@ohos-ports/nx 23.2.1-beta.1 → 23.3.0-beta.0

package/dist/src/command-line/init/implementation/utils.js

@@ -10,7 +10,6 @@ exports.toErrorString = toErrorString;
 exports.readErrorStderr = readErrorStderr;
 exports.extractErrorName = extractErrorName;
 exports.initCloud = initCloud;
-exports.setNeverConnectToCloud = setNeverConnectToCloud;
 exports.addVsCodeRecommendedExtensions = addVsCodeRecommendedExtensions;
 exports.markRootPackageJsonAsNxProjectLegacy = markRootPackageJsonAsNxProjectLegacy;
 exports.markPackageJsonAsNxProject = markPackageJsonAsNxProject;
@@ -253,13 +252,17 @@ function updateGitIgnore(root) {
 }
 function runInstall(repoRoot, packageManager = (0, package_manager_1.detectPackageManager)(repoRoot), pmc = (0, package_manager_1.getPackageManagerCommand)(packageManager)) {
     let command = pmc.install;
+    const env = { ...process.env };
     // Plugins added during init can pull build-script deps whose allowBuilds
     // entries are only recorded by their init generators after this install;
-    // warn and skip for this one install, like pnpm 10 did.
+    // warn and skip for this one install, like pnpm 10 did. pnpm 12 gave
+    // `--config` a meaning of its own and takes the setting from the
+    // environment instead.
     if (packageManager === 'pnpm') {
         try {
             if ((0, semver_1.gte)((0, package_manager_1.getPackageManagerVersion)('pnpm', repoRoot), '11.0.0')) {
                 command += ' --config.strictDepBuilds=false';
+                env.PNPM_CONFIG_STRICT_DEP_BUILDS = 'false';
             }
         }
         catch {
@@ -272,6 +275,7 @@ function runInstall(repoRoot, packageManager = (0, package_manager_1.detectPacka
             encoding: 'utf8',
             cwd: repoRoot,
             windowsHide: true,
+            env,
         });
     }
     catch (e) {
@@ -341,13 +345,6 @@ async function initCloud(installationSource) {
     });
     await (0, connect_to_nx_cloud_1.printSuccessMessage)(token, installationSource);
 }
-function setNeverConnectToCloud(repoRoot) {
-    const nxJsonPath = (0, path_1.join)(repoRoot, 'nx.json');
-    const nxJson = (0, fileutils_1.readJsonFile)(nxJsonPath);
-    nxJson.neverConnectToCloud = true;
-    (0, fileutils_1.writeJsonFile)(nxJsonPath, nxJson);
-    (0, format_1.recordInitWrite)(nxJsonPath);
-}
 function addVsCodeRecommendedExtensions(repoRoot, extensions) {
     const vsCodeExtensionsPath = (0, path_1.join)(repoRoot, '.vscode/extensions.json');
     if ((0, fileutils_1.fileExists)(vsCodeExtensionsPath)) {

package/dist/src/command-line/init/init-v2.js

@@ -379,9 +379,6 @@ async function runInit(options, baseMeta) {
     if (nxCloudChoice === 'yes') {
         await (0, utils_1.initCloud)('nx-init');
     }
-    else if (nxCloudChoice === 'never') {
-        (0, utils_1.setNeverConnectToCloud)(repoRoot);
-    }
     const analyticsPrompt = await (0, analytics_prompt_1.ensureAnalyticsPreferenceSet)(repoRoot, options.interactive);
     await (0, ab_testing_1.recordStat)({
         command: 'init',

