@ohos-ports/nx 23.3.0-beta.2 → 24.0.2-beta.0

package/dist/src/utils/acknowledge-build-scripts.js

@@ -1,13 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.acknowledgeBuildScripts = acknowledgeBuildScripts;
+exports.acknowledgeDeclaredBuildScripts = acknowledgeDeclaredBuildScripts;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const yaml_1 = require("yaml");
 const semver_1 = require("semver");
 const package_manager_1 = require("./package-manager");
 const fileutils_1 = require("./fileutils");
+const is_ci_1 = require("./is-ci");
 const json_1 = require("./json");
+const output_1 = require("./output");
+const prompt_helpers_1 = require("./prompt-helpers");
 const PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
 /**
  * Records build-script decisions for dependencies that are about to be
@@ -18,67 +22,202 @@ const PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
  * that introduces such a dependency records the decision up front. Other
  * package managers run build scripts unconditionally, so this is a no-op for
  * them.
+ *
+ * @param treeOrRoot The workspace tree, or its root on disk.
+ * @param packageManager The workspace package manager.
+ * @param entries Package name to decision: `true` runs the package's build
+ * scripts, `false` skips them. Entries the user already decided are kept.
+ * @param directory Workspace root relative to the tree root, for generators
+ * that scaffold a workspace into a subdirectory.
+ *
+ * @example
+ * ```typescript
+ * acknowledgeBuildScripts(tree, detectPackageManager(tree.root), {
+ *   esbuild: false,
+ *   cypress: true,
+ * });
+ * ```
  */
-function acknowledgeBuildScripts(treeOrRoot, packageManager, entries) {
+function acknowledgeBuildScripts(treeOrRoot, packageManager, entries, directory = '') {
     if (packageManager !== 'pnpm') {
         return;
     }
-    acknowledgePnpmBuildScripts(treeOrRoot, entries);
+    const host = createHost(treeOrRoot, directory);
+    const pnpmVersion = getPnpmVersion(host);
+    if (!pnpmVersion || !(0, semver_1.gte)(pnpmVersion, '11.0.0')) {
+        return;
+    }
+    acknowledgePnpmBuildScripts(host, entries);
 }
 /**
- * Records `allowBuilds` decisions in pnpm-workspace.yaml, creating the file
- * when missing (mirroring `pnpm approve-builds` in single-package repos).
+ * Records the build-script decisions a package declares for its own
+ * dependency tree, so the install that first pulls the package in can stay
+ * strict. A package declares them in the `pnpm.allowBuilds` field of its
+ * package.json, the same shape pnpm reads from a workspace root; pnpm ignores
+ * the field on dependencies, so it is read from the registry here.
  *
- * Comment-preserving. Existing entries are never overwritten, so user
- * decisions always win. No-op for pnpm < 11, which warns instead of erroring
- * and does not read `allowBuilds`.
+ * A declared `false` is recorded as is: it only skips a script. A declared
+ * `true` would let a publisher authorize code execution in the workspace, so
+ * it is a request: in a terminal the owner picks which to allow, elsewhere
+ * every request is recorded as `false`. Decisions the owner already recorded
+ * are kept either way, and everything recorded is printed.
+ *
+ * Resolves to whether the package declared any decision. Nothing is recorded
+ * for package managers other than pnpm, pnpm < 11, packages that declare
+ * nothing, and specs the registry cannot answer, such as a tarball path.
  */
-function acknowledgePnpmBuildScripts(treeOrRoot, entries) {
-    const host = createHost(treeOrRoot);
+async function acknowledgeDeclaredBuildScripts(treeOrRoot, packageManager, packageName, version, directory = '') {
+    if (packageManager !== 'pnpm') {
+        return false;
+    }
+    const host = createHost(treeOrRoot, directory);
     const pnpmVersion = getPnpmVersion(host);
