nx 23.1.0 → 23.1.2

package/dist/src/core/graph/styles.js

@@ -1 +1 @@
-"use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{8027(){}},e=>{var n;n=8027,e(e.s=n)}]);
+"use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{946(){}},e=>{var n;n=946,e(e.s=n)}]);

package/dist/src/daemon/client/client.d.ts

@@ -8,11 +8,23 @@ import { ConfigurationSourceMaps } from '../../project-graph/utils/project-confi
 import type { FlushSyncGeneratorChangesResult, SyncGeneratorRunResult } from '../../utils/sync-generators';
 import { type ConfigureAiAgentsStatusResponse } from '../message-types/configure-ai-agents';
 import { type NxConsoleStatusResponse, type SetNxConsolePreferenceAndInstallResponse } from '../message-types/nx-console';
+/** A refused connect: the errno, and the path it was made against. */
+type ConnectRefusal = {
+    error: NodeJS.ErrnoException;
+    socketPath: string;
+};
 export type UnregisterCallback = () => void;
 export type ChangedFile = {
     path: string;
     type: 'create' | 'update' | 'delete';
 };
+/**
+ * The daemon's workspace watcher died. Nothing it serves will see file changes
+ * again, so a watching client has to restart rather than keep waiting.
+ */
+export declare class WatcherFailedError extends Error {
+    constructor(message: string);
+}
 export declare class DaemonClient {
     private readonly nxJson;
     constructor();
@@ -26,8 +38,6 @@ export declare class DaemonClient {
     private _daemonStatus;
     private _waitForDaemonReady;
     private _daemonReady;
-    private _out;
-    private _err;
     private fileWatcherMessenger;
     private fileWatcherReconnecting;
     private fileWatcherCallbacks;
@@ -95,6 +105,12 @@ export declare class DaemonClient {
     resetConfigureAiAgentsStatus(): Promise<{
         success: boolean;
     }>;
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    private probeServer;
     isServerAvailable(): Promise<boolean>;
     private startDaemonIfNecessary;
     private sendToDaemonViaQueue;
@@ -110,8 +126,41 @@ export declare class DaemonClient {
     private sendMessageToDaemon;
     private registerDaemonProcessWithMetricsService;
     private handleMessage;
-    startInBackground(): Promise<ChildProcess['pid']>;
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    startInBackground(probeRefusal?: ConnectRefusal): Promise<ChildProcess['pid']>;
     stop(): Promise<void>;
 }
 export declare const daemonClient: DaemonClient;
 export declare function isDaemonEnabled(): boolean;
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+export declare function isPermissionErrno(error: NodeJS.ErrnoException): boolean;
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+export declare function daemonPermissionException(socketPath: string, cause: string): Error;
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
+export declare function daemonProcessException(message: string): Error;
+export {};

package/dist/src/daemon/client/client.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.daemonClient = exports.DaemonClient = void 0;
+exports.daemonClient = exports.DaemonClient = exports.WatcherFailedError = void 0;
 exports.isDaemonEnabled = isDaemonEnabled;
+exports.isPermissionErrno = isPermissionErrno;
+exports.daemonPermissionException = daemonPermissionException;
+exports.daemonProcessException = daemonProcessException;
 const child_process_1 = require("child_process");
-const promises_1 = require("fs/promises");
 const net_1 = require("net");
 const node_fs_1 = require("node:fs");
 const path_1 = require("path");
@@ -12,6 +14,7 @@ const configuration_1 = require("../../config/configuration");
 const nx_json_1 = require("../../config/nx-json");
 const native_1 = require("../../native");
 const error_types_1 = require("../../project-graph/error-types");
+const typescript_1 = require("../../plugins/js/utils/typescript");
 const project_graph_1 = require("../../project-graph/project-graph");
 const consume_messages_from_socket_1 = require("../../utils/consume-messages-from-socket");
 const delayed_spinner_1 = require("../../utils/delayed-spinner");
@@ -52,6 +55,18 @@ const WAIT_FOR_SERVER_CONFIG = {
     delayMs: 10,
     maxAttempts: 6000, // 6000 * 10ms = 60 seconds
 };
+/**
+ * The daemon's workspace watcher died. Nothing it serves will see file changes
+ * again, so a watching client has to restart rather than keep waiting.