package/dist/src/command-line/migrate/agentic/capture-generator-output.d.ts

@@ -3,11 +3,36 @@
  * preserving the original behavior. Does not intercept
  * `process.{stdout,stderr}.write` — those bypass `console` and would also
  * pick up unrelated framework output. Restoration is idempotent.
+ *
+ * `flush()` returns at most `MAX_GENERATOR_OUTPUT_BYTES`: up to the first
+ * `HEAD_BYTES` of output, a marker with the omitted byte count, and the most
+ * recent output. The terminal still receives everything through the tee.
  */
 export interface GeneratorOutputCapture {
     flush(): string;
     restore(): void;
 }
+export declare const MAX_GENERATOR_OUTPUT_BYTES = 16384;
+export declare const MARKER_BYTES: number;
+export declare class BoundedOutput {
+    private readonly head;
+    private headBytes;
+    private headOpen;
+    private headSplit;
+    private readonly tail;
+    private tailBytes;
+    private omitted;
+    append(record: string): void;
+    render(): string;
+}
+export declare class BoundedChunks {
+    private head;
+    private headOpen;
+    private tail;
+    private omitted;
+    append(chunk: string): void;
+    render(): string;
+}
 export declare function installGeneratorOutputCapture(): GeneratorOutputCapture;
 /**
  * Convenience wrapper that installs the capture, runs `fn`, restores on

