nx 22.7.6 → 22.7.8

package/dist/src/ai/set-up-ai-agents/set-up-ai-agents.js

@@ -12,6 +12,7 @@ const generate_files_1 = require("../../generators/utils/generate-files");
 const json_1 = require("../../generators/utils/json");
 const native_1 = require("../../native");
 const package_json_1 = require("../../utils/package-json");
+const package_manager_1 = require("../../utils/package-manager");
 const ignore_1 = require("../../utils/ignore");
 const provenance_1 = require("../../utils/provenance");
 const workspace_root_1 = require("../../utils/workspace-root");
@@ -48,7 +49,7 @@ async function setupAiAgentsGenerator(tree, options, inner = false) {
     }
     try {
         await (0, provenance_1.ensurePackageHasProvenance)('nx', normalizedOptions.packageVersion);
-        const { tempDir, cleanup } = (0, package_json_1.installPackageToTmp)('nx', normalizedOptions.packageVersion);
+        const { tempDir, cleanup } = (0, package_json_1.installPackageToTmp)('nx', normalizedOptions.packageVersion, (0, package_manager_1.detectPackageManager)(tree.root));
         let modulePath = (0, path_1.join)(tempDir, 'node_modules', 'nx', 'src/ai/set-up-ai-agents/set-up-ai-agents.js');
         const module = await (0, handle_import_1.handleImport)(modulePath);
         const setupAiAgentsGeneratorResult = await module.setupAiAgentsGenerator(tree, normalizedOptions, true);

package/dist/src/command-line/configure-ai-agents/configure-ai-agents.js

@@ -44,7 +44,7 @@ async function configureAiAgentsHandler(args, inner = false) {
     let cleanup;
     try {
         await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest');
+        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
         cleanup = packageInstallResults.cleanup;
         let modulePath = require.resolve('nx/src/command-line/configure-ai-agents/configure-ai-agents.js', { paths: [packageInstallResults.tempDir] });
         const module = await (0, handle_import_1.handleImport)(modulePath);

package/dist/src/command-line/init/init-v2.js

@@ -42,7 +42,7 @@ async function initHandler(options, inner = false) {
     let cleanup;
     try {
         await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest');
+        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest', (0, package_manager_2.detectPackageManager)(process.cwd()));
         cleanup = packageInstallResults.cleanup;
         let modulePath = require.resolve('nx/src/command-line/init/init-v2.js', {
             paths: [packageInstallResults.tempDir],

package/dist/src/command-line/migrate/migrate-ui-api.js

@@ -17,6 +17,7 @@ exports.stopMigration = stopMigration;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
+const git_revision_1 = require("../../utils/git-revision");
 const migrate_1 = require("./migrate");
 let currentMigrationProcess = null;
 let currentMigrationId = null;
@@ -47,6 +48,9 @@ function finishMigrationProcess(workspacePath, squashCommits, commitMessage) {
     const migrationsJsonPath = (0, path_1.join)(workspacePath, 'migrations.json');
     const parsedMigrationsJson = JSON.parse((0, fs_1.readFileSync)(migrationsJsonPath, 'utf-8'));
     const initialGitRef = parsedMigrationsJson['nx-console'].initialGitRef;
+    if (squashCommits && initialGitRef) {
+        (0, git_revision_1.assertValidGitSha)(initialGitRef.ref);
+    }
     if ((0, fs_1.existsSync)(migrationsJsonPath)) {
         (0, fs_1.rmSync)(migrationsJsonPath);
     }
@@ -55,24 +59,24 @@ function finishMigrationProcess(workspacePath, squashCommits, commitMessage) {
         encoding: 'utf-8',
         windowsHide: true,
     });
-    (0, child_process_1.execSync)(`git commit -m "${commitMessage}" --no-verify`, {
-        cwd: workspacePath,
-        encoding: 'utf-8',
-        windowsHide: true,
-    });
+    commit(workspacePath, commitMessage);
     if (squashCommits && initialGitRef) {
-        (0, child_process_1.execSync)(`git reset --soft ${initialGitRef.ref}`, {
-            cwd: workspacePath,
-            encoding: 'utf-8',
-            windowsHide: true,
-        });
-        (0, child_process_1.execSync)(`git commit -m "${commitMessage}" --no-verify`, {
+        (0, child_process_1.execFileSync)('git', ['reset', '--soft', initialGitRef.ref], {
             cwd: workspacePath,
             encoding: 'utf-8',
             windowsHide: true,
         });
+        commit(workspacePath, commitMessage);
     }
 }
+function commit(workspacePath, commitMessage) {
+    (0, child_process_1.execSync)('git commit --no-verify -F -', {
+        cwd: workspacePath,
+        encoding: 'utf-8',
+        windowsHide: true,
+        input: commitMessage,
+    });
+}
 async function runSingleMigration(workspacePath, migration, configuration) {
     try {
         // Set current migration tracking
@@ -312,7 +316,8 @@ function undoMigration(workspacePath, id) {
         const existing = migrationsJsonMetadata.completedMigrations[id];
         if (existing.type !== 'successful')
             throw new Error(`undoMigration called on unsuccessful migration: ${id}`);
-        (0, child_process_1.execSync)(`git reset --hard ${existing.ref}^`, {
+        (0, git_revision_1.assertValidGitSha)(existing.ref);
+        (0, child_process_1.execFileSync)('git', ['reset', '--hard', `${existing.ref}^`], {
             cwd: workspacePath,
             encoding: 'utf-8',
             windowsHide: true,