     if (!pnpmVersion || !(0, semver_1.gte)(pnpmVersion, '11.0.0')) {
-        return;
+        return false;
     }
-    const parsed = (0, yaml_1.parseDocument)(host.exists(PNPM_WORKSPACE_FILE) ? host.read(PNPM_WORKSPACE_FILE) : '');
-    // A file that doesn't parse cleanly or whose root isn't a mapping is
-    // malformed for pnpm; leave it alone rather than crashing or replacing the
-    // user's content. pnpm's own error on the file is the actionable signal.
-    // Empty and comment-only files have no contents at all; setIn creates the
-    // mapping for them while keeping whatever comments they carry.
-    if (parsed.errors.length > 0 ||
-        (parsed.contents != null && !(parsed.contents instanceof yaml_1.YAMLMap))) {
-        return;
+    const declared = await readDeclaredBuildScripts(packageName, version);
+    if (Object.keys(declared).length === 0) {
+        return false;
+    }
+    const decided = readRecordedDecisions(host);
+    const requests = Object.keys(declared).filter((pkg) => declared[pkg] && !(pkg in decided));
+    const prompted = requests.length > 0 && canPrompt();
+    const allowed = prompted
+        ? await (0, prompt_helpers_1.multiselectPrompt)({
+            message: `${packageName}@${version} asks to run the install scripts of these packages. Which ones do you allow?`,
+            choices: requests,
+            required: false,
+        })
+        : [];
+    const entries = { ...declared };
+    for (const pkg of requests) {
+        entries[pkg] = allowed.includes(pkg);
     }
-    let changed = false;
+    const recorded = acknowledgePnpmBuildScripts(host, entries);
+    if (Object.keys(recorded).length > 0) {
+        const blocked = requests.filter((pkg) => !entries[pkg] && pkg in recorded);
+        output_1.output.note({
+            title: `Recorded the build-script decisions ${packageName}@${version} declares in ${PNPM_WORKSPACE_FILE}`,
+            bodyLines: [
+                ...Object.entries(recorded).map(([pkg, value]) => blocked.includes(pkg)
+                    ? `${pkg}: false (the package asked to run it)`
+                    : `${pkg}: ${value}`),
+                ...(blocked.length > 0
+                    ? [
+                        `To run a blocked script, set its entry to true in ${PNPM_WORKSPACE_FILE} and run "pnpm rebuild <package>".`,
+                    ]
+                    : []),
+            ],
+        });
+    }
+    return true;
+}
+function canPrompt() {
+    return (process.env.NX_INTERACTIVE !== 'false' &&
+        !(0, is_ci_1.isCI)() &&
+        !!process.stdout.isTTY &&
+        !!process.stdin.isTTY);
+}
+async function readDeclaredBuildScripts(packageName, version) {
+    let declared;
+    try {
+        const output = await (0, package_manager_1.packageRegistryView)(packageName, version, [
+            'pnpm.allowBuilds',
+            '--json',
+        ]);
+        declared = output ? JSON.parse(output) : undefined;
+    }
+    catch {
+        return {};
+    }
+    // A range matches several versions; the view lists them lowest first.
+    if (Array.isArray(declared)) {
+        declared = declared[declared.length - 1];
+    }
+    if (declared == null || typeof declared !== 'object') {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(declared).filter((entry) => typeof entry[1] === 'boolean'));
+}
+/**
+ * Records `allowBuilds` decisions in pnpm-workspace.yaml, creating the file
+ * when missing (mirroring `pnpm approve-builds` in single-package repos).
+ * Returns the entries it wrote.
+ *
+ * Comment-preserving. Existing entries are never overwritten, so user
+ * decisions always win. pnpm < 11 warns instead of erroring and does not read
+ * `allowBuilds`, so callers gate on the version first.
+ */
+function acknowledgePnpmBuildScripts(host, entries) {
+    const parsed = parseWorkspaceFile(host);