package/dist/src/command-line/migrate/agentic/capture-generator-output.js

@@ -1,9 +1,127 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BoundedChunks = exports.BoundedOutput = exports.MARKER_BYTES = exports.MAX_GENERATOR_OUTPUT_BYTES = void 0;
 exports.installGeneratorOutputCapture = installGeneratorOutputCapture;
 exports.withGeneratorOutputCapture = withGeneratorOutputCapture;
 const node_util_1 = require("node:util");
 const logger_1 = require("../../../utils/logger");
+const handoff_1 = require("./handoff");
+exports.MAX_GENERATOR_OUTPUT_BYTES = 16384;
+const HEAD_BYTES = 4096;
+const omittedMarker = (omitted) => `[nx migrate: ${omitted} bytes of output omitted]`;
+// Reserved at the widest number spelling so a growing count cannot push a
+// flush over the cap.
+exports.MARKER_BYTES = Buffer.byteLength(`\n${omittedMarker(Number.MAX_VALUE)}\n`);
+const TAIL_LIMIT = exports.MAX_GENERATOR_OUTPUT_BYTES - HEAD_BYTES - exports.MARKER_BYTES;
+// Keeps the last `maxBytes` of `value`, cut on a code point.
+function keepTailUtf8(value, maxBytes) {
+    let start = value.length;
+    let kept = 0;
+    while (start > 0) {
+        const low = value.charCodeAt(start - 1);
+        const high = start > 1 ? value.charCodeAt(start - 2) : 0;
+        const from = low >= 0xdc00 && low <= 0xdfff && high >= 0xd800 && high <= 0xdbff
+            ? start - 2
+            : start - 1;
+        const bytes = Buffer.byteLength(value.slice(from, start));
+        if (kept + bytes > maxBytes)
+            break;
+        kept += bytes;
+        start = from;
+    }
+    return value.slice(start);
+}
+// The head/marker/tail buffer behind `flush()` above.
+class BoundedOutput {
+    constructor() {
+        this.head = [];
+        this.headBytes = 0;
+        this.headOpen = true;
+        // The head ends mid-record, so no newline separates it from the tail.
+        this.headSplit = false;
+        this.tail = [];
+        this.tailBytes = 0;
+        this.omitted = 0;
+    }
+    append(record) {
+        if (this.headOpen) {
+            const separator = this.head.length ? 1 : 0;
+            const bytes = Buffer.byteLength(record);
+            if (this.headBytes + separator + bytes <= HEAD_BYTES) {
+                this.head.push(record);
+                this.headBytes += separator + bytes;
+                return;
+            }
+            this.headOpen = false;
+            const prefix = (0, handoff_1.truncateUtf8)(record, HEAD_BYTES - this.headBytes - separator);
+            if (prefix) {
+                this.head.push(prefix);
+                this.headBytes += separator + Buffer.byteLength(prefix);
+                this.headSplit = true;
+                record = record.slice(prefix.length);
+            }
+        }
+        // Each tail record is charged its bytes plus a following newline; the last
+        // record's unused newline is one byte of slack at render time.
+        const cost = Buffer.byteLength(record) + 1;
+        this.tail.push({ text: record, cost });
+        this.tailBytes += cost;
+        while (this.tailBytes > TAIL_LIMIT && this.tail.length > 1) {
+            const dropped = this.tail.shift().cost;
+            this.tailBytes -= dropped;
+            this.omitted += dropped;
+        }
+        if (this.tailBytes > TAIL_LIMIT) {
+            const text = keepTailUtf8(this.tail[0].text, TAIL_LIMIT - 1);
+            const kept = Buffer.byteLength(text) + 1;
+            this.omitted += this.tailBytes - kept;
+            this.tail[0] = { text, cost: kept };
+            this.tailBytes = kept;
+        }
+    }
+    render() {
+        const head = this.head.join('\n');
+        const tail = this.tail.map((record) => record.text).join('\n');
+        if (this.omitted > 0) {
+            return `${head}\n${omittedMarker(this.omitted)}\n${tail}`;
+        }
+        if (!this.tail.length)
+            return head;
+        return this.headSplit ? head + tail : `${head}\n${tail}`;
+    }
+}
+exports.BoundedOutput = BoundedOutput;
+// The same head/marker/tail bound over a byte stream: chunks carry no record
+// boundary, so the cuts land on code points wherever the budgets run out and
+// the result does not depend on how the stream was chunked.
+class BoundedChunks {
+    constructor() {
+        this.head = '';
+        this.headOpen = true;
+        this.tail = '';
+        this.omitted = 0;
+    }
+    append(chunk) {
+        if (this.headOpen) {
+            const prefix = (0, handoff_1.truncateUtf8)(chunk, HEAD_BYTES - Buffer.byteLength(this.head));
+            this.head += prefix;
+            chunk = chunk.slice(prefix.length);
+            if (!chunk)
+                return;
+            this.headOpen = false;
+        }
+        const joined = this.tail + chunk;
+        this.tail = keepTailUtf8(joined, TAIL_LIMIT);
+        this.omitted += Buffer.byteLength(joined) - Buffer.byteLength(this.tail);
+    }
+    render() {
+        if (this.omitted > 0) {
+            return `${this.head}\n${omittedMarker(this.omitted)}\n${this.tail}`;
+        }
+        return this.head + this.tail;
+    }
+}
+exports.BoundedChunks = BoundedChunks;
 const CONSOLE_METHODS = [
     'log',
     'warn',
@@ -20,15 +138,13 @@ const NOOP_CAPTURE = {
     restore: () => { },
 };
 function installGeneratorOutputCapture() {
-    // Refuse to layer if the previous install never restored. Returns a noop
-    // handle so callers' `flush()` / `restore()` calls remain safe.
     for (const method of CONSOLE_METHODS) {
         if (console[method][CAPTURED_MARKER]) {
             logger_1.logger.verbose(`nx migrate: refusing to layer a second generator-output capture; the previous one was not restored. This typically means a caller skipped its \`try/finally\`. The inner caller's \`flush()\` will return empty, but its console output is still being captured by the outer install.`);
             return NOOP_CAPTURE;
         }
     }
-    const buffer = [];
+    const buffer = new BoundedOutput();
     const originals = new Map();
     for (const method of CONSOLE_METHODS) {
         originals.set(method, console[method]);
@@ -36,7 +152,7 @@ function installGeneratorOutputCapture() {
         const wrapper = ((...args) => {
             original(...args);
             try {
-                buffer.push((0, node_util_1.format)(...args));
+                buffer.append((0, node_util_1.format)(...args));
             }
             catch {
                 // `format` is robust against the common pathologies but a user arg
@@ -55,7 +171,7 @@ function installGeneratorOutputCapture() {
     let restored = false;
     return {
         flush() {
-            return buffer.join('\n');
+            return buffer.render();
         },
         restore() {
             if (restored)

package/dist/src/command-line/migrate/agentic/close-agent-session.d.ts

@@ -0,0 +1,21 @@
+import { type ChildProcess } from 'child_process';
+export declare const AGENT_GRACEFUL_EXIT_MS = 5000;
+export declare const FORCE_KILL_WAIT_MS = 500;
+export interface ExitInfo {
+    code?: number | null;
+    signal?: NodeJS.Signals | null;
+    error?: Error;
+}
+export declare function waitForExit(child: ChildProcess): Promise<ExitInfo>;
+/**
+ * Stops a running agent process.
+ *
+ * POSIX: SIGINT, then SIGKILL after a bounded wait. SIGTERM is skipped so a
+ * child that ignored the first graceful signal does not get a second one.
+ *
+ * Windows: `taskkill /T /F`. `child.kill` is a `TerminateProcess` call whatever
+ * the signal name, which on the `cmd.exe` shim path would kill the shim and
+ * orphan the agent. `taskkill` failures are swallowed.
+ */
+export declare function closeAgentSession(child: ChildProcess, exitPromise: Promise<ExitInfo>, gracefulExitMs: number, forceKillWaitMs: number): Promise<void>;
+export declare function raceWithTimeout(promise: Promise<unknown>, timeoutMs: number): Promise<void>;