+ */
+class WatcherFailedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'WatcherFailedError';
+        Object.setPrototypeOf(this, WatcherFailedError.prototype);
+    }
+}
+exports.WatcherFailedError = WatcherFailedError;
 class DaemonClient {
     constructor() {
         // Tracks the spinner owned by the in-flight request so streamed
@@ -62,8 +77,6 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.DISCONNECTED;
         this._waitForDaemonReady = null;
         this._daemonReady = null;
-        this._out = null;
-        this._err = null;
         this.fileWatcherReconnecting = false;
         this.fileWatcherCallbacks = new Map();
         this.fileWatcherConfigs = new Map();
@@ -127,10 +140,6 @@ class DaemonClient {
         this.currentResolve = null;
         this.currentReject = null;
         this._enabled = undefined;
-        this._out?.close();
-        this._err?.close();
-        this._out = null;
-        this._err = null;
         // Clean up file watcher and project graph listener connections
         this.fileWatcherMessenger?.close();
         this.fileWatcherMessenger = undefined;
@@ -183,12 +192,21 @@ class DaemonClient {
         return await this.sendToDaemonViaQueue({ type: 'REQUEST_FILE_DATA' });
     }
     hashTasks(runnerOptions, tasks, taskGraph, perTaskEnvs, cwd, collectInputs) {
+        // Task results get written back onto these task objects as the run
+        // progresses — hash/hashDetails/timestamps by hashing and the
+        // orchestrator, terminalOutput by the Nx Cloud life cycle (untyped) —
+        // so a later message would otherwise re-ship every earlier result.
+        const trimmedTasks = {};
+        for (const [id, t] of Object.entries(taskGraph.tasks)) {
+            const { hash, hashDetails, startTime, endTime, terminalOutput, ...strippedTask } = t;
+            trimmedTasks[id] = strippedTask;
+        }
         return this.sendToDaemonViaQueue({
             type: 'HASH_TASKS',
             runnerOptions,
             perTaskEnvs,
-            tasks,
-            taskGraph,
+            tasks: tasks.map((t) => trimmedTasks[t.id]),
+            taskGraph: { ...taskGraph, tasks: trimmedTasks },
             cwd,
             collectInputs,
         });
@@ -224,6 +242,13 @@ class DaemonClient {
             this.fileWatcherMessenger = new daemon_socket_messenger_1.DaemonSocketMessenger((0, net_1.connect)(socketPath)).listen((message) => {
                 try {
                     const parsedMessage = (0, consume_messages_from_socket_1.parseMessage)(message);
+                    if (parsedMessage?.watcherError) {
+                        const error = new WatcherFailedError(parsedMessage.watcherError);
+                        for (const cb of this.fileWatcherCallbacks.values()) {
+                            cb(error, null);
+                        }
+                        return;
+                    }
                     // Notify all callbacks
                     for (const cb of this.fileWatcherCallbacks.values()) {
                         cb(null, parsedMessage);
@@ -282,9 +307,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -434,9 +459,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -671,30 +696,40 @@ class DaemonClient {
         };
         return this.sendToDaemonViaQueue(message);
     }
-    async isServerAvailable() {
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    async probeServer() {
         return new Promise((resolve, reject) => {
             try {
                 const socketPath = this.getSocketPath();
                 if (!socketPath) {
-                    resolve(false);
+                    resolve({ available: false });
                     return;
                 }
                 const socket = (0, net_1.connect)(socketPath, () => {
                     socket.destroy();
-                    resolve(true);
+                    resolve({ available: true });
                 });
-                socket.once('error', () => {
-                    resolve(false);
+                socket.once('error', (err) => {
+                    // The only place the errno for "the socket is there but refuses us"
+                    // is produced, and the only thing separating it from "no daemon yet".
