nx 22.7.8 → 22.7.9

package/dist/src/command-line/reset/reset.js

@@ -137,7 +137,12 @@ function cleanupCacheEntries() {
 }
 function cleanupNativeFileCache() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
-        (0, node_fs_1.rmSync)((0, native_file_cache_location_1.getNativeFileCacheLocation)(), { recursive: true, force: true });
+        // Null when the native cache root is not a real directory we own, which
+        // would mean deleting through a path another user planted.
+        const cacheDir = (0, native_file_cache_location_1.getNativeFileCacheLocationToDelete)();
+        if (cacheDir) {
+            (0, node_fs_1.rmSync)(cacheDir, { recursive: true, force: true });
+        }
     });
 }
 function cleanupWorkspaceData() {

package/dist/src/daemon/client/client.d.ts

@@ -8,6 +8,11 @@ import { ConfigurationSourceMaps } from '../../project-graph/utils/project-confi
 import type { FlushSyncGeneratorChangesResult, SyncGeneratorRunResult } from '../../utils/sync-generators';
 import { type ConfigureAiAgentsStatusResponse } from '../message-types/configure-ai-agents';
 import { type NxConsoleStatusResponse, type SetNxConsolePreferenceAndInstallResponse } from '../message-types/nx-console';
+/** A refused connect: the errno, and the path it was made against. */
+type ConnectRefusal = {
+    error: NodeJS.ErrnoException;
+    socketPath: string;
+};
 export type UnregisterCallback = () => void;
 export type ChangedFile = {
     path: string;
@@ -26,8 +31,6 @@ export declare class DaemonClient {
     private _daemonStatus;
     private _waitForDaemonReady;
     private _daemonReady;
-    private _out;
-    private _err;
     private fileWatcherMessenger;
     private fileWatcherReconnecting;
     private fileWatcherCallbacks;
@@ -95,6 +98,12 @@ export declare class DaemonClient {
     resetConfigureAiAgentsStatus(): Promise<{
         success: boolean;
     }>;
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    private probeServer;
     isServerAvailable(): Promise<boolean>;
     private startDaemonIfNecessary;
     private sendToDaemonViaQueue;
@@ -110,8 +119,41 @@ export declare class DaemonClient {
     private sendMessageToDaemon;
     private registerDaemonProcessWithMetricsService;
     private handleMessage;
-    startInBackground(): Promise<ChildProcess['pid']>;
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    startInBackground(probeRefusal?: ConnectRefusal): Promise<ChildProcess['pid']>;
     stop(): Promise<void>;
 }
 export declare const daemonClient: DaemonClient;
 export declare function isDaemonEnabled(): boolean;
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+export declare function isPermissionErrno(error: NodeJS.ErrnoException): boolean;
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+export declare function daemonPermissionException(socketPath: string, cause: string): Error;
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
+export declare function daemonProcessException(message: string): Error;
+export {};

