nx 22.7.7 → 22.7.9

package/dist/src/utils/git-utils.js

@@ -9,9 +9,9 @@ exports.getLatestCommitSha = getLatestCommitSha;
 const child_process_1 = require("child_process");
 const path_1 = require("path");
 const logger_1 = require("./logger");
-function execAsync(command, execOptions) {
+function execFileAsync(file, args, execOptions) {
     return new Promise((res, rej) => {
-        (0, child_process_1.exec)(command, { ...execOptions, windowsHide: true }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => {
             if (err) {
                 return rej(err);
             }
@@ -22,7 +22,14 @@ function execAsync(command, execOptions) {
 async function cloneFromUpstream(url, destination, { originName, depth } = {
     originName: 'origin',
 }) {
-    await execAsync(`git clone ${url} ${destination} ${depth ? `--depth ${depth}` : ''} --origin ${originName}`, {
+    await execFileAsync('git', [
+        'clone',
+        url,
+        destination,
+        ...(depth ? ['--depth', `${depth}`] : []),
+        '--origin',
+        originName,
+    ], {
         cwd: (0, path_1.dirname)(destination),
         maxBuffer: 10 * 1024 * 1024,
     });
@@ -34,7 +41,7 @@ class GitRepository {
         this.root = this.getGitRootPath(this.directory);
     }
     getGitRootPath(cwd) {
-        return (0, child_process_1.execSync)('git rev-parse --show-toplevel', {
+        return (0, child_process_1.execFileSync)('git', ['rev-parse', '--show-toplevel'], {
             cwd,
             windowsHide: true,
         })
@@ -42,17 +49,22 @@ class GitRepository {
             .trim();
     }
     async hasUncommittedChanges() {
-        const data = await this.execAsync(`git status --porcelain`);
+        const data = await this.execGit(['status', '--porcelain']);
         return data.trim() !== '';
     }
     async addFetchRemote(remoteName, branch) {
-        return await this.execAsync(`git config --add remote.${remoteName}.fetch "+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}"`);
+        return await this.execGit([
+            'config',
+            '--add',
+            `remote.${remoteName}.fetch`,
+            `+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}`,
+        ]);
     }
     async showStat() {
-        return await this.execAsync(`git show --stat`);
+        return await this.execGit(['show', '--stat']);
     }
     async listBranches() {
-        return (await this.execAsync(`git ls-remote --heads --quiet`))
+        return (await this.execGit(['ls-remote', '--heads', '--quiet']))
             .trim()
             .split('\n')
             .map((s) => s
@@ -63,45 +75,58 @@ class GitRepository {
     async getGitFiles(path) {
         // Use -z to return file names exactly as they are stored in git, separated by NULL (\x00) character.
         // This avoids problems with special characters in file names.
-        return (await this.execAsync(`git ls-files -z ${path}`))
+        return (await this.execGit(['ls-files', '-z', '--', path]))
             .trim()
             .split('\x00')
             .map((s) => s.trim())
             .filter(Boolean);
     }
     async reset(ref) {
-        return await this.execAsync(`git reset ${ref} --hard`);
+        return await this.execGit(['reset', '--hard', ref]);
     }
     async mergeUnrelatedHistories(ref, message) {
-        return await this.execAsync(`git merge ${ref} -X ours --allow-unrelated-histories -m "${message}"`);
+        return await this.execGit([
+            'merge',
+            ref,
+            '-X',
+            'ours',
+            '--allow-unrelated-histories',
+            '-m',
+            message,
+        ]);
     }
     async fetch(remote, ref) {
-        return await this.execAsync(`git fetch ${remote}${ref ? ` ${ref}` : ''}`);
+        return await this.execGit(['fetch', remote, ...(ref ? [ref] : [])]);
     }
     async checkout(branch, opts) {
-        return await this.execAsync(`git checkout ${opts.new ? '-b ' : ' '}${branch}${opts.base ? ' ' + opts.base : ''}`);
+        return await this.execGit([
+            'checkout',
+            ...(opts.new ? ['-b'] : []),
+            branch,
+            ...(opts.base ? [opts.base] : []),
+        ]);
     }
     async move(path, destination) {
-        return await this.execAsync(`git mv ${this.quotePath(path)} ${this.quotePath(destination)}`);
+        return await this.execGit(['mv', '--', path, destination]);
     }
     async push(ref, remoteName) {
-        return await this.execAsync(`git push -u -f ${remoteName} ${ref}`);
+        return await this.execGit(['push', '-u', '-f', remoteName, ref]);
     }
     async commit(message) {
-        return await this.execAsync(`git commit -am "${message}"`);
+        return await this.execGit(['commit', '-am', message]);
     }
     async amendCommit() {
-        return await this.execAsync(`git commit --amend -a --no-edit`);
+        return await this.execGit(['commit', '--amend', '-a', '--no-edit']);
     }
     async deleteGitRemote(name) {
