@ohos-ports/nx 23.3.0-beta.3 → 24.0.2-beta.0

package/dist/src/nx-cloud/update-manager.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NxCloudClientUnavailableError = exports.NxCloudEnterpriseOutdatedError = void 0;
 exports.verifyOrUpdateNxCloudClient = verifyOrUpdateNxCloudClient;
 exports.getBundleInstallDefaultLocation = getBundleInstallDefaultLocation;
+exports.downloadAndExtractClientBundle = downloadAndExtractClientBundle;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const zlib_1 = require("zlib");
@@ -16,6 +17,7 @@ const tar = tslib_1.__importStar(require("tar-stream"));
 const cache_directory_1 = require("../utils/cache-directory");
 const is_ci_1 = require("../utils/is-ci");
 const crypto_1 = require("crypto");
+const native_1 = require("../native");
 const workspace_root_1 = require("../utils/workspace-root");
 class NxCloudEnterpriseOutdatedError extends Error {
     constructor(url) {
@@ -74,13 +76,13 @@ async function verifyOrUpdateNxCloudClient(options) {
         if (version === 'NX_ENTERPRISE_OUTDATED_IMAGE') {
             throw new NxCloudEnterpriseOutdatedError(apiUrl);
         }
-        const fullPath = await downloadAndExtractClientBundle(httpClient, runnerBundleInstallDirectory, version, url);
-        (0, debug_logger_1.debugLog)('Done: ', fullPath);
-        const nxCloudClient = require(fullPath);
+        const installedBundle = await downloadAndExtractClientBundle(httpClient, version, url);
+        (0, debug_logger_1.debugLog)('Done: ', installedBundle.fullPath);
+        const nxCloudClient = require(installedBundle.fullPath);
         if (nxCloudClient.commands === undefined) {
             throw new NxCloudEnterpriseOutdatedError(apiUrl);
         }
-        return { version, nxCloudClient };
+        return { version: installedBundle.version, nxCloudClient };
     }
     if (currentBundle === null) {
         throw new NxCloudClientUnavailableError();
@@ -114,6 +116,25 @@ function getBundleInstallDefaultLocation() {
     return (0, path_1.join)((0, is_ci_1.isCI)() ? (0, cache_directory_1.cacheDirectoryForWorkspace)(workspace_root_1.workspaceRoot) : cache_directory_1.cacheDir, 'cloud');
 }
 const runnerBundleInstallDirectory = getBundleInstallDefaultLocation();
+// Control files live outside the install directory. Released nx versions load
+// any directory there as a bundle, so they would `require` a state directory
+// placed inside it.
+const stateDirectory = (0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'nx.json'))
+    ? (0, path_1.join)(cache_directory_1.workspaceDataDirectory, 'nx-cloud')
+    : `${runnerBundleInstallDirectory}-state`;
+function ensureStateDirectory() {
+    (0, fs_1.mkdirSync)(stateDirectory, { recursive: true });
+}
+const downloadLockFilePath = (0, path_1.join)(stateDirectory, 'download.lock');
+// The record lives beside the lockfile rather than inside it. Windows
+// byte-range locks are mandatory and handle-scoped, so writing to a file this
+// process holds an exclusive lock on fails with ERROR_LOCK_VIOLATION. It also
+// matches the convention elsewhere in nx: project-graph.lock and run.json.lock
+// are never written to.
+const downloadRecordFilePath = (0, path_1.join)(stateDirectory, 'download.record');
+// A version names a directory that is created and later deleted, so a value
+// from the server must not be able to escape the install directory.
