nx 23.1.0 → 23.1.2

package/dist/src/plugins/js/project-graph/build-dependencies/target-project-locator.js

@@ -8,6 +8,7 @@ const semver_1 = require("semver");
 const find_project_for_path_1 = require("../../../../project-graph/utils/find-project-for-path");
 const fileutils_1 = require("../../../../utils/fileutils");
 const get_package_name_from_import_path_1 = require("../../../../utils/get-package-name-from-import-path");
+const path_1 = require("../../../../utils/path");
 const workspace_root_1 = require("../../../../utils/workspace-root");
 const packages_1 = require("../../utils/packages");
 const resolve_relative_to_dir_1 = require("../../utils/resolve-relative-to-dir");
@@ -161,11 +162,19 @@ class TargetProjectLocator {
                 return externalNodeName;
             }
             const version = (0, semver_1.clean)(externalPackageJson.version);
-            let matchingExternalNode = this.npmProjects[`npm:${externalPackageJson.name}@${version}`];
-            if (!matchingExternalNode) {
-                // check if it's a package alias, where the resolved package key is used as the version
+            const isAliasImport = packageName !== externalPackageJson.name;
+            let matchingExternalNode = null;
+            if (isAliasImport) {
+                // Prefer the alias node when both the alias import and the resolved package
+                // exist in the graph, otherwise generated package.json files lose the alias key.
                 const aliasNpmProjectKey = `npm:${packageName}@npm:${externalPackageJson.name}@${version}`;
-                matchingExternalNode = this.npmProjects[aliasNpmProjectKey];
+                matchingExternalNode =
+                    this.npmProjects[aliasNpmProjectKey] ??
+                        this.npmProjects[`npm:${packageName}`];
+            }
+            if (!matchingExternalNode) {
+                matchingExternalNode =
+                    this.npmProjects[`npm:${externalPackageJson.name}@${version}`];
             }
             if (!matchingExternalNode) {
                 // Fallback to package name as key. This can happen if the version in project graph is not the same as in the resolved package.json.
@@ -338,6 +347,7 @@ class TargetProjectLocator {
         }));
     }
     findProjectOfResolvedModule(resolvedModule) {
+        resolvedModule = (0, path_1.normalizePath)(resolvedModule);
         if (resolvedModule.startsWith('node_modules/') ||
             resolvedModule.includes('/node_modules/')) {
             return undefined;

package/dist/src/plugins/js/utils/register.d.ts

@@ -96,6 +96,24 @@ export declare function ensureNodeNextEsmResolverRegistered(): void;
  * unaffected when both files exist. Idempotent on repeat calls.
  */
 export declare function ensureCjsResolverPatched(): void;
+/**
+ * Make Node's module resolver honor the given export conditions for the rest of
+ * the process, via `module.registerHooks()`. Used when a local plugin is loaded
+ * from source in-process (no child process to pass `--conditions` to at spawn):
+ * the hook appends the conditions to every resolution so the plugin's transitive
+ * workspace imports resolve to source the same way the plugin entry did.
+ *
+ * No-op when:
+ *   - `conditions` is empty (nothing to inject);
+ *   - every target condition is already active at startup (a spawned plugin
+ *     worker or daemon was launched with the full `--conditions` set, so Node's
+ *     resolver already honors them and the per-resolve hook would be redundant);
+ *   - `module.registerHooks` is unavailable (Node < 22.15 / < 23.5). Those
+ *     runtimes keep the `NODE_OPTIONS=--conditions` escape hatch.
+ *
+ * Idempotent and best-effort.
+ */
+export declare function ensureResolveConditionsInjected(conditions: string[]): void;
 /**
  * Whether Nx will defer to Node's native TypeScript stripping for the next
  * `.ts` load. Mirrors the gate used by `loadTsFile`/`registerTsProject` so