-        return await this.execAsync(`git remote rm ${name}`);
+        return await this.execGit(['remote', 'rm', name]);
     }
     async addGitRemote(name, url) {
-        return await this.execAsync(`git remote add ${name} ${url}`);
+        return await this.execGit(['remote', 'add', name, url]);
     }
     async hasFilterRepoInstalled() {
         try {
-            await this.execAsync(`git filter-repo --help`);
+            await this.execGit(['filter-repo', '--help']);
             return true;
         }
         catch {
@@ -114,35 +139,57 @@ class GitRepository {
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
-        await this.execAsync(`git filter-repo -f ${source !== '' ? `--path ${this.quotePath(sourcePosixPath)}` : ''} ${source !== destination
-            ? `--path-rename ${this.quotePath(sourcePosixPath, true)}:${this.quotePath(destinationPosixPath, true)}`
-            : ''}`);
+        const sourcePath = ensureTrailingSlash(sourcePosixPath);
+        const destinationPath = ensureTrailingSlash(destinationPosixPath);
+        await this.execGit([
+            'filter-repo',
+            '-f',
+            ...(source !== '' ? ['--path', sourcePosixPath] : []),
+            ...(source !== destination
+                ? ['--path-rename', `${sourcePath}:${destinationPath}`]
+                : []),
+        ]);
     }
     async filterBranch(source, destination, branchName) {
         // We need non-ASCII file names to not be quoted, or else filter-branch will exclude them.
-        await this.execAsync(`git config core.quotepath false`);
+        await this.execGit(['config', 'core.quotepath', 'false']);
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
         // First, if the source is not a root project, then only include commits relevant to the subdirectory.
         if (source !== '') {
-            const indexFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.index-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --index-filter ${indexFilterCommand} --prune-empty -- ${branchName}`, {
+            const indexFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.index-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--index-filter',
+                indexFilterCommand,
+                '--prune-empty',
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
         // Then, move files to their new location if necessary.
         if (source === '' || source !== destination) {
-            const treeFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.tree-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --tree-filter ${treeFilterCommand} -- ${branchName}`, {
+            const treeFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.tree-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--tree-filter',
+                treeFilterCommand,
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
     }
-    execAsync(command, env) {
-        return execAsync(command, {
+    execGit(args, env) {
+        return execFileAsync('git', args, {
             cwd: this.root,
             maxBuffer: 10 * 1024 * 1024,
             env: {
@@ -151,25 +198,14 @@ class GitRepository {
             },
         });
     }
-    quotePath(path, ensureTrailingSlash) {
-        return this.quoteArg(ensureTrailingSlash && path !== '' && !path.endsWith('/')
-            ? `${path}/`
-            : path);
-    }
-    quoteArg(arg) {
-        return process.platform === 'win32'
-            ? // Windows/CMD only understands double-quotes, single-quotes are treated as part of the file name
-                // Bash and other shells will substitute `$` in file names with a variable value.
-                `"${arg
-                    // Need to keep two slashes for Windows or else the path will be invalid.
-                    // e.g. 'C:\Users\bob\projects\repo' is invalid, but 'C:\\Users\\bob\\projects\\repo' is valid
-                    .replaceAll('\\', '\\\\')}"`
-            : // e.g. `git mv "$$file.txt" "libs/a/$$file.txt"` will not work since `$$` is swapped with the PID of the last process.
-                // Using single-quotes prevents this substitution.
-                `'${arg}'`;
-    }
 }
 exports.GitRepository = GitRepository;
+function ensureTrailingSlash(path) {
+    return path !== '' && !path.endsWith('/') ? `${path}/` : path;
+}
+function quoteForShell(arg) {
+    return `'${arg.replaceAll("'", "'\"'\"'")}'`;
+}
 function parseVcsRemoteUrl(url) {
     // Remove whitespace and handle common URL formats
     const cleanUrl = url.trim();

package/dist/src/utils/nx-tmp-dir.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Stable root for Nx runtime artifacts that need an OS tmp location. On POSIX a
+ * literal `/tmp`, not `os.tmpdir()`, which honours `$TMPDIR` — per-user on
+ * macOS, rewritten by sandboxes, stripped from the daemon env, so client and
+ * daemon would disagree. Windows has no `/tmp`, and `%TMP%` is already per-user
+ * and stable, so it keeps `os.tmpdir()`.