+const VALID_BUNDLE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function getLatestInstalledRunnerBundle() {
     if (!(0, fs_1.existsSync)(runnerBundleInstallDirectory)) {
         (0, fs_1.mkdirSync)(runnerBundleInstallDirectory, { recursive: true });
@@ -121,7 +142,9 @@ function getLatestInstalledRunnerBundle() {
     try {
         const installedBundles = (0, fs_1.readdirSync)(runnerBundleInstallDirectory)
             .filter((potentialDirectory) => {
-            return (0, fs_1.statSync)((0, path_1.join)(runnerBundleInstallDirectory, potentialDirectory)).isDirectory();
+            // '.tmp-*' directories are in-progress or crashed downloads
+            return (!potentialDirectory.startsWith('.') &&
+                (0, fs_1.statSync)((0, path_1.join)(runnerBundleInstallDirectory, potentialDirectory)).isDirectory());
         })
             .map((fileOrDirectory) => ({
             version: fileOrDirectory,
@@ -131,7 +154,13 @@ function getLatestInstalledRunnerBundle() {
             // No installed bundles
             return null;
         }
-        return installedBundles[0];
+        // A contended install can leave several bundles on disk. The record names
+        // the directory an install last completed in, which is the one to run.
+        // Without a record the directory name is all there is to go on and is read
+        // as the version, which is right for a bundle an older nx installed and
+        // otherwise yields a version the server rejects, costing one more
+        // download.
+        return recordedBundle() ?? installedBundles[0];
     }
     catch (e) {
         console.log('Could not read runner bundle path:', e.message);
@@ -170,7 +199,7 @@ async function verifyCurrentBundle(httpClient, currentBundle) {
     });
 }
 function getLatestBundleVerificationTimestamp() {
-    const lockfilePath = (0, path_1.join)(runnerBundleInstallDirectory, 'verify.lock');
+    const lockfilePath = (0, path_1.join)(stateDirectory, 'verify.lock');
     if ((0, fs_1.existsSync)(lockfilePath)) {
         const timestampAsString = (0, fs_1.readFileSync)(lockfilePath, 'utf-8');
         let timestampAsNumber;
@@ -185,7 +214,8 @@ function getLatestBundleVerificationTimestamp() {
     return null;
 }
 function writeBundleVerificationLock() {
-    const lockfilePath = (0, path_1.join)(runnerBundleInstallDirectory, 'verify.lock');
+    const lockfilePath = (0, path_1.join)(stateDirectory, 'verify.lock');
+    ensureStateDirectory();
     (0, fs_1.writeFileSync)(lockfilePath, new Date().getTime().toString(), 'utf-8');
 }
 function getBundleContentHash(bundle) {
@@ -211,7 +241,118 @@ function hashDirectory(dir) {
     const combinedHashes = hashes.sort().join('');
     return (0, crypto_1.createHash)('sha256').update(combinedHashes).digest('hex');
 }
-async function downloadAndExtractClientBundle(httpClient, runnerBundleInstallDirectory, version, url) {
+async function downloadAndExtractClientBundle(httpClient, version, url) {
+    // Parallel nx processes race to install bundles, possibly at different
+    // versions. The first to take the lock downloads; the rest wait and adopt
+    // its bundle when an install completed during the wait at the version the
+    // server asked them for. Otherwise they download their own as a contended
+    // install, which publishes its own directory and skips cleanup, so the
+    // holder's bundle stays on disk for the process running from it - at the
+    // same version as well as a different one. The flock is released by the
+    // kernel if the holder dies, so no stale-lock cleanup is needed. Under WASM
+    // the lock is unavailable and downloads run unserialized.
+    if (!VALID_BUNDLE_VERSION.test(version)) {
+        throw new Error(`Invalid Nx Cloud client bundle version: ${version}`);
+    }
+    const recordBeforeContending = readDownloadRecord();
+    const lock = !native_1.IS_WASM ? new native_1.FileLock(downloadLockFilePath) : null;
+    let locked = lock?.locked;
+    let contended = false;
+    while (locked) {
+        (0, debug_logger_1.debugLog)('Another process is downloading the client bundle, waiting for it to complete');
+        await lock.wait();
+        // The holder may be running from a bundle whose record predates this call,
+        // so the wait alone makes the install contended.
+        contended = true;
+        const installedBundle = bundleInstalledSince(recordBeforeContending);
+        if (installedBundle) {
+            if (installedBundle.version === version) {
+                (0, debug_logger_1.debugLog)('Using client bundle downloaded by another process: ', installedBundle.version);
+                return installedBundle;
+            }
+            (0, debug_logger_1.debugLog)('Another process installed a different bundle: ', installedBundle.version);
+        }
+        // The other process failed or installed an older version, so this process
+        // still needs to download.