package/dist/src/plugins/js/utils/register.js

@@ -5,6 +5,7 @@ exports.forceRegisterEsmLoader = forceRegisterEsmLoader;
 exports.nodeNextEsmResolveHook = nodeNextEsmResolveHook;
 exports.ensureNodeNextEsmResolverRegistered = ensureNodeNextEsmResolverRegistered;
 exports.ensureCjsResolverPatched = ensureCjsResolverPatched;
+exports.ensureResolveConditionsInjected = ensureResolveConditionsInjected;
 exports.isNativeStripPreferred = isNativeStripPreferred;
 exports.registerTsProject = registerTsProject;
 exports.getSwcTranspiler = getSwcTranspiler;
@@ -388,6 +389,86 @@ const isInvokedByTsx = (() => {
     return (requireArgs.some((a) => isTsxPath(a)) ||
         importArgs.some((a) => isTsxPath(a)));
 })();
+let resolveConditionsInjected = false;
+/**
+ * Make Node's module resolver honor the given export conditions for the rest of
+ * the process, via `module.registerHooks()`. Used when a local plugin is loaded
+ * from source in-process (no child process to pass `--conditions` to at spawn):
+ * the hook appends the conditions to every resolution so the plugin's transitive
+ * workspace imports resolve to source the same way the plugin entry did.
+ *
+ * No-op when:
+ *   - `conditions` is empty (nothing to inject);
+ *   - every target condition is already active at startup (a spawned plugin
+ *     worker or daemon was launched with the full `--conditions` set, so Node's
+ *     resolver already honors them and the per-resolve hook would be redundant);
+ *   - `module.registerHooks` is unavailable (Node < 22.15 / < 23.5). Those
+ *     runtimes keep the `NODE_OPTIONS=--conditions` escape hatch.
+ *
+ * Idempotent and best-effort.
+ */
+function ensureResolveConditionsInjected(conditions) {
+    if (resolveConditionsInjected)
+        return;
+    resolveConditionsInjected = true;
+    if (!conditions.length)
+        return;
+    // Skip only when Node already honors every target condition (e.g. a worker or
+    // daemon spawned with the full `--conditions` set); a partial overlap still
+    // needs the hook to add the missing ones.
+    const activeConditions = getConditionsActiveAtStartup();
+    if (conditions.every((condition) => activeConditions.has(condition)))
+        return;
+    const module = require('node:module');
+    const registerHooks = module.registerHooks;
+    if (typeof registerHooks !== 'function')
+        return;
+    try {
+        registerHooks.call(module, {
+            resolve(specifier, context, nextResolve) {
+                const merged = context.conditions
+                    ? [...context.conditions, ...conditions]
+                    : conditions;
+                return nextResolve(specifier, { ...context, conditions: merged });
+            },
+        });
+    }
+    catch {
+        // Best-effort: leave Node's native resolution in place rather than failing.
+    }
+}
+/**
+ * Export conditions this process was started with, parsed from `--conditions`
+ * (or its `-C` alias) in `process.execArgv` and `NODE_OPTIONS`. Node's resolver
+ * already honors these, so the injected hook only needs to cover target
+ * conditions not present here.
+ */
+function getConditionsActiveAtStartup() {
+    const active = new Set();
+    const collect = (tokens) => {
+        for (let i = 0; i < tokens.length; i++) {
+            const token = tokens[i];
+            if (token === '--conditions' || token === '-C') {
+                const value = tokens[i + 1];
+                if (value) {
+                    active.add(value);
+                    i++;
+                }
+            }
+            else if (token.startsWith('--conditions=')) {
+                active.add(token.slice('--conditions='.length));
+            }
+            else if (token.startsWith('-C=')) {
+                active.add(token.slice('-C='.length));
+            }
+        }
+    };
+    collect(process.execArgv ?? []);
+    const nodeOptions = process.env.NODE_OPTIONS;
+    if (nodeOptions)
+        collect(nodeOptions.split(/\s+/).filter(Boolean));
+    return active;
+}
 /**
  * Whether the current Node.js runtime exposes native TypeScript type
  * stripping. This is the authoritative gate - it correctly handles every

package/dist/src/plugins/js/utils/typescript.d.ts

@@ -20,4 +20,13 @@ export declare function getRootTsConfigCustomConditions(root?: string): string[]
  * `migrate-development-custom-condition` (21.5).
  */
 export declare function getRootTsConfigResolveExportsConditions(root?: string): string[];
+/**
+ * Node `--conditions <name>` CLI args for spawning a plugin worker or the daemon
+ * with the plugin-resolution conditions active at startup. Mirrors the set Nx
+ * uses to resolve the plugin entry (`getRootTsConfigResolveExportsConditions`)
+ * so the entry and the plugin's transitive workspace imports resolve the same
+ * way; Node's own resolver otherwise ignores TypeScript `customConditions` and a
+ * source-loaded plugin's imports land on their unbuilt `dist`.
+ */
+export declare function getPluginResolveConditionNodeArgs(root?: string): string[];
 export declare function findNodes(node: Node, kind: SyntaxKind | SyntaxKind[], max?: number): Node[];