package/dist/src/daemon/client/client.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.daemonClient = exports.DaemonClient = void 0;
 exports.isDaemonEnabled = isDaemonEnabled;
+exports.isPermissionErrno = isPermissionErrno;
+exports.daemonPermissionException = daemonPermissionException;
+exports.daemonProcessException = daemonProcessException;
 const child_process_1 = require("child_process");
-const promises_1 = require("fs/promises");
 const net_1 = require("net");
 const node_fs_1 = require("node:fs");
 const path_1 = require("path");
@@ -62,8 +64,6 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.DISCONNECTED;
         this._waitForDaemonReady = null;
         this._daemonReady = null;
-        this._out = null;
-        this._err = null;
         this.fileWatcherReconnecting = false;
         this.fileWatcherCallbacks = new Map();
         this.fileWatcherConfigs = new Map();
@@ -127,10 +127,6 @@ class DaemonClient {
         this.currentResolve = null;
         this.currentReject = null;
         this._enabled = undefined;
-        this._out?.close();
-        this._err?.close();
-        this._out = null;
-        this._err = null;
         // Clean up file watcher and project graph listener connections
         this.fileWatcherMessenger?.close();
         this.fileWatcherMessenger = undefined;
@@ -282,9 +278,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -434,9 +430,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -671,30 +667,40 @@ class DaemonClient {
         };
         return this.sendToDaemonViaQueue(message);
     }
-    async isServerAvailable() {
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    async probeServer() {
         return new Promise((resolve, reject) => {
             try {
                 const socketPath = this.getSocketPath();
                 if (!socketPath) {
-                    resolve(false);
+                    resolve({ available: false });
                     return;
                 }
                 const socket = (0, net_1.connect)(socketPath, () => {
                     socket.destroy();
-                    resolve(true);
+                    resolve({ available: true });
                 });
-                socket.once('error', () => {
-                    resolve(false);
+                socket.once('error', (err) => {
+                    // The only place the errno for "the socket is there but refuses us"
+                    // is produced, and the only thing separating it from "no daemon yet".
+                    resolve({ available: false, refusal: { error: err, socketPath } });
                 });
             }
             catch (err) {
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
                     reject(err); // Let version mismatch bubble up
                 }
-                resolve(false);
+                resolve({ available: false });
             }
         });
     }
+    async isServerAvailable() {
+        return (await this.probeServer()).available;
+    }
     async startDaemonIfNecessary() {
         if (this._daemonStatus == DaemonStatus.CONNECTED) {
             return;
@@ -703,21 +709,22 @@ class DaemonClient {
         if (this._daemonStatus == DaemonStatus.DISCONNECTED) {
             this._daemonStatus = DaemonStatus.CONNECTING;
             let daemonPid = null;
-            let serverAvailable;
+            let probe;
             try {
-                serverAvailable = await this.isServerAvailable();
+                probe = await this.probeServer();
             }
             catch (err) {
                 // Version mismatch - treat as server not available, start new one
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
-                    serverAvailable = false;
+                    probe = { available: false };
                 }
                 else {
                     throw err;
                 }
             }
-            if (!serverAvailable) {
-                daemonPid = await this.startInBackground();
+            if (!probe.available) {
+                // Carried as a value so no other caller's probe can substitute for it.
+                daemonPid = await this.startInBackground(probe.refusal);
             }
             this.setUpConnection();
             this._daemonStatus = DaemonStatus.CONNECTED;
@@ -768,6 +775,11 @@ class DaemonClient {
             if (err.message.startsWith('connect ENOENT')) {
                 error = daemonProcessException('The Daemon Server is not running');
             }
+            else if (isPermissionErrno(err)) {