package/dist/src/daemon/server/latest-nx.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLatestNxTmpPath = getLatestNxTmpPath;
 exports.cleanupLatestNx = cleanupLatestNx;
 const devkit_internals_1 = require("../../devkit-internals");
+const package_manager_1 = require("../../utils/package-manager");
 const provenance_1 = require("../../utils/provenance");
+const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
 // Module-level state - persists across invocations within daemon lifecycle
 let latestNxTmpPath = null;
@@ -26,7 +28,7 @@ async function getLatestNxTmpPath() {
         try {
             logger_1.serverLogger.log('[LATEST-NX]: Pulling latest Nx...');
             await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest');
+            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
             latestNxTmpPath = result.tempDir;
             cleanupFn = result.cleanup;
             logger_1.serverLogger.log('[LATEST-NX]: Successfully pulled latest Nx to', latestNxTmpPath);

package/dist/src/project-graph/file-utils.js

@@ -10,6 +10,7 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const fileutils_1 = require("../utils/fileutils");
+const git_revision_1 = require("../utils/git-revision");
 const ignore_1 = require("../utils/ignore");
 const json_diff_1 = require("../utils/json-diff");
 const workspace_root_1 = require("../utils/workspace-root");
@@ -77,6 +78,9 @@ function calculateFileChanges(files, nxArgs, readFileAtRevision = defaultReadFil
 }
 exports.TEN_MEGABYTES = 1024 * 10000;
 function defaultReadFileAtRevision(file, revision) {
+    if (revision) {
+        (0, git_revision_1.assertValidGitRevision)(revision);
+    }
     try {
         const fileFullPath = `${workspace_root_1.workspaceRoot}${path_1.sep}${file}`;
         const gitRepositoryPath = (0, child_process_1.execSync)('git rev-parse --show-toplevel', {
@@ -89,7 +93,7 @@ function defaultReadFileAtRevision(file, revision) {
             .join('/');
         return !revision
             ? (0, fs_1.readFileSync)(file, 'utf-8')
-            : (0, child_process_1.execSync)(`git show ${revision}:${filePathInGitRepository}`, {
+            : (0, child_process_1.execFileSync)('git', ['show', `${revision}:${filePathInGitRepository}`], {
                 maxBuffer: exports.TEN_MEGABYTES,
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,

package/dist/src/tasks-runner/cache.js

@@ -251,6 +251,12 @@ class DbCache {
                 logger_1.logger.warn('The HTTP remote cache is not yet supported in the wasm build of Nx.');
                 return null;
             }
+            // The cache request runs in Rust (reqwest), which honors
+            // NODE_TLS_REJECT_UNAUTHORIZED but bypasses Node's TLS stack, so Node's own
+            // insecure-TLS warning never fires for it. Re-emit Node's warning here.
+            if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0') {
+                process.emitWarning("Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.");
+            }
             return new native_1.HttpRemoteCache();
         }
         return null;