+                    resolve({ available: false, refusal: { error: err, socketPath } });
                 });
             }
             catch (err) {
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
                     reject(err); // Let version mismatch bubble up
                 }
-                resolve(false);
+                resolve({ available: false });
             }
         });
     }
+    async isServerAvailable() {
+        return (await this.probeServer()).available;
+    }
     async startDaemonIfNecessary() {
         if (this._daemonStatus == DaemonStatus.CONNECTED) {
             return;
@@ -703,21 +738,22 @@ class DaemonClient {
         if (this._daemonStatus == DaemonStatus.DISCONNECTED) {
             this._daemonStatus = DaemonStatus.CONNECTING;
             let daemonPid = null;
-            let serverAvailable;
+            let probe;
             try {
-                serverAvailable = await this.isServerAvailable();
+                probe = await this.probeServer();
             }
             catch (err) {
                 // Version mismatch - treat as server not available, start new one
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
-                    serverAvailable = false;
+                    probe = { available: false };
                 }
                 else {
                     throw err;
                 }
             }
-            if (!serverAvailable) {
-                daemonPid = await this.startInBackground();
+            if (!probe.available) {
+                // Carried as a value so no other caller's probe can substitute for it.
+                daemonPid = await this.startInBackground(probe.refusal);
             }
             this.setUpConnection();
             this._daemonStatus = DaemonStatus.CONNECTED;
@@ -768,6 +804,11 @@ class DaemonClient {
             if (err.message.startsWith('connect ENOENT')) {
                 error = daemonProcessException('The Daemon Server is not running');
             }
+            else if (isPermissionErrno(err)) {
+                // The 0700 dir and 0600 socket mean the OS refuses this rather than the
+                // connect silently succeeding.
+                error = daemonPermissionException(socketPath, err.message);
+            }
             else if (err.message.startsWith('connect ECONNREFUSED')) {
                 error = daemonProcessException(`A server instance had not been fully shut down. Please try running the command again.`);
             }
@@ -788,9 +829,9 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.CONNECTING;
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
@@ -836,6 +877,11 @@ class DaemonClient {
      */
     async waitForServerToBeAvailable(options) {
         logger_1.clientLogger.log(`[Client] Waiting for server (max: ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts, ${WAIT_FOR_SERVER_CONFIG.delayMs}ms interval)`);
+        // Poll-scoped, not instance state: reconnect paths have their own flags, so
+        // several attempts can be in flight and a shared slot would let one report
+        // another's socket.
+        let stoppedOnRefusal = false;
+        let refusal;
         const socket = await (0, wait_for_socket_connection_1.waitForSocketConnection)(() => {
             try {
                 return this.getSocketPath();
@@ -852,14 +898,29 @@ class DaemonClient {
         }, {
             maxAttempts: WAIT_FOR_SERVER_CONFIG.maxAttempts,
             delayMs: WAIT_FOR_SERVER_CONFIG.delayMs,
+            onConnectError: (error, socketPath) => {
+                refusal = { error, socketPath };
+                // A refusal is not expected to become an acceptance, so polling the
+                // full 60s budget only delays the same answer. Not absolute:
+                // `server.ts` binds before it chmods to 0600, so under a umask that
+                // strips owner write a same-user connect can lose a microsecond race
+                // and see EACCES. That costs a specific error rather than a retry — a
+                // better trade than a 60s hang.
+                return (stoppedOnRefusal = isPermissionErrno(error));
+            },
         });
         if (socket) {
             socket.destroy();
             logger_1.clientLogger.log(`[Client] Server available`);
-            return true;
+            return { available: true };
         }
-        logger_1.clientLogger.log(`[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
-        return false;
+        // Keyed on the early exit taken, not on whether an errno was recorded:
+        // every failed connect records one, including an ordinary cold start's
+        // ENOENT.