package/dist/src/command-line/migrate/agentic/close-agent-session.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FORCE_KILL_WAIT_MS = exports.AGENT_GRACEFUL_EXIT_MS = void 0;
+exports.waitForExit = waitForExit;
+exports.closeAgentSession = closeAgentSession;
+exports.raceWithTimeout = raceWithTimeout;
+const child_process_1 = require("child_process");
+exports.AGENT_GRACEFUL_EXIT_MS = 5_000;
+// Safety bound after force-kill. SIGKILL normally reaps in microseconds;
+// the bound exists for uninterruptible kernel calls or taskkill returning
+// before the process actually exits.
+exports.FORCE_KILL_WAIT_MS = 500;
+// Merge window so a paired exit + error both land in one ExitInfo. On
+// error-only paths like spawn ENOENT, where Node fires error but never exit,
+// this timer is the only settlement mechanism.
+const EXIT_MERGE_WINDOW_MS = 10;
+function waitForExit(child) {
+    return new Promise((resolve) => {
+        const info = {};
+        let pending = null;
+        let settled = false;
+        const settle = () => {
+            if (settled)
+                return;
+            settled = true;
+            if (pending)
+                clearTimeout(pending);
+            resolve(info);
+        };
+        const onFirst = () => {
+            if (settled || pending)
+                return;
+            pending = setTimeout(settle, EXIT_MERGE_WINDOW_MS);
+        };
+        child.on('exit', (code, signal) => {
+            info.code = code;
+            info.signal = signal;
+            onFirst();
+        });
+        child.on('error', (error) => {
+            info.error = error;
+            onFirst();
+        });
+    });
+}
+/**
+ * Stops a running agent process.
+ *
+ * POSIX: SIGINT, then SIGKILL after a bounded wait. SIGTERM is skipped so a
+ * child that ignored the first graceful signal does not get a second one.
+ *
+ * Windows: `taskkill /T /F`. `child.kill` is a `TerminateProcess` call whatever
+ * the signal name, which on the `cmd.exe` shim path would kill the shim and
+ * orphan the agent. `taskkill` failures are swallowed.
+ */
+async function closeAgentSession(child, exitPromise, gracefulExitMs, forceKillWaitMs) {
+    if (child.exitCode !== null || child.signalCode !== null)
+        return;
+    if (process.platform === 'win32') {
+        await forceKillWindowsTree(child, exitPromise, forceKillWaitMs);
+        return;
+    }
+    try {
+        child.kill('SIGINT');
+    }
+    catch {
+        // child already gone between the check above and here
+        return;
+    }
+    let escalation;
+    try {
+        await Promise.race([
+            exitPromise,
+            new Promise((resolve) => {
+                escalation = setTimeout(resolve, gracefulExitMs);
+            }),
+        ]);
+    }
+    finally {
+        if (escalation)
+            clearTimeout(escalation);
+    }
+    if (child.exitCode !== null || child.signalCode !== null)
+        return;
+    try {
+        child.kill('SIGKILL');
+    }
+    catch {
+        /* child already gone */
+    }
+    await raceWithTimeout(exitPromise, forceKillWaitMs);
+}
+async function forceKillWindowsTree(child, exitPromise, forceKillWaitMs) {
+    const pid = child.pid;
+    // No pid means spawn itself failed, which the guard in `closeAgentSession`
+    // normally short-circuits. Without one there is nothing to taskkill.
+    if (pid !== undefined) {
+        try {
+            (0, child_process_1.execSync)(`taskkill /T /F /PID ${pid}`, {
+                stdio: 'ignore',
+                windowsHide: true,
+                // Bound so a hung Windows shell can't block the orchestrator.
+                timeout: 2_000,
+            });
+        }
+        catch {
+            /* taskkill missing, pid already dead, or timed out */
+        }
+    }
+    await raceWithTimeout(exitPromise, forceKillWaitMs);
+}
+async function raceWithTimeout(promise, timeoutMs) {
+    let timer;
+    try {
+        await Promise.race([
+            promise,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/src/command-line/migrate/agentic/definitions.d.ts

