nx 23.1.1 → 23.1.3

package/dist/src/core/graph/styles.js

@@ -1 +1 @@
-"use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{8027(){}},e=>{var n;n=8027,e(e.s=n)}]);
+"use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{946(){}},e=>{var n;n=946,e(e.s=n)}]);

package/dist/src/daemon/client/client.d.ts

@@ -8,11 +8,23 @@ import { ConfigurationSourceMaps } from '../../project-graph/utils/project-confi
 import type { FlushSyncGeneratorChangesResult, SyncGeneratorRunResult } from '../../utils/sync-generators';
 import { type ConfigureAiAgentsStatusResponse } from '../message-types/configure-ai-agents';
 import { type NxConsoleStatusResponse, type SetNxConsolePreferenceAndInstallResponse } from '../message-types/nx-console';
+/** A refused connect: the errno, and the path it was made against. */
+type ConnectRefusal = {
+    error: NodeJS.ErrnoException;
+    socketPath: string;
+};
 export type UnregisterCallback = () => void;
 export type ChangedFile = {
     path: string;
     type: 'create' | 'update' | 'delete';
 };
+/**
+ * The daemon's workspace watcher died. Nothing it serves will see file changes
+ * again, so a watching client has to restart rather than keep waiting.
+ */
+export declare class WatcherFailedError extends Error {
+    constructor(message: string);
+}
 export declare class DaemonClient {
     private readonly nxJson;
     constructor();
@@ -93,6 +105,12 @@ export declare class DaemonClient {
     resetConfigureAiAgentsStatus(): Promise<{
         success: boolean;
     }>;
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    private probeServer;
     isServerAvailable(): Promise<boolean>;
     private startDaemonIfNecessary;
     private sendToDaemonViaQueue;
@@ -108,8 +126,41 @@ export declare class DaemonClient {
     private sendMessageToDaemon;
     private registerDaemonProcessWithMetricsService;
     private handleMessage;
-    startInBackground(): Promise<ChildProcess['pid']>;
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    startInBackground(probeRefusal?: ConnectRefusal): Promise<ChildProcess['pid']>;
     stop(): Promise<void>;
 }
 export declare const daemonClient: DaemonClient;
 export declare function isDaemonEnabled(): boolean;
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+export declare function isPermissionErrno(error: NodeJS.ErrnoException): boolean;
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+export declare function daemonPermissionException(socketPath: string, cause: string): Error;
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
+export declare function daemonProcessException(message: string): Error;
+export {};

package/dist/src/daemon/client/client.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.daemonClient = exports.DaemonClient = void 0;
+exports.daemonClient = exports.DaemonClient = exports.WatcherFailedError = void 0;
 exports.isDaemonEnabled = isDaemonEnabled;
+exports.isPermissionErrno = isPermissionErrno;
+exports.daemonPermissionException = daemonPermissionException;
+exports.daemonProcessException = daemonProcessException;
 const child_process_1 = require("child_process");
 const net_1 = require("net");
 const node_fs_1 = require("node:fs");
@@ -52,6 +55,18 @@ const WAIT_FOR_SERVER_CONFIG = {
     delayMs: 10,
     maxAttempts: 6000, // 6000 * 10ms = 60 seconds
 };
+/**
+ * The daemon's workspace watcher died. Nothing it serves will see file changes
+ * again, so a watching client has to restart rather than keep waiting.
+ */
+class WatcherFailedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'WatcherFailedError';
+        Object.setPrototypeOf(this, WatcherFailedError.prototype);
+    }
+}
+exports.WatcherFailedError = WatcherFailedError;
 class DaemonClient {
     constructor() {
         // Tracks the spinner owned by the in-flight request so streamed
@@ -177,12 +192,21 @@ class DaemonClient {
         return await this.sendToDaemonViaQueue({ type: 'REQUEST_FILE_DATA' });
     }
     hashTasks(runnerOptions, tasks, taskGraph, perTaskEnvs, cwd, collectInputs) {
+        // Task results get written back onto these task objects as the run
+        // progresses — hash/hashDetails/timestamps by hashing and the
+        // orchestrator, terminalOutput by the Nx Cloud life cycle (untyped) —
+        // so a later message would otherwise re-ship every earlier result.