+        locked = lock.check();
+    }
+    lock?.lock();
+    try {
+        // A process that acquired the lock between the check above and lock() may
+        // have completed an install already.
+        const installedBundle = bundleInstalledSince(recordBeforeContending);
+        if (installedBundle) {
+            if (installedBundle.version === version) {
+                (0, debug_logger_1.debugLog)('Using client bundle downloaded by another process: ', installedBundle.version);
+                return installedBundle;
+            }
+            // A different version means that process is running from a bundle this
+            // one must not delete.
+            contended = true;
+            (0, debug_logger_1.debugLog)('Another process installed a different bundle: ', installedBundle.version);
+        }
+        const fullPath = await downloadAndExtractBundle(httpClient, version, url, contended);
+        return { version, fullPath };
+    }
+    finally {
+        lock?.unlock();
+    }
+}
+// Records "<serverVersion> <directoryName>", written only once an install has
+// COMPLETED. The directory is recorded separately because it cannot be derived
+// from the version - every install publishes its own (see
+// downloadAndExtractBundle), so several directories can carry the same
+// version. That also makes every record distinct, so a waiter can tell "an
+// install finished while I waited" from "this record is left over from a past
+// run" by comparing the record it read before contending. Timestamps cannot
+// answer that: filesystem mtime granularity is coarser than the race window.
+function readDownloadRecord() {
+    try {
+        return (0, fs_1.readFileSync)(downloadRecordFilePath, 'utf-8').trim();
+    }
+    catch {
+        return '';
+    }
+}
+function writeDownloadRecord(version, directoryName) {
+    ensureStateDirectory();
+    (0, fs_1.writeFileSync)(downloadRecordFilePath, `${version} ${directoryName}`, 'utf-8');
+}
+/**
+ * The bundle the record names, if it is still on disk. A record whose second
+ * field does not name a live directory resolves to null and leaves selection
+ * on its fallback, which is what a one-field record or anything else
+ * unexpected in the file has to do.
+ */
+function recordedBundle() {
+    const [version, directoryName] = readDownloadRecord().split(' ');
+    if (!version ||
+        !directoryName ||
+        !VALID_BUNDLE_VERSION.test(version) ||
+        !VALID_BUNDLE_VERSION.test(directoryName)) {
+        return null;
+    }
+    const fullPath = (0, path_1.join)(runnerBundleInstallDirectory, directoryName);
+    return (0, fs_1.existsSync)(fullPath) ? { version, fullPath } : null;
+}
+/**
+ * The bundle an install completed during this call, or null. Requires the
+ * record to have changed since `recordBefore` was read: a directory existing
+ * proves only that some earlier run left one there, and an install
+ * interrupted on a released nx leaves exactly that.
+ */
+function bundleInstalledSince(recordBefore) {
+    return readDownloadRecord() === recordBefore ? null : recordedBundle();
+}
+async function downloadAndExtractBundle(httpClient, version, url, contended) {
+    // Every install publishes its own directory. Two processes can be asked for
+    // the same version while one of them is already running from a completed
+    // install of it, so replacing <installDir>/<version> in place would delete
+    // that bundle out from under it - and a holder loading its client in the gap
+    // fails with MODULE_NOT_FOUND, which drops the task runner to running
+    // without Nx Cloud. A directory nothing else has seen cannot be in use.