+                // The 0700 dir and 0600 socket mean the OS refuses this rather than the
+                // connect silently succeeding.
+                error = daemonPermissionException(socketPath, err.message);
+            }
             else if (err.message.startsWith('connect ECONNREFUSED')) {
                 error = daemonProcessException(`A server instance had not been fully shut down. Please try running the command again.`);
             }
@@ -788,9 +800,9 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.CONNECTING;
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
@@ -836,6 +848,11 @@ class DaemonClient {
      */
     async waitForServerToBeAvailable(options) {
         logger_1.clientLogger.log(`[Client] Waiting for server (max: ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts, ${WAIT_FOR_SERVER_CONFIG.delayMs}ms interval)`);
+        // Poll-scoped, not instance state: reconnect paths have their own flags, so
+        // several attempts can be in flight and a shared slot would let one report
+        // another's socket.
+        let stoppedOnRefusal = false;
+        let refusal;
         const socket = await (0, wait_for_socket_connection_1.waitForSocketConnection)(() => {
             try {
                 return this.getSocketPath();
@@ -852,14 +869,29 @@ class DaemonClient {
         }, {
             maxAttempts: WAIT_FOR_SERVER_CONFIG.maxAttempts,
             delayMs: WAIT_FOR_SERVER_CONFIG.delayMs,
+            onConnectError: (error, socketPath) => {
+                refusal = { error, socketPath };
+                // A refusal is not expected to become an acceptance, so polling the
+                // full 60s budget only delays the same answer. Not absolute:
+                // `server.ts` binds before it chmods to 0600, so under a umask that
+                // strips owner write a same-user connect can lose a microsecond race
+                // and see EACCES. That costs a specific error rather than a retry — a
+                // better trade than a 60s hang.
+                return (stoppedOnRefusal = isPermissionErrno(error));
+            },
         });
         if (socket) {
             socket.destroy();
             logger_1.clientLogger.log(`[Client] Server available`);
-            return true;
+            return { available: true };
         }
-        logger_1.clientLogger.log(`[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
-        return false;
+        // Keyed on the early exit taken, not on whether an errno was recorded:
+        // every failed connect records one, including an ordinary cold start's
+        // ENOENT.
+        logger_1.clientLogger.log(stoppedOnRefusal
+            ? `[Client] Server refused the connection (${refusal?.error.code}), stopped polling`
+            : `[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
+        return { available: false, refusal };
     }
     async sendMessageToDaemon(message, force) {
         // the first message sent to the daemon includes an env prop
@@ -941,7 +973,12 @@ class DaemonClient {
             ].join('\n')));
         }
     }
-    async startInBackground() {
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    async startInBackground(probeRefusal) {
         if (global.NX_PLUGIN_WORKER) {
             throw new Error('Fatal Error: Something unexpected has occurred. Plugin Workers should not start a new daemon process. Please report this issue.');
         }
@@ -949,17 +986,24 @@ class DaemonClient {
         if (!(0, node_fs_1.existsSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE)) {
             (0, node_fs_1.writeFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, '');
         }
-        this._out = await (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
-        this._err = await (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
+        // Redirect the detached daemon's stdout/stderr into the log file. The
+        // child dup's these descriptors at spawn, so we close ours right after
+        // instead of holding them for the life of this process (Node >=26 turns a
+        // file descriptor closed during garbage collection into a fatal error).
+        const outFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
+        const errFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
         logger_1.clientLogger.log(`[Client] Starting new daemon server in background`);
         const backgroundProcess = (0, child_process_1.spawn)(process.execPath, [(0, path_1.join)(__dirname, `../server/start.js`)], {
             cwd: workspace_root_1.workspaceRoot,
