected): ${err.message}`);
+            }
+        });
+    }
+    catch (e) {
+        console.log(`Failed to send streaming message to client: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/**
+ * Broadcasts a progress message to every client currently subscribed to
+ * the given topic. No-op when there are no subscribers.
+ *
+ * Must only be invoked from inside the Nx daemon process.
+ */
+function sendProgressMessageToTopic(topic, message) {
+    assertOnDaemon('sendProgressMessageToTopic');
+    const subscribers = getTopicSubscribers(topic);
+    if (!subscribers?.size)
+        return;
+    const payload = { type: streaming_messages_1.UPDATE_PROGRESS_MESSAGE, message };
+    for (const socket of subscribers) {
+        writeStreamingMessage(socket, payload, 'progress update for topic ' + topic);
+    }
+}
+function sendEmitLogMessageToTopic(topic, message, level) {
+    assertOnDaemon('sendEmitLogMessageToTopic');
+    const subscribers = getTopicSubscribers(topic);
+    if (!subscribers?.size)
+        return;
+    const payload = { type: streaming_messages_1.EMIT_LOG, message, level };
+    for (const socket of subscribers) {
+        writeStreamingMessage(socket, payload, 'emit log message to ' + topic);
+    }
+}

package/dist/src/daemon/server/dotenv-graph-changes.d.ts

@@ -0,0 +1,97 @@
+import type { ProjectGraph } from '../../config/project-graph';
+import { type WatchEvent } from '../../native';
+export interface DotEnvChangeClassification {
+    invalidating: string[];
+    unclassified: WatchEvent[];
+}
+/**
+ * Splits the change events into `invalidating`: the paths with the dotenv name
+ * shape getEnvPathsForTask loads (`.env[.<id>]` / `.<id>.env` variants), under
+ * the workspace root or a project root, whose content actually changed; and
+ * `unclassified`: the dotenv-shaped events under no known root. The
+ * invalidating names are a superset of what any task loads: target and
+ * configuration names are unknown here, so `.env.staging` is reported whether
+ * or not a task loads it. The daemon uses this to refresh its graph cache so
+ * createNodes re-resolves config that reads process.env.
+ *
+ * Only the workspace root and project roots invalidate: getEnvPathsForTask
+ * loads dotenv files from those, never from an arbitrary subdirectory (e.g. one
+ * under node_modules), and the raw-event stream spans the whole workspace root.
+ * An unclassified event is not necessarily irrelevant, though: the graph it was
+ * classified against can predate the file's project root (none is committed
+ * during the initial computation, and a replaced graph lacks a project that
+ * computation is adding), so the caller queues it for replay against the next
+ * graph a computation is about to serve rather than dropping it.
+ *
+ * Known limitation: a `.nxignore`d dotenv file never reaches this watcher (the
+ * native watcher applies `.nxignore` even with `use_ignore: false`), so a warm
+ * edit of one does not invalidate the graph. The cold path still resolves it:
+ * getGraphTimeDotEnvForTask reads dotenv from disk directly.
+ */
+export declare function classifyDotEnvChanges(changeEvents: WatchEvent[], projectGraph: ProjectGraph | undefined): DotEnvChangeClassification;
+/**
+ * `generation` is the recomputation generation current at queue time; the
+ * drain compares it against the serving computation's generation to prove
+ * whether that computation started before the event arrived.
+ */
+export declare function queuePendingDotEnvEvents(paths: string[], generation: number): void;
+/**
+ * Takes and clears the queued unclassified events, returning the paths that
+ * are dotenv files under a root of `projectGraph` and were queued at or after
+ * `sinceGeneration` (the serving computation's generation). A path queued
+ * earlier is dropped safely: the computation claimed its generation after the
+ * event was queued, so it read the file after the edit landed. Content hashes
+ * are neither consulted nor recorded here, and any hash recorded for a
+ * drained path is dropped: a hash taken mid-computation is not proof any
+ * served graph observed those bytes (the computation may read intermediate
+ * content), so suppressing a later event on it could leave the graph stale.
+ * `overflowed` means events were lost at or after `sinceGeneration`, so the
+ * caller cannot prove its graph fresh and must invalidate; an overflow
+ * recorded earlier is dropped by the same rule as a queued entry. A relevant
+ * overflow also drops every recorded hash: with events lost, a retained hash
+ * (even for a path that invalidated directly and never entered the queue)
+ * could suppress a later event over intermediate bytes read by the successor
+ * this drain forces. That successor is already being forced, so clearing
+ * adds no recomputation.
+ *
+ * A stamp records callback time, not edit time, so an event whose edit a
+ * workspace-watcher-triggered computation already observed can still
+ * invalidate it: one redundant recompute, accepted because the callback
+ * cannot prove which side of that computation's file read the edit landed on.
+ */
+export declare function drainPendingDotEnvEvents(projectGraph: ProjectGraph | undefined, sinceGeneration: number): {
+    invalidating: string[];
+    overflowed: boolean;
+};
+/**
+ * Whether the queue holds evidence that a computation at `sinceGeneration`
+ * may have read a dotenv file before a reported edit landed: an entry or an
+ * overflow stamped at or after that generation. Consumes nothing and
+ * classifies against no roots: the error paths use this to decide on a retry,
+ * where there may be no graph to classify against, and a spurious retry costs
+ * one recompute on an already failing path. A persistent error retries once,
+ * because the retry's successor claims a generation above every stamp
+ * recorded so far.
+ */
+export declare function hasPendingDotEnvEvidence(sinceGeneration: number): boolean;
+/**
+ * Like hasPendingDotEnvEvidence, but classifies each entry against the roots
+ * of `projectGraph`: evidence is an overflow stamped at or after
+ * `sinceGeneration`, or an entry so stamped whose path is a dotenv file under
+ * one of the graph's roots. The warm-reuse check uses this, where the graph
+ * the cache serves exists and is exactly what a recompute would refresh;
+ * skipping paths under none of its roots avoids recomputing for events only
+ * a future graph could classify, and consuming nothing leaves those entries
+ * queued for that computation's drain.
+ */
+export declare function hasRelevantPendingDotEnvEvidence(projectGraph: ProjectGraph | undefined, sinceGeneration: number): boolean;
+/**
+ * Drops every recorded content hash. Each computation clears on claiming its
+ * generation, bounding every hash to the window since the last claim: an
+ * older hash is not proof the graph a successor serves observed those bytes,
+ * and kept, it could suppress a callback that lands while the successor
+ * reads. The error-path retry and the warm-reuse check also clear when they
+ * force a successor while preserving the queue for its drain.
+ */
+export declare function clearDotEnvFileHashes(): void;
+export declare function _resetPendingDotEnvEvents(): void;