package/dist/src/utils/command-line-utils.js

@@ -11,6 +11,7 @@ const yargs_parser_1 = tslib_1.__importDefault(require("yargs-parser"));
 const file_utils_1 = require("../project-graph/file-utils");
 const output_1 = require("./output");
 const child_process_1 = require("child_process");
+const git_revision_1 = require("./git-revision");
 const workspace_root_1 = require("./workspace-root");
 const shared_options_1 = require("../command-line/yargs-utils/shared-options");
 function createOverrides(__overrides_unparsed__ = []) {
@@ -192,30 +193,27 @@ function parseFiles(options) {
     }
 }
 function getUncommittedFiles() {
-    return parseGitOutput(`git diff --name-only --no-renames --relative HEAD .`);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        'HEAD',
+        '.',
+    ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(`git ls-files --others --exclude-standard`);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
 }
 function getMergeBase(base, head = 'HEAD') {
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
     try {
-        return (0, child_process_1.execSync)(`git merge-base "${base}" "${head}"`, {
-            maxBuffer: file_utils_1.TEN_MEGABYTES,
-            cwd: workspace_root_1.workspaceRoot,
-            stdio: 'pipe',
-            windowsHide: true,
-        })
-            .toString()
-            .trim();
+        return runGit(['merge-base', base, head]).toString().trim();
     }
     catch {
         try {
-            return (0, child_process_1.execSync)(`git merge-base --fork-point "${base}" "${head}"`, {
-                maxBuffer: file_utils_1.TEN_MEGABYTES,
-                cwd: workspace_root_1.workspaceRoot,
-                stdio: 'pipe',
-                windowsHide: true,
-            })
+            return runGit(['merge-base', '--fork-point', base, head])
                 .toString()
                 .trim();
         }
@@ -225,15 +223,27 @@ function getMergeBase(base, head = 'HEAD') {
     }
 }
 function getFilesUsingBaseAndHead(base, head) {
-    return parseGitOutput(`git diff --name-only --no-renames --relative "${base}" "${head}"`);
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        base,
+        head,
+    ]);
 }
-function parseGitOutput(command) {
-    return (0, child_process_1.execSync)(command, {
+function runGit(args) {
+    return (0, child_process_1.execFileSync)('git', args, {
         maxBuffer: file_utils_1.TEN_MEGABYTES,
         cwd: workspace_root_1.workspaceRoot,
         stdio: 'pipe',
         windowsHide: true,
-    })
+    });
+}
+function parseGitOutput(args) {
+    return runGit(args)
         .toString('utf-8')
         .split('\n')
         .map((a) => a.trim())

package/dist/src/utils/git-revision.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+export declare function assertValidGitRevision(revision: string): void;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+export declare function assertValidGitSha(sha: string): void;

package/dist/src/utils/git-revision.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidGitRevision = assertValidGitRevision;
+exports.assertValidGitSha = assertValidGitSha;
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+function assertValidGitRevision(revision) {
+    if (revision.startsWith('-')) {
+        throw new Error(`Invalid git revision: "${revision}". Git revisions cannot start with "-".`);
+    }
+}
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/i;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+function assertValidGitSha(sha) {
+    if (!COMMIT_SHA.test(sha)) {
+        throw new Error(`Invalid git commit sha: "${sha}". Expected a hexadecimal commit sha.`);
+    }
+}

package/dist/src/utils/git-utils.d.ts

@@ -28,9 +28,7 @@ export declare class GitRepository {
     hasFilterRepoInstalled(): Promise<boolean>;
     filterRepo(source: string, destination: string): Promise<void>;
     filterBranch(source: string, destination: string, branchName: string): Promise<void>;
-    private execAsync;
-    private quotePath;
-    private quoteArg;
+    private execGit;
 }
 export interface VcsRemoteInfo {
     domain: string;

