nx 22.7.7 → 22.7.9

package/dist/src/daemon/server/latest-nx.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLatestNxTmpPath = getLatestNxTmpPath;
 exports.cleanupLatestNx = cleanupLatestNx;
 const devkit_internals_1 = require("../../devkit-internals");
+const package_manager_1 = require("../../utils/package-manager");
 const provenance_1 = require("../../utils/provenance");
+const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
 // Module-level state - persists across invocations within daemon lifecycle
 let latestNxTmpPath = null;
@@ -26,7 +28,7 @@ async function getLatestNxTmpPath() {
         try {
             logger_1.serverLogger.log('[LATEST-NX]: Pulling latest Nx...');
             await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest');
+            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
             latestNxTmpPath = result.tempDir;
             cleanupFn = result.cleanup;
             logger_1.serverLogger.log('[LATEST-NX]: Successfully pulled latest Nx to', latestNxTmpPath);

package/dist/src/daemon/server/server.js

@@ -116,6 +116,17 @@ async function handleMessage(socket, data) {
         await (0, shutdown_utils_1.respondWithErrorAndExit)(socket, `Invalid payload from the client`, new Error(`Unsupported payload sent to daemon server: ${unparsedPayload}`));
     }
     logger_1.serverLogger.log(`Received ${mode} message of type ${payload.type}`);
+    // A mismatch means the client reached the wrong daemon (e.g. a shared
+    // NX_SOCKET_DIR). Respond, but stay alive for our own workspace.
+    if ((0, daemon_message_1.isDaemonMessage)(payload)) {
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(payload, workspace_root_1.workspaceRoot);
+        }
+        catch (e) {
+            await (0, shutdown_utils_1.respondWithError)(socket, `Workspace root mismatch`, e);
+            return;
+        }
+    }
     if ((0, daemon_message_1.isDaemonMessage)(payload) && payload.env) {
         let shouldRecomputeGraph = false;
         for (const key in payload.env) {
@@ -461,6 +472,17 @@ async function startServer() {
             server.listen(socketPath, async () => {
                 try {
                     logger_1.serverLogger.log(`Started listening on: ${socketPath}`);
+                    // Linux gates connect() on write permission to the socket file; macOS/BSD gate
+                    // on the directory, which is already 0700. Done after listen because
+                    // net.Server.listen takes no mode and umask is process-global.
+                    if (!socket_utils_1.isWindows) {
+                        try {
+                            (0, fs_1.chmodSync)(socketPath, 0o600);
+                        }
+                        catch {
+                            // Best effort; the 0700 socket directory is the primary control.
+                        }
+                    }
                     // this triggers the storage of the lock file hash
                     daemonIsOutdated();
                     if (!(0, shutdown_utils_1.getWatcherInstance)()) {

package/dist/src/daemon/server/shutdown-utils.d.ts

@@ -14,5 +14,10 @@ export declare function handleServerProcessTermination({ server, reason, sockets
 export declare function handleServerProcessTerminationWithRestart({ server, reason, sockets, }: HandleServerProcessTerminationParams): Promise<void>;
 export declare function resetInactivityTimeout(cb: () => void): void;
 export declare function respondToClient(socket: Socket, response: string, description: string): Promise<unknown>;
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+export declare function respondWithError(socket: Socket, description: string, error: Error): Promise<void>;
 export declare function respondWithErrorAndExit(socket: Socket, description: string, error: Error): Promise<void>;
 export {};

package/dist/src/daemon/server/shutdown-utils.js

@@ -9,6 +9,7 @@ exports.handleServerProcessTermination = handleServerProcessTermination;
 exports.handleServerProcessTerminationWithRestart = handleServerProcessTerminationWithRestart;
 exports.resetInactivityTimeout = resetInactivityTimeout;
 exports.respondToClient = respondToClient;
+exports.respondWithError = respondWithError;
 exports.respondWithErrorAndExit = respondWithErrorAndExit;
 const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
@@ -135,9 +136,12 @@ function respondToClient(socket, response, description) {
         });
     });
 }
-async function respondWithErrorAndExit(socket, description, error) {
-    const isProjectGraphError = error instanceof error_types_1.DaemonProjectGraphError;
-    const normalizedError = isProjectGraphError
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+async function respondWithError(socket, description, error) {
+    const normalizedError = error instanceof error_types_1.DaemonProjectGraphError
         ? error_types_1.ProjectGraphError.fromDaemonProjectGraphError(error)
         : error;
     // print some extra stuff in the error message
@@ -145,8 +149,11 @@ async function respondWithErrorAndExit(socket, description, error) {
     console.error(normalizedError.stack);
     // Respond with the original error
     await respondToClient(socket, (0, socket_utils_1.serializeResult)(error, null, null), null);
+}
+async function respondWithErrorAndExit(socket, description, error) {
+    await respondWithError(socket, description, error);
     // Project Graph errors are okay. Restarting the daemon won't help with this.
-    if (!isProjectGraphError) {
+    if (!(error instanceof error_types_1.DaemonProjectGraphError)) {
         process.exit(1);
     }
 }

package/dist/src/daemon/socket-utils.d.ts

@@ -8,6 +8,7 @@ export declare const isWindows: boolean;
 export declare const getFullOsSocketPath: () => string;
 export declare const getForkedProcessOsSocketPath: (id: string) => string;
 export declare const getPluginOsSocketPath: (id: string) => string;
+export declare function getPluginSocketFileName(id: string): string;
 export declare function killSocketOrPath(): void;
 export declare function serializeResult(error: Error | null, serializedProjectGraph: string | null, serializedSourceMaps: string | null): string | null;
 /**