package/dist/src/plugins/js/utils/typescript.js

@@ -8,6 +8,7 @@ exports.getRootTsConfigFileName = getRootTsConfigFileName;
 exports.getRootTsConfigPath = getRootTsConfigPath;
 exports.getRootTsConfigCustomConditions = getRootTsConfigCustomConditions;
 exports.getRootTsConfigResolveExportsConditions = getRootTsConfigResolveExportsConditions;
+exports.getPluginResolveConditionNodeArgs = getPluginResolveConditionNodeArgs;
 exports.findNodes = findNodes;
 const workspace_root_1 = require("../../../utils/workspace-root");
 const fs_1 = require("fs");
@@ -113,6 +114,20 @@ function getRootTsConfigResolveExportsConditions(root = workspace_root_1.workspa
         ? conditions
         : [...conditions, 'development'];
 }
+/**
+ * Node `--conditions <name>` CLI args for spawning a plugin worker or the daemon
+ * with the plugin-resolution conditions active at startup. Mirrors the set Nx
+ * uses to resolve the plugin entry (`getRootTsConfigResolveExportsConditions`)
+ * so the entry and the plugin's transitive workspace imports resolve the same
+ * way; Node's own resolver otherwise ignores TypeScript `customConditions` and a
+ * source-loaded plugin's imports land on their unbuilt `dist`.
+ */
+function getPluginResolveConditionNodeArgs(root = workspace_root_1.workspaceRoot) {
+    return getRootTsConfigResolveExportsConditions(root).flatMap((c) => [
+        '--conditions',
+        c,
+    ]);
+}
 function findNodes(node, kind, max = Infinity) {
     if (!node || max == 0) {
         return [];

package/dist/src/project-graph/affected/affected-project-graph-models.d.ts

@@ -7,5 +7,5 @@ export interface AffectedProjectGraphContext {
     touchedProjects: string[];
 }
 export interface TouchedProjectLocator<T extends Change = Change> {
-    (fileChanges: FileChange<T>[], projectGraphNodes?: Record<string, ProjectGraphProjectNode>, nxJson?: NxJsonConfiguration<any>, packageJson?: any, projectGraph?: ProjectGraph): string[] | Promise<string[]>;
+    (fileChanges: FileChange<T>[], projectGraphNodes?: Record<string, ProjectGraphProjectNode>, nxJson?: NxJsonConfiguration<any>, packageJson?: any, projectGraph?: ProjectGraph, projectDeletionAffectsAllProjects?: boolean): string[] | Promise<string[]>;
 }

package/dist/src/project-graph/affected/affected-project-graph.d.ts

@@ -1,4 +1,4 @@
 import { FileChange } from '../file-utils';
 import { NxJsonConfiguration } from '../../config/nx-json';
 import { ProjectGraph } from '../../config/project-graph';
-export declare function filterAffected(graph: ProjectGraph, touchedFiles: FileChange[], nxJson?: NxJsonConfiguration, packageJson?: any): Promise<ProjectGraph>;
+export declare function filterAffected(graph: ProjectGraph, touchedFiles: FileChange[], nxJson?: NxJsonConfiguration, packageJson?: any, projectDeletionAffectsAllProjects?: boolean): Promise<ProjectGraph>;

