nx 23.1.1 → 23.1.2

package/dist/src/daemon/message-types/daemon-message.d.ts

@@ -1,6 +1,38 @@
 export type DaemonMessage = {
     type: string;
     env?: Record<string, string>;
+    /**
+     * Stamped centrally by `DaemonSocketMessenger.sendMessage`, not by the ~30
+     * sites that construct messages — hence optional. It can also be absent on a
+     * message that predates the field, which is why `isForeignWorkspaceMessage`
+     * treats `undefined` as "not foreign".
+     */
+    workspaceRoot?: string;
     data?: any;
 };
 export declare function isDaemonMessage(msg: unknown): msg is DaemonMessage;
+/**
+ * Any message carrying the sender's workspace root. Structural so the checks
+ * below serve the daemon and the plugin worker without either importing the
+ * other's message type. `type` is required only so the type is not all-optional,
+ * which would accept `{}`.
+ */
+type WorkspaceScopedMessage = {
+    type: string;
+    workspaceRoot?: string;
+};
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Compared directly; both come from the same resolution.
+ */
+export declare function isForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string): boolean;
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+export declare function assertNotForeignWorkspaceMessage(msg: WorkspaceScopedMessage, receiverWorkspaceRoot: string, receiverDescription?: string): void;
+export {};

package/dist/src/daemon/message-types/daemon-message.js

@@ -1,6 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDaemonMessage = isDaemonMessage;
+exports.isForeignWorkspaceMessage = isForeignWorkspaceMessage;
+exports.assertNotForeignWorkspaceMessage = assertNotForeignWorkspaceMessage;
 function isDaemonMessage(msg) {
     return typeof msg === 'object' && msg && 'type' in msg;
 }
+/**
+ * A message from a different workspace — two sharing an NX_SOCKET_DIR — must not
+ * be processed. Compared directly; both come from the same resolution.
+ */
+function isForeignWorkspaceMessage(msg, receiverWorkspaceRoot) {
+    if (msg.workspaceRoot === undefined) {
+        return false;
+    }
+    return msg.workspaceRoot !== receiverWorkspaceRoot;
+}
+/**
+ * Throws on a message this receiver must not act on. The daemon catches it and
+ * responds with the mismatch; the plugin worker catches it and drops the
+ * message. `receiverDescription` names whichever raised it.
+ *
+ * An unstamped message is deliberately accepted: this is accident detection,
+ * not a control.
+ */
+function assertNotForeignWorkspaceMessage(msg, receiverWorkspaceRoot, receiverDescription = `The Nx Daemon for '${receiverWorkspaceRoot}'`) {
+    if (isForeignWorkspaceMessage(msg, receiverWorkspaceRoot)) {
+        throw new Error(`${receiverDescription} received a message from a different workspace ('${msg.workspaceRoot}') and refused to process it. This usually means multiple workspaces are sharing a socket directory; ensure NX_SOCKET_DIR (or NX_DAEMON_SOCKET_DIR) is not set to a shared location.`);
+    }
+}

package/dist/src/daemon/server/file-watching/file-watcher-sockets.d.ts

@@ -9,4 +9,9 @@ export declare let registeredFileWatcherSockets: {
 }[];
 export declare function removeRegisteredFileWatcherSocket(socket: Socket): void;
 export declare function hasRegisteredFileWatcherSockets(): boolean;
+/**
+ * The workspace watcher has died; no further change events will ever arrive.
+ * Registered clients are passive, so without this push they wait forever.
+ */
+export declare function notifyFileWatcherSocketsOfError(error: Error): void;
 export declare function notifyFileWatcherSockets(createdFiles: string[] | null, updatedFiles: string[], deletedFiles: string[]): void;