+        const trimmedTasks = {};
+        for (const [id, t] of Object.entries(taskGraph.tasks)) {
+            const { hash, hashDetails, startTime, endTime, terminalOutput, ...strippedTask } = t;
+            trimmedTasks[id] = strippedTask;
+        }
         return this.sendToDaemonViaQueue({
             type: 'HASH_TASKS',
             runnerOptions,
             perTaskEnvs,
-            tasks,
-            taskGraph,
+            tasks: tasks.map((t) => trimmedTasks[t.id]),
+            taskGraph: { ...taskGraph, tasks: trimmedTasks },
             cwd,
             collectInputs,
         });
@@ -218,6 +242,13 @@ class DaemonClient {
             this.fileWatcherMessenger = new daemon_socket_messenger_1.DaemonSocketMessenger((0, net_1.connect)(socketPath)).listen((message) => {
                 try {
                     const parsedMessage = (0, consume_messages_from_socket_1.parseMessage)(message);
+                    if (parsedMessage?.watcherError) {
+                        const error = new WatcherFailedError(parsedMessage.watcherError);
+                        for (const cb of this.fileWatcherCallbacks.values()) {
+                            cb(error, null);
+                        }
+                        return;
+                    }
                     // Notify all callbacks
                     for (const cb of this.fileWatcherCallbacks.values()) {
                         cb(null, parsedMessage);
@@ -276,9 +307,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -428,9 +459,9 @@ class DaemonClient {
         // Wait for daemon server to be available before trying to reconnect
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             // Version mismatch - pass error to callbacks so they can handle it
@@ -665,30 +696,40 @@ class DaemonClient {
         };
         return this.sendToDaemonViaQueue(message);
     }
-    async isServerAvailable() {
+    /**
+     * The pre-start probe, returning why it failed rather than leaving it on the
+     * instance: `_daemonStatus` does not serialize `isServerAvailable`'s five
+     * public callers against `startDaemonIfNecessary`.
+     */
+    async probeServer() {
         return new Promise((resolve, reject) => {
             try {
                 const socketPath = this.getSocketPath();
                 if (!socketPath) {
-                    resolve(false);
+                    resolve({ available: false });
                     return;
                 }
                 const socket = (0, net_1.connect)(socketPath, () => {
                     socket.destroy();
-                    resolve(true);
+                    resolve({ available: true });
                 });
-                socket.once('error', () => {
-                    resolve(false);
+                socket.once('error', (err) => {
+                    // The only place the errno for "the socket is there but refuses us"
+                    // is produced, and the only thing separating it from "no daemon yet".
+                    resolve({ available: false, refusal: { error: err, socketPath } });
                 });
             }
             catch (err) {
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
                     reject(err); // Let version mismatch bubble up
                 }
-                resolve(false);
+                resolve({ available: false });
             }
         });
     }
+    async isServerAvailable() {
+        return (await this.probeServer()).available;
+    }
     async startDaemonIfNecessary() {
         if (this._daemonStatus == DaemonStatus.CONNECTED) {
             return;
@@ -697,21 +738,22 @@ class DaemonClient {
         if (this._daemonStatus == DaemonStatus.DISCONNECTED) {
             this._daemonStatus = DaemonStatus.CONNECTING;
             let daemonPid = null;
-            let serverAvailable;
+            let probe;
             try {
-                serverAvailable = await this.isServerAvailable();
+                probe = await this.probeServer();
             }
             catch (err) {
                 // Version mismatch - treat as server not available, start new one
                 if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
-                    serverAvailable = false;
+                    probe = { available: false };
                 }
                 else {
                     throw err;
                 }
             }
-            if (!serverAvailable) {
-                daemonPid = await this.startInBackground();
+            if (!probe.available) {
+                // Carried as a value so no other caller's probe can substitute for it.