+    const bundleDirectoryName = `${version}-${(0, crypto_1.randomUUID)()}`;
+    const bundleExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, bundleDirectoryName);
     let resp;
     try {
         resp = await httpClient.get(url, {
@@ -222,53 +363,99 @@ async function downloadAndExtractClientBundle(httpClient, runnerBundleInstallDir
         console.error('Error while updating Nx Cloud client bundle');
         throw e;
     }
-    const bundleExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, version);
-    if (!(0, fs_1.existsSync)(bundleExtractLocation)) {
-        (0, fs_1.mkdirSync)(bundleExtractLocation);
-    }
-    return new Promise((res, rej) => {
-        const extract = tar.extract();
-        extract.on('entry', function (headers, stream, next) {
-            if (headers.type === 'directory') {
-                const directoryPath = (0, path_1.join)(bundleExtractLocation, headers.name);
-                if (!(0, fs_1.existsSync)(directoryPath)) {
-                    (0, fs_1.mkdirSync)(directoryPath, { recursive: true });
-                }
-                next();
-                stream.resume();
-            }
-            else if (headers.type === 'file') {
-                const outputFilePath = (0, path_1.join)(bundleExtractLocation, headers.name);
-                const writeStream = (0, fs_1.createWriteStream)(outputFilePath);
-                // Surface disk errors through the pipeline instead of crashing
-                writeStream.on('error', (e) => extract.destroy(e));
-                stream.pipe(writeStream);
-                // Continue the tar stream after the write stream closes
-                writeStream.on('close', () => {
+    // Extract into a temp directory and rename into place afterwards, so a
+    // failed or interrupted download never leaves a partial bundle at the
+    // path other processes require it from.
+    const tempExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, `.tmp-${version}-${process.pid}`);
+    (0, fs_1.mkdirSync)(tempExtractLocation, { recursive: true });
+    try {
+        await new Promise((res, rej) => {
+            const extract = tar.extract();
+            extract.on('entry', function (headers, stream, next) {
+                if (headers.type === 'directory') {
+                    const directoryPath = (0, path_1.join)(tempExtractLocation, headers.name);
+                    if (!(0, fs_1.existsSync)(directoryPath)) {
+                        (0, fs_1.mkdirSync)(directoryPath, { recursive: true });
+                    }
                     next();
-                });
-                stream.resume();
-            }
-        });
-        extract.on('finish', function () {
-            removeOldClientBundles(version);
-            writeBundleVerificationLock();
-            res(bundleExtractLocation);
-        });
-        // pipeline propagates download/gunzip errors that .pipe() would leave
-        // uncaught
-        (0, stream_1.pipeline)(resp.data, (0, zlib_1.createGunzip)(), extract, (e) => {
-            if (e)
-                rej(e);
+                    stream.resume();
+                }
+                else if (headers.type === 'file') {
+                    const outputFilePath = (0, path_1.join)(tempExtractLocation, headers.name);
+                    const writeStream = (0, fs_1.createWriteStream)(outputFilePath);
+                    // Surface disk errors through the pipeline instead of crashing
+                    writeStream.on('error', (e) => extract.destroy(e));
+                    stream.pipe(writeStream);
+                    // Continue the tar stream after the write stream closes
+                    writeStream.on('close', () => {
+                        next();
+                    });
+                    stream.resume();
+                }
+                else {
+                    // Skipping the entry would publish an incomplete bundle.
+                    extract.destroy(new Error(`Unsupported ${headers.type} entry in Nx Cloud client bundle: ${headers.name}`));
+                }
+            });
+            extract.on('finish', function () {
+                res();
+            });
+            // pipeline propagates download/gunzip errors that .pipe() would leave
+            // uncaught
+            (0, stream_1.pipeline)(resp.data, (0, zlib_1.createGunzip)(), extract, (e) => {
+                if (e)
+                    rej(e);
+            });
         });
-    });
+        (0, fs_1.renameSync)(tempExtractLocation, bundleExtractLocation);
+        // Recorded only now: the record is the signal that a bundle at this
+        // version was installed by this process, which is what lets a waiter
+        // adopt it instead of downloading again, and it carries the directory
+        // that selection has to load from.
+        writeDownloadRecord(version, bundleDirectoryName);
+    }
+    catch (e) {
+        (0, fs_1.rmSync)(tempExtractLocation, { recursive: true, force: true });
+        throw e;
+    }
+    // On a contended install another process may be running from any bundle on
+    // disk, now including one at this same version, so nothing here can be shown
+    // to be unused and collection waits for a later uncontended install. Repeat
+    // contention accumulates directories until one of those runs. Bounding that
+    // means knowing which bundles are still loaded, which nothing on disk
+    // records today.