package/dist/src/daemon/server/file-watching/file-watcher-sockets.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registeredFileWatcherSockets = void 0;
 exports.removeRegisteredFileWatcherSocket = removeRegisteredFileWatcherSocket;
 exports.hasRegisteredFileWatcherSockets = hasRegisteredFileWatcherSockets;
+exports.notifyFileWatcherSocketsOfError = notifyFileWatcherSocketsOfError;
 exports.notifyFileWatcherSockets = notifyFileWatcherSockets;
 const find_matching_projects_1 = require("../../../utils/find-matching-projects");
 const project_graph_utils_1 = require("../../../utils/project-graph-utils");
@@ -18,6 +19,21 @@ function removeRegisteredFileWatcherSocket(socket) {
 function hasRegisteredFileWatcherSockets() {
     return exports.registeredFileWatcherSockets.length > 0;
 }
+/**
+ * The workspace watcher has died; no further change events will ever arrive.
+ * Registered clients are passive, so without this push they wait forever.
+ */
+function notifyFileWatcherSocketsOfError(error) {
+    if (!hasRegisteredFileWatcherSockets()) {
+        return;
+    }
+    queue.sendToQueue(async () => {
+        await Promise.all(exports.registeredFileWatcherSockets.map(({ socket }) => (0, server_1.handleResult)(socket, 'FILE-WATCH-CHANGED', () => Promise.resolve({
+            description: 'File watch error',
+            response: JSON.stringify({ watcherError: error.message }),
+        }), 'json')));
+    });
+}
 function notifyFileWatcherSockets(createdFiles, updatedFiles, deletedFiles) {
     if (!hasRegisteredFileWatcherSockets()) {
         return;

package/dist/src/daemon/server/latest-nx.js

@@ -2,7 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLatestNxTmpPath = getLatestNxTmpPath;
 exports.cleanupLatestNx = cleanupLatestNx;
-const devkit_internals_1 = require("../../devkit-internals");
+// Import from the defining module, not the devkit-internals barrel: the barrel
+// eagerly pulls in the task-execution subsystem and instantiates a daemon
+// client, all of which would stay resident for the daemon server's lifetime.
+const package_json_1 = require("../../utils/package-json");
 const package_manager_1 = require("../../utils/package-manager");
 const provenance_1 = require("../../utils/provenance");
 const workspace_root_1 = require("../../utils/workspace-root");
@@ -28,7 +31,7 @@ async function getLatestNxTmpPath() {
         try {
             logger_1.serverLogger.log('[LATEST-NX]: Pulling latest Nx...');
             await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-            const result = await (0, devkit_internals_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
+            const result = await (0, package_json_1.installPackageToTmpAsync)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
             latestNxTmpPath = result.tempDir;
             cleanupFn = result.cleanup;
             logger_1.serverLogger.log('[LATEST-NX]: Successfully pulled latest Nx to', latestNxTmpPath);

package/dist/src/daemon/server/server.js

@@ -119,6 +119,17 @@ async function handleMessage(socket, data) {
         await (0, shutdown_utils_1.respondWithErrorAndExit)(socket, `Invalid payload from the client`, new Error(`Unsupported payload sent to daemon server: ${unparsedPayload}`));
     }
     logger_1.serverLogger.log(`Received ${mode} message of type ${payload.type}`);
+    // A mismatch means the client reached the wrong daemon (e.g. a shared
+    // NX_SOCKET_DIR). Respond, but stay alive for our own workspace.
+    if ((0, daemon_message_1.isDaemonMessage)(payload)) {
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(payload, workspace_root_1.workspaceRoot);
+        }
+        catch (e) {
+            await (0, shutdown_utils_1.respondWithError)(socket, `Workspace root mismatch`, e);
+            return;
+        }
+    }
     if ((0, daemon_message_1.isDaemonMessage)(payload) && payload.env) {
         const changedEnvKeys = (0, daemon_environment_1.applyDaemonEnvFromClient)(payload.env);
         if (changedEnvKeys.length > 0) {
@@ -325,6 +336,7 @@ const handleWorkspaceChanges = async (err, changeEvents) => {
             logger_1.serverLogger.watcherLog('Unexpected workspace watcher error', error.message);
             console.error(error);
             workspaceWatcherError = error;
+            (0, file_watcher_sockets_1.notifyFileWatcherSocketsOfError)(error);
             return;
         }
         logger_1.serverLogger.watcherLog((0, watcher_1.convertChangeEventsToLogMessage)(changeEvents));
@@ -334,6 +346,7 @@ const handleWorkspaceChanges = async (err, changeEvents) => {
         logger_1.serverLogger.watcherLog(`Unexpected workspace error`, err.message);
         console.error(err);
         workspaceWatcherError = err;
+        (0, file_watcher_sockets_1.notifyFileWatcherSocketsOfError)(err);
     }
 };
 const handleOutputsChanges = async (err, changeEvents) => {
@@ -423,6 +436,17 @@ async function startServer() {
             server.listen(socketPath, async () => {
                 try {
                     logger_1.serverLogger.log(`Started listening on: ${socketPath}`);
+                    // Linux gates connect() on write permission to the socket file; macOS/BSD gate
+                    // on the directory, which is already 0700. Done after listen because
+                    // net.Server.listen takes no mode and umask is process-global.
+                    if (!socket_utils_1.isWindows) {
+                        try {
+                            (0, fs_1.chmodSync)(socketPath, 0o600);
+                        }
+                        catch {
+                            // Best effort; the 0700 socket directory is the primary control.
+                        }
+                    }
                     // this triggers the storage of the lock file hash
                     daemonIsOutdated();
                     if (!(0, shutdown_utils_1.getOutputWatcherInstance)()) {