+                daemonPid = await this.startInBackground(probe.refusal);
             }
             this.setUpConnection();
             this._daemonStatus = DaemonStatus.CONNECTED;
@@ -762,6 +804,11 @@ class DaemonClient {
             if (err.message.startsWith('connect ENOENT')) {
                 error = daemonProcessException('The Daemon Server is not running');
             }
+            else if (isPermissionErrno(err)) {
+                // The 0700 dir and 0600 socket mean the OS refuses this rather than the
+                // connect silently succeeding.
+                error = daemonPermissionException(socketPath, err.message);
+            }
             else if (err.message.startsWith('connect ECONNREFUSED')) {
                 error = daemonProcessException(`A server instance had not been fully shut down. Please try running the command again.`);
             }
@@ -782,9 +829,9 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.CONNECTING;
         let serverAvailable;
         try {
-            serverAvailable = await this.waitForServerToBeAvailable({
+            ({ available: serverAvailable } = await this.waitForServerToBeAvailable({
                 ignoreVersionMismatch: false,
-            });
+            }));
         }
         catch (err) {
             if (err instanceof daemon_socket_messenger_1.VersionMismatchError) {
@@ -830,6 +877,11 @@ class DaemonClient {
      */
     async waitForServerToBeAvailable(options) {
         logger_1.clientLogger.log(`[Client] Waiting for server (max: ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts, ${WAIT_FOR_SERVER_CONFIG.delayMs}ms interval)`);
+        // Poll-scoped, not instance state: reconnect paths have their own flags, so
+        // several attempts can be in flight and a shared slot would let one report
+        // another's socket.
+        let stoppedOnRefusal = false;
+        let refusal;
         const socket = await (0, wait_for_socket_connection_1.waitForSocketConnection)(() => {
             try {
                 return this.getSocketPath();
@@ -846,14 +898,29 @@ class DaemonClient {
         }, {
             maxAttempts: WAIT_FOR_SERVER_CONFIG.maxAttempts,
             delayMs: WAIT_FOR_SERVER_CONFIG.delayMs,
+            onConnectError: (error, socketPath) => {
+                refusal = { error, socketPath };
+                // A refusal is not expected to become an acceptance, so polling the
+                // full 60s budget only delays the same answer. Not absolute:
+                // `server.ts` binds before it chmods to 0600, so under a umask that
+                // strips owner write a same-user connect can lose a microsecond race
+                // and see EACCES. That costs a specific error rather than a retry — a
+                // better trade than a 60s hang.
+                return (stoppedOnRefusal = isPermissionErrno(error));
+            },
         });
         if (socket) {
             socket.destroy();
             logger_1.clientLogger.log(`[Client] Server available`);
-            return true;
+            return { available: true };
         }
-        logger_1.clientLogger.log(`[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
-        return false;
+        // Keyed on the early exit taken, not on whether an errno was recorded:
+        // every failed connect records one, including an ordinary cold start's
+        // ENOENT.
+        logger_1.clientLogger.log(stoppedOnRefusal
+            ? `[Client] Server refused the connection (${refusal?.error.code}), stopped polling`
+            : `[Client] Server not available after ${WAIT_FOR_SERVER_CONFIG.maxAttempts} attempts`);
+        return { available: false, refusal };
     }
     async sendMessageToDaemon(message, force) {
         // the first message sent to the daemon includes an env prop
@@ -935,7 +1002,12 @@ class DaemonClient {
             ].join('\n')));
         }
     }
-    async startInBackground() {
+    /**
+     * @param probeRefusal what the caller's pre-start probe saw. The only evidence
+     *        when a daemon refuses us and then exits — the poll cannot reproduce it
+     *        once the process json is gone. `nx daemon --start` passes nothing.
+     */
+    async startInBackground(probeRefusal) {
         if (global.NX_PLUGIN_WORKER) {
             throw new Error('Fatal Error: Something unexpected has occurred. Plugin Workers should not start a new daemon process. Please report this issue.');
         }
@@ -961,7 +1033,7 @@ class DaemonClient {
             detached: true,
             windowsHide: true,
             shell: false,
-            env: (0, daemon_environment_1.getDaemonEnv)(),
+            env: (0, daemon_environment_1.getDaemonSpawnEnv)(),
         });
         // The child now owns dup'd copies of the descriptors, so release ours.
