nx 23.1.0 → 23.1.2

package/dist/src/daemon/client/daemon-environment.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDaemonEnv = getDaemonEnv;
+exports.getDaemonSpawnEnv = getDaemonSpawnEnv;
 exports.applyDaemonEnvFromClient = applyDaemonEnvFromClient;
 const DAEMON_ENV_REQUIRED_SETTINGS = {
     NX_PROJECT_GLOB_CACHE: 'false',
@@ -37,6 +38,12 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'NX_BATCH_MODE',
     'NX_CI_EXECUTION_ID',
     'NX_DAEMON_PROCESS',
+    'NX_CLI_SET',
+    // Set by Nx Console on the extension host; always equals the daemon's own
+    // workspace root (foreign-workspace messages are rejected), and the daemon
+    // resolves its root at startup before any client env is applied. The spawn
+    // env keeps it so that startup resolution honors the pinned root.
+    'NX_WORKSPACE_ROOT_PATH',
     // Nx UI/logging vars (don't affect graph structure)
     'NX_TUI',
     'NX_TUI_AUTO_EXIT',
@@ -46,6 +53,7 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'NX_NATIVE_LOGGING',
     'NX_PROFILE',
     'NX_DAEMON_VERBOSE_LOGGING',
+    'NX_ORIGINAL_FORCE_COLOR',
     // AI agent detection vars (the daemon itself is not an AI agent)
     'CLAUDECODE',
     'CLAUDE_CODE',
@@ -54,9 +62,12 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'COMPOSER_NO_INTERACTION',
     'OPENCODE',
     'GEMINI_CLI',
+    'CODEX_THREAD_ID',
+    'AI_AGENT',
     // Shell mechanics
     '_',
     'SHLVL',
+    'PWD',
     'OLDPWD',
     'SHELL_SESSION_ID',
     'TERM_SESSION_ID',
@@ -66,6 +77,56 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'COLUMNS',
     'LINES',
     'TMPDIR',
+    'PROMPT',
+    // Package-manager per-invocation vars not covered by the npm_/pnpm_ prefixes
+    'INIT_CWD',
+    'COLOR',
+    // Per-shell-session state; these tools' other vars are stable or can be
+    // meaningful (e.g. fnm's FNM_DIR), so no prefix exclusion
+    'FNM_MULTISHELL_PATH',
+    'POSH_SESSION_ID',
+    'MISE_SHELL',
+    // Editor preference; graph computation is non-interactive
+    'EDITOR',
+    'VISUAL',
+    // Output presentation
+    'PAGER',
+    'FORCE_COLOR',
+    'NO_COLOR',
+    'NODE_DISABLE_COLORS',
+    'FORCE_HYPERLINK',
+    // Terminal identification/presentation; differs per terminal app, so it
+    // churns whenever clients from different terminals share the daemon
+    'TERM',
+    'TERM_PROGRAM',
+    'TERM_PROGRAM_VERSION',
+    'COLORTERM',
+    'COLORFGBG',
+    'VTE_VERSION',
+    'GNOME_TERMINAL_SCREEN',
+    'GNOME_TERMINAL_SERVICE',
+    'WT_SESSION',
+    'WT_PROFILE_ID',
+    'TERMINAL_EMULATOR',
+    'TERMINUS_SUBLIME',
+    'ConEmuTask',
+    'ZELLIJ_PANE_ID',
+    'LC_TERMINAL',
+    'LC_TERMINAL_VERSION',
+    // Injected by VS Code and its extensions into integrated terminals. Single
+    // entries rather than GIT_/CHROME_/COPILOT_ prefixes: GIT_DIR, CHROME_BIN,
+    // COPILOT_HOME and COPILOT_GITHUB_TOKEN are functional inputs.
+    'GIT_ASKPASS',
+    'GIT_EDITOR',
+    'GIT_PAGER',
+    'GIT_MERGE_AUTOEDIT',
+    'APPLICATION_INSIGHTS_NO_STATSBEAT',
+    // Override for the @microsoft/mxc-sdk sandbox binaries; the SDK falls back
+    // to its bundled binaries when unset
+    'MXC_BIN_DIR',
+    'CHROME_CRASHPAD_PIPE_NAME',
+    'COPILOT_OTEL_FILE_EXPORTER_PATH',
+    'COPILOT_DEBUG_NONCE',
     // Session / auth