package/dist/src/utils/git-utils.js

@@ -9,9 +9,9 @@ exports.getLatestCommitSha = getLatestCommitSha;
 const child_process_1 = require("child_process");
 const path_1 = require("path");
 const logger_1 = require("./logger");
-function execAsync(command, execOptions) {
+function execFileAsync(file, args, execOptions) {
     return new Promise((res, rej) => {
-        (0, child_process_1.exec)(command, { ...execOptions, windowsHide: true }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => {
             if (err) {
                 return rej(err);
             }
@@ -22,7 +22,14 @@ function execAsync(command, execOptions) {
 async function cloneFromUpstream(url, destination, { originName, depth } = {
     originName: 'origin',
 }) {
-    await execAsync(`git clone ${url} ${destination} ${depth ? `--depth ${depth}` : ''} --origin ${originName}`, {
+    await execFileAsync('git', [
+        'clone',
+        url,
+        destination,
+        ...(depth ? ['--depth', `${depth}`] : []),
+        '--origin',
+        originName,
+    ], {
         cwd: (0, path_1.dirname)(destination),
         maxBuffer: 10 * 1024 * 1024,
     });
@@ -34,7 +41,7 @@ class GitRepository {
         this.root = this.getGitRootPath(this.directory);
     }
     getGitRootPath(cwd) {
-        return (0, child_process_1.execSync)('git rev-parse --show-toplevel', {
+        return (0, child_process_1.execFileSync)('git', ['rev-parse', '--show-toplevel'], {
             cwd,
             windowsHide: true,
         })
@@ -42,17 +49,22 @@ class GitRepository {
             .trim();
     }
     async hasUncommittedChanges() {
-        const data = await this.execAsync(`git status --porcelain`);
+        const data = await this.execGit(['status', '--porcelain']);
         return data.trim() !== '';
     }
     async addFetchRemote(remoteName, branch) {
-        return await this.execAsync(`git config --add remote.${remoteName}.fetch "+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}"`);
+        return await this.execGit([
+            'config',
+            '--add',
+            `remote.${remoteName}.fetch`,
+            `+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}`,
+        ]);
     }
     async showStat() {
-        return await this.execAsync(`git show --stat`);
+        return await this.execGit(['show', '--stat']);
     }
     async listBranches() {
-        return (await this.execAsync(`git ls-remote --heads --quiet`))
+        return (await this.execGit(['ls-remote', '--heads', '--quiet']))
             .trim()
             .split('\n')
             .map((s) => s
@@ -63,45 +75,58 @@ class GitRepository {
     async getGitFiles(path) {
         // Use -z to return file names exactly as they are stored in git, separated by NULL (\x00) character.
         // This avoids problems with special characters in file names.
-        return (await this.execAsync(`git ls-files -z ${path}`))
+        return (await this.execGit(['ls-files', '-z', '--', path]))
             .trim()
             .split('\x00')
             .map((s) => s.trim())
             .filter(Boolean);
     }
     async reset(ref) {
-        return await this.execAsync(`git reset ${ref} --hard`);
+        return await this.execGit(['reset', '--hard', ref]);
     }
     async mergeUnrelatedHistories(ref, message) {
-        return await this.execAsync(`git merge ${ref} -X ours --allow-unrelated-histories -m "${message}"`);
+        return await this.execGit([
+            'merge',
+            ref,
+            '-X',
+            'ours',
+            '--allow-unrelated-histories',
+            '-m',
+            message,
+        ]);
     }
     async fetch(remote, ref) {
-        return await this.execAsync(`git fetch ${remote}${ref ? ` ${ref}` : ''}`);
+        return await this.execGit(['fetch', remote, ...(ref ? [ref] : [])]);
     }
     async checkout(branch, opts) {
-        return await this.execAsync(`git checkout ${opts.new ? '-b ' : ' '}${branch}${opts.base ? ' ' + opts.base : ''}`);
+        return await this.execGit([
+            'checkout',
+            ...(opts.new ? ['-b'] : []),
+            branch,
+            ...(opts.base ? [opts.base] : []),
+        ]);
     }
     async move(path, destination) {
-        return await this.execAsync(`git mv ${this.quotePath(path)} ${this.quotePath(destination)}`);
+        return await this.execGit(['mv', '--', path, destination]);
     }
     async push(ref, remoteName) {
-        return await this.execAsync(`git push -u -f ${remoteName} ${ref}`);
+        return await this.execGit(['push', '-u', '-f', remoteName, ref]);
     }
     async commit(message) {
-        return await this.execAsync(`git commit -am "${message}"`);
+        return await this.execGit(['commit', '-am', message]);
     }