+    if (!parsed) {
+        return {};
+    }
+    const recorded = {};
     for (const [pkg, allowed] of Object.entries(entries)) {
         // Only a real boolean is a user decision. pnpm's non-strict installs stub
         // undecided packages with a placeholder string ("set this to true or
         // false"), which would fail the next strict install if left in place.
         if (typeof parsed.getIn(['allowBuilds', pkg]) !== 'boolean') {
             parsed.setIn(['allowBuilds', pkg], allowed);
-            changed = true;
+            recorded[pkg] = allowed;
         }
     }
-    if (changed) {
+    if (Object.keys(recorded).length > 0) {
         host.write(PNPM_WORKSPACE_FILE, parsed.toString());
     }
+    return recorded;
+}
+/**
+ * Parses pnpm-workspace.yaml, or null when pnpm itself would reject it. A file
+ * that doesn't parse cleanly or whose root isn't a mapping is left alone
+ * rather than crashed on or replaced; pnpm's own error on the file is the
+ * actionable signal. Empty and comment-only files have no contents at all;
+ * setIn creates the mapping for them while keeping whatever comments they
+ * carry.
+ */
+function parseWorkspaceFile(host) {
+    const parsed = (0, yaml_1.parseDocument)(host.exists(PNPM_WORKSPACE_FILE) ? host.read(PNPM_WORKSPACE_FILE) : '');
+    if (parsed.errors.length > 0 ||
+        (parsed.contents != null && !(parsed.contents instanceof yaml_1.YAMLMap))) {
+        return null;
+    }
+    return parsed;
+}
+/** The `allowBuilds` entries that carry a real decision, not a placeholder. */
+function readRecordedDecisions(host) {
+    const allowBuilds = parseWorkspaceFile(host)?.get('allowBuilds');
+    if (!(allowBuilds instanceof yaml_1.YAMLMap)) {
+        return {};
+    }
+    const decisions = {};
+    for (const pair of allowBuilds.items) {
+        const value = (0, yaml_1.isScalar)(pair.value) ? pair.value.value : pair.value;
+        if (typeof value === 'boolean') {
+            decisions[String((0, yaml_1.isScalar)(pair.key) ? pair.key.value : pair.key)] = value;
+        }
+    }
+    return decisions;
 }
-function createHost(treeOrRoot) {
+function createHost(treeOrRoot, directory) {
     if (typeof treeOrRoot === 'string') {
+        const root = (0, path_1.join)(treeOrRoot, directory);
         return {
-            root: treeOrRoot,
-            exists: (p) => (0, fs_1.existsSync)((0, path_1.join)(treeOrRoot, p)),
-            read: (p) => (0, fs_1.readFileSync)((0, path_1.join)(treeOrRoot, p), 'utf-8'),
-            write: (p, c) => (0, fs_1.writeFileSync)((0, path_1.join)(treeOrRoot, p), c),
-            readJson: (p) => (0, fileutils_1.readJsonFile)((0, path_1.join)(treeOrRoot, p)),
+            root,
+            exists: (p) => (0, fs_1.existsSync)((0, path_1.join)(root, p)),
+            read: (p) => (0, fs_1.readFileSync)((0, path_1.join)(root, p), 'utf-8'),
+            write: (p, c) => (0, fs_1.writeFileSync)((0, path_1.join)(root, p), c),
+            readJson: (p) => (0, fileutils_1.readJsonFile)((0, path_1.join)(root, p)),
         };
     }
+    // The directory may not exist on disk yet (a workspace being scaffolded
+    // into it), so the package manager is probed from the tree root.
     return {
         root: treeOrRoot.root,
-        exists: (p) => treeOrRoot.exists(p),
-        read: (p) => treeOrRoot.read(p, 'utf-8'),
-        write: (p, c) => treeOrRoot.write(p, c),
-        readJson: (p) => (0, json_1.parseJson)(treeOrRoot.read(p, 'utf-8')),
+        exists: (p) => treeOrRoot.exists((0, path_1.join)(directory, p)),
+        read: (p) => treeOrRoot.read((0, path_1.join)(directory, p), 'utf-8'),
+        write: (p, c) => treeOrRoot.write((0, path_1.join)(directory, p), c),
+        readJson: (p) => (0, json_1.parseJson)(treeOrRoot.read((0, path_1.join)(directory, p), 'utf-8')),
     };
 }
 function getPnpmVersion(host) {

