nx 22.7.9 → 22.7.11

package/dist/src/tasks-runner/forked-process-task-runner.d.ts

@@ -11,6 +11,8 @@ export declare class ForkedProcessTaskRunner {
     cliPath: string;
     private readonly verbose;
     private processes;
+    private processMessageHandler;
+    private processExitHandler;
     private finishedProcesses;
     private pseudoTerminals;
     constructor(options: DefaultTasksRunnerOptions, tuiEnabled: boolean);
@@ -39,4 +41,5 @@ export declare class ForkedProcessTaskRunner {
     private writeTerminalOutput;
     cleanup(signal?: NodeJS.Signals): void;
     private setupProcessEventListeners;
+    removeProcessEventListeners(): void;
 }

package/dist/src/tasks-runner/forked-process-task-runner.js

@@ -271,7 +271,7 @@ class ForkedProcessTaskRunner {
         this.cleanUpBatchProcesses();
     }
     setupProcessEventListeners() {
-        const messageHandler = (message) => {
+        this.processMessageHandler = (message) => {
             this.pseudoTerminals.forEach((p) => {
                 p.sendMessageToChildren(message);
             });
@@ -281,14 +281,23 @@ class ForkedProcessTaskRunner {
                 }
             });
         };
+        this.processExitHandler = () => {
+            this.cleanup();
+            process.off('message', this.processMessageHandler);
+        };
         // When the nx process gets a message, it will be sent into the task's process
-        process.on('message', messageHandler);
+        process.on('message', this.processMessageHandler);
         // Terminate any task processes on exit
-        process.once('exit', () => {
-            this.cleanup();
-            process.off('message', messageHandler);
-        });
+        process.once('exit', this.processExitHandler);
         // Signal handlers removed - TaskOrchestrator owns signal handling
     }
+    // Long-lived processes (Nx Cloud agents) create a runner per invocation;
+    // without this each instance stays reachable from `process` forever.
+    // Call only after cleanup(): the exit handler is the last-resort child
+    // kill, so it must not be removed while children may still be alive.
+    removeProcessEventListeners() {
+        process.off('message', this.processMessageHandler);
+        process.off('exit', this.processExitHandler);
+    }
 }
 exports.ForkedProcessTaskRunner = ForkedProcessTaskRunner;

package/dist/src/tasks-runner/init-tasks-runner.js

@@ -14,6 +14,7 @@ const life_cycle_1 = require("./life-cycle");
 const task_orchestrator_1 = require("./task-orchestrator");
 const create_task_hasher_1 = require("../hasher/create-task-hasher");
 const client_1 = require("../daemon/client/client");
+const shared_running_task_1 = require("./running-tasks/shared-running-task");
 const task_results_life_cycle_1 = require("./life-cycles/task-results-life-cycle");
 /**
  * This function is deprecated. Do not use this
@@ -110,6 +111,11 @@ async function createOrchestrator(tasks, projectGraph, taskGraphForHashing, nxJs
     orchestrator.processAllScheduledTasks();
     return orchestrator;
 }
+// Nothing awaits the dispose chains below, so an unhandled rejection would take
+// down a long-lived agent process.
+function logDisposeFailure(e) {
+    console.error('Failed to dispose the task orchestrator:', e);
+}
 async function runDiscreteTasks(tasks, projectGraph, taskGraphForHashing, nxJson, lifeCycle) {
     const orchestrator = await createOrchestrator(tasks, projectGraph, taskGraphForHashing, nxJson, lifeCycle);
     let groupId = 0;
@@ -138,12 +144,36 @@ async function runDiscreteTasks(tasks, projectGraph, taskGraphForHashing, nxJson
             return [hit];
         return [await orchestrator.runTaskDirectly(true, task, groupId++)];
     });
-    return [...batchResults, ...taskResults];
+    const results = [...batchResults, ...taskResults];
+    // Callers like Nx Cloud agents create an orchestrator per invocation in a
+    // long-lived process; release its process-level listeners once all tasks
+    // settle, otherwise every invocation's orchestrator stays reachable forever.
+    // Not awaited, so callers keep consuming handles as they settle; the forked
+    // runner's exit handler still reaps children until dispose() runs.
+    Promise.allSettled(results)
+        .then(() => orchestrator.dispose())
+        .catch(logDisposeFailure);
+    return results;
 }
 async function runContinuousTasks(tasks, projectGraph, taskGraphForHashing, nxJson, lifeCycle) {
     const orchestrator = await createOrchestrator(tasks, projectGraph, taskGraphForHashing, nxJson, lifeCycle);
-    return tasks.reduce((current, task, index) => {
+    const runningTasks = tasks.reduce((current, task, index) => {
         current[task.id] = orchestrator.startContinuousTask(task, index);
         return current;
     }, {});
+    // Unlike runDiscreteTasks, this must resolve at task start: callers keep
+    // the RunningTask handles to kill later, so disposal has to be deferred
+    // until every task actually exits.
+    Promise.allSettled(Object.entries(runningTasks).map(async ([taskId, promise]) => {
+        const runningTask = await promise;
+        // A shared task is owned by another nx process; this orchestrator has
+        // no child to protect for it, so disposal does not wait on it.
+        if (runningTask instanceof shared_running_task_1.SharedRunningTask) {
+            return;
+        }
+        await orchestrator.waitForContinuousTaskExit(taskId);
+    }))
+        .then(() => orchestrator.dispose())
+        .catch(logDisposeFailure);
+    return runningTasks;
 }