     async amendCommit() {
-        return await this.execAsync(`git commit --amend -a --no-edit`);
+        return await this.execGit(['commit', '--amend', '-a', '--no-edit']);
     }
     async deleteGitRemote(name) {
-        return await this.execAsync(`git remote rm ${name}`);
+        return await this.execGit(['remote', 'rm', name]);
     }
     async addGitRemote(name, url) {
-        return await this.execAsync(`git remote add ${name} ${url}`);
+        return await this.execGit(['remote', 'add', name, url]);
     }
     async hasFilterRepoInstalled() {
         try {
-            await this.execAsync(`git filter-repo --help`);
+            await this.execGit(['filter-repo', '--help']);
             return true;
         }
         catch {
@@ -114,35 +139,57 @@ class GitRepository {
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
-        await this.execAsync(`git filter-repo -f ${source !== '' ? `--path ${this.quotePath(sourcePosixPath)}` : ''} ${source !== destination
-            ? `--path-rename ${this.quotePath(sourcePosixPath, true)}:${this.quotePath(destinationPosixPath, true)}`
-            : ''}`);
+        const sourcePath = ensureTrailingSlash(sourcePosixPath);
+        const destinationPath = ensureTrailingSlash(destinationPosixPath);
+        await this.execGit([
+            'filter-repo',
+            '-f',
+            ...(source !== '' ? ['--path', sourcePosixPath] : []),
+            ...(source !== destination
+                ? ['--path-rename', `${sourcePath}:${destinationPath}`]
+                : []),
+        ]);
     }
     async filterBranch(source, destination, branchName) {
         // We need non-ASCII file names to not be quoted, or else filter-branch will exclude them.
-        await this.execAsync(`git config core.quotepath false`);
+        await this.execGit(['config', 'core.quotepath', 'false']);
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
         // First, if the source is not a root project, then only include commits relevant to the subdirectory.
         if (source !== '') {
-            const indexFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.index-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --index-filter ${indexFilterCommand} --prune-empty -- ${branchName}`, {
+            const indexFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.index-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--index-filter',
+                indexFilterCommand,
+                '--prune-empty',
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
         // Then, move files to their new location if necessary.
         if (source === '' || source !== destination) {
-            const treeFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.tree-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --tree-filter ${treeFilterCommand} -- ${branchName}`, {
+            const treeFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.tree-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--tree-filter',
+                treeFilterCommand,
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
     }
-    execAsync(command, env) {
-        return execAsync(command, {
+    execGit(args, env) {
+        return execFileAsync('git', args, {
             cwd: this.root,
             maxBuffer: 10 * 1024 * 1024,
             env: {
@@ -151,25 +198,14 @@ class GitRepository {
             },
         });
     }
-    quotePath(path, ensureTrailingSlash) {
-        return this.quoteArg(ensureTrailingSlash && path !== '' && !path.endsWith('/')
-            ? `${path}/`
-            : path);
-    }
-    quoteArg(arg) {
-        return process.platform === 'win32'
-            ? // Windows/CMD only understands double-quotes, single-quotes are treated as part of the file name
-                // Bash and other shells will substitute `$` in file names with a variable value.
-                `"${arg
-                    // Need to keep two slashes for Windows or else the path will be invalid.
-                    // e.g. 'C:\Users\bob\projects\repo' is invalid, but 'C:\\Users\\bob\\projects\\repo' is valid
-                    .replaceAll('\\', '\\\\')}"`
-            : // e.g. `git mv "$$file.txt" "libs/a/$$file.txt"` will not work since `$$` is swapped with the PID of the last process.
-                // Using single-quotes prevents this substitution.
-                `'${arg}'`;
-    }
 }
 exports.GitRepository = GitRepository;
+function ensureTrailingSlash(path) {
+    return path !== '' && !path.endsWith('/') ? `${path}/` : path;
+}
+function quoteForShell(arg) {
+    return `'${arg.replaceAll("'", "'\"'\"'")}'`;
+}
 function parseVcsRemoteUrl(url) {
     // Remove whitespace and handle common URL formats
     const cleanUrl = url.trim();