-            stdio: ['ignore', this._out.fd, this._err.fd],
+            stdio: ['ignore', outFd, errFd],
             detached: true,
             windowsHide: true,
             shell: false,
             env: (0, daemon_environment_1.getDaemonEnv)(),
         });
+        // The child now owns dup'd copies of the descriptors, so release ours.
+        (0, node_fs_1.closeSync)(outFd);
+        (0, node_fs_1.closeSync)(errFd);
         // if this process is the process that spawned the daemon,
         // the daemon env is already up to date
         this.envReflectionSent = true;
@@ -967,14 +1011,25 @@ class DaemonClient {
         /**
          * Ensure the server is actually available to connect to via IPC before resolving
          */
-        const serverAvailable = await this.waitForServerToBeAvailable({
-            ignoreVersionMismatch: true,
-        });
-        if (serverAvailable) {
+        const { available, refusal: polled } = await this.waitForServerToBeAvailable({ ignoreVersionMismatch: true });
+        if (available) {
             logger_1.clientLogger.log(`[Client] Daemon server started, pid=${backgroundProcess.pid}`);
             return backgroundProcess.pid;
         }
         else {
+            // A permission refusal from either source wins, then the poll's errno,
+            // then the probe's. Recency alone would report a daemon's ENOENT over the
+            // EACCES the probe saw a moment earlier, losing the diagnosis.
+            const refusal = [polled, probeRefusal].find((r) => r && isPermissionErrno(r.error)) ??
+                polled ??
+                probeRefusal;
+            if (refusal && isPermissionErrno(refusal.error)) {
+                // Reported here rather than as a generic startup failure, so it degrades
+                // without disabling the daemon until `nx reset`. Both operands come from
+                // the refusal: resolving a path here instead would throw once a daemon
+                // that failed to bind has unlinked its process json.
+                throw daemonPermissionException(refusal.socketPath, refusal.error.message);
+            }
             throw daemonProcessException('Failed to start or connect to the Nx Daemon process.');
         }
     }
@@ -1017,24 +1072,65 @@ function isDocker() {
 function nxJsonIsNotPresent() {
     return !(0, nx_json_1.hasNxJson)(workspace_root_1.workspaceRoot);
 }
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+function isPermissionErrno(error) {
+    return error?.code === 'EACCES' || error?.code === 'EPERM';
+}
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+function daemonPermissionException(socketPath, cause) {
+    const error = new Error([
+        `The operating system refused the connection to the Nx Daemon socket (${cause}).`,
+        '',
+        `Socket: ${socketPath}`,
+        '',
+        'Most often the socket belongs to a different user: a daemon left behind by running Nx under `sudo`, a different uid inside a container, or a working copy shared between accounts. If the socket is your own, a sandbox is refusing the connection instead.',
+        'If it belongs to another user, delete the socket above or set NX_SOCKET_DIR to a directory only your user can reach. If you are in a sandbox, allow unix sockets under the Nx socket root — in Claude Code a scoped `allowUnixSockets` only permits connecting, so starting a daemon there needs `allowAllUnixSockets: true`. See https://nx.dev/docs/kb/nx-sandbox-unix-sockets',
+    ].join('\n'));
+    error.daemonPermissionError = true;
+    return error;
+}
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
 function daemonProcessException(message) {
+    // The log is an enrichment, not the classifier: it is absent on a first run,
+    // which is exactly when the daemon is most likely to fail to start.
+    let body = message;
     try {
         let log = (0, node_fs_1.readFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE).toString().split('\n');
         if (log.length > 20) {
             log = log.slice(log.length - 20);
         }
-        const error = new Error([
+        body = [
             message,
             '',
             'Messages from the log:',
             ...log,
             '\n',
             `More information: ${tmp_dir_1.DAEMON_OUTPUT_LOG_FILE}`,
-        ].join('\n'));
-        error.internalDaemonError = true;
-        return error;
-    }
-    catch (e) {
-        return new Error(message);
+        ].join('\n');
     }
+    catch { }
+    const error = new Error(body);
+    error.internalDaemonError = true;
+    return error;
 }