     'SSH_AUTH_SOCK',
     'SSH_AGENT_PID',
@@ -103,16 +164,37 @@ const DAEMON_ENV_PREFIX_EXCLUSIONS = [
     // Editors / IDEs
     'VSCODE_',
     'JETBRAINS_',
+    'ELECTRON_',
+    // AI agent harnesses (per-session ids; the bare CLAUDECODE/CLAUDE_CODE
+    // detection vars are excluded above)
+    'CLAUDE_CODE_',
+    // Shell prompts / integrations (per-command and per-session state)
+    'ATUIN_',
+    'STARSHIP_',
+    'MCFLY_',
+    'DIRENV_',
+    '__MISE_',
     // Terminal emulators
     'ITERM_',
     'KITTY_',
     'WEZTERM_',
     'ALACRITTY_',
     'KONSOLE_',
+    'GHOSTTY_',
     'TMUX',
     // Benchmarking / profiling tools
     'HYPERFINE_', // hyperfine sets HYPERFINE_RANDOMIZED_ENVIRONMENT_OFFSET for each iteration
 ];
+/**
+ * Env var name patterns that should never be sent to the daemon. For vars
+ * whose NAME embeds a process id, so neither an exact entry nor a safe
+ * prefix can match them.
+ */
+const DAEMON_ENV_PATTERN_EXCLUSIONS = [
+    // Set by Windows 11 explorer.exe as EFC_<pid> (observed as EFC_<pid>_<hash>
+    // in Electron-spawned shells); regenerated on every login
+    /^EFC_\d+(_\d+)?$/,
+];
 /**
  * Vars that match an excluded prefix but should still reach the daemon. The
  * Nx Cloud auth/access tokens are excluded by the `NX_CLOUD_` prefix, but
@@ -125,11 +207,14 @@ const DAEMON_ENV_PREFIX_EXCLUSION_OVERRIDES = new Set([
     'NX_CLOUD_AUTH_TOKEN',
 ]);
 function isExcludedEnvVar(key) {
+    if (DAEMON_ENV_VARS_EXCLUSIONS.has(key) ||
+        DAEMON_ENV_PATTERN_EXCLUSIONS.some((pattern) => pattern.test(key))) {
+        return true;
+    }
     if (DAEMON_ENV_PREFIX_EXCLUSION_OVERRIDES.has(key)) {
         return false;
     }
-    return (DAEMON_ENV_VARS_EXCLUSIONS.has(key) ||
-        DAEMON_ENV_PREFIX_EXCLUSIONS.some((prefix) => key.startsWith(prefix)));
+    return DAEMON_ENV_PREFIX_EXCLUSIONS.some((prefix) => key.startsWith(prefix));
 }
 function getDaemonEnv() {
     const env = { ...DAEMON_ENV_OVERRIDABLE_SETTINGS };
@@ -140,6 +225,29 @@ function getDaemonEnv() {
     }
     return Object.assign(env, DAEMON_ENV_REQUIRED_SETTINGS);
 }
+/**
+ * Env for spawning the daemon process. On top of the reflected env, it must
+ * keep excluded vars the daemon needs to start correctly:
+ * - ELECTRON_RUN_AS_NODE (matched by the ELECTRON_ prefix exclusion): when
+ *   the spawning client runs inside an Electron host, process.execPath is
+ *   the Electron binary and only this var makes it run the daemon's Node
+ *   entry point.
+ * - NX_WORKSPACE_ROOT_PATH: the daemon resolves its workspace root at
+ *   startup by walking up from cwd looking for workspace markers; without
+ *   the pin, a root without markers under an ancestor that has them
+ *   resolves to the ancestor and the daemon publishes its socket under the
+ *   wrong workspace.
+ */
+function getDaemonSpawnEnv() {
+    const env = getDaemonEnv();
+    if (process.env.ELECTRON_RUN_AS_NODE !== undefined) {
+        env.ELECTRON_RUN_AS_NODE = process.env.ELECTRON_RUN_AS_NODE;
+    }
+    if (process.env.NX_WORKSPACE_ROOT_PATH !== undefined) {
+        env.NX_WORKSPACE_ROOT_PATH = process.env.NX_WORKSPACE_ROOT_PATH;
+    }
+    return env;
+}
 /**
  * Without the deletion step, a var set by one client (e.g.
  * `NX_PREFER_NODE_STRIP_TYPES=true` or `JAVA_TOOL_OPTIONS=...` for a single

