nx 23.1.0 → 23.1.2

package/dist/src/utils/fileutils.js

@@ -41,8 +41,13 @@ function readJsonFile(path, options) {
  */
 function readYamlFile(path, options) {
     const content = (0, node_fs_1.readFileSync)(path, 'utf-8');
-    const { load } = require('@zkochan/js-yaml');
-    return load(content, { ...options, filename: path });
+    const { load, FAILSAFE_SCHEMA } = require('@zkochan/js-yaml');
+    const { failsafe, ...loadOptions } = options ?? {};
+    return load(content, {
+        ...loadOptions,
+        ...(failsafe ? { schema: FAILSAFE_SCHEMA } : {}),
+        filename: path,
+    });
 }
 /**
  * Serializes the given data to JSON and writes it to a file.

package/dist/src/utils/git-revision.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+export declare function assertValidGitRevision(revision: string): void;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+export declare function assertValidGitSha(sha: string): void;

package/dist/src/utils/git-revision.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidGitRevision = assertValidGitRevision;
+exports.assertValidGitSha = assertValidGitSha;
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+function assertValidGitRevision(revision) {
+    if (revision.startsWith('-')) {
+        throw new Error(`Invalid git revision: "${revision}". Git revisions cannot start with "-".`);
+    }
+}
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/i;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+function assertValidGitSha(sha) {
+    if (!COMMIT_SHA.test(sha)) {
+        throw new Error(`Invalid git commit sha: "${sha}". Expected a hexadecimal commit sha.`);
+    }
+}

package/dist/src/utils/git-utils.d.ts

@@ -28,9 +28,7 @@ export declare class GitRepository {
     hasFilterRepoInstalled(): Promise<boolean>;
     filterRepo(source: string, destination: string): Promise<void>;
     filterBranch(source: string, destination: string, branchName: string): Promise<void>;
-    private execAsync;
-    private quotePath;
-    private quoteArg;
+    private execGit;
 }
 export interface VcsRemoteInfo {
     domain: string;
@@ -38,6 +36,21 @@ export interface VcsRemoteInfo {
 }
 export declare function parseVcsRemoteUrl(url: string): VcsRemoteInfo | null;
 export declare function getVcsRemoteInfo(directory?: string): VcsRemoteInfo | null;
+export declare function getGitRootPath(cwd?: string): string;
+/**
+ * Path of `directory` relative to its git root, posix-separated so it is
+ * identical on every OS, and '' when the directory is the git root itself.
+ * Null outside a git repository.
+ */
+export declare function getGitRootRelativePath(directory: string): string | null;
+/** A shallow clone's truncated history has no stable root commit. */
+export declare function isShallowRepository(directory?: string): boolean;
+/**
+ * SHA of the repository's first commit. Merged unrelated histories leave
+ * several root commits — the sorted-first one is picked so every clone
+ * agrees. Null when there are no commits, or outside a git repository.