package/dist/src/daemon/client/daemon-socket-messenger.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DaemonSocketMessenger = exports.VersionMismatchError = void 0;
 const perf_hooks_1 = require("perf_hooks");
 const consume_messages_from_socket_1 = require("../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
 const socket_utils_1 = require("../socket-utils");
 class VersionMismatchError extends Error {
@@ -21,6 +22,9 @@ class DaemonSocketMessenger {
         if (!this.socket) {
             throw new Error('Socket not initialized.');
         }
+        // Stamp every message with the sending workspace's root so the daemon can
+        // reject messages from a different workspace (e.g. a shared NX_SOCKET_DIR).
+        messageToDaemon.workspaceRoot = workspace_root_1.workspaceRoot;
         logger_1.clientLogger.log('[Messenger] Sending message type:', messageToDaemon.type);
         perf_hooks_1.performance.mark('daemon-message-serialization-start-' + messageToDaemon.type);
         const serialized = (0, socket_utils_1.serialize)(messageToDaemon, force);

package/dist/src/daemon/message-types/daemon-message.d.ts

@@ -1,6 +1,39 @@
 export type DaemonMessage = {
     type: string;
     env?: Record<string, string>;
+    /**
+     * Stamped centrally by `DaemonSocketMessenger.sendMessage`, not by the ~30
+     * sites that construct messages — hence optional. It can also be absent on a
+     * message that predates the field, which is why `isForeignWorkspaceMessage`
+     * treats `undefined` as "not foreign".
+     */
+    workspaceRoot?: string;
     data?: any;
 };
 export declare function isDaemonMessage(msg: unknown): msg is DaemonMessage;
+/**
+ * Any message carrying the sender's workspace root. Structural so the checks
+ * below serve the daemon and the plugin worker without either importing the
+ * other's message type. `type` is required only so the type is not all-optional,
+ * which would accept `{}`.
+ */
+type WorkspaceScopedMessage = {
+    type: string;
+    workspaceRoot?: string;
+};
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Roots are normalized first so that a workspace does not look
+ * foreign to itself; see {@link normalizeWorkspaceRoot}.
+ */
+export declare function isForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string): boolean;
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+export declare function assertNotForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string, receiverDescription?: string): void;
+export {};

package/dist/src/daemon/message-types/daemon-message.js

@@ -1,6 +1,54 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDaemonMessage = isDaemonMessage;
+exports.isForeignWorkspaceMessage = isForeignWorkspaceMessage;
+exports.assertNotForeignWorkspaceMessage = assertNotForeignWorkspaceMessage;
+const node_path_1 = require("node:path");
 function isDaemonMessage(msg) {
     return typeof msg === 'object' && msg && 'type' in msg;
 }
+/**
+ * Puts a workspace root into a form two independently-resolved spellings of the
+ * same directory agree on.
+ *
+ * The sender's root and the receiver's root do not always come out of the same
+ * branch of `workspaceRootInner`: one side can be handed `NX_WORKSPACE_ROOT_PATH`
+ * verbatim while the other walks up from `process.cwd()`. On Windows those two
+ * sources routinely disagree on the case of the drive letter — an editor or
+ * agent may export `d:\repo` while `process.cwd()` reports `D:\repo` — and on
+ * separators. Both address the same directory: Windows paths are
+ * case-insensitive, and a drive letter is case-insensitive without exception.
+ *
+ * POSIX roots keep their case, where `/repo` and `/REPO` really can be two
+ * directories.
+ */
+function normalizeWorkspaceRoot(workspaceRoot) {
+    return process.platform === 'win32'
+        ? node_path_1.win32.normalize(workspaceRoot).toLowerCase()
+        : node_path_1.posix.normalize(workspaceRoot);
+}
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Roots are normalized first so that a workspace does not look
+ * foreign to itself; see {@link normalizeWorkspaceRoot}.
+ */
+function isForeignWorkspaceMessage(msg, receiverWorkspaceRoot) {
+    if (msg.workspaceRoot === undefined) {
+        return false;
+    }
+    return (normalizeWorkspaceRoot(msg.workspaceRoot) !==
+        normalizeWorkspaceRoot(receiverWorkspaceRoot));
+}
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+function assertNotForeignWorkspaceMessage(msg, receiverWorkspaceRoot, receiverDescription = `The Nx Daemon for '${receiverWorkspaceRoot}'`) {
+    if (isForeignWorkspaceMessage(msg, receiverWorkspaceRoot)) {
+        throw new Error(`${receiverDescription} received a message from a different workspace ('${msg.workspaceRoot}') and refused to process it. This usually means multiple workspaces are sharing a socket directory; ensure NX_SOCKET_DIR (or NX_DAEMON_SOCKET_DIR) is not set to a shared location.`);
+    }
+}