+    if (!contended) {
+        removeOldClientBundles(bundleDirectoryName);
+    }
+    writeBundleVerificationLock();
+    return bundleExtractLocation;
 }
-function removeOldClientBundles(currentInstallVersion) {
+function removeOldClientBundles(currentInstallDirectoryName) {
     const filesAndFolders = (0, fs_1.readdirSync)(runnerBundleInstallDirectory);
     for (let fileOrFolder of filesAndFolders) {
+        // A '.tmp-*' left by a crashed extract is reclaimed here, which is safe
+        // only because this runs after our own was renamed away and the download
+        // lock means no other process is extracting. Under WASM there is no lock,
+        // so a concurrent extract may still own that directory: leaving it costs
+        // disk, deleting it would fail that process's install.
+        if (fileOrFolder === currentInstallDirectoryName ||
+            (native_1.IS_WASM && fileOrFolder.startsWith('.tmp-'))) {
+            continue;
+        }
         const fileOrFolderPath = (0, path_1.join)(runnerBundleInstallDirectory, fileOrFolder);
-        if (fileOrFolder !== currentInstallVersion) {
-            (0, fs_1.rmSync)(fileOrFolderPath, { recursive: true });
+        // Another process's cleanup can remove an entry between the readdir above
+        // and these calls, so both tolerate it already being gone.
+        let isBundle;
+        try {
+            // Only directories are bundles. Files here, like the verify.lock a
+            // released nx writes, are left alone.
+            isBundle = (0, fs_1.statSync)(fileOrFolderPath).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isBundle) {
+            (0, fs_1.rmSync)(fileOrFolderPath, { recursive: true, force: true });
         }
     }
 }

package/dist/src/plugins/js/lock-file/pnpm-parser.js

@@ -438,7 +438,8 @@ function getDependencies(data, keyMap, isV5, ctx) {
                     Object.keys(section).forEach((name) => {
                         const versionRange = section[name];
                         const version = parseBaseVersion(findVersion(versionRange, name, isV5), isV5);
-                        const target = ctx.externalNodes[`npm:${name}@${version}`] ||
+                        const target = keyMap.get(versionRange)?.values().next().value ||
+                            ctx.externalNodes[`npm:${name}@${version}`] ||
                             ctx.externalNodes[`npm:${name}`];
                         if (target) {
                             const dep = {
@@ -603,9 +604,7 @@ function stringifyPnpmLockfile(graph, rootLockFileContent, packageJson, workspac
     // relocated at its synthesis site, which is why it is added afterwards: a
     // second pass over an already-relocated path cannot tell it apart from a
     // workspace path that genuinely starts with the shipped directory's name.
-    // TODO(v24): throw on this collision like the colliding-patches case; today
-    // the copied workspace module silently supersedes the file: dependency.
-    (0, pruned_output_1.warnOnWorkspaceModulePathCollision)(snapshots, synthesizedModulePaths);
+    (0, pruned_output_1.assertNoWorkspaceModulePathCollision)(snapshots, synthesizedModulePaths);
     (0, pruned_output_1.containShippedLocalFilePaths)(output, synthesizedModulePaths);
     // Peers pnpm left out of the importer (autoInstallPeers off) still ship as
     // real dependencies, matching the copied manifest that moves every

package/dist/src/plugins/js/lock-file/pruned-output.d.ts

@@ -148,12 +148,12 @@ export declare function normalizeLocalPathSpec(spec: string): string;
  */
 export declare function uncontainLocalPathSpec(spec: string): string;
 /**
- * Warns when a workspace directory occupies the output path of a copied
+ * Throws when a workspace directory occupies the output path of a copied
  * workspace module. Both spell `workspace_modules/<name>`, so no later pass can
  * tell them apart: the vendored source is read as the copied module and never
  * ships, leaving the lockfile pointing at a path the output does not carry.