package/dist/src/daemon/client/daemon-socket-messenger.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DaemonSocketMessenger = exports.VersionMismatchError = void 0;
 const perf_hooks_1 = require("perf_hooks");
 const consume_messages_from_socket_1 = require("../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
 const socket_utils_1 = require("../socket-utils");
 class VersionMismatchError extends Error {
@@ -21,6 +22,9 @@ class DaemonSocketMessenger {
         if (!this.socket) {
             throw new Error('Socket not initialized.');
         }
+        // Stamp every message with the sending workspace's root so the daemon can
+        // reject messages from a different workspace (e.g. a shared NX_SOCKET_DIR).
+        messageToDaemon.workspaceRoot = workspace_root_1.workspaceRoot;
         logger_1.clientLogger.log('[Messenger] Sending message type:', messageToDaemon.type);
         perf_hooks_1.performance.mark('daemon-message-serialization-start-' + messageToDaemon.type);
         const serialized = (0, socket_utils_1.serialize)(messageToDaemon, force);

package/dist/src/daemon/message-types/daemon-message.d.ts

@@ -1,6 +1,38 @@
 export type DaemonMessage = {
     type: string;
     env?: Record<string, string>;
+    /**
+     * Stamped centrally by `DaemonSocketMessenger.sendMessage`, not by the ~30
+     * sites that construct messages — hence optional. It can also be absent on a
+     * message that predates the field, which is why `isForeignWorkspaceMessage`
+     * treats `undefined` as "not foreign".
+     */
+    workspaceRoot?: string;
     data?: any;
 };
 export declare function isDaemonMessage(msg: unknown): msg is DaemonMessage;
+/**
+ * Any message carrying the sender's workspace root. Structural so the checks
+ * below serve the daemon and the plugin worker without either importing the
+ * other's message type. `type` is required only so the type is not all-optional,
+ * which would accept `{}`.
+ */
+type WorkspaceScopedMessage = {
+    type: string;
+    workspaceRoot?: string;
+};
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Compared directly; both come from the same resolution.
+ */
+export declare function isForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string): boolean;
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+export declare function assertNotForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string, receiverDescription?: string): void;
+export {};

package/dist/src/daemon/message-types/daemon-message.js

@@ -1,6 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDaemonMessage = isDaemonMessage;
+exports.isForeignWorkspaceMessage = isForeignWorkspaceMessage;
+exports.assertNotForeignWorkspaceMessage = assertNotForeignWorkspaceMessage;
 function isDaemonMessage(msg) {
     return typeof msg === 'object' && msg && 'type' in msg;
 }
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Compared directly; both come from the same resolution.
+ */
+function isForeignWorkspaceMessage(msg, receiverWorkspaceRoot) {
+    if (msg.workspaceRoot === undefined) {
+        return false;
+    }
+    return msg.workspaceRoot !== receiverWorkspaceRoot;
+}
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+function assertNotForeignWorkspaceMessage(msg, receiverWorkspaceRoot, receiverDescription = `The Nx Daemon for '${receiverWorkspaceRoot}'`) {
+    if (isForeignWorkspaceMessage(msg, receiverWorkspaceRoot)) {
+        throw new Error(`${receiverDescription} received a message from a different workspace ('${msg.workspaceRoot}') and refused to process it. This usually means multiple workspaces are sharing a socket directory; ensure NX_SOCKET_DIR (or NX_DAEMON_SOCKET_DIR) is not set to a shared location.`);
+    }
+}