package/dist/src/project-graph/affected/affected-project-graph.js

@@ -7,7 +7,7 @@ const touched_projects_1 = require("../../plugins/js/project-graph/affected/touc
 const operators_1 = require("../operators");
 const configuration_1 = require("../../config/configuration");
 const project_glob_changes_1 = require("./locators/project-glob-changes");
-async function filterAffected(graph, touchedFiles, nxJson = (0, configuration_1.readNxJson)(), packageJson = (0, file_utils_1.readPackageJson)()) {
+async function filterAffected(graph, touchedFiles, nxJson = (0, configuration_1.readNxJson)(), packageJson = (0, file_utils_1.readPackageJson)(), projectDeletionAffectsAllProjects = true) {
     // Additional affected logic should be in this array.
     const touchedProjectLocators = [
         workspace_projects_1.getTouchedProjects,
@@ -18,7 +18,7 @@ async function filterAffected(graph, touchedFiles, nxJson = (0, configuration_1.
     const touchedProjects = [];
     for (const locator of touchedProjectLocators) {
         performance.mark(locator.name + ':start');
-        const projects = await locator(touchedFiles, graph.nodes, nxJson, packageJson, graph);
+        const projects = await locator(touchedFiles, graph.nodes, nxJson, packageJson, graph, projectDeletionAffectsAllProjects);
         performance.mark(locator.name + ':end');
         performance.measure(locator.name, locator.name + ':start', locator.name + ':end');
         touchedProjects.push(...projects);

package/dist/src/project-graph/affected/locators/project-glob-changes.js

@@ -9,7 +9,7 @@ const fs_1 = require("fs");
 const retrieve_workspace_files_1 = require("../../utils/retrieve-workspace-files");
 const globs_1 = require("../../../utils/globs");
 const get_plugins_1 = require("../../plugins/get-plugins");
-const getTouchedProjectsFromProjectGlobChanges = async (touchedFiles, projectGraphNodes) => {
+const getTouchedProjectsFromProjectGlobChanges = async (touchedFiles, projectGraphNodes, _nxJson, _packageJson, _projectGraph, projectDeletionAffectsAllProjects = true) => {
     const globPattern = await (async () => {
         // TODO: We need a quicker way to get patterns that should not
         // require starting up plugin workers
@@ -33,7 +33,10 @@ const getTouchedProjectsFromProjectGlobChanges = async (touchedFiles, projectGra
             // If the file no longer exists on disk, then it was deleted
             if (!(0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, touchedFile.file))) {
                 // If any project has been deleted, we must assume all projects were affected
-                return Object.keys(projectGraphNodes);
+                if (projectDeletionAffectsAllProjects) {
+                    return Object.keys(projectGraphNodes);
+                }
+                continue;
             }
             // Modified project config files are under a project's root, and implicitly
             // mark it as affected. Thus, we don't need to handle it here.

package/dist/src/project-graph/build-project-graph.js

@@ -7,6 +7,7 @@ exports.applyProjectMetadata = applyProjectMetadata;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const perf_hooks_1 = require("perf_hooks");
+const analytics_1 = require("../analytics");
 const configuration_1 = require("../config/configuration");
 const file_hasher_1 = require("../hasher/file-hasher");
 const typescript_1 = require("../plugins/js/utils/typescript");
@@ -222,7 +223,12 @@ async function updateProjectGraphWithPlugins(context, initProjectGraph, plugins,
         perf_hooks_1.performance.measure(`${plugin.name}:createDependencies`, {
             start: `${plugin.name}:createDependencies - start`,
             end: `${plugin.name}:createDependencies - end`,
-            detail: { track: true },
+            detail: {
+                track: true,
+                ...(analytics_1.customDimensions && {
+                    [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
+                }),
+            },
         });
     }));
     perf_hooks_1.performance.mark('createDependencies:end');

package/dist/src/project-graph/error-types.d.ts

@@ -3,6 +3,7 @@ import { ProjectConfiguration } from '../config/workspace-json-project-json';
 import { CreateNodesFunction } from './plugins/public-api';
 import { ConfigurationResult } from './utils/project-configuration-utils';
 import type { ConfigurationSourceMaps } from './utils/project-configuration/source-maps';
+import type { WorktreeConflictAdvice } from '../utils/git-worktrees';
 export type ProjectGraphErrorTypes = AggregateCreateNodesError | MergeNodesError | CreateMetadataError | ProjectsWithNoNameError | MultipleProjectsWithSameNameError | ProcessDependenciesError | WorkspaceValidityError;
 export declare class StaleProjectGraphCacheError extends Error {
     constructor();
@@ -29,7 +30,17 @@ export declare class ProjectGraphError extends Error {
 export declare class MultipleProjectsWithSameNameError extends Error {
     conflicts: Map<string, string[]>;
     projects: Record<string, ProjectConfiguration>;
-    constructor(conflicts: Map<string, string[]>, projects: Record<string, ProjectConfiguration>);
+    /**
+     * Set when some of the duplicates come from git worktrees nested in the
+     * workspace, which is a different fix than renaming them.
+     */
+    worktreeAdvice?: WorktreeConflictAdvice;
+    constructor(conflicts: Map<string, string[]>, projects: Record<string, ProjectConfiguration>, 
+    /**
+     * Set when some of the duplicates come from git worktrees nested in the
+     * workspace, which is a different fix than renaming them.
+     */
+    worktreeAdvice?: WorktreeConflictAdvice);
 }
 export declare class ProjectWithExistingNameError extends Error {
     projectName: string;