+ *
+ * Consumed by the native binding loader, so keep this file limited to local
+ * helpers that themselves use Node builtins only.
+ */
+export declare const NX_TMP_DIR: string;
+/**
+ * Owner-only runtime root for the current user. No user segment on Windows —
+ * `%TMP%` is already per-account, and the segment would only cost path length.
+ */
+export declare const NX_USER_TMP_DIR: string;
+/** Runtime root under the user's home, used when the shared container cannot be established. */
+export declare const NX_HOME_TMP_DIR: string;

package/dist/src/utils/nx-tmp-dir.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NX_HOME_TMP_DIR = exports.NX_USER_TMP_DIR = exports.NX_TMP_DIR = void 0;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const owned_private_dir_1 = require("./owned-private-dir");
+/**
+ * Stable root for Nx runtime artifacts that need an OS tmp location. On POSIX a
+ * literal `/tmp`, not `os.tmpdir()`, which honours `$TMPDIR` — per-user on
+ * macOS, rewritten by sandboxes, stripped from the daemon env, so client and
+ * daemon would disagree. Windows has no `/tmp`, and `%TMP%` is already per-user
+ * and stable, so it keeps `os.tmpdir()`.
+ *
+ * Consumed by the native binding loader, so keep this file limited to local
+ * helpers that themselves use Node builtins only.
+ */
+exports.NX_TMP_DIR = (0, node_os_1.platform)() === 'win32' ? (0, node_path_1.join)((0, node_os_1.tmpdir)(), '.nx') : '/tmp/.nx';
+/**
+ * Owner-only runtime root for the current user. No user segment on Windows —
+ * `%TMP%` is already per-account, and the segment would only cost path length.
+ */
+exports.NX_USER_TMP_DIR = (0, node_os_1.platform)() === 'win32' ? exports.NX_TMP_DIR : (0, node_path_1.join)(exports.NX_TMP_DIR, (0, owned_private_dir_1.getUserSegment)());
+/** Runtime root under the user's home, used when the shared container cannot be established. */
+exports.NX_HOME_TMP_DIR = resolveHomeTmpDir();
+/**
+ * Absolute, not merely non-empty: a relative `$HOME` would make `join` return
+ * `.nx`, putting sockets under the cwd and aiming `removeSocketDir`'s recursive
+ * delete at it. A rootless container has no `$HOME` and no passwd entry, so
+ * `homedir()` throws or returns empty — caught here because this runs at module
+ * scope and the native binding loader imports this file.
+ */
+function resolveHomeTmpDir() {
+    try {
+        const home = (0, node_os_1.homedir)();
+        return home && (0, node_path_1.isAbsolute)(home) ? (0, node_path_1.join)(home, '.nx') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/utils/owned-private-dir.d.ts

@@ -0,0 +1,132 @@
+declare const safeSharedRootBrand: unique symbol;
+declare const sharedRootEstablishedBrand: unique symbol;
+declare const ownedRealDirBrand: unique symbol;
+declare const ownedPrivateDirBrand: unique symbol;
+/** Verified safe to keep an owner-only directory under. Not created. */
+export type SafeSharedRoot = string & {
+    readonly [safeSharedRootBrand]: true;
+};
+/** Created if absent, then verified safe as above. */
+export type EstablishedSharedRoot = string & {
+    readonly [sharedRootEstablishedBrand]: true;
+};
+/** An existing real directory owned by us. Mode is *not* checked. */
+export type OwnedRealDir = string & {
+    readonly [ownedRealDirBrand]: true;
+};
+/**
+ * POSIX: created if absent, owned by us, and carrying no group or other bits —
+ * re-locked first if it was looser. The mode is checked on whichever branch
+ * produced it, so the brand does not depend on who created the directory.
+ *
+ * Windows: only *is a real directory*. `getuid` is unavailable there, so
+ * neither ownership nor mode is checked; `%TMP%` is already per-account.