package/dist/src/utils/package-json.d.ts

@@ -1,7 +1,7 @@
 import { NxJsonConfiguration } from '../config/nx-json';
 import { ProjectConfiguration, ProjectMetadata, TargetConfiguration } from '../config/workspace-json-project-json';
 import type { Tree } from '../generators/tree';
-import { PackageManagerCommands } from './package-manager';
+import { PackageManager, PackageManagerCommands } from './package-manager';
 export interface NxProjectPackageJsonConfiguration extends Partial<ProjectConfiguration> {
     includedScripts?: string[];
 }
@@ -124,11 +124,11 @@ export declare function readModulePackageJson(moduleSpecifier: string, requirePa
     packageJson: PackageJson;
     path: string;
 };
-export declare function installPackageToTmp(pkg: string, requiredVersion: string): {
+export declare function installPackageToTmp(pkg: string, requiredVersion: string, packageManager: PackageManager): {
     tempDir: string;
     cleanup: () => void;
 };
-export declare function installPackageToTmpAsync(pkg: string, requiredVersion: string): Promise<{
+export declare function installPackageToTmpAsync(pkg: string, requiredVersion: string, packageManager: PackageManager): Promise<{
     tempDir: string;
     cleanup: () => void;
 }>;

package/dist/src/utils/package-json.js

@@ -204,22 +204,40 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
  * Prepares all necessary information for installing a package to a temporary directory.
  * This is used by both sync and async installation functions.
  */
-function preparePackageInstallation(pkg, requiredVersion) {
+function preparePackageInstallation(pkg, requiredVersion, packageManager) {
     const { dir: tempDir, cleanup } = (0, package_manager_1.createTempNpmDirectory)?.() ?? {
         dir: (0, tmp_1.dirSync)().name,
         cleanup: () => { },
     };
     console.log(`Fetching ${pkg}...`);
-    const packageManager = (0, package_manager_1.detectPackageManager)();
     const isVerbose = process.env.NX_VERBOSE_LOGGING === 'true';
     generatePackageManagerFiles(tempDir, packageManager);
-    const preInstallCommand = (0, package_manager_1.getPackageManagerCommand)(packageManager).preInstall;
+    // For pnpm, `addDev` is `pnpm add -Dw` when the workspace has a
+    // pnpm-workspace.yaml. `createTempNpmDirectory` copies a sanitized copy of
+    // it into the temp dir, so the `-w` here resolves to the temp dir.
     const pmCommands = (0, package_manager_1.getPackageManagerCommand)(packageManager);
-    let addCommand = pmCommands.addDev;
-    if (packageManager === 'pnpm') {
-        addCommand = 'pnpm add -D'; // we need to ensure that we are not using workspace command
-    }
-    const installCommand = `${addCommand} ${pkg}@${requiredVersion} ${pmCommands.ignoreScriptsFlag ?? ''}`;
+    const preInstallCommand = pmCommands.preInstall;
+    // Keep peer dependencies out of the temp install. `ensurePackage` puts the
+    // workspace's `node_modules` on `NODE_PATH`, so a loaded package resolves its
+    // peers from the workspace instead of pulling its own (possibly incompatible)
+    // copies into the temp dir.
+    //
+    // npm needs `--legacy-peer-deps` rather than `--omit=peer`: npm marks a package
+    // as a peer if anything in the tree peer-depends on it, so `--omit=peer` also
+    // prunes packages that are real dependencies. Bun's `--omit=peer` does not.
+    const skipPeerDependenciesFlags = {
+        npm: '--legacy-peer-deps',
+        bun: '--omit=peer',
+        pnpm: '--config.auto-install-peers=false',
+    };
+    const installCommand = [
+        pmCommands.addDev,
+        `${pkg}@${requiredVersion}`,
+        skipPeerDependenciesFlags[packageManager],
+        pmCommands.ignoreScriptsFlag,
+    ]
+        .filter(Boolean)
+        .join(' ');
     const execOptions = {
         cwd: tempDir,
         stdio: isVerbose ? 'inherit' : 'ignore',
@@ -239,8 +257,8 @@ function preparePackageInstallation(pkg, requiredVersion) {
         execOptions,
     };
 }
-function installPackageToTmp(pkg, requiredVersion) {
-    const { tempDir, cleanup, preInstallCommand, installCommand, execOptions } = preparePackageInstallation(pkg, requiredVersion);
+function installPackageToTmp(pkg, requiredVersion, packageManager) {
+    const { tempDir, cleanup, preInstallCommand, installCommand, execOptions } = preparePackageInstallation(pkg, requiredVersion, packageManager);
     if (preInstallCommand) {
         // ensure package.json and repo in tmp folder is set to a proper package manager state
         (0, child_process_1.execSync)(preInstallCommand, execOptions);
@@ -251,8 +269,8 @@ function installPackageToTmp(pkg, requiredVersion) {
         cleanup,
     };
 }
-async function installPackageToTmpAsync(pkg, requiredVersion) {
-    const { tempDir, cleanup, preInstallCommand, installCommand, execOptions } = preparePackageInstallation(pkg, requiredVersion);
+async function installPackageToTmpAsync(pkg, requiredVersion, packageManager) {
+    const { tempDir, cleanup, preInstallCommand, installCommand, execOptions } = preparePackageInstallation(pkg, requiredVersion, packageManager);
     try {
         if (preInstallCommand) {
             // ensure package.json and repo in tmp folder is set to a proper package manager state