package/dist/src/project-graph/error-types.js

@@ -92,19 +92,44 @@ class ProjectGraphError extends Error {
 exports.ProjectGraphError = ProjectGraphError;
 _ProjectGraphError_partialProjectGraph = new WeakMap(), _ProjectGraphError_partialSourceMaps = new WeakMap();
 class MultipleProjectsWithSameNameError extends Error {
-    constructor(conflicts, projects) {
+    constructor(conflicts, projects, 
+    /**
+     * Set when some of the duplicates come from git worktrees nested in the
+     * workspace, which is a different fix than renaming them.
+     */
+    worktreeAdvice) {
         super([
             `The following projects are defined in multiple locations:`,
             ...Array.from(conflicts.entries()).map(([project, roots]) => [`- ${project}: `, ...roots.map((r) => `  - ${r}`)].join('\n')),
             '',
-            "To fix this, set a unique name for each project in a project.json inside the project's root. If the project does not currently have a project.json, you can create one that contains only a name.",
+            ...(worktreeAdvice?.ignoreTargets.length
+                ? [
+                    'Some of these are inside git worktrees nested in this workspace. A worktree is a full checkout, so every project in it collides with the one it was checked out from.',
+                    '',
+                    // Which `.gitignore` matters: a leading slash anchors to the
+                    // directory holding the file, and these paths are relative to
+                    // the workspace, which is not always the repository root.
+                    'To fix those, add the following to the .gitignore in the workspace root:',
+                    ...worktreeAdvice.ignoreTargets.map((target) => `  ${target}`),
+                    // Ignoring the worktrees settles only the duplicates they
+                    // explain; anything left is an ordinary name collision and still
+                    // needs the ordinary answer.
+                    ...(worktreeAdvice.explainsAllConflicts
+                        ? []
+                        : ['', `The rest are not from worktrees. ${RENAME_ADVICE}`]),
+                ]
+                : [
+                    `To fix this, ${RENAME_ADVICE[0].toLowerCase()}${RENAME_ADVICE.slice(1)}`,
+                ]),
         ].join('\n'));
         this.conflicts = conflicts;
         this.projects = projects;
+        this.worktreeAdvice = worktreeAdvice;
         this.name = this.constructor.name;
     }
 }
 exports.MultipleProjectsWithSameNameError = MultipleProjectsWithSameNameError;
+const RENAME_ADVICE = "Set a unique name for each project in a project.json inside the project's root. If the project does not currently have a project.json, you can create one that contains only a name.";
 class ProjectWithExistingNameError extends Error {
     constructor(projectName, projectRoot) {
         super(`The project "${projectName}" is defined in multiple locations.`);
@@ -242,9 +267,48 @@ class AggregateCreateNodesError extends Error {
                 errorTuple.length === 2)) {
             throw new Error('AggregateCreateNodesError must be constructed with an array of tuples where the first element is a filename or undefined and the second element is the underlying error.');
         }
+        // Plugins pass through whatever value they caught, which is not
+        // guaranteed to be an Error. Coerce so formatting can rely on
+        // message and stack being present.
+        for (const errorTuple of errors) {
+            errorTuple[1] = coerceToError(errorTuple[1]);
+        }
     }
 }
 exports.AggregateCreateNodesError = AggregateCreateNodesError;
+function coerceToError(value) {
+    if (value instanceof Error) {
+        return value;
+    }
+    let message;
+    let stack;
+    if (typeof value === 'object' && value !== null) {
+        const candidate = value;
+        if (typeof candidate.message === 'string') {
+            message = candidate.message;
+            if (typeof candidate.stack === 'string') {
+                stack = candidate.stack;
+            }
+        }
+        else {
+            try {
+                message = JSON.stringify(value);
+            }
+            catch {
+                // Circular structures cannot be stringified.
+                message = String(value);
+            }
+        }
+    }
+    else {
+        message = String(value);
+    }
+    const error = new Error(message);
+    // A synthesized stack would point at this coercion site rather than
+    // the original failure, so prefer the original stack or just the message.
+    error.stack = stack ?? message;
+    return error;
+}
 function formatAggregateCreateNodesError(error, pluginName) {
     const errorCount = error.errors.length > 1 ? `${error.errors.length} errors` : 'An error';
     const pluginLocation = error.pluginIndex
@@ -270,7 +334,8 @@ function formatAggregateCreateNodesError(error, pluginName) {
         }
         for (const e of errors) {
             const messageLines = e.message.split('\n');
-            const stackLines = e.stack.split('\n');
+            // Errors deserialized from a plugin worker may arrive without a stack.
+            const stackLines = (e.stack ?? e.message).split('\n');
             if (file) {
                 errorBodyLines.push(...messageLines.map((line) => `      ${line}`));
                 errorStackLines.push(...stackLines.map((line) => `     ${line}`));