+ */
+export type OwnedPrivateDir = string & {
+    readonly [ownedPrivateDirBrand]: true;
+};
+/** Why a guard refused a directory. Data, not a sentence: `remedyFor` decides on it. */
+export type DirRefusal = {
+    kind: 'not-created';
+    dir: string;
+    code?: string;
+} | {
+    kind: 'not-inspectable';
+    dir: string;
+    code?: string;
+} | {
+    kind: 'not-a-directory';
+    dir: string;
+    symlink?: true;
+} | {
+    kind: 'foreign-owner';
+    dir: string;
+    uid: number;
+} | {
+    kind: 'foreign-shared-container';
+    dir: string;
+    uid: number;
+} | {
+    kind: 'not-tightenable';
+    dir: string;
+    mode: number;
+} | {
+    kind: 'peer-writable-not-sticky';
+    dir: string;
+    mode: number;
+};
+/** A guard's verdict. */
+export type GuardResult<T> = {
+    status: 'ok';
+    path: T;
+} | {
+    status: 'refused';
+    refusal: DirRefusal;
+};
+/** The user-facing sentence for a refusal. The only place wording is decided. */
+export declare function describeRefusal(r: DirRefusal): string;
+/** What the user can do about a refusal, or `undefined` when there is nothing. */
+export declare function remedyFor(r: DirRefusal): string | undefined;
+/** One refusal as an `Error`, so several can travel in an `AggregateError`. */
+export declare class DirectoryRefusedError extends Error {
+    readonly refusal: DirRefusal;
+    constructor(refusal: DirRefusal);
+}
+/**
+ * Whether a shared container is safe to keep an owner-only directory under.
+ *
+ * On POSIX, a container writable by other users must be sticky, and it must be
+ * owned by either root or the current user. Windows short-circuits after the
+ * directory test — the OS temp root is already scoped to one account, so there
+ * is no shared level whose ownership could matter.
+ *
+ * Sticky directories still let the directory's own owner rename entries, so a
+ * container owned by another unprivileged user could replace a previously
+ * verified private directory beneath it.
+ */
+export declare function isSafeSharedRoot(dir: string): GuardResult<SafeSharedRoot>;
+/**
+ * Whether other users on this machine can write into `dir`. Gates whether a
+ * refusal message may cite other users, so it must not over-report: `false` on
+ * Windows, where libuv synthesizes `st_mode` from the READONLY attribute and
+ * reports an ordinary per-account directory as `0666`, and `false` on a path
+ * that cannot be inspected.
+ *
+ * `statSync`, not `lstatSync`: the question is about the directory that will be
+ * used, not the link pointing at it. Link modes mislead in both directions —
+ * Linux creates symlinks `0777`, macOS applies the umask. Nothing here decides
+ * whether a path is accepted, so following the link costs nothing the guards
+ * do not already re-check.
+ */
+export declare function isPeerWritable(dir: string): boolean;
+/**
+ * Create a shared container as sticky + world-writable if it does not exist,
+ * and report whether the resulting path is safe for the current user.
+ *
+ * **A container that already exists is never modified — only judged.** Do not
+ * chmod before deciding trust: `CAP_FOWNER` (root's default in Docker and most
+ * CI images) can chmod a directory it does not own, so a peer-owned root would
+ * be widened to `1777` and then refused, and an operator who deliberately
+ * tightened this root would have it re-widened on every `nx` process.
+ */
+export declare function ensureSafeSharedRoot(dir: string): GuardResult<EstablishedSharedRoot>;
+/**
+ * Whether `dir` is an existing real directory owned by us. Unlike
+ * `ensureOwnedPrivateDir` it creates nothing and repairs nothing — for callers
+ * that only want to know whether a path is safe to act on, such as deleting.
+ */
+export declare function isOwnedRealDirectory(dir: string): OwnedRealDir | null;
+/** The path segment separating one user's Nx runtime state from another's. */
+export declare function getUserSegment(): string;
+/**
+ * Ensure `dir` exists, is a real directory owned by us, and carries no group or
+ * other bits at all — read and search alone reach a socket inside it, so 0755 is
+ * re-locked rather than accepted. A `refused` status carries which check said
+ * no — usually `foreign-owner` for a directory another user planted, but also
+ * `not-created`/`not-inspectable` for a filesystem error, `not-a-directory`, or
+ * `not-tightenable` when the re-lock did not land.
+ *
+ * Node builtins only: reached from the native binding loader.
+ */
+export declare function ensureOwnedPrivateDir(dir: string): GuardResult<OwnedPrivateDir>;
+export {};