+        logger_1.clientLogger.log(stoppedOnRefusal
+            ? `[Client] Server refused the connection (${refusal?.error.code}), stopped polling`
+            : `[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
+        return { available: false, refusal };
     }
     async sendMessageToDaemon(message, force) {
         // the first message sent to the daemon includes an env prop
@@ -941,7 +1002,12 @@ class DaemonClient {
             ].join('\n')));
         }
     }
-    async startInBackground() {
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    async startInBackground(probeRefusal) {
         if (global.NX_PLUGIN_WORKER) {
             throw new Error('Fatal Error: Something unexpected has occurred. Plugin Workers should not start a new daemon process. Please report this issue.');
         }
@@ -949,25 +1015,29 @@ class DaemonClient {
         if (!(0, node_fs_1.existsSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE)) {
             (0, node_fs_1.writeFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, '');
         }
-        // Open the log handles into locals first. If the previous daemon's
-        // socket close handler fires reset() while we're awaiting these opens,
-        // it would null out this._out/this._err and the spawn below would hit
-        // `Cannot read properties of null (reading 'fd')`.
-        const [out, err] = await Promise.all([
-            (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a'),
-            (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a'),
-        ]);
-        this._out = out;
-        this._err = err;
+        // Redirect the detached daemon's stdout/stderr into the log file. The
+        // child dup's these descriptors at spawn, so we close ours right after
+        // instead of holding them for the life of this process (Node >=26 turns a
+        // file descriptor closed during garbage collection into a fatal error).
+        const outFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
+        const errFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
         logger_1.clientLogger.log(`[Client] Starting new daemon server in background`);
-        const backgroundProcess = (0, child_process_1.spawn)(process.execPath, [(0, path_1.join)(__dirname, `../server/start.js`)], {
+        const backgroundProcess = (0, child_process_1.spawn)(process.execPath, [
+            // Spawn with the same resolve conditions Nx uses for plugin entries so a
+            // source-loaded plugin's transitive workspace imports resolve to source.
+            ...(0, typescript_1.getPluginResolveConditionNodeArgs)(),
+            (0, path_1.join)(__dirname, `../server/start.js`),
+        ], {
             cwd: workspace_root_1.workspaceRoot,
-            stdio: ['ignore', out.fd, err.fd],
+            stdio: ['ignore', outFd, errFd],
             detached: true,
             windowsHide: true,
             shell: false,
-            env: (0, daemon_environment_1.getDaemonEnv)(),
+            env: (0, daemon_environment_1.getDaemonSpawnEnv)(),
         });
+        // The child now owns dup'd copies of the descriptors, so release ours.
+        (0, node_fs_1.closeSync)(outFd);
+        (0, node_fs_1.closeSync)(errFd);
         // if this process is the process that spawned the daemon,
         // the daemon env is already up to date
         this.envReflectionSent = true;
@@ -975,14 +1045,25 @@ class DaemonClient {
         /**
          * Ensure the server is actually available to connect to via IPC before resolving
          */
-        const serverAvailable = await this.waitForServerToBeAvailable({
-            ignoreVersionMismatch: true,
-        });
-        if (serverAvailable) {
+        const { available, refusal: polled } = await this.waitForServerToBeAvailable({ ignoreVersionMismatch: true });
+        if (available) {
             logger_1.clientLogger.log(`[Client] Daemon server started, pid=${backgroundProcess.pid}`);
             return backgroundProcess.pid;
         }
         else {
+            // A permission refusal from either source wins, then the poll's errno,
+            // then the probe's. Recency alone would report a daemon's ENOENT over the
+            // EACCES the probe saw a moment earlier, losing the diagnosis.
+            const refusal = [polled, probeRefusal].find((r) => r && isPermissionErrno(r.error)) ??
+                polled ??