package/dist/src/daemon/server/file-watching/file-watcher-sockets.d.ts

@@ -9,4 +9,9 @@ export declare let registeredFileWatcherSockets: {
 }[];
 export declare function removeRegisteredFileWatcherSocket(socket: Socket): void;
 export declare function hasRegisteredFileWatcherSockets(): boolean;
+/**
+ * The workspace watcher has died; no further change events will ever arrive.
+ * Registered clients are passive, so without this push they wait forever.
+ */
+export declare function notifyFileWatcherSocketsOfError(error: Error): void;
 export declare function notifyFileWatcherSockets(createdFiles: string[] | null, updatedFiles: string[], deletedFiles: string[]): void;

package/dist/src/daemon/server/file-watching/file-watcher-sockets.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registeredFileWatcherSockets = void 0;
 exports.removeRegisteredFileWatcherSocket = removeRegisteredFileWatcherSocket;
 exports.hasRegisteredFileWatcherSockets = hasRegisteredFileWatcherSockets;
+exports.notifyFileWatcherSocketsOfError = notifyFileWatcherSocketsOfError;
 exports.notifyFileWatcherSockets = notifyFileWatcherSockets;
 const find_matching_projects_1 = require("../../../utils/find-matching-projects");
 const project_graph_utils_1 = require("../../../utils/project-graph-utils");
@@ -18,6 +19,21 @@ function removeRegisteredFileWatcherSocket(socket) {
 function hasRegisteredFileWatcherSockets() {
     return exports.registeredFileWatcherSockets.length > 0;
 }
+/**
+ * The workspace watcher has died; no further change events will ever arrive.
+ * Registered clients are passive, so without this push they wait forever.
+ */
+function notifyFileWatcherSocketsOfError(error) {
+    if (!hasRegisteredFileWatcherSockets()) {
+        return;
+    }
+    queue.sendToQueue(async () => {
+        await Promise.all(exports.registeredFileWatcherSockets.map(({ socket }) => (0, server_1.handleResult)(socket, 'FILE-WATCH-CHANGED', () => Promise.resolve({
+            description: 'File watch error',
+            response: JSON.stringify({ watcherError: error.message }),
+        }), 'json')));
+    });
+}
 function notifyFileWatcherSockets(createdFiles, updatedFiles, deletedFiles) {
     if (!hasRegisteredFileWatcherSockets()) {
         return;

package/dist/src/daemon/server/handle-tasks-execution-hooks.d.ts

@@ -1,8 +1,8 @@
 import type { PostTasksExecutionContext, PreTasksExecutionContext } from '../../project-graph/plugins/public-api';
 export declare function handleRunPreTasksExecution(context: PreTasksExecutionContext): Promise<{
-    error?: undefined;
     response: NodeJS.ProcessEnv[];
     description: string;
+    error?: undefined;
 } | {
     response?: undefined;
     error: any;

package/dist/src/daemon/server/latest-nx.js

@@ -2,7 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLatestNxTmpPath = getLatestNxTmpPath;
 exports.cleanupLatestNx = cleanupLatestNx;
-const devkit_internals_1 = require("../../devkit-internals");
+// Import from the defining module, not the devkit-internals barrel: the barrel
+// eagerly pulls in the task-execution subsystem and instantiates a daemon
+// client, all of which would stay resident for the daemon server's lifetime.
+const package_json_1 = require("../../utils/package-json");
 const package_manager_1 = require("../../utils/package-manager");
 const provenance_1 = require("../../utils/provenance");
 const workspace_root_1 = require("../../utils/workspace-root");
@@ -28,7 +31,7 @@ async function getLatestNxTmpPath() {
         try {
             logger_1.serverLogger.log('[LATEST-NX]: Pulling latest Nx...');
             await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
+            const result = await (0, package_json_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
             latestNxTmpPath = result.tempDir;
             cleanupFn = result.cleanup;
             logger_1.serverLogger.log('[LATEST-NX]: Successfully pulled latest Nx to', latestNxTmpPath);