         (0, node_fs_1.closeSync)(outFd);
@@ -973,14 +1045,25 @@ class DaemonClient {
         /**
          * Ensure the server is actually available to connect to via IPC before resolving
          */
-        const serverAvailable = await this.waitForServerToBeAvailable({
-            ignoreVersionMismatch: true,
-        });
-        if (serverAvailable) {
+        const { available, refusal: polled } = await this.waitForServerToBeAvailable({ ignoreVersionMismatch: true });
+        if (available) {
             logger_1.clientLogger.log(`[Client] Daemon server started, pid=${backgroundProcess.pid}`);
             return backgroundProcess.pid;
         }
         else {
+            // A permission refusal from either source wins, then the poll's errno,
+            // then the probe's. Recency alone would report a daemon's ENOENT over the
+            // EACCES the probe saw a moment earlier, losing the diagnosis.
+            const refusal = [polled, probeRefusal].find((r) => r && isPermissionErrno(r.error)) ??
+                polled ??
+                probeRefusal;
+            if (refusal && isPermissionErrno(refusal.error)) {
+                // Reported here rather than as a generic startup failure, so it degrades
+                // without disabling the daemon until `nx reset`. Both operands come from
+                // the refusal: resolving a path here instead would throw once a daemon
+                // that failed to bind has unlinked its process json.
+                throw daemonPermissionException(refusal.socketPath, refusal.error.message);
+            }
             throw daemonProcessException('Failed to start or connect to the Nx Daemon process.');
         }
     }
@@ -1023,24 +1106,65 @@ function isDocker() {
 function nxJsonIsNotPresent() {
     return !(0, nx_json_1.hasNxJson)(workspace_root_1.workspaceRoot);
 }
+/**
+ * EACCES and EPERM are the two errnos that mean the OS refused us rather than
+ * that nothing was listening. They need opposite remedies — a socket owned by
+ * someone else versus a sandbox refusing the connect syscall — but they share
+ * the property that retrying cannot change the answer.
+ */
+function isPermissionErrno(error) {
+    return error?.code === 'EACCES' || error?.code === 'EPERM';
+}
+/**
+ * The operating system refused the connection. Most often the socket belongs to
+ * another user, which is the guarantee the owner-only socket directory buys —
+ * but a sandbox that denies unix-socket connects produces the same errno, so the
+ * message does not assert which. Either way it is an environment condition
+ * rather than a defect in Nx, and it deliberately does not
+ * carry `internalDaemonError`: that tag tells the user to file an issue and
+ * disables the daemon until `nx reset`, which would outlast the stale socket
+ * that caused it.
+ *
+ * It also skips the daemon log that `daemonProcessException` appends. The log
+ * belongs to *our* daemon; the process holding this socket is someone else's, so
+ * quoting it would describe an unrelated run.
+ */
+function daemonPermissionException(socketPath, cause) {
+    const error = new Error([
+        `The operating system refused the connection to the Nx Daemon socket (${cause}).`,
+        '',
+        `Socket: ${socketPath}`,
+        '',
+        'Most often the socket belongs to a different user: a daemon left behind by running Nx under `sudo`, a different uid inside a container, or a working copy shared between accounts. If the socket is your own, a sandbox is refusing the connection instead.',
+        'If it belongs to another user, delete the socket above or set NX_SOCKET_DIR to a directory only your user can reach. If you are in a sandbox, allow unix sockets under the Nx socket root — in Claude Code a scoped `allowUnixSockets` only permits connecting, so starting a daemon there needs `allowAllUnixSockets: true`. See https://nx.dev/docs/kb/nx-sandbox-unix-sockets',
+    ].join('\n'));
+    error.daemonPermissionError = true;
+    return error;
+}
+/**
+ * Exported for testing: the `internalDaemonError` tag decides whether a daemon
+ * failure degrades to a daemonless graph build or aborts the command.