@@ -1,5 +1,29 @@
 import { AgentDefinition, AgentId } from './types';
+/**
+ * Pre-authorizes the handoff write. Claude Code's default permission mode
+ * asks before a file write it has no allow rule for, so without this every
+ * step ends on an approval prompt for Nx's own handoff scratch.
+ *
+ * The rule reaches one run's handoffs and nothing else. Its own run
+ * directory also holds state Nx wrote and reads back, and the sibling
+ * directories belong to other runs, including an orchestrated run whose
+ * handoffs decide how its steps settle. `Edit` is the only tool name file
+ * rules are matched against, and it covers creating the file as well as
+ * correcting one already written. Prefix-less patterns resolve against the
+ * session cwd, which every caller pins to the workspace root.
+ *
+ * Returns null for a name it cannot express, which costs the approval prompt
+ * this exists to avoid. That beats widening the rule, and nothing narrower is
+ * available: Claude Code has no escape for a literal path.
+ */
+export declare function claudeCodeHandoffAllowedTools(runDirName: string): string | null;
 export declare const claudeCodeDefinition: AgentDefinition;
+/**
+ * Encodes a single-line TOML string for codex overrides. Codex treats a parse
+ * failure as literal text instead of reporting it, so the result is parsed
+ * back before it reaches the command line.
+ */
+export declare function encodeTomlString(value: string): string;
 export declare const codexDefinition: AgentDefinition;
 export declare const opencodeDefinition: AgentDefinition;
 export declare const AGENT_DEFINITIONS: readonly AgentDefinition[];