package/dist/src/tasks-runner/life-cycles/task-history-life-cycle.js

@@ -22,6 +22,8 @@ function getTasksHistoryLifeCycle() {
 class TaskHistoryLifeCycle {
     constructor() {
         this.startTimings = {};
+        // Holds no terminalOutput: this singleton outlives every run in the
+        // process, and agents complete thousands of tasks in one process.
         this.pendingResults = new Map();
         this.taskRuns = new Map();
         this.taskHistory = (0, task_history_1.getTaskHistory)();
@@ -36,25 +38,28 @@ class TaskHistoryLifeCycle {
         }
     }
     async endTasks(taskResults) {
-        for (const taskResult of taskResults) {
-            this.pendingResults.set(taskResult.task.id, taskResult);
+        for (const { task, code, status } of taskResults) {
+            this.pendingResults.set(task.id, { task, code, status });
         }
     }
     async endCommand() {
+        const pendingResults = Array.from(this.pendingResults.values());
+        this.pendingResults.clear();
         if (!this.taskHistory) {
             return;
         }
         // Build TaskRun objects now — task.hash is guaranteed to be set by this point
-        for (const [, taskResult] of this.pendingResults) {
-            this.taskRuns.set(taskResult.task.hash, {
-                hash: taskResult.task.hash,
-                target: taskResult.task.target,
-                code: taskResult.code,
-                status: taskResult.status,
-                start: taskResult.task.startTime ?? this.startTimings[taskResult.task.id],
-                end: taskResult.task.endTime ?? Date.now(),
-                cacheable: taskResult.task.cache === true,
+        for (const { task, code, status } of pendingResults) {
+            this.taskRuns.set(task.hash, {
+                hash: task.hash,
+                target: task.target,
+                code,
+                status,
+                start: task.startTime ?? this.startTimings[task.id],
+                end: task.endTime ?? Date.now(),
+                cacheable: task.cache === true,
             });
+            delete this.startTimings[task.id];
         }
         const runs = [];
         // Only check for flaky tasks among cacheable tasks

package/dist/src/tasks-runner/running-tasks/batch-process.js

@@ -82,6 +82,9 @@ class BatchProcess {
     onOutput(cb) {
         this.outputCallbacks.push(cb);
     }
+    // Resolves on the CompleteBatchExecution message, not process exit: the
+    // child can outlive its results (open handles keep it alive), so callers
+    // must not treat a settled batch as an exited process.
     async getResults() {
         return Promise.race([
             new Promise((_, rej) => {

package/dist/src/tasks-runner/running-tasks/shared-running-task.d.ts

@@ -3,6 +3,7 @@ import { RunningTasksService } from '../../native';
 export declare class SharedRunningTask implements RunningTask {
     private runningTasksService;
     private exitCallbacks;
+    private detached;
     constructor(runningTasksService: RunningTasksService, taskId: string);
     getResults(): Promise<{
         code: number;

package/dist/src/tasks-runner/running-tasks/shared-running-task.js

@@ -5,7 +5,11 @@ class SharedRunningTask {
     constructor(runningTasksService, taskId) {
         this.runningTasksService = runningTasksService;
         this.exitCallbacks = [];
+        this.detached = false;
         this.waitForTaskToFinish(taskId).then(() => {
+            if (this.detached) {
+                return;
+            }
             // notify exit callbacks
             this.exitCallbacks.forEach((cb) => cb(0));
         });
@@ -13,8 +17,14 @@ class SharedRunningTask {
     async getResults() {
         throw new Error('Results cannot be retrieved from a shared task');
     }
+    // Detaches from the shared task; the owning process keeps running it.
     kill() {
+        if (this.detached) {
+            return;
+        }
+        this.detached = true;
         this.exitCallbacks.forEach((cb) => cb(0));
+        this.exitCallbacks = [];
     }
     onExit(cb) {
         this.exitCallbacks.push(cb);
@@ -24,7 +34,8 @@ class SharedRunningTask {
         // wait for the running task to finish
         do {
             await new Promise((resolve) => setTimeout(resolve, 100));
-        } while (this.runningTasksService.getRunningTasks([taskId]).length);
+        } while (!this.detached &&
+            this.runningTasksService.getRunningTasks([taskId]).length);
     }
 }
 exports.SharedRunningTask = SharedRunningTask;