package/dist/src/daemon/server/server.js

@@ -119,6 +119,17 @@ async function handleMessage(socket, data) {
         await (0, shutdown_utils_1.respondWithErrorAndExit)(socket, `Invalid payload from the client`, new Error(`Unsupported payload sent to daemon server: ${unparsedPayload}`));
     }
     logger_1.serverLogger.log(`Received ${mode} message of type ${payload.type}`);
+    // A mismatch means the client reached the wrong daemon (e.g. a shared
+    // NX_SOCKET_DIR). Respond, but stay alive for our own workspace.
+    if ((0, daemon_message_1.isDaemonMessage)(payload)) {
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(payload, workspace_root_1.workspaceRoot);
+        }
+        catch (e) {
+            await (0, shutdown_utils_1.respondWithError)(socket, `Workspace root mismatch`, e);
+            return;
+        }
+    }
     if ((0, daemon_message_1.isDaemonMessage)(payload) && payload.env) {
         const changedEnvKeys = (0, daemon_environment_1.applyDaemonEnvFromClient)(payload.env);
         if (changedEnvKeys.length > 0) {
@@ -325,6 +336,7 @@ const handleWorkspaceChanges = async (err, changeEvents) => {
             logger_1.serverLogger.watcherLog('Unexpected workspace watcher error', error.message);
             console.error(error);
             workspaceWatcherError = error;
+            (0, file_watcher_sockets_1.notifyFileWatcherSocketsOfError)(error);
             return;
         }
         logger_1.serverLogger.watcherLog((0, watcher_1.convertChangeEventsToLogMessage)(changeEvents));
@@ -334,6 +346,7 @@ const handleWorkspaceChanges = async (err, changeEvents) => {
         logger_1.serverLogger.watcherLog(`Unexpected workspace error`, err.message);
         console.error(err);
         workspaceWatcherError = err;
+        (0, file_watcher_sockets_1.notifyFileWatcherSocketsOfError)(err);
     }
 };
 const handleOutputsChanges = async (err, changeEvents) => {
@@ -360,6 +373,13 @@ const handleOutputsChanges = async (err, changeEvents) => {
     }
 };
 async function startServer() {
+    // Watch before scan: a file written during boot must be visible to the
+    // watcher or the scan below. Scan-first left a blind window where such
+    // files stayed invisible to both until an unrelated change arrived.
+    if (!(0, shutdown_utils_1.getWatcherInstance)()) {
+        (0, shutdown_utils_1.storeWatcherInstance)(await (0, watcher_1.watchWorkspace)(server, handleWorkspaceChanges));
+        logger_1.serverLogger.watcherLog(`Subscribed to changes within: ${workspace_root_1.workspaceRoot} (native)`);
+    }
     (0, workspace_context_1.setupWorkspaceContext)(workspace_root_1.workspaceRoot);
     // Initialize analytics for daemon process
     await (0, analytics_1.startAnalytics)();
@@ -416,12 +436,19 @@ async function startServer() {
             server.listen(socketPath, async () => {
                 try {
                     logger_1.serverLogger.log(`Started listening on: ${socketPath}`);
+                    // Linux gates connect() on write permission to the socket file; macOS/BSD gate
+                    // on the directory, which is already 0700. Done after listen because
+                    // net.Server.listen takes no mode and umask is process-global.
+                    if (!socket_utils_1.isWindows) {
+                        try {
+                            (0, fs_1.chmodSync)(socketPath, 0o600);
+                        }
+                        catch {
+                            // Best effort; the 0700 socket directory is the primary control.
+                        }
+                    }
                     // this triggers the storage of the lock file hash
                     daemonIsOutdated();
-                    if (!(0, shutdown_utils_1.getWatcherInstance)()) {
-                        (0, shutdown_utils_1.storeWatcherInstance)(await (0, watcher_1.watchWorkspace)(server, handleWorkspaceChanges));
-                        logger_1.serverLogger.watcherLog(`Subscribed to changes within: ${workspace_root_1.workspaceRoot} (native)`);
-                    }
                     if (!(0, shutdown_utils_1.getOutputWatcherInstance)()) {
                         (0, shutdown_utils_1.storeOutputWatcherInstance)(await (0, watcher_1.watchOutputFiles)(server, handleOutputsChanges));
                     }