+ */
+export declare function getFirstCommitSha(directory?: string): string | null;
 export declare function isGitRepository(directory?: string): boolean;
 export declare function hasUncommittedChanges(directory?: string): boolean;
 export declare function getUncommittedChangesSnapshot(directory?: string): string;

package/dist/src/utils/git-utils.js

@@ -4,6 +4,10 @@ exports.GitRepository = void 0;
 exports.cloneFromUpstream = cloneFromUpstream;
 exports.parseVcsRemoteUrl = parseVcsRemoteUrl;
 exports.getVcsRemoteInfo = getVcsRemoteInfo;
+exports.getGitRootPath = getGitRootPath;
+exports.getGitRootRelativePath = getGitRootRelativePath;
+exports.isShallowRepository = isShallowRepository;
+exports.getFirstCommitSha = getFirstCommitSha;
 exports.isGitRepository = isGitRepository;
 exports.hasUncommittedChanges = hasUncommittedChanges;
 exports.getUncommittedChangesSnapshot = getUncommittedChangesSnapshot;
@@ -16,9 +20,9 @@ const crypto = tslib_1.__importStar(require("crypto"));
 const fs = tslib_1.__importStar(require("fs"));
 const path_1 = require("path");
 const logger_1 = require("./logger");
-function execAsync(command, execOptions) {
+function execFileAsync(file, args, execOptions) {
     return new Promise((res, rej) => {
-        (0, child_process_1.exec)(command, { ...execOptions, windowsHide: true }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => {
             if (err) {
                 return rej(err);
             }
@@ -29,7 +33,14 @@ function execAsync(command, execOptions) {
 async function cloneFromUpstream(url, destination, { originName, depth } = {
     originName: 'origin',
 }) {
-    await execAsync(`git clone ${url} ${destination} ${depth ? `--depth ${depth}` : ''} --origin ${originName}`, {
+    await execFileAsync('git', [
+        'clone',
+        url,
+        destination,
+        ...(depth ? ['--depth', `${depth}`] : []),
+        '--origin',
+        originName,
+    ], {
         cwd: (0, path_1.dirname)(destination),
         maxBuffer: 10 * 1024 * 1024,
     });
@@ -41,25 +52,25 @@ class GitRepository {
         this.root = this.getGitRootPath(this.directory);
     }
     getGitRootPath(cwd) {
-        return (0, child_process_1.execSync)('git rev-parse --show-toplevel', {
-            cwd,
-            windowsHide: true,
-        })
-            .toString()
-            .trim();
+        return getGitRootPath(cwd);
     }
     async hasUncommittedChanges() {
-        const data = await this.execAsync(`git status --porcelain`);
+        const data = await this.execGit(['status', '--porcelain']);
         return data.trim() !== '';
     }
     async addFetchRemote(remoteName, branch) {
-        return await this.execAsync(`git config --add remote.${remoteName}.fetch "+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}"`);
+        return await this.execGit([
+            'config',
+            '--add',
+            `remote.${remoteName}.fetch`,
+            `+refs/heads/${branch}:refs/remotes/${remoteName}/${branch}`,
+        ]);
     }
     async showStat() {
-        return await this.execAsync(`git show --stat`);
+        return await this.execGit(['show', '--stat']);
     }
     async listBranches() {
-        return (await this.execAsync(`git ls-remote --heads --quiet`))
+        return (await this.execGit(['ls-remote', '--heads', '--quiet']))
             .trim()
             .split('\n')
             .map((s) => s
@@ -70,45 +81,58 @@ class GitRepository {
     async getGitFiles(path) {
         // Use -z to return file names exactly as they are stored in git, separated by NULL (\x00) character.
         // This avoids problems with special characters in file names.
-        return (await this.execAsync(`git ls-files -z ${path}`))
+        return (await this.execGit(['ls-files', '-z', '--', path]))
             .trim()
             .split('\x00')
             .map((s) => s.trim())
             .filter(Boolean);
     }
     async reset(ref) {
-        return await this.execAsync(`git reset ${ref} --hard`);
+        return await this.execGit(['reset', '--hard', ref]);
     }
     async mergeUnrelatedHistories(ref, message) {
-        return await this.execAsync(`git merge ${ref} -X ours --allow-unrelated-histories -m "${message}"`);
+        return await this.execGit([
+            'merge',
+            ref,
+            '-X',
+            'ours',
+            '--allow-unrelated-histories',
+            '-m',
+            message,
+        ]);
     }
     async fetch(remote, ref) {
-        return await this.execAsync(`git fetch ${remote}${ref ? ` ${ref}` : ''}`);
+        return await this.execGit(['fetch', remote, ...(ref ? [ref] : [])]);
     }
     async checkout(branch, opts) {
-        return await this.execAsync(`git checkout ${opts.new ? '-b ' : ' '}${branch}${opts.base ? ' ' + opts.base : ''}`);
+        return await this.execGit([
+            'checkout',
+            ...(opts.new ? ['-b'] : []),
+            branch,
