nx 23.2.0-beta.11 → 23.2.0-beta.12

package/dist/src/ai/constants.d.ts

@@ -29,3 +29,18 @@ export declare const nxMcpTomlHeader = "[mcp_servers.\"nx-mcp\"]";
  * For Nx < 22, uses 'nx-mcp'
  */
 export declare function getNxMcpTomlConfig(nxVersion: string): string;
+/**
+ * The Nx runtime roots as they belong in a *committed* sandbox allowlist.
+ *
+ * `~/.nx` is the literal tilde rather than an expanded `NX_HOME_TMP_DIR`: the
+ * sandbox expands it per user, which is the property that makes the entry worth
+ * committing at all. An absolute home would pin the file to whoever ran the
+ * generator.
+ *
+ * Both are listed because socket resolution walks a chain — `/tmp/.nx` first,
+ * `~/.nx` when a peer already owns the shared container. Allowing only the first
+ * leaves every user on a machine where someone else got there first silently
+ * uncovered. Windows resolves `NX_TMP_DIR` to a machine-specific `%TMP%` and has
+ * no sandbox to configure, so the POSIX root is the one that belongs here.
+ */
+export declare const NX_ALLOWLIST_ROOTS: readonly ["/tmp/.nx", '~/.nx'];

package/dist/src/ai/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.nxMcpTomlHeader = exports.analyticsDomain = exports.getAgentRulesWrapped = exports.rulesRegex = exports.nxRulesMarkerCommentEnd = exports.nxRulesMarkerCommentDescription = exports.nxRulesMarkerCommentStart = void 0;
+exports.NX_ALLOWLIST_ROOTS = exports.nxMcpTomlHeader = exports.analyticsDomain = exports.getAgentRulesWrapped = exports.rulesRegex = exports.nxRulesMarkerCommentEnd = exports.nxRulesMarkerCommentDescription = exports.nxRulesMarkerCommentStart = void 0;
 exports.agentsMdPath = agentsMdPath;
 exports.geminiMdPath = geminiMdPath;
 exports.parseGeminiSettings = parseGeminiSettings;
@@ -13,6 +13,7 @@ exports.getNxMcpTomlConfig = getNxMcpTomlConfig;
 const path_1 = require("path");
 const semver_1 = require("semver");
 const fileutils_1 = require("../utils/fileutils");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const get_agent_rules_1 = require("./set-up-ai-agents/get-agent-rules");
 function agentsMdPath(root) {
     return (0, path_1.join)(root, 'AGENTS.md');
@@ -74,3 +75,18 @@ command = "npx"
 args = ${args}
 `;
 }
+/**
+ * The Nx runtime roots as they belong in a *committed* sandbox allowlist.
+ *
+ * `~/.nx` is the literal tilde rather than an expanded `NX_HOME_TMP_DIR`: the
+ * sandbox expands it per user, which is the property that makes the entry worth
+ * committing at all. An absolute home would pin the file to whoever ran the
+ * generator.
+ *
+ * Both are listed because socket resolution walks a chain — `/tmp/.nx` first,
+ * `~/.nx` when a peer already owns the shared container. Allowing only the first
+ * leaves every user on a machine where someone else got there first silently
+ * uncovered. Windows resolves `NX_TMP_DIR` to a machine-specific `%TMP%` and has
+ * no sandbox to configure, so the POSIX root is the one that belongs here.
+ */
+exports.NX_ALLOWLIST_ROOTS = [nx_tmp_dir_1.NX_TMP_DIR_POSIX, '~/.nx'];