package/dist/src/utils/child-process.js

@@ -128,6 +128,7 @@ function runNxArgvSync(argv, options) {
     if (result.status !== 0) {
         const error = new Error(`Command failed: nx ${argv.join(' ')} (exit code ${result.status})`);
         error.status = result.status ?? 1;
+        error.signal = result.signal;
         throw error;
     }
 }
@@ -174,7 +175,7 @@ class PseudoTtyProcess {
         this.exitCallbacks.push(callback);
     }
     onOutput(callback) {
-        this.childProcess.onOutput(callback);
+        this.childProcess.onOutput((message) => callback(message));
     }
     kill() {
         try {

package/dist/src/utils/find-matching-projects.js

@@ -112,8 +112,9 @@ function addMatchingProjectsByName(projectNames, projects, pattern, matchedProje
         return;
     }
     if (!(0, globs_1.isGlobPattern)(pattern.value)) {
+        const escapedValue = pattern.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         // Custom regex that is basically \b but includes hyphens (-) and excludes underscores (_), so "foo" pattern matches "foo_bar" but not "foo-e2e".
-        const regex = new RegExp(`(?<![@a-zA-Z0-9-])${pattern.value}(?![@a-zA-Z0-9-])`, 'i');
+        const regex = new RegExp(`(?<![@a-zA-Z0-9-])${escapedValue}(?![@a-zA-Z0-9-])`, 'i');
         const matchingProjects = Object.keys(projects).filter((name) => regex.test(name));
         for (const projectName of matchingProjects) {
             if (pattern.exclude) {
@@ -181,11 +182,13 @@ function parseStringPattern(pattern, projects) {
     }
     else {
         const potentialType = pattern.substring(0, indexOfFirstPotentialSeparator);
-        return {
-            type: isValidPatternType(potentialType) ? potentialType : 'unlabeled',
-            value: pattern.substring(indexOfFirstPotentialSeparator + 1),
-            exclude: isExclude,
-        };
+        return isValidPatternType(potentialType)
+            ? {
+                type: potentialType,
+                value: pattern.substring(indexOfFirstPotentialSeparator + 1),
+                exclude: isExclude,
+            }
+            : { type: 'unlabeled', value: pattern, exclude: isExclude };
     }
 }
 function isValidPatternType(type) {

package/dist/src/utils/git-utils.d.ts

@@ -71,6 +71,8 @@ export declare function getWorkingTreeStatus(directory?: string, excludePaths?:
 export declare function hasUncommittedChanges(directory?: string, excludePaths?: string[]): boolean;
 export type PathCommitExposure = 'ignored' | 'tracked' | 'unignored' | 'unknown';
 export declare function getPathCommitExposure(dirPath: string, directory?: string): PathCommitExposure;
+export type PathHeadStatus = 'committed' | 'absent' | 'unknown';
+export declare function getPathHeadStatus(path: string, directory: string): PathHeadStatus;
 export declare function getUncommittedChangesSnapshot(directory?: string): string;
 export declare function commitChanges(commitMessage: string, directory?: string): string | null;
 /**
@@ -93,13 +95,18 @@ export declare function tryCommitChanges(commitMessage: string, directory: strin
 /**
  * `tryCommitChanges` for a process that has to stay responsive while git
  * runs: a signing prompt or a hook can hold the commit for minutes.
+ * `withoutTerminal` is for a caller sharing the terminal with another program:
+ * git runs without it (see `spawnWithoutTerminal`), so such a prompt fails the
+ * commit instead.
  */
-export declare function tryCommitChangesAsync(commitMessage: string, directory: string, excludePaths?: string[]): Promise<string | null>;
+export declare function tryCommitChangesAsync(commitMessage: string, directory: string, excludePaths?: string[], { withoutTerminal }?: {
+    withoutTerminal?: boolean;
+}): Promise<string | null>;
 /**
- * `git reset --hard <ref>` then `git clean -fd`, keeping `keepPaths` (git
- * exclusion patterns, repo-relative) out of the clean. Throws with git's
- * stderr when either fails. `ref` is a sha a caller validated with `GIT_SHA`,
- * never user input.
+ * `git reset --hard <ref>` then `git clean -fd`, sparing the
+ * `directory`-relative `keepPaths`, staged or not. A kept path `ref` tracks
+ * comes back at `ref`'s version. Throws with git's stderr when git fails.
+ * `ref` is a sha a caller validated with `GIT_SHA`, never user input.
  */
 export declare function resetWorkingTree(ref: string, keepPaths: string[], directory: string): void;
 export declare function getLatestCommitSha(directory?: string): string | null;