+ */
 function daemonProcessException(message) {
+    // The log is an enrichment, not the classifier: it is absent on a first run,
+    // which is exactly when the daemon is most likely to fail to start.
+    let body = message;
     try {
         let log = (0, node_fs_1.readFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE).toString().split('\n');
         if (log.length > 20) {
             log = log.slice(log.length - 20);
         }
-        const error = new Error([
+        body = [
             message,
             '',
             'Messages from the log:',
             ...log,
             '\n',
             `More information: ${tmp_dir_1.DAEMON_OUTPUT_LOG_FILE}`,
-        ].join('\n'));
-        error.internalDaemonError = true;
-        return error;
-    }
-    catch (e) {
-        return new Error(message);
+        ].join('\n');
     }
+    catch { }
+    const error = new Error(body);
+    error.internalDaemonError = true;
+    return error;
 }

package/dist/src/daemon/client/daemon-environment.d.ts

@@ -2,6 +2,23 @@ export declare function getDaemonEnv(): NodeJS.ProcessEnv & {
     NX_PROJECT_GLOB_CACHE: string;
     NX_CACHE_PROJECTS_CONFIG: string;
 };
+/**
+ * Env for spawning the daemon process. On top of the reflected env, it must
+ * keep excluded vars the daemon needs to start correctly:
+ * - ELECTRON_RUN_AS_NODE (matched by the ELECTRON_ prefix exclusion): when
+ *   the spawning client runs inside an Electron host, process.execPath is
+ *   the Electron binary and only this var makes it run the daemon's Node
+ *   entry point.
+ * - NX_WORKSPACE_ROOT_PATH: the daemon resolves its workspace root at
+ *   startup by walking up from cwd looking for workspace markers; without
+ *   the pin, a root without markers under an ancestor that has them
+ *   resolves to the ancestor and the daemon publishes its socket under the
+ *   wrong workspace.
+ */
+export declare function getDaemonSpawnEnv(): NodeJS.ProcessEnv & {
+    NX_PROJECT_GLOB_CACHE: string;
+    NX_CACHE_PROJECTS_CONFIG: string;
+};
 /**
  * Without the deletion step, a var set by one client (e.g.
  * `NX_PREFER_NODE_STRIP_TYPES=true` or `JAVA_TOOL_OPTIONS=...` for a single

package/dist/src/daemon/client/daemon-environment.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDaemonEnv = getDaemonEnv;
+exports.getDaemonSpawnEnv = getDaemonSpawnEnv;
 exports.applyDaemonEnvFromClient = applyDaemonEnvFromClient;
 const DAEMON_ENV_REQUIRED_SETTINGS = {
     NX_PROJECT_GLOB_CACHE: 'false',
@@ -37,6 +38,12 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'NX_BATCH_MODE',
     'NX_CI_EXECUTION_ID',
     'NX_DAEMON_PROCESS',
+    'NX_CLI_SET',
+    // Set by Nx Console on the extension host; always equals the daemon's own
+    // workspace root (foreign-workspace messages are rejected), and the daemon
+    // resolves its root at startup before any client env is applied. The spawn
+    // env keeps it so that startup resolution honors the pinned root.