package/dist/src/command-line/migrate/agentic/definitions.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_DEFINITIONS = exports.opencodeDefinition = exports.codexDefinition = exports.claudeCodeDefinition = void 0;
+exports.claudeCodeHandoffAllowedTools = claudeCodeHandoffAllowedTools;
+exports.encodeTomlString = encodeTomlString;
 exports.getAgentDefinition = getAgentDefinition;
 const os_1 = require("os");
 const path_1 = require("path");
+const smol_toml_1 = require("smol-toml");
 const types_1 = require("./types");
 // --- Claude Code ---------------------------------------------------------
 function claudeCodeWellKnownPaths() {
@@ -34,7 +37,7 @@ const RULE_SAFE_RUN_DIR_NAME = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
  * handoffs decide how its steps settle. `Edit` is the only tool name file
  * rules are matched against, and it covers creating the file as well as
  * correcting one already written. Prefix-less patterns resolve against the
- * session cwd, pinned to the workspace root below.
+ * session cwd, which every caller pins to the workspace root.
  *
  * Returns null for a name it cannot express, which costs the approval prompt
  * this exists to avoid. That beats widening the rule, and nothing narrower is
@@ -49,15 +52,14 @@ function claudeCodeHandoffAllowedTools(runDirName) {
 function claudeCodeBuildInteractive(ctx) {
     const allowedTools = claudeCodeHandoffAllowedTools(ctx.runDirName);
     return {
-        // `--allowedTools` is variadic (space/comma separated): a positional
-        // placed right after its value gets swallowed as another rule. The rules
-        // must stay in one comma-joined element with a non-variadic flag
-        // (`--system-prompt`) between them and the user prompt.
+        // `--allowedTools` is variadic, so a positional right after it is read as
+        // another rule: keep the rules in one comma-joined element and a flag
+        // between them and the instructions pointer.
         args: [
             ...(allowedTools ? ['--allowedTools', allowedTools] : []),
-            '--system-prompt',
-            ctx.systemContext,
-            ctx.userPrompt,
+            '--system-prompt-file',
+            ctx.systemPromptFilePath,
+            ctx.instructionsPointer,
         ],
         cwd: ctx.workspaceRoot,
     };
@@ -74,14 +76,42 @@ function codexWellKnownPaths() {
     return [];
 }
 // No handoff permission flag: codex's default sandbox already allows writes
-// inside the cwd tree without prompting, and a user-hardened read-only config
-// is a deliberate choice we don't override.
+// inside the cwd tree (`.git` excepted), and a user-hardened read-only config
+// is theirs to keep.
+//
+// `-c model_instructions_file` replaces codex's built-in instructions rather
+// than adding this context to them, so the context stays on the command line,
+// reduced rather than the full prompt.
 function codexBuildInteractive(ctx) {
     return {
-        args: ['-c', `developer_instructions=${ctx.systemContext}`, ctx.userPrompt],
+        args: [
+            '-c',
+            `developer_instructions=${encodeTomlString(ctx.inlineSystemContext)}`,
+            ctx.instructionsPointer,
+        ],
         cwd: ctx.workspaceRoot,
     };
 }
+/**
+ * Encodes a single-line TOML string for codex overrides. Codex treats a parse
+ * failure as literal text instead of reporting it, so the result is parsed
+ * back before it reaches the command line.
+ */
+function encodeTomlString(value) {
+    // JSON escapes every control TOML rejects except DEL, which it leaves raw.
+    const encoded = JSON.stringify(value).replace(/\x7f/g, '\\u007F');
+    let decoded;
+    try {
+        decoded = (0, smol_toml_1.parse)(`value = ${encoded}`).value;
+    }
+    catch (err) {
+        throw new Error(`Could not encode the agent's system context as TOML for OpenAI Codex: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    if (decoded !== value) {
+        throw new Error(`Encoding the agent's system context as TOML for OpenAI Codex did not round-trip; refusing to run the agent on altered instructions.`);
+    }
+    return encoded;
+}
 exports.codexDefinition = {
     id: 'codex',
     displayName: 'OpenAI Codex',
@@ -110,25 +140,54 @@ function opencodeWellKnownPaths() {
     return candidates;
 }
 // No handoff permission config: opencode's `edit` permission defaults to
-// allow, and injecting one would clobber (not merge with) a user's own
-// permission patterns.
+// allow, and injecting one would clobber a user's own patterns rather than
+// merge with them.
+//
+// The config travels through OPENCODE_CONFIG_CONTENT rather than
+// OPENCODE_CONFIG. Both merge with the user's own config, but the runner
+// spreads `env` over `process.env`, so the latter would overwrite a value the
+// user had set.
 function opencodeBuildInteractive(ctx) {
-    const config = {
-        agent: {
-            [OPENCODE_TRANSIENT_AGENT_NAME]: { prompt: ctx.systemContext },
-        },
-    };
     return {
         args: [
             '--agent',
             OPENCODE_TRANSIENT_AGENT_NAME,
             '--prompt',
-            ctx.userPrompt,
+            ctx.instructionsPointer,
         ],
-        env: { OPENCODE_CONFIG_CONTENT: JSON.stringify(config) },
+        env: { OPENCODE_CONFIG_CONTENT: opencodeConfigContent(ctx) },
         cwd: ctx.workspaceRoot,
     };
 }
+/**
+ * Escapes inline prompt patterns before opencode's pre-JSON substitution pass.
+ * Excludes generator instructions from the config; cmd.exe drops inherited
+ * variables longer than 8191 characters.
+ */
+function opencodeConfigContent(ctx) {
+    // Windows separators become `/`, which its APIs accept just as well.
+    // Elsewhere a `\` belongs to the file name.
+    const filePath = process.platform === 'win32'
+        ? ctx.systemPromptFilePath.replace(/\\/g, '/')
+        : ctx.systemPromptFilePath;
+    const prompt = isSubstitutionSafePath(filePath)
+        ? JSON.stringify(`{file:${filePath}}`)
+        : // `\u007b` starts no pattern and JSON decodes it back to `{`, so the
+            // prompt survives expansion whatever the workspace path put in it.
+            JSON.stringify(ctx.systemPrompt).replace(/\{/g, '\\u007b');
+    // Assembled rather than serialized whole: `JSON.stringify` over the object
+    // would re-escape the backslashes the `\u007b` encoding introduced.
+    return `{"agent":{${JSON.stringify(OPENCODE_TRANSIENT_AGENT_NAME)}:{"prompt":${prompt}}}}`;
+}
+/**
+ * Whether opencode would read back the path nx wrote. A `}` closes the
+ * reference early, and a character JSON escapes arrives escaped. Braces are
+ * rejected wholesale rather than matched against `{env:` and `{file:`, since a
+ * pattern opening inside the path swallows the reference's closing brace.
+ */
+function isSubstitutionSafePath(filePath) {
+    return (!/[{}]/.test(filePath) && JSON.stringify(filePath).slice(1, -1) === filePath);
+}
 exports.opencodeDefinition = {
     id: 'opencode',
     displayName: 'OpenCode',