package/dist/src/utils/git-utils.js

@@ -16,6 +16,7 @@ exports.getGitRemoteNames = getGitRemoteNames;
 exports.getWorkingTreeStatus = getWorkingTreeStatus;
 exports.hasUncommittedChanges = hasUncommittedChanges;
 exports.getPathCommitExposure = getPathCommitExposure;
+exports.getPathHeadStatus = getPathHeadStatus;
 exports.getUncommittedChangesSnapshot = getUncommittedChangesSnapshot;
 exports.commitChanges = commitChanges;
 exports.tryCommitChanges = tryCommitChanges;
@@ -30,6 +31,7 @@ const crypto = tslib_1.__importStar(require("crypto"));
 const fs = tslib_1.__importStar(require("fs"));
 const path_1 = require("path");
 const owned_private_dir_1 = require("./owned-private-dir");
+const spawn_without_terminal_1 = require("./spawn-without-terminal");
 function execFileAsync(file, args, execOptions) {
     return new Promise((res, rej) => {
         (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => {
@@ -673,12 +675,14 @@ function getGitRemoteNames(directory) {
 // `excludePaths` are left out of the probe the way `tryCommitChanges` leaves
 // them out of the commit, so a tree dirty only under them reads as clean. An
 // exclude-only pathspec still covers the whole tree, matching `git add -A`.
+// The untracked mode is explicit because `status.showUntrackedFiles=no` would
+// hide new files that `git add -A` still stages.
 function getWorkingTreeStatus(directory, excludePaths = []) {
     const pathspecs = excludePaths
         .map((excludePath) => ` ":(exclude)${excludePath}"`)
         .join('');
     try {
-        const out = (0, child_process_1.execSync)(`git status --porcelain${pathspecs ? ` --${pathspecs}` : ''}`, {
+        const out = (0, child_process_1.execSync)(`git status --porcelain --untracked-files=normal${pathspecs ? ` --${pathspecs}` : ''}`, {
             encoding: 'utf8',
             cwd: directory,
             stdio: ['ignore', 'pipe', 'pipe'],
@@ -738,6 +742,30 @@ function getPathCommitExposure(dirPath, directory) {
         return e?.status === 1 ? 'unignored' : 'unknown';
     }
 }
+// Whether HEAD's tree, not the index, has an entry at the `directory`-relative
+// `path`. An unborn HEAD has none; 'unknown' means git failed.
+function getPathHeadStatus(path, directory) {
+    const options = {
+        encoding: 'utf8',
+        cwd: directory,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+    };
+    try {
+        (0, child_process_1.execFileSync)('git', ['rev-parse', '--verify', '-q', 'HEAD'], options);
+    }
+    catch (e) {
+        // --verify -q exits 1 for a ref that does not resolve: an unborn HEAD.
+        return e?.status === 1 ? 'absent' : 'unknown';
+    }
+    try {
+        const entries = (0, child_process_1.execFileSync)('git', ['ls-tree', '--name-only', 'HEAD', '--', path], options);
+        return entries.trim() === '' ? 'absent' : 'committed';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 // Returns a content-sensitive sha1 snapshot of the working tree state for
 // before/after comparison. Hashes three probes:
 //   1. `git diff HEAD` with defensive flags — every byte of tracked-file
@@ -870,11 +898,14 @@ function tryCommitChanges(commitMessage, directory, excludePaths = []) {
 /**
  * `tryCommitChanges` for a process that has to stay responsive while git
  * runs: a signing prompt or a hook can hold the commit for minutes.
+ * `withoutTerminal` is for a caller sharing the terminal with another program:
+ * git runs without it (see `spawnWithoutTerminal`), so such a prompt fails the
+ * commit instead.
  */
-async function tryCommitChangesAsync(commitMessage, directory, excludePaths = []) {
+async function tryCommitChangesAsync(commitMessage, directory, excludePaths = [], { withoutTerminal = false } = {}) {
     try {
         for (const { command, input } of commitCommands(commitMessage, excludePaths)) {
-            await execAsync(command, directory, input);