package/dist/src/daemon/socket-utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPluginOsSocketPath = exports.getForkedProcessOsSocketPath = exports.getFullOsSocketPath = exports.isWindows = void 0;
+exports.getPluginSocketFileName = getPluginSocketFileName;
 exports.killSocketOrPath = killSocketOrPath;
 exports.serializeResult = serializeResult;
 exports.serialize = serialize;
@@ -31,18 +32,38 @@ const getForkedProcessOsSocketPath = (id) => {
 };
 exports.getForkedProcessOsSocketPath = getForkedProcessOsSocketPath;
 const getPluginOsSocketPath = (id) => {
-    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getSocketDir)(true), 'plugin' + id + '.sock'));
+    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getPluginSocketDir)(), getPluginSocketFileName(id)));
     assertValidSocketPath(path);
     return exports.isWindows ? '\\\\.\\pipe\\nx\\' + path : path;
 };
 exports.getPluginOsSocketPath = getPluginOsSocketPath;
+function getPluginSocketFileName(id) {
+    return `p${id}.sock`;
+}
 function assertValidSocketPath(path) {
     if (path.length > 95) {
+        const fallbackCause = (0, tmp_dir_1.getSocketDirFallbackCause)();
+        const refusedConfiguredSocketDir = (0, tmp_dir_1.getRefusedConfiguredSocketDir)();
         throw new Error([
             'Attempted to open socket that exceeds the maximum socket length.',
+            ...(fallbackCause === undefined
+                ? []
+                : [
+                    `Nx fell back to ${(0, path_1.dirname)(path)} because the default socket directory could not be used.`,
+                    'Run the command with --verbose to see why the default directory was rejected.',
+                ]),
             '',
-            `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
-        ].join('\n'));
+            ...(refusedConfiguredSocketDir === undefined
+                ? [
+                    `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
+                ]
+                : [
+                    // Saying "set a shorter path" here would be advice they already
+                    // followed: they set one, and it was refused for another reason.
+                    `The directory set in NX_SOCKET_DIR (${refusedConfiguredSocketDir}) could not be used — see the warning above — so Nx fell back to a longer path.`,
+                    'Point NX_SOCKET_DIR at a short directory your user owns.',
+                ]),
+        ].join('\n'), fallbackCause === undefined ? undefined : { cause: fallbackCause });
     }
 }
 function killSocketOrPath() {

package/dist/src/daemon/tmp-dir.d.ts

@@ -1,12 +1,52 @@
+/**
+ * Why a directory was refused. Named rather than a boolean so a table entry
+ * reads as its own reason: picking the wrong one tells a user their private
+ * directory is a code-execution risk, which is the one claim here that most
+ * needs to be true.
+ */
+export type SocketDirRefusal = 'shared-with-other-users' | 'nx-managed' | 'os-temp-root';
+/**
+ * Thrown when the socket dir resolves to a directory Nx will not accept.
+ * Invalid configuration, not a recoverable failure.
+ *
+ * Three reasons, and they are not interchangeable. A directory other users can
+ * reach is a security problem; the OS temp root is the user's own but holds
+ * everything else that uses it, and Nx deletes the socket directory
+ * recursively; an Nx container or cache root is refused because Nx manages what
+ * lives there. Telling someone their own `0700` directory lets a local attacker
+ * execute code would be false, which is why the reason is derived from the
+ * directory rather than the platform.
+ */
+export declare class InvalidSocketDirConfigured extends Error {
+    readonly dir: string;
+    readonly reason: SocketDirRefusal;
+    constructor(dir: string, reason: SocketDirRefusal);
+}
 export declare const DAEMON_DIR_FOR_CURRENT_WORKSPACE: string;
 export declare const DAEMON_OUTPUT_LOG_FILE: string;
 export declare const getDaemonSocketDir: () => string;
 export declare function writeDaemonLogs(error?: string): string;
 export declare function markDaemonAsDisabled(reason: string): void;
 export declare function isDaemonDisabled(): boolean;
+export declare function getSocketDir(): string;
+/**
+ * Plugin worker sockets get their own workspace-scoped directory rather than
+ * sitting in the shared system temp dir, which cannot be locked down.
+ */
+export declare function getPluginSocketDir(): string;
+/**
+ * Exported for tests: both fallback warnings fire once per process, so a suite
+ * that stages either fallback more than once has to clear the latches between
+ * cases.
+ */
+export declare function resetSocketDirWarningsForTesting(): void;
+export declare function getSocketDirFallbackCause(): unknown;
 /**
- * We try to create a socket file in a tmp dir, but if it doesn't work because
- * for instance we don't have permissions, we create it in DAEMON_DIR_FOR_CURRENT_WORKSPACE
+ * The NX_SOCKET_DIR that was refused, if that is why we are in the fallback.
+ * Reflects the most recent resolution only — both accessors are cleared at the
+ * top of every `createOwnerOnlySocketDir` call, and the daemon and plugin socket
+ * paths each drive one. Read it immediately after the call that produced the
+ * path, which is what `assertValidSocketPath` does.
  */
-export declare function getSocketDir(alreadyUnique?: boolean): string;
+export declare function getRefusedConfiguredSocketDir(): string | undefined;
 export declare function removeSocketDir(): void;