  */
-export declare function warnOnWorkspaceModulePathCollision(sourcePackages: Record<string, unknown> | undefined, synthesizedModulePaths: ReadonlySet<string>): void;
+export declare function assertNoWorkspaceModulePathCollision(sourcePackages: Record<string, unknown> | undefined, synthesizedModulePaths: ReadonlySet<string>): void;
 /**
  * Relocates every shippable non-workspace `file:` local-path reference in a
  * pruned lockfile (package keys, resolutions, and snapshot/importer dependency

package/dist/src/plugins/js/lock-file/pruned-output.js

@@ -11,7 +11,7 @@ exports.containLocalPath = containLocalPath;
 exports.uncontainLocalPath = uncontainLocalPath;
 exports.normalizeLocalPathSpec = normalizeLocalPathSpec;
 exports.uncontainLocalPathSpec = uncontainLocalPathSpec;
-exports.warnOnWorkspaceModulePathCollision = warnOnWorkspaceModulePathCollision;
+exports.assertNoWorkspaceModulePathCollision = assertNoWorkspaceModulePathCollision;
 exports.containShippedLocalFilePaths = containShippedLocalFilePaths;
 exports.containShippedLocalLinkRefs = containShippedLocalLinkRefs;
 exports.getPrunedPnpmLocalPathArtifacts = getPrunedPnpmLocalPathArtifacts;
@@ -772,18 +772,18 @@ function containFileToken(token, synthesized) {
         : `${token.slice(0, pathStart)}${contained}`;
 }
 /**
- * Warns when a workspace directory occupies the output path of a copied
+ * Throws when a workspace directory occupies the output path of a copied
  * workspace module. Both spell `workspace_modules/<name>`, so no later pass can
  * tell them apart: the vendored source is read as the copied module and never
  * ships, leaving the lockfile pointing at a path the output does not carry.
  */
-function warnOnWorkspaceModulePathCollision(sourcePackages, synthesizedModulePaths) {
+function assertNoWorkspaceModulePathCollision(sourcePackages, synthesizedModulePaths) {
     for (const snapshot of Object.values(sourcePackages ?? {})) {
         const directory = snapshot
             ?.resolution?.directory;
         if (typeof directory === 'string' &&
             synthesizedModulePaths.has((0, path_2.normalizePath)(directory))) {
-            logger_1.logger.warn(`Local-path dependency "file:${directory}" sits where the pruned output copies a workspace module of the same name, so it cannot ship separately. Move it out of ${WORKSPACE_MODULES_DIR}/ to deploy it.`);
+            throw new Error(`Cannot prune pnpm lockfile: local-path dependency "file:${directory}" sits where the standalone output copies a workspace module of the same name. Move it out of ${WORKSPACE_MODULES_DIR}/ so they do not collide.`);
         }
     }
 }

package/dist/src/plugins/js/utils/register.js

@@ -744,12 +744,16 @@ function isNativeTypeStripError(err) {
  * Module resolution failures - typically a tsconfig path alias that hasn't
  * been registered yet, or a workspace lib not surfaced via package manager
  * symlinks. CJS uses `MODULE_NOT_FOUND`, ESM uses `ERR_MODULE_NOT_FOUND`.
+ * `ERR_PACKAGE_PATH_NOT_EXPORTED` covers a linked package shadowing a path
+ * alias for a subpath its `exports` doesn't list.
  */
 function isModuleNotFoundError(err) {
     if (!err || typeof err !== 'object')
         return false;
     const code = err.code;
-    return code === 'MODULE_NOT_FOUND' || code === 'ERR_MODULE_NOT_FOUND';
+    return (code === 'MODULE_NOT_FOUND' ||
+        code === 'ERR_MODULE_NOT_FOUND' ||
+        code === 'ERR_PACKAGE_PATH_NOT_EXPORTED');
 }
 /**
  * A SyntaxError thrown while parsing a forced-CJS file (`.cts`/`.cjs`) as
@@ -1010,8 +1014,8 @@ function requireWithTsconfigFallback(filePath, tsConfigPath) {
  *   - ESM-redispatch signals callers expect to handle
  *     (`ERR_REQUIRE_ESM`, `ERR_REQUIRE_ASYNC_MODULE`)
  *   - plain module-resolution failures (`MODULE_NOT_FOUND`,
- *     `ERR_MODULE_NOT_FOUND`) - disabling strip-types doesn't fix a missing
- *     module, the hint just misleads.