+            await execAsync(command, directory, input, withoutTerminal);
         }
     }
     catch (err) {
@@ -908,12 +939,14 @@ function commitFailure(err) {
     // for callers to inspect; otherwise only stderr/stdout text survives.
     return new Error(detail || (err instanceof Error ? err.message : String(err)), { cause: err });
 }
-function execAsync(command, cwd, input) {
+function execAsync(command, cwd, input, withoutTerminal) {
     return new Promise((res, rej) => {
-        const child = (0, child_process_1.exec)(command, { encoding: 'utf8', cwd, windowsHide: true }, 
         // The streams ride on the error as `execSync` reports them, so
         // `commitFailure` shapes both the same way.
-        (err, stdout, stderr) => err ? rej(Object.assign(err, { stdout, stderr })) : res());
+        const settle = (err, stdout, stderr) => err ? rej(Object.assign(err, { stdout, stderr })) : res();
+        const child = withoutTerminal
+            ? collectOutput((0, spawn_without_terminal_1.spawnWithoutTerminal)(command, { cwd }), command, settle)
+            : (0, child_process_1.exec)(command, { encoding: 'utf8', cwd, windowsHide: true }, settle);
         // Closed for every command, since `git commit -F -` reads to end of
         // input. A child that exits before reading raises EPIPE here, which the
         // exit callback already reports.
@@ -921,21 +954,46 @@ function execAsync(command, cwd, input) {
         child.stdin?.end(input ?? '');
     });
 }
+// What `exec` reports through its callback; `exec` itself ignores `detached`.
+function collectOutput(child, command, done) {
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.setEncoding('utf8').on('data', (chunk) => (stdout += chunk));
+    child.stderr?.setEncoding('utf8').on('data', (chunk) => (stderr += chunk));
+    child.once('error', (err) => done(err, stdout, stderr));
+    child.once('close', (code, signal) => done(code === 0
+        ? null
+        : Object.assign(new Error(`Command failed: ${command}`), {
+            code,
+            signal,
+        }), stdout, stderr));
+    return child;
+}
 /**
- * `git reset --hard <ref>` then `git clean -fd`, keeping `keepPaths` (git
- * exclusion patterns, repo-relative) out of the clean. Throws with git's
- * stderr when either fails. `ref` is a sha a caller validated with `GIT_SHA`,
- * never user input.
+ * `git reset --hard <ref>` then `git clean -fd`, sparing the
+ * `directory`-relative `keepPaths`, staged or not. A kept path `ref` tracks
+ * comes back at `ref`'s version. Throws with git's stderr when git fails.
+ * `ref` is a sha a caller validated with `GIT_SHA`, never user input.
  */
 function resetWorkingTree(ref, keepPaths, directory) {
+    // `git clean -e` takes ignore patterns, which resolve from the repository
+    // root whatever the cwd, and match at any depth when they hold no slash.
+    const prefix = getGitRootRelativePath(directory);
+    if (prefix === null) {
+        throw new Error(`${directory} is not inside a git repository.`);
+    }
+    const keepPatterns = keepPaths.map((keepPath) => `/${path_1.posix.join(prefix, keepPath).replace(/[\\*?[]/g, '\\$&')}`);
     const options = {
         encoding: 'utf8',
         stdio: 'pipe',
         cwd: directory,
         windowsHide: true,
     };
+    // `reset --hard` deletes a kept path staged since `ref`, so its index entry
+    // goes back to `ref` first, leaving it untracked for the clean to skip.
+    (0, child_process_1.execFileSync)('git', ['reset', '-q', ref, '--', ...keepPaths], options);
     (0, child_process_1.execFileSync)('git', ['reset', '--hard', ref], options);
-    (0, child_process_1.execFileSync)('git', ['clean', '-fd', ...keepPaths.flatMap((keepPath) => ['-e', keepPath])], options);
+    (0, child_process_1.execFileSync)('git', ['clean', '-fd', ...keepPatterns.flatMap((pattern) => ['-e', pattern])], options);
 }
 function getLatestCommitSha(directory) {
     try {