+            ...(opts.base ? [opts.base] : []),
+        ]);
     }
     async move(path, destination) {
-        return await this.execAsync(`git mv ${this.quotePath(path)} ${this.quotePath(destination)}`);
+        return await this.execGit(['mv', '--', path, destination]);
     }
     async push(ref, remoteName) {
-        return await this.execAsync(`git push -u -f ${remoteName} ${ref}`);
+        return await this.execGit(['push', '-u', '-f', remoteName, ref]);
     }
     async commit(message) {
-        return await this.execAsync(`git commit -am "${message}"`);
+        return await this.execGit(['commit', '-am', message]);
     }
     async amendCommit() {
-        return await this.execAsync(`git commit --amend -a --no-edit`);
+        return await this.execGit(['commit', '--amend', '-a', '--no-edit']);
     }
     async deleteGitRemote(name) {
-        return await this.execAsync(`git remote rm ${name}`);
+        return await this.execGit(['remote', 'rm', name]);
     }
     async addGitRemote(name, url) {
-        return await this.execAsync(`git remote add ${name} ${url}`);
+        return await this.execGit(['remote', 'add', name, url]);
     }
     async hasFilterRepoInstalled() {
         try {
-            await this.execAsync(`git filter-repo --help`);
+            await this.execGit(['filter-repo', '--help']);
             return true;
         }
         catch {
@@ -121,35 +145,57 @@ class GitRepository {
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
-        await this.execAsync(`git filter-repo -f ${source !== '' ? `--path ${this.quotePath(sourcePosixPath)}` : ''} ${source !== destination
-            ? `--path-rename ${this.quotePath(sourcePosixPath, true)}:${this.quotePath(destinationPosixPath, true)}`
-            : ''}`);
+        const sourcePath = ensureTrailingSlash(sourcePosixPath);
+        const destinationPath = ensureTrailingSlash(destinationPosixPath);
+        await this.execGit([
+            'filter-repo',
+            '-f',
+            ...(source !== '' ? ['--path', sourcePosixPath] : []),
+            ...(source !== destination
+                ? ['--path-rename', `${sourcePath}:${destinationPath}`]
+                : []),
+        ]);
     }
     async filterBranch(source, destination, branchName) {
         // We need non-ASCII file names to not be quoted, or else filter-branch will exclude them.
-        await this.execAsync(`git config core.quotepath false`);
+        await this.execGit(['config', 'core.quotepath', 'false']);
         // NOTE: filter-repo requires POSIX path to work
         const sourcePosixPath = source.split(path_1.sep).join(path_1.posix.sep);
         const destinationPosixPath = destination.split(path_1.sep).join(path_1.posix.sep);
         // First, if the source is not a root project, then only include commits relevant to the subdirectory.
         if (source !== '') {
-            const indexFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.index-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --index-filter ${indexFilterCommand} --prune-empty -- ${branchName}`, {
+            const indexFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.index-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--index-filter',
+                indexFilterCommand,
+                '--prune-empty',
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
         // Then, move files to their new location if necessary.
         if (source === '' || source !== destination) {
-            const treeFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.tree-filter.js')}`);
-            await this.execAsync(`git filter-branch -f --tree-filter ${treeFilterCommand} -- ${branchName}`, {
+            const treeFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.tree-filter.js'))}`;
+            await this.execGit([
+                'filter-branch',
+                '-f',
+                '--tree-filter',
+                treeFilterCommand,
+                '--',
+                branchName,
+            ], {
                 NX_IMPORT_SOURCE: sourcePosixPath,
                 NX_IMPORT_DESTINATION: destinationPosixPath,
             });
         }
     }
-    execAsync(command, env) {
-        return execAsync(command, {
+    execGit(args, env) {
+        return execFileAsync('git', args, {
             cwd: this.root,
             maxBuffer: 10 * 1024 * 1024,
             env: {
@@ -158,25 +204,14 @@ class GitRepository {
             },
         });
     }
-    quotePath(path, ensureTrailingSlash) {
-        return this.quoteArg(ensureTrailingSlash && path !== '' && !path.endsWith('/')
-            ? `${path}/`
-            : path);
-    }
-    quoteArg(arg) {
-        return process.platform === 'win32'
-            ? // Windows/CMD only understands double-quotes, single-quotes are treated as part of the file name
-                // Bash and other shells will substitute `$` in file names with a variable value.