+ *     `ERR_MODULE_NOT_FOUND`, `ERR_PACKAGE_PATH_NOT_EXPORTED`) - disabling
+ *     strip-types doesn't fix a missing module, the hint just misleads.
  */
 function augmentLoadFailure(filePath, err) {
     if (!(err instanceof Error))
@@ -1020,7 +1024,8 @@ function augmentLoadFailure(filePath, err) {
     if (code === 'ERR_REQUIRE_ESM' ||
         code === 'ERR_REQUIRE_ASYNC_MODULE' ||
         code === 'MODULE_NOT_FOUND' ||
-        code === 'ERR_MODULE_NOT_FOUND') {
+        code === 'ERR_MODULE_NOT_FOUND' ||
+        code === 'ERR_PACKAGE_PATH_NOT_EXPORTED') {
         return err;
     }
     if (err.message.includes(NX_PREFER_NODE_STRIP_TYPES_DOCS_URL)) {

package/dist/src/project-graph/affected/affected-tasks.d.ts

@@ -11,13 +11,14 @@ import { TaskPlanningContext } from '../../hasher/task-planning-context';
 import type { TaskSelection } from '../../tasks-runner/run-command';
 /**
  * Whether `nx affected` selects the individual tasks whose inputs a change
- * reaches, rather than whole projects. Off by default while the task path
- * settles.
+ * reaches, rather than whole projects. `NX_LEGACY_AFFECTED` overrides
+ * nx.json's `affected.legacy`.
  *
- * Env-var only, so `nx show projects --affected` and `nx affected` in one CI
- * script agree. The run also executes the selected tasks' dependencies.
+ * The run also executes the selected tasks' dependencies.
  */
-export declare function selectsAffectedTasks(): boolean;
+export declare function selectsAffectedTasks(nxJson: NxJsonConfiguration): boolean;
+/** What to change so {@link selectsAffectedTasks} returns true, for error messages. */
+export declare function taskGranularityRequirement(): string;
 export interface AffectedTasksResult {
     /** The graph selection ran against, which the command should run with too. */
     projectGraph: ProjectGraph;
@@ -91,7 +92,8 @@ export declare function computeAffectedTasks(opts: ComputeAffectedTasksOptions):
  * task can read files no affected project owns. Shared by the client and the
  * daemon.
  */
-export declare function selectAffectedTasks(projectGraph: ProjectGraph, nxJson: NxJsonConfiguration, planningContext: TaskPlanningContext, request: AffectedTasksRequest, { touchedFiles, packageJson, ultracacheConfigurations, }?: {
+export declare function selectAffectedTasks(...args: Parameters<typeof matchAffectedTasks>): ReturnType<typeof matchAffectedTasks>;
+declare function matchAffectedTasks(projectGraph: ProjectGraph, nxJson: NxJsonConfiguration, planningContext: TaskPlanningContext, request: AffectedTasksRequest, { touchedFiles, packageJson, ultracacheConfigurations, }?: {
     touchedFiles?: FileChange[];
     packageJson?: any;
     ultracacheConfigurations?: UltracacheConfigurations;
@@ -101,3 +103,4 @@ export declare function selectAffectedTasks(projectGraph: ProjectGraph, nxJson:
     taskSelection: TaskSelection;
     explanation?: InternedExplanation;
 }>;
+export {};

package/dist/src/project-graph/affected/affected-tasks.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.selectsAffectedTasks = selectsAffectedTasks;
+exports.taskGranularityRequirement = taskGranularityRequirement;
 exports.computeAffectedTasks = computeAffectedTasks;
 exports.selectAffectedTasks = selectAffectedTasks;
 const native_1 = require("../../native");
@@ -16,6 +17,8 @@ const logger_1 = require("../../utils/logger");
 const error_types_1 = require("../error-types");
 const affected_reasons_1 = require("./affected-reasons");
 const workspace_root_1 = require("../../utils/workspace-root");
+const delayed_spinner_1 = require("../../utils/delayed-spinner");
+const progress_topics_1 = require("../../utils/progress-topics");
 const task_planning_context_1 = require("../../hasher/task-planning-context");
 const client_1 = require("../../daemon/client/client");
 const is_on_daemon_1 = require("../../daemon/is-on-daemon");
@@ -25,14 +28,23 @@ const npm_packages_1 = require("../../plugins/js/project-graph/affected/npm-pack
 const lock_file_1 = require("../../plugins/js/lock-file/lock-file");
 /**
  * Whether `nx affected` selects the individual tasks whose inputs a change
- * reaches, rather than whole projects. Off by default while the task path
- * settles.