package/dist/src/command-line/migrate/agentic/format-command.d.ts

@@ -0,0 +1,14 @@
+import { FormatterType } from '../../../utils/formatters';
+/**
+ * The command the agent runs over the files it changed, with a `<paths>`
+ * placeholder. `--` keeps a path that starts with `-` from being read as an
+ * option.
+ */
+export declare function formatCommandFor(formatter: FormatterType, pmExec: string): string;
+/**
+ * Resolved per dispense so a migration's formatter change takes effect; the
+ * scope rules name the replacement commands for the step that made it. `null`
+ * when no formatter is configured or its binary cannot be resolved: under npm
+ * the command would otherwise make `npx` download it.
+ */
+export declare function resolveFormatCommand(root: string, pmExec: string): string | null;

package/dist/src/command-line/migrate/agentic/format-command.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatCommandFor = formatCommandFor;
+exports.resolveFormatCommand = resolveFormatCommand;
+const formatters_1 = require("../../../utils/formatters");
+/**
+ * The command the agent runs over the files it changed, with a `<paths>`
+ * placeholder. `--` keeps a path that starts with `-` from being read as an
+ * option.
+ */
+function formatCommandFor(formatter, pmExec) {
+    switch (formatter) {
+        case 'prettier':
+            // --ignore-unknown skips files prettier has no parser for.
+            return `${pmExec} prettier --write --ignore-unknown -- <paths>`;
+        case 'oxfmt':
+            // oxfmt exits 2 when every path was skipped; the flag makes that
+            // success. Unlike prettier it skips unparseable files on its own.
+            return `${pmExec} oxfmt --no-error-on-unmatched-pattern -- <paths>`;
+        default: {
+            const unhandled = formatter;
+            throw new Error(`Unhandled formatter: ${unhandled}`);
+        }
+    }
+}
+/**
+ * Resolved per dispense so a migration's formatter change takes effect; the
+ * scope rules name the replacement commands for the step that made it. `null`
+ * when no formatter is configured or its binary cannot be resolved: under npm
+ * the command would otherwise make `npx` download it.
+ */
+function resolveFormatCommand(root, pmExec) {
+    const formatter = (0, formatters_1.detectFormatter)(root);
+    if (formatter === null) {
+        return null;
+    }
+    try {
+        formatters_1.resolveFormatterBin[formatter]();
+    }
+    catch {
+        return null;
+    }
+    return formatCommandFor(formatter, pmExec);
+}

package/dist/src/command-line/migrate/agentic/handoff-gitignore.d.ts

@@ -1,8 +1,8 @@
 /**
  * Both the agentic runner and the orchestrator write per-run scratch under
- * `.nx/migrate-runs/<run-id>/`: handoff files in both cases, plus the durable
- * run state and its plan snapshots for the orchestrator. The v23 migration
- * `23-0-0-add-migrate-runs-to-git-ignore` adds `.nx/migrate-runs` to
+ * `.nx/migrate-runs/<run-id>/`: handoff and prompt files in both cases, plus
+ * the durable run state and its plan snapshots for the orchestrator. The v23
+ * migration `23-0-0-add-migrate-runs-to-git-ignore` adds `.nx/migrate-runs` to
  * `.gitignore`; in its declared slot (typically late) earlier per-migration
  * commits would absorb the scratch into the user-visible diff.
  *