+    'NX_WORKSPACE_ROOT_PATH',
     // Nx UI/logging vars (don't affect graph structure)
     'NX_TUI',
     'NX_TUI_AUTO_EXIT',
@@ -46,6 +53,7 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'NX_NATIVE_LOGGING',
     'NX_PROFILE',
     'NX_DAEMON_VERBOSE_LOGGING',
+    'NX_ORIGINAL_FORCE_COLOR',
     // AI agent detection vars (the daemon itself is not an AI agent)
     'CLAUDECODE',
     'CLAUDE_CODE',
@@ -54,9 +62,12 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'COMPOSER_NO_INTERACTION',
     'OPENCODE',
     'GEMINI_CLI',
+    'CODEX_THREAD_ID',
+    'AI_AGENT',
     // Shell mechanics
     '_',
     'SHLVL',
+    'PWD',
     'OLDPWD',
     'SHELL_SESSION_ID',
     'TERM_SESSION_ID',
@@ -66,6 +77,56 @@ const DAEMON_ENV_VARS_EXCLUSIONS = new Set([
     'COLUMNS',
     'LINES',
     'TMPDIR',
+    'PROMPT',
+    // Package-manager per-invocation vars not covered by the npm_/pnpm_ prefixes
+    'INIT_CWD',
+    'COLOR',
+    // Per-shell-session state; these tools' other vars are stable or can be
+    // meaningful (e.g. fnm's FNM_DIR), so no prefix exclusion
+    'FNM_MULTISHELL_PATH',
+    'POSH_SESSION_ID',
+    'MISE_SHELL',
+    // Editor preference; graph computation is non-interactive
+    'EDITOR',
+    'VISUAL',
+    // Output presentation
+    'PAGER',
+    'FORCE_COLOR',
+    'NO_COLOR',
+    'NODE_DISABLE_COLORS',
+    'FORCE_HYPERLINK',
+    // Terminal identification/presentation; differs per terminal app, so it
+    // churns whenever clients from different terminals share the daemon
+    'TERM',
+    'TERM_PROGRAM',
+    'TERM_PROGRAM_VERSION',
+    'COLORTERM',
+    'COLORFGBG',
+    'VTE_VERSION',
+    'GNOME_TERMINAL_SCREEN',
+    'GNOME_TERMINAL_SERVICE',
+    'WT_SESSION',
+    'WT_PROFILE_ID',
+    'TERMINAL_EMULATOR',
+    'TERMINUS_SUBLIME',
+    'ConEmuTask',
+    'ZELLIJ_PANE_ID',
+    'LC_TERMINAL',
+    'LC_TERMINAL_VERSION',
+    // Injected by VS Code and its extensions into integrated terminals. Single
+    // entries rather than GIT_/CHROME_/COPILOT_ prefixes: GIT_DIR, CHROME_BIN,
+    // COPILOT_HOME and COPILOT_GITHUB_TOKEN are functional inputs.
+    'GIT_ASKPASS',
+    'GIT_EDITOR',
+    'GIT_PAGER',
+    'GIT_MERGE_AUTOEDIT',
+    'APPLICATION_INSIGHTS_NO_STATSBEAT',
+    // Override for the @microsoft/mxc-sdk sandbox binaries; the SDK falls back
+    // to its bundled binaries when unset
+    'MXC_BIN_DIR',
+    'CHROME_CRASHPAD_PIPE_NAME',
+    'COPILOT_OTEL_FILE_EXPORTER_PATH',
+    'COPILOT_DEBUG_NONCE',
     // Session / auth
     'SSH_AUTH_SOCK',
     'SSH_AGENT_PID',
@@ -103,16 +164,37 @@ const DAEMON_ENV_PREFIX_EXCLUSIONS = [
     // Editors / IDEs
     'VSCODE_',
     'JETBRAINS_',
+    'ELECTRON_',
+    // AI agent harnesses (per-session ids; the bare CLAUDECODE/CLAUDE_CODE
+    // detection vars are excluded above)
+    'CLAUDE_CODE_',
+    // Shell prompts / integrations (per-command and per-session state)
+    'ATUIN_',
+    'STARSHIP_',
+    'MCFLY_',
+    'DIRENV_',
+    '__MISE_',
     // Terminal emulators
     'ITERM_',
     'KITTY_',
     'WEZTERM_',
     'ALACRITTY_',
     'KONSOLE_',
+    'GHOSTTY_',
     'TMUX',
     // Benchmarking / profiling tools
     'HYPERFINE_', // hyperfine sets HYPERFINE_RANDOMIZED_ENVIRONMENT_OFFSET for each iteration
 ];
+/**
+ * Env var name patterns that should never be sent to the daemon. For vars
+ * whose NAME embeds a process id, so neither an exact entry nor a safe
+ * prefix can match them.