package/dist/src/utils/package-manager.d.ts

@@ -75,6 +75,19 @@ export declare function modifyYarnRcYmlToFitNewDirectory(contents: string): stri
  * @returns Updated string contents of the yarnrc.yml file
  */
 export declare function modifyYarnRcToFitNewDirectory(contents: string): string;
+/**
+ * We copy pnpm-workspace.yaml to the temporary directory so the workspace's
+ * registry, auth and release-age settings still apply, and so `pnpm add -w`
+ * recognizes the directory as a workspace root. `packages` (member globs) and
+ * `patchedDependencies` (relative patch paths) only resolve in the real
+ * workspace, so they are dropped.
+ *
+ * Exported for testing - not meant to be used outside of this file.
+ *
+ * @param contents The string contents of the pnpm-workspace.yaml file
+ * @returns Updated string contents of the pnpm-workspace.yaml file
+ */
+export declare function modifyPnpmWorkspaceYamlToFitNewDirectory(contents: string): string;
 export declare function copyPackageManagerConfigurationFiles(root: string, destination: string): void;
 /**
  * Creates a temporary directory where you can run package manager commands safely.

package/dist/src/utils/package-manager.js

@@ -8,6 +8,7 @@ exports.parseVersionFromPackageManagerField = parseVersionFromPackageManagerFiel
 exports.findFileInPackageJsonDirectory = findFileInPackageJsonDirectory;
 exports.modifyYarnRcYmlToFitNewDirectory = modifyYarnRcYmlToFitNewDirectory;
 exports.modifyYarnRcToFitNewDirectory = modifyYarnRcToFitNewDirectory;
+exports.modifyPnpmWorkspaceYamlToFitNewDirectory = modifyPnpmWorkspaceYamlToFitNewDirectory;
 exports.copyPackageManagerConfigurationFiles = copyPackageManagerConfigurationFiles;
 exports.createTempNpmDirectory = createTempNpmDirectory;
 exports.resolvePackageVersionUsingRegistry = resolvePackageVersionUsingRegistry;
@@ -322,12 +323,33 @@ function modifyYarnRcToFitNewDirectory(contents) {
     }
     return lines.join('\n');
 }
+/**
+ * We copy pnpm-workspace.yaml to the temporary directory so the workspace's
+ * registry, auth and release-age settings still apply, and so `pnpm add -w`
+ * recognizes the directory as a workspace root. `packages` (member globs) and
+ * `patchedDependencies` (relative patch paths) only resolve in the real
+ * workspace, so they are dropped.
+ *
+ * Exported for testing - not meant to be used outside of this file.
+ *
+ * @param contents The string contents of the pnpm-workspace.yaml file
+ * @returns Updated string contents of the pnpm-workspace.yaml file
+ */
+function modifyPnpmWorkspaceYamlToFitNewDirectory(contents) {
+    const doc = (0, yaml_1.parseDocument)(contents);
+    if (doc.contents) {
+        doc.delete('packages');
+        doc.delete('patchedDependencies');
+    }
+    return doc.toString();
+}
 function copyPackageManagerConfigurationFiles(root, destination) {
     for (const packageManagerConfigFile of [
         '.npmrc',
         '.yarnrc',