-                `"${arg
-                    // Need to keep two slashes for Windows or else the path will be invalid.
-                    // e.g. 'C:\Users\bob\projects\repo' is invalid, but 'C:\\Users\\bob\\projects\\repo' is valid
-                    .replaceAll('\\', '\\\\')}"`
-            : // e.g. `git mv "$$file.txt" "libs/a/$$file.txt"` will not work since `$$` is swapped with the PID of the last process.
-                // Using single-quotes prevents this substitution.
-                `'${arg}'`;
-    }
 }
 exports.GitRepository = GitRepository;
+function ensureTrailingSlash(path) {
+    return path !== '' && !path.endsWith('/') ? `${path}/` : path;
+}
+function quoteForShell(arg) {
+    return `'${arg.replaceAll("'", "'\"'\"'")}'`;
+}
 function parseVcsRemoteUrl(url) {
     // Remove whitespace and handle common URL formats
     const cleanUrl = url.trim();
@@ -260,6 +295,65 @@ function getVcsRemoteInfo(directory) {
         return null;
     }
 }
+function getGitRootPath(cwd) {
+    return (0, child_process_1.execFileSync)('git', ['rev-parse', '--show-toplevel'], {
+        cwd,
+        windowsHide: true,
+    })
+        .toString()
+        .trim();
+}
+/**
+ * Path of `directory` relative to its git root, posix-separated so it is
+ * identical on every OS, and '' when the directory is the git root itself.
+ * Null outside a git repository.
+ */
+function getGitRootRelativePath(directory) {
+    try {
+        return (0, path_1.relative)(getGitRootPath(directory), directory)
+            .split(path_1.sep)
+            .join(path_1.posix.sep);
+    }
+    catch {
+        return null;
+    }
+}
+/** A shallow clone's truncated history has no stable root commit. */
+function isShallowRepository(directory) {
+    try {
+        return ((0, child_process_1.execFileSync)('git', ['rev-parse', '--is-shallow-repository'], {
+            encoding: 'utf8',
+            stdio: 'pipe',
+            cwd: directory,
+            windowsHide: true,
+        }).trim() === 'true');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * SHA of the repository's first commit. Merged unrelated histories leave
+ * several root commits — the sorted-first one is picked so every clone
+ * agrees. Null when there are no commits, or outside a git repository.
+ */
+function getFirstCommitSha(directory) {
+    try {
+        const roots = (0, child_process_1.execFileSync)('git', ['rev-list', '--max-parents=0', 'HEAD'], {
+            encoding: 'utf8',
+            stdio: 'pipe',
+            cwd: directory,
+            windowsHide: true,
+        })
+            .trim()
+            .split(/\r?\n/)
+            .filter(Boolean);
+        return roots.sort()[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 function isGitRepository(directory) {
     try {
         (0, child_process_1.execSync)('git rev-parse --is-inside-work-tree', {

package/dist/src/utils/git-worktrees.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Roots of the git linked worktrees that live inside `workspaceRoot`,
+ * relative to it and separator-normalized.
+ *
+ * Reads git's own registry rather than probing the workspace, so it costs one
+ * `readdir` plus a small file per worktree. Worktrees outside the workspace
+ * are dropped - nothing walks them. Submodules use the same gitfile mechanism
+ * but register under `<git-dir>/modules`, so they never appear here.
+ */
+export declare function nestedWorktreeRoots(workspaceRoot: string): string[];
+/**
+ * Whether `path` sits inside `root`, comparing whole path segments so that
+ * `wt-other` is not read as living inside `wt`.
+ */
+export declare function isInside(path: string, root: string): boolean;
+/** Advice for duplicate project names that come from nested git worktrees. */
+export interface WorktreeConflictAdvice {
+    /** Paths to add to `.gitignore`. */
+    ignoreTargets: string[];
+    /**
+     * Whether ignoring them settles every duplicate. When false the caller still
+     * owes the reader the ordinary advice for the ones left over.