+ */
+const DAEMON_ENV_PATTERN_EXCLUSIONS = [
+    // Set by Windows 11 explorer.exe as EFC_<pid> (observed as EFC_<pid>_<hash>
+    // in Electron-spawned shells); regenerated on every login
+    /^EFC_\d+(_\d+)?$/,
+];
 /**
  * Vars that match an excluded prefix but should still reach the daemon. The
  * Nx Cloud auth/access tokens are excluded by the `NX_CLOUD_` prefix, but
@@ -125,11 +207,14 @@ const DAEMON_ENV_PREFIX_EXCLUSION_OVERRIDES = new Set([
     'NX_CLOUD_AUTH_TOKEN',
 ]);
 function isExcludedEnvVar(key) {
+    if (DAEMON_ENV_VARS_EXCLUSIONS.has(key) ||
+        DAEMON_ENV_PATTERN_EXCLUSIONS.some((pattern) => pattern.test(key))) {
+        return true;
+    }
     if (DAEMON_ENV_PREFIX_EXCLUSION_OVERRIDES.has(key)) {
         return false;
     }
-    return (DAEMON_ENV_VARS_EXCLUSIONS.has(key) ||
-        DAEMON_ENV_PREFIX_EXCLUSIONS.some((prefix) => key.startsWith(prefix)));
+    return DAEMON_ENV_PREFIX_EXCLUSIONS.some((prefix) => key.startsWith(prefix));
 }
 function getDaemonEnv() {
     const env = { ...DAEMON_ENV_OVERRIDABLE_SETTINGS };
@@ -140,6 +225,29 @@ function getDaemonEnv() {
     }
     return Object.assign(env, DAEMON_ENV_REQUIRED_SETTINGS);
 }
+/**
+ * Env for spawning the daemon process. On top of the reflected env, it must
+ * keep excluded vars the daemon needs to start correctly:
+ * - ELECTRON_RUN_AS_NODE (matched by the ELECTRON_ prefix exclusion): when
+ *   the spawning client runs inside an Electron host, process.execPath is
+ *   the Electron binary and only this var makes it run the daemon's Node
+ *   entry point.
+ * - NX_WORKSPACE_ROOT_PATH: the daemon resolves its workspace root at
+ *   startup by walking up from cwd looking for workspace markers; without
+ *   the pin, a root without markers under an ancestor that has them
+ *   resolves to the ancestor and the daemon publishes its socket under the
+ *   wrong workspace.
+ */
+function getDaemonSpawnEnv() {
+    const env = getDaemonEnv();
+    if (process.env.ELECTRON_RUN_AS_NODE !== undefined) {
+        env.ELECTRON_RUN_AS_NODE = process.env.ELECTRON_RUN_AS_NODE;
+    }
+    if (process.env.NX_WORKSPACE_ROOT_PATH !== undefined) {
+        env.NX_WORKSPACE_ROOT_PATH = process.env.NX_WORKSPACE_ROOT_PATH;
+    }
+    return env;
+}
 /**
  * Without the deletion step, a var set by one client (e.g.
  * `NX_PREFER_NODE_STRIP_TYPES=true` or `JAVA_TOOL_OPTIONS=...` for a single

package/dist/src/daemon/client/daemon-socket-messenger.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DaemonSocketMessenger = exports.VersionMismatchError = void 0;
 const perf_hooks_1 = require("perf_hooks");
 const consume_messages_from_socket_1 = require("../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../utils/workspace-root");
 const logger_1 = require("../logger");
 const socket_utils_1 = require("../socket-utils");
 class VersionMismatchError extends Error {
@@ -21,6 +22,9 @@ class DaemonSocketMessenger {
         if (!this.socket) {
             throw new Error('Socket not initialized.');
         }
+        // Stamp every message with the sending workspace's root so the daemon can
+        // reject messages from a different workspace (e.g. a shared NX_SOCKET_DIR).
+        messageToDaemon.workspaceRoot = workspace_root_1.workspaceRoot;
         logger_1.clientLogger.log('[Messenger] Sending message type:', messageToDaemon.type);
         perf_hooks_1.performance.mark('daemon-message-serialization-start-' + messageToDaemon.type);
         const serialized = (0, socket_utils_1.serialize)(messageToDaemon, force);