package/dist/src/tasks-runner/task-orchestrator.d.ts

@@ -47,6 +47,7 @@ export declare class TaskOrchestrator {
     private discreteTaskExitHandled;
     private continuousTaskExitHandled;
     private cleanupPromise;
+    private signalHandlers;
     constructor(hasher: TaskHasher, initiatingProject: string | undefined, initiatingTasks: Task[], projectGraph: ProjectGraph, taskGraph: TaskGraph, nxJson: NxJsonConfiguration, options: NxArgs & DefaultTasksRunnerOptions, bail: boolean, daemon: DaemonClient, outputStyle: string, taskGraphForHashing?: TaskGraph);
     init(): Promise<void>;
     run(): Promise<{
@@ -170,6 +171,8 @@ export declare class TaskOrchestrator {
     private cleanup;
     private performCleanup;
     private setupSignalHandlers;
+    waitForContinuousTaskExit(taskId: string): Promise<void>;
+    dispose(): Promise<void>;
     private cleanUpUnneededContinuousTasks;
 }
 export declare function getThreadPoolSize(options: NxArgs & DefaultTasksRunnerOptions, taskGraph: TaskGraph): {

package/dist/src/tasks-runner/task-orchestrator.js

@@ -86,6 +86,7 @@ class TaskOrchestrator {
         this.discreteTaskExitHandled = new Map();
         this.continuousTaskExitHandled = new Map();
         this.cleanupPromise = null;
+        this.signalHandlers = [];
     }
     async init() {
         this.setupSignalHandlers();
@@ -139,6 +140,7 @@ class TaskOrchestrator {
             this.cache.removeOldCacheRecords();
         }
         await this.cleanup();
+        await this.dispose();
         // Public API (defaultTasksRunner) returns a plain object keyed by
         // task id. Internal state is a Map for faster lookup.
         return Object.fromEntries(this.completedTasks);
@@ -1184,7 +1186,7 @@ class TaskOrchestrator {
         await Promise.all(this.discreteTaskExitHandled.values());
     }
     setupSignalHandlers() {
-        process.once('SIGINT', () => {
+        const sigintHandler = () => {
             this.stopRequested = true;
             if (!this.tuiEnabled) {
                 // Synchronously remove DB entries before async cleanup to prevent
@@ -1216,23 +1218,55 @@ class TaskOrchestrator {
                     process.exit((0, exit_codes_1.signalToCode)('SIGINT'));
                 }
             });
-        });
-        process.once('SIGTERM', () => {
+        };
+        const sigtermHandler = () => {
             this.stopRequested = true;
             this.cleanup().finally(() => {
                 if (this.resolveStopPromise) {
                     this.resolveStopPromise();
                 }
             });
-        });
-        process.once('SIGHUP', () => {
+        };
+        const sighupHandler = () => {
             this.stopRequested = true;
             this.cleanup().finally(() => {
                 if (this.resolveStopPromise) {
                     this.resolveStopPromise();
                 }
             });
-        });
+        };
+        for (const [signal, handler] of [
+            ['SIGINT', sigintHandler],
+            ['SIGTERM', sigtermHandler],
+            ['SIGHUP', sighupHandler],
+        ]) {
+            this.signalHandlers.push([signal, handler]);
+            process.once(signal, handler);
+        }
+    }
+    // Registered at child creation, so unlike subscribing to RunningTask.onExit
+    // after the fact it cannot miss an exit that already happened.
+    waitForContinuousTaskExit(taskId) {
+        return this.continuousTaskExitHandled.get(taskId) ?? Promise.resolve();
+    }
+    // Releases the process-level listeners registered by setupSignalHandlers.
+    // Each closes over `this`, so a long-lived caller (an Nx Cloud agent creates
+    // an orchestrator per invocation) leaks whole orchestrators until they run.
+    async dispose() {
+        // The forked runner's exit handler is the last-resort kill for child
+        // processes, and a batch child can outlive its results message. Signal the
+        // children first so removing that handler cannot orphan a live one.
+        try {
+            await this.forkedProcessTaskRunner.cleanup();
+        }
+        catch (e) {
+            console.error('Failed to clean up child processes on dispose:', e);
+        }
+        for (const [signal, handler] of this.signalHandlers) {
+            process.off(signal, handler);
+        }
+        this.signalHandlers = [];
+        this.forkedProcessTaskRunner.removeProcessEventListeners();
     }
     cleanUpUnneededContinuousTasks() {
         const incompleteTasks = this.tasksSchedule.getIncompleteTasks();