package/dist/src/daemon/server/shutdown-utils.d.ts

@@ -14,5 +14,10 @@ export declare function handleServerProcessTermination({ server, reason, sockets
 export declare function handleServerProcessTerminationWithRestart({ server, reason, sockets, }: HandleServerProcessTerminationParams): Promise<void>;
 export declare function resetInactivityTimeout(cb: () => void): void;
 export declare function respondToClient(socket: Socket, response: string, description: string): Promise<unknown>;
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+export declare function respondWithError(socket: Socket, description: string, error: Error): Promise<void>;
 export declare function respondWithErrorAndExit(socket: Socket, description: string, error: Error): Promise<void>;
 export {};

package/dist/src/daemon/server/shutdown-utils.js

@@ -9,6 +9,7 @@ exports.handleServerProcessTermination = handleServerProcessTermination;
 exports.handleServerProcessTerminationWithRestart = handleServerProcessTerminationWithRestart;
 exports.resetInactivityTimeout = resetInactivityTimeout;
 exports.respondToClient = respondToClient;
+exports.respondWithError = respondWithError;
 exports.respondWithErrorAndExit = respondWithErrorAndExit;
 const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
@@ -135,9 +136,12 @@ function respondToClient(socket, response, description) {
         });
     });
 }
-async function respondWithErrorAndExit(socket, description, error) {
-    const isProjectGraphError = error instanceof error_types_1.DaemonProjectGraphError;
-    const normalizedError = isProjectGraphError
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+async function respondWithError(socket, description, error) {
+    const normalizedError = error instanceof error_types_1.DaemonProjectGraphError
         ? error_types_1.ProjectGraphError.fromDaemonProjectGraphError(error)
         : error;
     // print some extra stuff in the error message
@@ -145,8 +149,11 @@ async function respondWithErrorAndExit(socket, description, error) {
     console.error(normalizedError.stack);
     // Respond with the original error
     await respondToClient(socket, (0, socket_utils_1.serializeResult)(error, null, null), null);
+}
+async function respondWithErrorAndExit(socket, description, error) {
+    await respondWithError(socket, description, error);
     // Project Graph errors are okay. Restarting the daemon won't help with this.
-    if (!isProjectGraphError) {
+    if (!(error instanceof error_types_1.DaemonProjectGraphError)) {
         process.exit(1);
     }
 }

package/dist/src/daemon/socket-utils.d.ts

@@ -8,6 +8,7 @@ export declare const isWindows: boolean;
 export declare const getFullOsSocketPath: () => string;
 export declare const getForkedProcessOsSocketPath: (id: string) => string;
 export declare const getPluginOsSocketPath: (id: string) => string;
+export declare function getPluginSocketFileName(id: string): string;
 export declare function killSocketOrPath(): void;
 export declare function serializeResult(error: Error | null, serializedProjectGraph: string | null, serializedSourceMaps: string | null): string | null;
 /**