+     */
+    explainsAllConflicts: boolean;
+}
+/**
+ * What to tell someone whose duplicate project names come from git worktrees
+ * nested in the workspace, or null when none of them do.
+ */
+export declare function analyzeWorktreeConflicts(workspaceRoot: string, conflicts: Map<string, string[]>): WorktreeConflictAdvice | null;

package/dist/src/utils/git-worktrees.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nestedWorktreeRoots = nestedWorktreeRoots;
+exports.isInside = isInside;
+exports.analyzeWorktreeConflicts = analyzeWorktreeConflicts;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const GITDIR_PREFIX = 'gitdir:';
+function readRecordedPath(file, base) {
+    let contents;
+    try {
+        contents = (0, node_fs_1.readFileSync)(file, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+    const raw = contents.startsWith(GITDIR_PREFIX)
+        ? contents.slice(GITDIR_PREFIX.length).trim()
+        : contents;
+    return raw ? (0, node_path_1.resolve)(base, raw) : null;
+}
+function isDirectory(path) {
+    try {
+        return (0, node_fs_1.statSync)(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The nearest directory at or above `from` holding a `.git`, or null when
+ * there is no repository above it.
+ *
+ * The workspace root and the repository root are often the same directory, but
+ * a workspace nested in a larger repo is ordinary - and its worktrees are
+ * registered against the repository, not against the workspace.
+ */
+function findGitRoot(from) {
+    let current = (0, node_path_1.resolve)(from);
+    while (!(0, node_fs_1.existsSync)((0, node_path_1.join)(current, '.git'))) {
+        const parent = (0, node_path_1.dirname)(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+    return current;
+}
+/**
+ * `<git-dir>/worktrees`, where git registers every linked worktree of the
+ * repository `workspaceRoot` belongs to - found by walking up, since the
+ * workspace need not be the repository root. Null when there is no `.git`, or
+ * when it is a gitfile that names nothing. The registry itself is not checked -
+ * reading it is what tells us whether anything is registered.
+ */
+function worktreeRegistry(workspaceRoot) {
+    const gitRoot = findGitRoot(workspaceRoot);
+    if (!gitRoot) {
+        return null;
+    }
+    const dotGit = (0, node_path_1.join)(gitRoot, '.git');
+    let gitDir;
+    try {
+        gitDir = (0, node_fs_1.statSync)(dotGit).isDirectory()
+            ? dotGit
+            : readRecordedPath(dotGit, gitRoot);
+    }
+    catch {
+        return null;
+    }
+    if (!gitDir) {
+        return null;
+    }
+    // Running from inside a linked worktree lands on
+    // `<main>/.git/worktrees/<name>`, whose `commondir` names the real git dir.
+    // Ignored unless it names a directory that exists. That is a sanity check
+    // on a path out of a file we did not write, not a bound on where it may
+    // point - it can still name any directory on the machine.
+    const commonDir = readRecordedPath((0, node_path_1.join)(gitDir, 'commondir'), gitDir);
+    return (0, node_path_1.join)(commonDir && isDirectory(commonDir) ? commonDir : gitDir, 'worktrees');
+}
+/**
+ * Roots of the git linked worktrees that live inside `workspaceRoot`,
+ * relative to it and separator-normalized.
+ *
+ * Reads git's own registry rather than probing the workspace, so it costs one
+ * `readdir` plus a small file per worktree. Worktrees outside the workspace
+ * are dropped - nothing walks them. Submodules use the same gitfile mechanism
+ * but register under `<git-dir>/modules`, so they never appear here.
+ */
+function nestedWorktreeRoots(workspaceRoot) {
+    const registry = worktreeRegistry(workspaceRoot);
+    if (!registry) {
+        return [];
+    }
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)(registry);
+    }
+    catch {
+        return [];
+    }
+    const roots = [];
+    for (const entry of entries) {
+        // Points at the worktree's own `.git` gitfile, so its parent is the root.