package/dist/src/project-graph/file-utils.js

@@ -12,6 +12,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const fileutils_1 = require("../utils/fileutils");
+const git_revision_1 = require("../utils/git-revision");
 const ignore_1 = require("../utils/ignore");
 const json_diff_1 = require("../utils/json-diff");
 const workspace_root_1 = require("../utils/workspace-root");
@@ -116,11 +117,14 @@ function readLockFileAtRevision(file, lockFileName, revision, readFileAtRevision
 }
 exports.TEN_MEGABYTES = 1024 * 10000;
 function defaultReadFileAtRevision(file, revision) {
+    if (revision) {
+        (0, git_revision_1.assertValidGitRevision)(revision);
+    }
     try {
         const filePathInGitRepository = getFilePathInGitRepository(file);
         return !revision
             ? (0, fs_1.readFileSync)(file, 'utf-8')
-            : (0, child_process_1.execSync)(`git show ${revision}:${filePathInGitRepository}`, {
+            : (0, child_process_1.execFileSync)('git', ['show', `${revision}:${filePathInGitRepository}`], {
                 maxBuffer: exports.TEN_MEGABYTES,
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,
@@ -140,6 +144,7 @@ function defaultReadBunLockFileAtRevision(file, revision) {
             windowsHide: true,
         }).trim();
     }
+    (0, git_revision_1.assertValidGitRevision)(revision);
     const filePathInGitRepository = getFilePathInGitRepository(file);
     const tempDirectory = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'nx-bun-lock-'));
     const tempLockfilePath = (0, path_1.join)(tempDirectory, 'bun.lockb');

package/dist/src/project-graph/plugins/isolation/isolated-plugin.d.ts

@@ -60,3 +60,4 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     shutdown(): void;
     private registerProcessMetrics;
 }
+export declare function getPluginWorkerSocketId(): string;