package/dist/src/utils/package-json.js

@@ -22,6 +22,7 @@ const target_merging_1 = require("../project-graph/utils/project-configuration/t
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const has_nx_js_plugin_1 = require("./has-nx-js-plugin");
+const path_2 = require("./path");
 const installation_directory_1 = require("./installation-directory");
 const package_manager_1 = require("./package-manager");
 const workspace_root_1 = require("./workspace-root");
@@ -34,15 +35,25 @@ function normalizePackageGroup(packageGroup) {
         }));
 }
 function readNxMigrateConfig(json) {
+    // Registry fetching uses this value to build a temporary extraction path.
+    // Reject unsupported absolute paths and escaping parent traversal before extraction.
+    const assertContained = (migrations) => {
+        if (!(0, path_2.isContainedRelativePath)(migrations)) {
+            throw new Error(`Invalid migrations path "${migrations}" in package "${json.name ?? 'unknown'}@${json.version ?? 'unknown'}": migration paths must not be absolute or escape their base directory through parent traversal.`);
+        }
+        return migrations;
+    };
     const parseNxMigrationsConfig = (fromJson) => {
         if (!fromJson) {
             return {};
         }
         if (typeof fromJson === 'string') {
-            return { migrations: fromJson, packageGroup: [] };
+            return { migrations: assertContained(fromJson), packageGroup: [] };
         }
         return {
-            ...(fromJson.migrations ? { migrations: fromJson.migrations } : {}),
+            ...(fromJson.migrations
+                ? { migrations: assertContained(fromJson.migrations) }
+                : {}),
             ...(fromJson.packageGroup
                 ? { packageGroup: normalizePackageGroup(fromJson.packageGroup) }
                 : {}),

package/dist/src/utils/path.d.ts

@@ -8,6 +8,12 @@ export declare function normalizePath(osSpecificPath: string): string;
  * This should not be used to read files on disk because of the removal of Windows drive letters.
  */
 export declare function joinPathFragments(...fragments: string[]): string;
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+export declare function isContainedRelativePath(relativePath: string): boolean;
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/dist/src/utils/path.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizePath = normalizePath;
 exports.joinPathFragments = joinPathFragments;
+exports.isContainedRelativePath = isContainedRelativePath;
 exports.getCwd = getCwd;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
@@ -23,6 +24,20 @@ function normalizePath(osSpecificPath) {
 function joinPathFragments(...fragments) {
     return normalizePath(path.join(...fragments));
 }
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+function isContainedRelativePath(relativePath) {
+    if (path.isAbsolute(relativePath)) {
+        return false;
+    }
+    const normalized = path.normalize(relativePath);
+    return !(normalized === '..' ||
+        normalized.startsWith(`..${path.sep}`) ||
+        normalized.startsWith(`..${path.posix.sep}`));
+}
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "22.7.9",
+  "version": "22.7.11",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -175,16 +175,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "22.7.9",
-    "@nx/nx-darwin-x64": "22.7.9",
-    "@nx/nx-freebsd-x64": "22.7.9",
-    "@nx/nx-linux-arm-gnueabihf": "22.7.9",
-    "@nx/nx-linux-arm64-gnu": "22.7.9",
-    "@nx/nx-linux-arm64-musl": "22.7.9",
-    "@nx/nx-linux-x64-gnu": "22.7.9",
-    "@nx/nx-linux-x64-musl": "22.7.9",
-    "@nx/nx-win32-arm64-msvc": "22.7.9",
-    "@nx/nx-win32-x64-msvc": "22.7.9"
+    "@nx/nx-darwin-arm64": "22.7.11",
+    "@nx/nx-darwin-x64": "22.7.11",
+    "@nx/nx-freebsd-x64": "22.7.11",
+    "@nx/nx-linux-arm-gnueabihf": "22.7.11",
+    "@nx/nx-linux-arm64-gnu": "22.7.11",
+    "@nx/nx-linux-arm64-musl": "22.7.11",
+    "@nx/nx-linux-x64-gnu": "22.7.11",
+    "@nx/nx-linux-x64-musl": "22.7.11",
+    "@nx/nx-win32-arm64-msvc": "22.7.11",
+    "@nx/nx-win32-x64-msvc": "22.7.11"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",