package/dist/src/daemon/server/shutdown-utils.d.ts

@@ -14,5 +14,10 @@ export declare function handleServerProcessTermination({ server, reason, sockets
 export declare function handleServerProcessTerminationWithRestart({ server, reason, sockets, }: HandleServerProcessTerminationParams): Promise<void>;
 export declare function resetInactivityTimeout(cb: () => void): void;
 export declare function respondToClient(socket: Socket, response: string, description: string): Promise<unknown>;
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+export declare function respondWithError(socket: Socket, description: string, error: Error): Promise<void>;
 export declare function respondWithErrorAndExit(socket: Socket, description: string, error: Error): Promise<void>;
 export {};

package/dist/src/daemon/server/shutdown-utils.js

@@ -9,6 +9,7 @@ exports.handleServerProcessTermination = handleServerProcessTermination;
 exports.handleServerProcessTerminationWithRestart = handleServerProcessTerminationWithRestart;
 exports.resetInactivityTimeout = resetInactivityTimeout;
 exports.respondToClient = respondToClient;
+exports.respondWithError = respondWithError;
 exports.respondWithErrorAndExit = respondWithErrorAndExit;
 const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
@@ -135,9 +136,12 @@ function respondToClient(socket, response, description) {
         });
     });
 }
-async function respondWithErrorAndExit(socket, description, error) {
-    const isProjectGraphError = error instanceof error_types_1.DaemonProjectGraphError;
-    const normalizedError = isProjectGraphError
+/**
+ * Send an error to the client without terminating the daemon. Use this when the
+ * daemon should keep running for other clients after refusing a request.
+ */
+async function respondWithError(socket, description, error) {
+    const normalizedError = error instanceof error_types_1.DaemonProjectGraphError
         ? error_types_1.ProjectGraphError.fromDaemonProjectGraphError(error)
         : error;
     // print some extra stuff in the error message
@@ -145,8 +149,11 @@ async function respondWithErrorAndExit(socket, description, error) {
     console.error(normalizedError.stack);
     // Respond with the original error
     await respondToClient(socket, (0, socket_utils_1.serializeResult)(error, null, null), null);
+}
+async function respondWithErrorAndExit(socket, description, error) {
+    await respondWithError(socket, description, error);
     // Project Graph errors are okay. Restarting the daemon won't help with this.
-    if (!isProjectGraphError) {
+    if (!(error instanceof error_types_1.DaemonProjectGraphError)) {
         process.exit(1);
     }
 }

package/dist/src/daemon/socket-utils.d.ts

@@ -8,6 +8,7 @@ export declare const isWindows: boolean;
 export declare const getFullOsSocketPath: () => string;
 export declare const getForkedProcessOsSocketPath: (id: string) => string;
 export declare const getPluginOsSocketPath: (id: string) => string;
+export declare function getPluginSocketFileName(id: string): string;
 export declare function killSocketOrPath(): void;
 export declare function serializeResult(error: Error | null, serializedProjectGraph: string | null, serializedSourceMaps: string | null): string | null;
 /**