         '.yarnrc.yml',
         'bunfig.toml',
+        'pnpm-workspace.yaml',
     ]) {
         // f is an absolute path, including the {workspaceRoot}.
         const f = findFileInPackageJsonDirectory(packageManagerConfigFile, root);
@@ -355,6 +377,11 @@ function copyPackageManagerConfigurationFiles(root, destination) {
                     (0, fs_1.copyFileSync)(f, destinationPath);
                     break;
                 }
+                case 'pnpm-workspace.yaml': {
+                    const updated = modifyPnpmWorkspaceYamlToFitNewDirectory((0, fileutils_1.readFileIfExisting)(f));
+                    (0, fs_1.writeFileSync)(destinationPath, updated);
+                    break;
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "22.7.6",
+  "version": "22.7.8",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -55,16 +55,17 @@
     "@tybys/wasm-util": "0.9.0",
     "@yarnpkg/lockfile": "1.1.0",
     "@zkochan/js-yaml": "0.0.7",
+    "agent-base": "6.0.2",
     "ansi-colors": "4.1.3",
     "ansi-regex": "5.0.1",
     "ansi-styles": "4.3.0",
     "argparse": "2.0.1",
     "asynckit": "0.4.0",
-    "axios": "1.16.0",
+    "axios": "1.18.1",
     "balanced-match": "4.0.3",
     "base64-js": "1.5.1",
     "bl": "4.1.0",
-    "brace-expansion": "5.0.6",
+    "brace-expansion": "5.0.8",
     "buffer": "5.7.1",
     "call-bind-apply-helpers": "1.0.2",
     "chalk": "4.1.2",
@@ -75,6 +76,7 @@
     "color-convert": "2.0.1",
     "color-name": "1.1.4",
     "combined-stream": "1.0.8",
+    "debug": "4.4.3",
     "defaults": "1.0.4",
     "define-lazy-prop": "2.0.0",
     "delayed-stream": "1.0.0",
@@ -105,6 +107,7 @@
     "has-symbols": "1.1.0",
     "has-tostringtag": "1.0.2",
     "hasown": "2.0.4",
+    "https-proxy-agent": "5.0.1",
     "ieee754": "1.2.1",
     "ignore": "7.0.5",
     "inherits": "2.0.4",
@@ -123,6 +126,7 @@
     "mimic-fn": "2.1.0",
     "minimatch": "10.2.5",
     "minimist": "1.2.8",
+    "ms": "2.1.3",
     "npm-run-path": "4.0.1",
     "once": "1.4.0",
     "onetime": "5.1.2",
@@ -171,16 +175,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "22.7.6",
-    "@nx/nx-darwin-x64": "22.7.6",
-    "@nx/nx-freebsd-x64": "22.7.6",
-    "@nx/nx-linux-arm-gnueabihf": "22.7.6",
-    "@nx/nx-linux-arm64-gnu": "22.7.6",
-    "@nx/nx-linux-arm64-musl": "22.7.6",
-    "@nx/nx-linux-x64-gnu": "22.7.6",
-    "@nx/nx-linux-x64-musl": "22.7.6",
-    "@nx/nx-win32-arm64-msvc": "22.7.6",
-    "@nx/nx-win32-x64-msvc": "22.7.6"
+    "@nx/nx-darwin-arm64": "22.7.8",
+    "@nx/nx-darwin-x64": "22.7.8",
+    "@nx/nx-freebsd-x64": "22.7.8",
+    "@nx/nx-linux-arm-gnueabihf": "22.7.8",
+    "@nx/nx-linux-arm64-gnu": "22.7.8",
+    "@nx/nx-linux-arm64-musl": "22.7.8",
+    "@nx/nx-linux-x64-gnu": "22.7.8",
+    "@nx/nx-linux-x64-musl": "22.7.8",
+    "@nx/nx-win32-arm64-msvc": "22.7.8",
+    "@nx/nx-win32-x64-msvc": "22.7.8"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",