package/dist/src/daemon/server/server.js

@@ -116,6 +116,17 @@ async function handleMessage(socket, data) {
         await (0, shutdown_utils_1.respondWithErrorAndExit)(socket, `Invalid payload from the client`, new Error(`Unsupported payload sent to daemon server: ${unparsedPayload}`));
     }
     logger_1.serverLogger.log(`Received ${mode} message of type ${payload.type}`);
+    // A mismatch means the client reached the wrong daemon (e.g. a shared
+    // NX_SOCKET_DIR). Respond, but stay alive for our own workspace.
+    if ((0, daemon_message_1.isDaemonMessage)(payload)) {
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(payload, workspace_root_1.workspaceRoot);
+        }
+        catch (e) {
+            await (0, shutdown_utils_1.respondWithError)(socket, `Workspace root mismatch`, e);
+            return;
+        }
+    }
     if ((0, daemon_message_1.isDaemonMessage)(payload) && payload.env) {
         let shouldRecomputeGraph = false;
         for (const key in payload.env) {
@@ -461,6 +472,17 @@ async function startServer() {
             server.listen(socketPath, async () => {
                 try {
                     logger_1.serverLogger.log(`Started listening on: ${socketPath}`);
+                    // Linux gates connect() on write permission to the socket file; macOS/BSD gate
+                    // on the directory, which is already 0700. Done after listen because
+                    // net.Server.listen takes no mode and umask is process-global.
+                    if (!socket_utils_1.isWindows) {
+                        try {
+                            (0, fs_1.chmodSync)(socketPath, 0o600);
+                        }
+                        catch {
+                            // Best effort; the 0700 socket directory is the primary control.
+                        }
+                    }
                     // this triggers the storage of the lock file hash
                     daemonIsOutdated();
                     if (!(0, shutdown_utils_1.getWatcherInstance)()) {

package/dist/src/daemon/server/shutdown-utils.d.ts

@@ -14,5 +14,10 @@ export declare function handleServerProcessTermination({ server, reason, sockets
 export declare function handleServerProcessTerminationWithRestart({ server, reason, sockets, }: HandleServerProcessTerminationParams): Promise<void>;
 export declare function resetInactivityTimeout(cb: () => void): void;
 export declare function respondToClient(socket: Socket, response: string, description: string): Promise<unknown>;
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+export declare function respondWithError(socket: Socket, description: string, error: Error): Promise<void>;
 export declare function respondWithErrorAndExit(socket: Socket, description: string, error: Error): Promise<void>;
 export {};

package/dist/src/daemon/server/shutdown-utils.js

@@ -9,6 +9,7 @@ exports.handleServerProcessTermination = handleServerProcessTermination;
 exports.handleServerProcessTerminationWithRestart = handleServerProcessTerminationWithRestart;
 exports.resetInactivityTimeout = resetInactivityTimeout;
 exports.respondToClient = respondToClient;
+exports.respondWithError = respondWithError;
 exports.respondWithErrorAndExit = respondWithErrorAndExit;
 const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
@@ -135,9 +136,12 @@ function respondToClient(socket, response, description) {
         });
     });
 }
-async function respondWithErrorAndExit(socket, description, error) {
-    const isProjectGraphError = error instanceof error_types_1.DaemonProjectGraphError;
-    const normalizedError = isProjectGraphError
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+async function respondWithError(socket, description, error) {
+    const normalizedError = error instanceof error_types_1.DaemonProjectGraphError
         ? error_types_1.ProjectGraphError.fromDaemonProjectGraphError(error)
         : error;
     // print some extra stuff in the error message
@@ -145,8 +149,11 @@ async function respondWithErrorAndExit(socket, description, error) {
     console.error(normalizedError.stack);
     // Respond with the original error
     await respondToClient(socket, (0, socket_utils_1.serializeResult)(error, null, null), null);
+}
+async function respondWithErrorAndExit(socket, description, error) {
+    await respondWithError(socket, description, error);
     // Project Graph errors are okay. Restarting the daemon won't help with this.
-    if (!isProjectGraphError) {
+    if (!(error instanceof error_types_1.DaemonProjectGraphError)) {
         process.exit(1);
     }
 }

package/dist/src/daemon/socket-utils.d.ts

@@ -8,6 +8,7 @@ export declare const isWindows: boolean;
 export declare const getFullOsSocketPath: () => string;
 export declare const getForkedProcessOsSocketPath: (id: string) => string;
 export declare const getPluginOsSocketPath: (id: string) => string;
+export declare function getPluginSocketFileName(id: string): string;
 export declare function killSocketOrPath(): void;
 export declare function serializeResult(error: Error | null, serializedProjectGraph: string | null, serializedSourceMaps: string | null): string | null;
 /**