+        const gitfile = readRecordedPath((0, node_path_1.join)(registry, entry, 'gitdir'), (0, node_path_1.join)(registry, entry));
+        if (!gitfile || !(0, node_fs_1.existsSync)(gitfile)) {
+            continue;
+        }
+        const root = (0, node_path_1.relative)(workspaceRoot, (0, node_path_1.dirname)(gitfile));
+        // Neither the workspace itself nor anything outside it is a nested
+        // worktree Nx would walk into. Compared by whole segments, because `..` is
+        // a traversal and `..hidden` is an ordinary directory name; and by
+        // absoluteness, because `relative` across Windows drives returns its
+        // second argument, which is outside by definition and carries no `..`.
+        if (!root || (0, node_path_1.isAbsolute)(root) || root.split(node_path_1.sep)[0] === '..') {
+            continue;
+        }
+        roots.push(root.split(node_path_1.sep).join('/'));
+    }
+    return roots;
+}
+/**
+ * Whether `path` sits inside `root`, comparing whole path segments so that
+ * `wt-other` is not read as living inside `wt`.
+ */
+function isInside(path, root) {
+    return path === root || path.startsWith(`${root}/`);
+}
+/**
+ * What to tell someone whose duplicate project names come from git worktrees
+ * nested in the workspace, or null when none of them do.
+ */
+function analyzeWorktreeConflicts(workspaceRoot, conflicts) {
+    const worktrees = nestedWorktreeRoots(workspaceRoot);
+    if (!worktrees.length) {
+        return null;
+    }
+    const offending = [];
+    let explainsAllConflicts = true;
+    for (const roots of conflicts.values()) {
+        const fromWorktrees = worktrees.filter((worktree) => roots.some((root) => isInside(root, worktree)));
+        // What would still be defined twice once the worktrees are out of the way.
+        const remaining = roots.filter((root) => !worktrees.some((worktree) => isInside(root, worktree)));
+        // Worth naming whenever a worktree is involved, even if ignoring it
+        // doesn't settle the whole conflict.
+        for (const worktree of fromWorktrees) {
+            if (!offending.includes(worktree)) {
+                offending.push(worktree);
+            }
+        }
+        if (!fromWorktrees.length || remaining.length > 1) {
+            explainsAllConflicts = false;
+        }
+    }
+    if (!offending.length) {
+        return null;
+    }
+    return {
+        ignoreTargets: ignoreTargetsFor(workspaceRoot, offending, worktrees),
+        explainsAllConflicts,
+    };
+}
+/**
+ * The worktree roots themselves, or the one directory holding them.
+ *
+ * Collapsing to the directory is only worth anything when it saves lines, and
+ * only safe when it holds nothing else. With a single worktree it saves
+ * nothing and risks everything: a lone worktree in `apps/` would have us name
+ * `apps/`, which holds only that worktree today and is where the reader will
+ * put projects tomorrow.
+ */
+function ignoreTargetsFor(workspaceRoot, offending, worktrees) {
+    if (offending.length < 2) {
+        return offending.map(anchored);
+    }
+    const parent = commonParent(offending);
+    return (parent && holdsOnlyWorktrees(workspaceRoot, parent, worktrees)
+        ? [parent]
+        : offending).map(anchored);
+}
+/**
+ * A gitignore pattern rooted at the workspace rather than matched anywhere.
+ *
+ * Without the leading slash a single-segment path like `wt1` is a name, not a
+ * location - it would ignore every `wt1` at any depth. Applied to all of them
+ * so the emitted line reads the same way wherever it came from.
+ */
+function anchored(root) {
+    return `/${root}`;
+}
+/**
+ * The directory every one of `roots` sits directly inside, or null when they
+ * don't share one - including when it would be the workspace root, which is
+ * never something to ignore.
+ */
+function commonParent(roots) {
+    const parents = new Set(roots.map((root) => root.split('/').slice(0, -1).join('/')));
+    const [parent] = parents;
+    return parents.size === 1 && parent ? parent : null;
+}
+function holdsOnlyWorktrees(workspaceRoot, directory, worktrees) {
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)((0, node_path_1.join)(workspaceRoot, directory));
+    }
+    catch {
+        return false;
+    }
+    return (entries.length > 0 &&
+        entries.every((entry) => worktrees.includes(`${directory}/${entry}`)));
+}