package/dist/src/daemon/socket-utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPluginOsSocketPath = exports.getForkedProcessOsSocketPath = exports.getFullOsSocketPath = exports.isWindows = void 0;
+exports.getPluginSocketFileName = getPluginSocketFileName;
 exports.killSocketOrPath = killSocketOrPath;
 exports.serializeResult = serializeResult;
 exports.serialize = serialize;
@@ -31,18 +32,38 @@ const getForkedProcessOsSocketPath = (id) => {
 };
 exports.getForkedProcessOsSocketPath = getForkedProcessOsSocketPath;
 const getPluginOsSocketPath = (id) => {
-    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getSocketDir)(true), 'plugin' + id + '.sock'));
+    let path = (0, path_1.resolve)((0, path_1.join)((0, tmp_dir_1.getPluginSocketDir)(), getPluginSocketFileName(id)));
     assertValidSocketPath(path);
     return exports.isWindows ? '\\\\.\\pipe\\nx\\' + path : path;
 };
 exports.getPluginOsSocketPath = getPluginOsSocketPath;
+function getPluginSocketFileName(id) {
+    return `p${id}.sock`;
+}
 function assertValidSocketPath(path) {
     if (path.length > 95) {
+        const fallbackCause = (0, tmp_dir_1.getSocketDirFallbackCause)();
+        const refusedConfiguredSocketDir = (0, tmp_dir_1.getRefusedConfiguredSocketDir)();
         throw new Error([
             'Attempted to open socket that exceeds the maximum socket length.',
+            ...(fallbackCause === undefined
+                ? []
+                : [
+                    `Nx fell back to ${(0, path_1.dirname)(path)} because the default socket directory could not be used.`,
+                    'Run the command with --verbose to see why the default directory was rejected.',
+                ]),
             '',
-            `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
-        ].join('\n'));
+            ...(refusedConfiguredSocketDir === undefined
+                ? [
+                    `Set NX_SOCKET_DIR to a shorter path (e.g. ${exports.isWindows ? '%TMP%/nx-tmp' : '/tmp/nx-tmp'}) to avoid this issue.`,
+                ]
+                : [
+                    // Saying "set a shorter path" here would be advice they already
+                    // followed: they set one, and it was refused for another reason.
+                    `The directory set in NX_SOCKET_DIR (${refusedConfiguredSocketDir}) could not be used — see the warning above — so Nx fell back to a longer path.`,
+                    'Point NX_SOCKET_DIR at a short directory your user owns.',
+                ]),
+        ].join('\n'), fallbackCause === undefined ? undefined : { cause: fallbackCause });
     }
 }
 function killSocketOrPath() {

package/dist/src/daemon/tmp-dir.d.ts

@@ -1,12 +1,52 @@
+/**
+ * Why a directory was refused. Named rather than a boolean so a table entry
+ * reads as its own reason: picking the wrong one tells a user their private
+ * directory is a code-execution risk, which is the one claim here that most
+ * needs to be true.
+ */
+export type SocketDirRefusal = 'shared-with-other-users' | 'nx-managed' | 'os-temp-root';
+/**
+ * Thrown when the socket dir resolves to a directory Nx will not accept.
+ * Invalid configuration, not a recoverable failure.
+ *
+ * Three reasons, and they are not interchangeable. A directory other users can
+ * reach is a security problem; the OS temp root is the user's own but holds
+ * everything else that uses it, and Nx deletes the socket directory
+ * recursively; an Nx container or cache root is refused because Nx manages what
+ * lives there. Telling someone their own `0700` directory lets a local attacker
+ * execute code would be false, which is why the reason is derived from the
+ * directory rather than the platform.
+ */
+export declare class InvalidSocketDirConfigured extends Error {
+    readonly dir: string;
+    readonly reason: SocketDirRefusal;
+    constructor(dir: string, reason: SocketDirRefusal);
+}
 export declare const DAEMON_DIR_FOR_CURRENT_WORKSPACE: string;
 export declare const DAEMON_OUTPUT_LOG_FILE: string;
 export declare const getDaemonSocketDir: () => string;
 export declare function writeDaemonLogs(error?: string): string;
 export declare function markDaemonAsDisabled(reason: string): void;
 export declare function isDaemonDisabled(): boolean;
+export declare function getSocketDir(): string;
+/**
+ * Plugin worker sockets get their own workspace-scoped directory rather than
+ * sitting in the shared system temp dir, which cannot be locked down.
+ */
+export declare function getPluginSocketDir(): string;
+/**
+ * Exported for tests: both fallback warnings fire once per process, so a suite
+ * that stages either fallback more than once has to clear the latches between
+ * cases.
+ */
+export declare function resetSocketDirWarningsForTesting(): void;
+export declare function getSocketDirFallbackCause(): unknown;
 /**
- * We try to create a socket file in a tmp dir, but if it doesn't work because
- * for instance we don't have permissions, we create it in DAEMON_DIR_FOR_CURRENT_WORKSPACE
+ * The NX_SOCKET_DIR that was refused, if that is why we are in the fallback.
+ * Reflects the most recent resolution only — both accessors are cleared at the
+ * top of every `createOwnerOnlySocketDir` call, and the daemon and plugin socket
+ * paths each drive one. Read it immediately after the call that produced the
+ * path, which is what `assertValidSocketPath` does.
  */
-export declare function getSocketDir(alreadyUnique?: boolean): string;
+export declare function getRefusedConfiguredSocketDir(): string | undefined;
 export declare function removeSocketDir(): void;