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -1,16 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IsolatedPlugin = void 0;
+exports.getPluginWorkerSocketId = getPluginWorkerSocketId;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const net_1 = require("net");
 const path = require("path");
 const logger_1 = require("../../../daemon/logger");
 const socket_utils_1 = require("../../../daemon/socket-utils");
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
+const typescript_1 = require("../../../plugins/js/utils/typescript");
 const installation_directory_1 = require("../../../utils/installation-directory");
 const logger_2 = require("../../../utils/logger");
 const progress_topics_1 = require("../../../utils/progress-topics");
 const wait_for_socket_connection_1 = require("../../../utils/wait-for-socket-connection");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const resolve_plugin_1 = require("../resolve-plugin");
 const messaging_1 = require("./messaging");
 const plugin_lifecycle_manager_1 = require("./plugin-lifecycle-manager");
@@ -335,6 +339,10 @@ class IsolatedPlugin {
 exports.IsolatedPlugin = IsolatedPlugin;
 // --- Worker Spawning Utilities ---
 global.nxPluginWorkerCount ??= 0;
+function getPluginWorkerSocketId() {
+    const counter = global.nxPluginWorkerCount++;
+    return `${process.pid}-${counter.toString(36)}-${(0, crypto_1.randomBytes)(4).toString('hex')}`;
+}
 async function startPluginWorker(name) {
     performance.mark(`start-plugin-worker:${name}`);
     const isWorkerTypescript = path.extname(__filename) === '.ts';
@@ -351,12 +359,25 @@ async function startPluginWorker(name) {
             }
             : {}),
     };
-    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)([process.pid, global.nxPluginWorkerCount++, performance.now()].join('-'));
+    // Keep the host pid readable for diagnostics, the counter collision-free
+    // within this process, and entropy for a reused pid across process runs. The
+    // suffix is a base36 counter plus four random bytes: eleven characters after
+    // the pid until the counter passes 36, and fixed-length where the
+    // `performance.now()` stamp it replaced varied with process uptime. That
+    // keeps the socket path inside the 95-character budget `assertValidSocketPath`
+    // enforces.
+    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)(getPluginWorkerSocketId());
     const worker = (0, child_process_1.spawn)(process.execPath, [
+        // Spawn the worker with the same resolve conditions Nx uses for plugin
+        // entries so the plugin's transitive workspace imports resolve to source.
+        ...(0, typescript_1.getPluginResolveConditionNodeArgs)(),
         ...(isWorkerTypescript ? ['--require', 'ts-node/register'] : []),
         workerPath,
         ipcPath,
         name,
+        // The host's root. The worker validates against this rather than re-resolving,
+        // so the two agree by construction.
+        workspace_root_1.workspaceRoot,
     ], {
         stdio: ['ignore', 'pipe', 'pipe'],
         env,

package/dist/src/project-graph/plugins/isolation/messaging.d.ts

@@ -107,10 +107,23 @@ type PluginMessageDefs = DefineMessages<{
         };
     };
 }>;
+/**
+ * The sender's workspace root. Only the *worker* asserts on it, for host→worker
+ * messages; results and notifications carry the field but the host does not
+ * check it. The daemon channel is checked in the same one direction — the
+ * server validates inbound client messages and the client does not validate
+ * responses — so the two are alike rather than one being weaker.
+ * Optional and stamped centrally in `sendMessageOverSocket`, so the many
+ * message constructors need not set it; undefined is treated as not foreign,
+ * which is why this detects a shared socket directory rather than an attacker.
+ */
+export type WorkspaceStampedMessage = {
+    workspaceRoot?: string;
+};
 /** Union of all plugin worker message types */
-export type PluginWorkerMessage = AllMessages<PluginMessageDefs>;
+export type PluginWorkerMessage = AllMessages<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Union of all plugin worker result types */
-export type PluginWorkerResult = AllResults<PluginMessageDefs>;
+export type PluginWorkerResult = AllResults<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Result type for the load message */
 export type PluginWorkerLoadResult = ResultOf<PluginMessageDefs, 'load'>;
 /**
@@ -122,7 +135,7 @@ export type PluginWorkerEmitLogNotification = {
     type: 'emitLog';
     level: 'log' | 'warn' | 'error';
     message: string;
-};
+} & WorkspaceStampedMessage;
 export type PluginWorkerNotification = PluginWorkerEmitLogNotification;
 export declare function isPluginWorkerNotification(message: Serializable): message is PluginWorkerNotification;
 export declare function isPluginWorkerMessage(message: Serializable): message is PluginWorkerMessage;

package/dist/src/project-graph/plugins/isolation/messaging.js

@@ -7,6 +7,7 @@ exports.consumeMessage = consumeMessage;
 exports.sendMessageOverSocket = sendMessageOverSocket;
 const socket_utils_1 = require("../../../daemon/socket-utils");
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const NOTIFICATION_TYPES = [
     'emitLog',
 ];
@@ -81,6 +82,8 @@ async function consumeMessage(socket, raw, handlers) {
  * Sends a message over the socket with proper formatting.
  */
 function sendMessageOverSocket(socket, message) {
+    // Stamped here rather than in each constructor, mirroring the daemon.
+    message.workspaceRoot = workspace_root_1.workspaceRoot;
     socket.write((0, socket_utils_1.serialize)(message));
     socket.write(consume_messages_from_socket_1.MESSAGE_END_SEQ);
 }