package/dist/src/utils/long-running-target.d.ts

@@ -1,7 +1,5 @@
 /**
- * Target names the pre-23 `longRunningTask` guard excluded from caching. Shared
- * between that guard and the deprecated target-name cache fallback so the two
- * cannot drift apart.
+ * Target names the pre-23 `longRunningTask` guard excluded from caching.
  *
  * The copy in `migrations/update-23-2-0/set-cache-on-executor-target-defaults.ts`
  * deliberately does not use this: a migration's decision has to freeze at the

package/dist/src/utils/long-running-target.js

@@ -2,9 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLongRunningTargetName = isLongRunningTargetName;
 /**
- * Target names the pre-23 `longRunningTask` guard excluded from caching. Shared
- * between that guard and the deprecated target-name cache fallback so the two
- * cannot drift apart.
+ * Target names the pre-23 `longRunningTask` guard excluded from caching.
  *
  * The copy in `migrations/update-23-2-0/set-cache-on-executor-target-defaults.ts`
  * deliberately does not use this: a migration's decision has to freeze at the

package/dist/src/utils/output.d.ts

@@ -224,9 +224,10 @@ declare class CLIOutput {
      * The batch's own output is copied straight from the file it was captured
      * into, so an arbitrarily long log costs a fixed amount of memory here.
      * Nothing is withheld: this rendering is chosen because the whole log was
-     * asked for, because no task claimed any of it, or because a task failed or
-     * was stopped — in which case repeating claimed bytes beside the per-task
-     * blocks is deliberate (see TaskOrchestrator.printGroupedBatchOutput).
+     * asked for, because no task claimed any of it, or because a task failed,
+     * was stopped or was never reached — in which case repeating claimed bytes
+     * beside the per-task blocks is deliberate (see
+     * TaskOrchestrator.printGroupedBatchOutput).
      */
     logBatchGroup(label: string, body: {
         capturedOutputPath?: string;

package/dist/src/utils/output.js

@@ -422,9 +422,10 @@ class CLIOutput {
      * The batch's own output is copied straight from the file it was captured
      * into, so an arbitrarily long log costs a fixed amount of memory here.
      * Nothing is withheld: this rendering is chosen because the whole log was
-     * asked for, because no task claimed any of it, or because a task failed or
-     * was stopped — in which case repeating claimed bytes beside the per-task
-     * blocks is deliberate (see TaskOrchestrator.printGroupedBatchOutput).
+     * asked for, because no task claimed any of it, or because a task failed,
+     * was stopped or was never reached — in which case repeating claimed bytes
+     * beside the per-task blocks is deliberate (see
+     * TaskOrchestrator.printGroupedBatchOutput).
      */
     logBatchGroup(label, body, taskStatus) {
         const grouped = isLogGroupingEnabled();

package/dist/src/utils/owned-private-dir.d.ts

@@ -25,7 +25,7 @@ export type OwnedRealDir = string & {
 export type OwnedPrivateDir = string & {
     readonly [ownedPrivateDirBrand]: true;
 };
-/** Why a guard refused a directory. Data, not a sentence: `remedyFor` decides on it. */
+/** Why a guard refused a directory. Data, not a sentence. */
 export type DirRefusal = {
     kind: 'not-created';
     dir: string;
@@ -65,8 +65,6 @@ export type GuardResult<T> = {
 };
 /** The user-facing sentence for a refusal. The only place wording is decided. */
 export declare function describeRefusal(r: DirRefusal): string;
-/** What the user can do about a refusal, or `undefined` when there is nothing. */
-export declare function remedyFor(r: DirRefusal): string | undefined;
 /** One refusal as an `Error`, so several can travel in an `AggregateError`. */
 export declare class DirectoryRefusedError extends Error {
     readonly refusal: DirRefusal;
@@ -98,20 +96,6 @@ export declare function canonicalDir(dir: string): string;
  * verified private directory beneath it.
  */
 export declare function isSafeSharedRoot(dir: string): GuardResult<SafeSharedRoot>;
-/**
- * Whether other users on this machine can write into `dir`. Gates whether a
- * refusal message may cite other users, so it must not over-report: `false` on
- * Windows, where libuv synthesizes `st_mode` from the READONLY attribute and
- * reports an ordinary per-account directory as `0666`, and `false` on a path
- * that cannot be inspected.
- *
- * `statSync`, not `lstatSync`: the question is about the directory that will be
- * used, not the link pointing at it. Link modes mislead in both directions —
- * Linux creates symlinks `0777`, macOS applies the umask. Nothing here decides
- * whether a path is accepted, so following the link costs nothing the guards
- * do not already re-check.
- */
-export declare function isPeerWritable(dir: string): boolean;
 /**
  * Create a shared container as sticky + world-writable if it does not exist,
  * and report whether the resulting path is safe for the current user.