+                probeRefusal;
+            if (refusal && isPermissionErrno(refusal.error)) {
+                // Reported here rather than as a generic startup failure, so it degrades
+                // without disabling the daemon until `nx reset`. Both operands come from
+                // the refusal: resolving a path here instead would throw once a daemon
+                // that failed to bind has unlinked its process json.
+                throw daemonPermissionException(refusal.socketPath, refusal.error.message);
+            }
             throw daemonProcessException('Failed to start or connect to the Nx Daemon process.');
         }
     }
@@ -1025,24 +1106,65 @@ function isDocker() {
 function nxJsonIsNotPresent() {
     return !(0, nx_json_1.hasNxJson)(workspace_root_1.workspaceRoot);
 }
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+function isPermissionErrno(error) {
+    return error?.code === 'EACCES' || error?.code === 'EPERM';
+}
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+function daemonPermissionException(socketPath, cause) {
+    const error = new Error([
+        `The operating system refused the connection to the Nx Daemon socket (${cause}).`,
+        '',
+        `Socket: ${socketPath}`,
+        '',
+        'Most often the socket belongs to a different user: a daemon left behind by running Nx under `sudo`, a different uid inside a container, or a working copy shared between accounts. If the socket is your own, a sandbox is refusing the connection instead.',
+        'If it belongs to another user, delete the socket above or set NX_SOCKET_DIR to a directory only your user can reach. If you are in a sandbox, allow unix sockets under the Nx socket root — in Claude Code a scoped `allowUnixSockets` only permits connecting, so starting a daemon there needs `allowAllUnixSockets: true`. See https://nx.dev/docs/kb/nx-sandbox-unix-sockets',
+    ].join('\n'));
+    error.daemonPermissionError = true;
+    return error;
+}
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
 function daemonProcessException(message) {
+    // The log is an enrichment, not the classifier: it is absent on a first run,
+    // which is exactly when the daemon is most likely to fail to start.
+    let body = message;
     try {
         let log = (0, node_fs_1.readFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE).toString().split('\n');
         if (log.length > 20) {
             log = log.slice(log.length - 20);
         }
-        const error = new Error([
+        body = [
             message,
             '',
             'Messages from the log:',
             ...log,
             '\n',
             `More information: ${tmp_dir_1.DAEMON_OUTPUT_LOG_FILE}`,
-        ].join('\n'));
-        error.internalDaemonError = true;
-        return error;
-    }
-    catch (e) {
-        return new Error(message);
+        ].join('\n');
     }
+    catch { }
+    const error = new Error(body);
+    error.internalDaemonError = true;
+    return error;
 }

package/dist/src/daemon/client/daemon-environment.d.ts

@@ -2,6 +2,23 @@ export declare function getDaemonEnv(): NodeJS.ProcessEnv & {
     NX_PROJECT_GLOB_CACHE: string;
     NX_CACHE_PROJECTS_CONFIG: string;
 };
+/**
+ * Env for spawning the daemon process. On top of the reflected env, it must
+ * keep excluded vars the daemon needs to start correctly:
+ * - ELECTRON_RUN_AS_NODE (matched by the ELECTRON_ prefix exclusion): when
+ *   the spawning client runs inside an Electron host, process.execPath is
+ *   the Electron binary and only this var makes it run the daemon's Node
+ *   entry point.
+ * - NX_WORKSPACE_ROOT_PATH: the daemon resolves its workspace root at
+ *   startup by walking up from cwd looking for workspace markers; without
+ *   the pin, a root without markers under an ancestor that has them
+ *   resolves to the ancestor and the daemon publishes its socket under the
+ *   wrong workspace.
+ */
+export declare function getDaemonSpawnEnv(): NodeJS.ProcessEnv & {
+    NX_PROJECT_GLOB_CACHE: string;
+    NX_CACHE_PROJECTS_CONFIG: string;
+};
 /**
  * Without the deletion step, a var set by one client (e.g.
  * `NX_PREFER_NODE_STRIP_TYPES=true` or `JAVA_TOOL_OPTIONS=...` for a single