+ * reaches, rather than whole projects. `NX_LEGACY_AFFECTED` overrides
+ * nx.json's `affected.legacy`.
  *
- * Env-var only, so `nx show projects --affected` and `nx affected` in one CI
- * script agree. The run also executes the selected tasks' dependencies.
+ * The run also executes the selected tasks' dependencies.
  */
-function selectsAffectedTasks() {
-    return process.env.NX_LEGACY_AFFECTED === 'false';
+function selectsAffectedTasks(nxJson) {
+    if (process.env.NX_LEGACY_AFFECTED === 'true')
+        return false;
+    if (process.env.NX_LEGACY_AFFECTED === 'false')
+        return true;
+    return !nxJson.affected?.legacy;
+}
+/** What to change so {@link selectsAffectedTasks} returns true, for error messages. */
+function taskGranularityRequirement() {
+    return process.env.NX_LEGACY_AFFECTED === 'true'
+        ? 'NX_LEGACY_AFFECTED unset or set to false'
+        : 'affected.legacy unset or false in nx.json';
 }
 /**
  * Selects the tasks a change reaches, rather than the projects that own a
@@ -110,7 +122,18 @@ async function computeAffectedTasks(opts) {
  * task can read files no affected project owns. Shared by the client and the
  * daemon.
  */
-async function selectAffectedTasks(projectGraph, nxJson, planningContext, request, { touchedFiles = (0, file_utils_1.calculateFileChanges)(request.changedFiles, request.fileChangeArgs), packageJson, ultracacheConfigurations, } = {}) {
+async function selectAffectedTasks(...args) {
+    const spinner = new delayed_spinner_1.DelayedSpinner('Calculating affected tasks', {
+        progressTopic: progress_topics_1.ProgressTopics.AffectedTasks,
+    });
+    try {
+        return await matchAffectedTasks(...args);
+    }
+    finally {
+        spinner.cleanup();
+    }
+}
+async function matchAffectedTasks(projectGraph, nxJson, planningContext, request, { touchedFiles = (0, file_utils_1.calculateFileChanges)(request.changedFiles, request.fileChangeArgs), packageJson, ultracacheConfigurations, } = {}) {
     const { targets } = request;
     // Only projects that have one of the targets: with a single target,
     // createTaskGraph tries to create a task for projects that lack it and
@@ -148,6 +171,7 @@ async function selectAffectedTasks(projectGraph, nxJson, planningContext, reques
     const dependencies = dependencyChanges(projectGraph, touchedFiles, nxJson, packageJson);
     const namedProjects = new Set(dependencies.projects);
     const projects = (0, project_graph_1.readProjectsConfigurationFromProjectGraph)(projectGraph).projects;
+    // TODO(v25): remove custom hasher support.
     const customHashed = new Set(taskIds.filter((id) => hasCustomHasher(taskGraph.tasks[id], projects)));
     const options = {
         projectGlobPatterns: await (0, affected_projects_1.getProjectGlobPatterns)(nxJson),

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -351,6 +351,13 @@ class IsolatedPlugin {
         this.shutdown();
     }
     async setWorkerEnv(env) {
+        // A restart may have spawned under the previous client env but not yet
+        // finished loading. Wait for that worker so it receives the update too.
+        // Do not start a stopped worker solely to forward env: its next spawn
+        // will inherit the daemon's already-updated environment.
+        if (!this._alive && this._connectPromise) {
+            await this._connectPromise;
+        }
         if (!this._alive) {
             return;
         }