package/dist/src/daemon/socket-utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPluginOsSocketPath = exports.getForkedProcessOsSocketPath = exports.getFullOsSocketPath = exports.isWindows = void 0;
+exports.getPluginSocketFileName = getPluginSocketFileName;
 exports.killSocketOrPath = killSocketOrPath;
 exports.serializeResult = serializeResult;
 exports.serialize = serialize;
@@ -31,18 +32,38 @@ const getForkedProcessOsSocketPath = (id) => {
 };
 exports.getForkedProcessOsSocketPath = getForkedProcessOsSocketPath;
 const getPluginOsSocketPath = (id) => {
-    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getSocketDir)(true), 'plugin' + id + '.sock'));
+    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getPluginSocketDir)(), getPluginSocketFileName(id)));
     assertValidSocketPath(path);
     return exports.isWindows ? '\\\\.\\pipe\\nx\\' + path : path;
 };
 exports.getPluginOsSocketPath = getPluginOsSocketPath;
+function getPluginSocketFileName(id) {
+    return `p${id}.sock`;
+}
 function assertValidSocketPath(path) {
     if (path.length > 95) {
+        const fallbackCause = (0, tmp_dir_1.getSocketDirFallbackCause)();
+        const refusedConfiguredSocketDir = (0, tmp_dir_1.getRefusedConfiguredSocketDir)();
         throw new Error([
             'Attempted to open socket that exceeds the maximum socket length.',
+            ...(fallbackCause === undefined
+                ? []
+                : [
+                    `Nx fell back to ${(0, path_1.dirname)(path)} because the default socket directory could not be used.`,
+                    'Run the command with --verbose to see why the default directory was rejected.',
+                ]),
             '',
-            `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
-        ].join('\n'));
+            ...(refusedConfiguredSocketDir === undefined
+                ? [
+                    `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
+                ]
+                : [
+                    // Saying "set a shorter path" here would be advice they already
+                    // followed: they set one, and it was refused for another reason.
+                    `The directory set in NX_SOCKET_DIR (${refusedConfiguredSocketDir}) could not be used — see the warning above — so Nx fell back to a longer path.`,
+                    'Point NX_SOCKET_DIR at a short directory your user owns.',
+                ]),
+        ].join('\n'), fallbackCause === undefined ? undefined : { cause: fallbackCause });
     }
 }
 function killSocketOrPath() {

package/dist/src/daemon/tmp-dir.d.ts

@@ -1,12 +1,52 @@
+/**
+ * Why a directory was refused. Named rather than a boolean so a table entry
+ * reads as its own reason: picking the wrong one tells a user their private
+ * directory is a code-execution risk, which is the one claim here that most
+ * needs to be true.
+ */
+export type SocketDirRefusal = 'shared-with-other-users' | 'nx-managed' | 'os-temp-root';
+/**
+ * Thrown when the socket dir resolves to a directory Nx will not accept.
+ * Invalid configuration, not a recoverable failure.
+ *
+ * Three reasons, and they are not interchangeable. A directory other users can
+ * reach is a security problem; the OS temp root is the user's own but holds
+ * everything else that uses it, and Nx deletes the socket directory
+ * recursively; an Nx container or cache root is refused because Nx manages what
+ * lives there. Telling someone their own `0700` directory lets a local attacker
+ * execute code would be false, which is why the reason is derived from the
+ * directory rather than the platform.
+ */
+export declare class InvalidSocketDirConfigured extends Error {
+    readonly dir: string;
+    readonly reason: SocketDirRefusal;
+    constructor(dir: string, reason: SocketDirRefusal);
+}
 export declare const DAEMON_DIR_FOR_CURRENT_WORKSPACE: string;
 export declare const DAEMON_OUTPUT_LOG_FILE: string;
 export declare const getDaemonSocketDir: () => string;
 export declare function writeDaemonLogs(error?: string): string;
 export declare function markDaemonAsDisabled(reason: string): void;
 export declare function isDaemonDisabled(): boolean;
+export declare function getSocketDir(): string;
+/**
+ * Plugin worker sockets get their own workspace-scoped directory rather than
+ * sitting in the shared system temp dir, which cannot be locked down.
+ */
+export declare function getPluginSocketDir(): string;
+/**
+ * Exported for tests: both fallback warnings fire once per process, so a suite
+ * that stages either fallback more than once has to clear the latches between
+ * cases.
+ */
+export declare function resetSocketDirWarningsForTesting(): void;
+export declare function getSocketDirFallbackCause(): unknown;
 /**
- * We try to create a socket file in a tmp dir, but if it doesn't work because
- * for instance we don't have permissions, we create it in DAEMON_DIR_FOR_CURRENT_WORKSPACE
+ * The NX_SOCKET_DIR that was refused, if that is why we are in the fallback.
+ * Reflects the most recent resolution only — both accessors are cleared at the
+ * top of every `createOwnerOnlySocketDir` call, and the daemon and plugin socket
+ * paths each drive one. Read it immediately after the call that produced the
+ * path, which is what `assertValidSocketPath` does.
  */
-export declare function getSocketDir(alreadyUnique?: boolean): string;
+export declare function getRefusedConfiguredSocketDir(): string | undefined;
 export declare function removeSocketDir(): void;