package/dist/src/ai/set-up-ai-agents/set-up-ai-agents.js

@@ -110,11 +110,43 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
                 ...json.enabledPlugins,
                 'nx@nx-claude-plugins': true,
             },
-            // Widening the sandbox's egress is only justified while events are
-            // actually being sent, so it follows the workspace's analytics opt-in.
-            ...(analyticsEnabled
-                ? { sandbox: allowAnalyticsDomain(json.sandbox) }
-                : {}),
+            // Allow Nx unix socket usage (daemon, plugin workers, forked processes)
+            // through Claude Code's sandbox, and analytics requests when the
+            // workspace has them on. Nx also copies its native binary into a cache
+            // under the same fixed tmp root before loading it, so the read/write
+            // grants cover that too. The root is a fixed /tmp path on macOS and
+            // Linux, so these entries are machine-independent and safe to commit.
+            sandbox: {
+                ...json.sandbox,
+                filesystem: {
+                    ...json.sandbox?.filesystem,
+                    allowRead: withEntries(json.sandbox?.filesystem?.allowRead, ...constants_1.NX_ALLOWLIST_ROOTS),
+                    // Covers the whole tmp root, not just the socket dir: the native
+                    // binary cache lives under it too, and without the cache a running
+                    // daemon keeps an open handle on the binding inside node_modules,
+                    // which blocks reinstalling or rebuilding dependencies. What keeps
+                    // users apart is not this allowlist but the 0700 per-uid directories
+                    // Nx verifies on every use (see ensureOwnedPrivateDir).
+                    allowWrite: withEntries(json.sandbox?.filesystem?.allowWrite, ...constants_1.NX_ALLOWLIST_ROOTS),
+                },
+                network: {
+                    ...json.sandbox?.network,
+                    // Egress follows the workspace's analytics opt-in (#36663). The
+                    // socket grant does not: Nx needs its sockets either way.
+                    ...(analyticsEnabled
+                        ? {
+                            allowedDomains: withEntries(json.sandbox?.network?.allowedDomains, constants_1.analyticsDomain),
+                        }
+                        : {}),
+                    // Covers binding as well as connecting, so a fresh daemon, a plugin
+                    // worker and a forked task can each create their own socket under
+                    // these roots. Deliberately scoped rather than `allowAllUnixSockets`,
+                    // which grants connect access to every socket on the machine —
+                    // including the Docker and SSH-agent sockets — and grants nothing
+                    // extra for creating Nx's own.
+                    allowUnixSockets: withEntries(json.sandbox?.network?.allowUnixSockets, ...constants_1.NX_ALLOWLIST_ROOTS),
+                },
+            },
         }));
         // Clean up .mcp.json (nx-mcp now handled by plugin)
         const mcpJsonPath = (0, constants_1.claudeMcpJsonPath)(options.directory);
@@ -308,17 +340,13 @@ async function setupAiAgentsGeneratorImpl(tree, options) {
         };
     };
 }
-function allowAnalyticsDomain(sandbox) {
-    const allowedDomains = sandbox?.network?.allowedDomains ?? [];
-    return {
-        ...sandbox,
-        network: {
-            ...sandbox?.network,
-            allowedDomains: allowedDomains.includes(constants_1.analyticsDomain)
-                ? allowedDomains
-                : [...allowedDomains, constants_1.analyticsDomain],
-        },
-    };
+/**
+ * The user's existing entries in their original order, plus any of `values`
+ * they do not already have. A Set does the deduping, so re-running the
+ * generator is a no-op rather than a growing list.
+ */
+function withEntries(existing, ...values) {
+    return [...new Set([...(existing ?? []), ...values])];
 }
 function writeAgentRules(tree, path, writeNxCloudRules) {
     if (!tree.exists(path)) {

package/dist/src/ai/utils.d.ts

@@ -18,3 +18,16 @@ export declare function getAgentConfigurations(agentsToConsider: Agent[], worksp
     disabledAgents: AgentConfiguration[];
 }>;
 export declare function configureAgents(agents: Agent[], workspaceRoot: string, useLatest?: boolean): Promise<void>;
+/**
+ * Explains a permission error thrown while writing agent configuration files.
+ *
+ * The errno alone does not identify the cause. Agent harnesses (e.g. Claude
+ * Code) deny writes to their own settings files from sandboxed shell commands,
+ * so `nx configure-ai-agents` run through an agent's bash tool fails with EPERM
+ * where the same command succeeds in a terminal — but a root-owned
+ * `.claude/settings.json` left by an earlier `sudo nx`, or a read-only
+ * checkout, produces the same errno with an unrelated remedy. The sandbox
+ * explanation is therefore only offered where a sandbox or an agent is
+ * actually detected, and the underlying message is kept either way.
+ */
+export declare function agentConfigWriteBlockedLines(error: unknown): string[];

package/dist/src/ai/utils.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentDisplayMap = exports.supportedAgents = void 0;
 exports.getAgentConfigurations = getAgentConfigurations;
 exports.configureAgents = configureAgents;
+exports.agentConfigWriteBlockedLines = agentConfigWriteBlockedLines;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const path_1 = require("path");
@@ -10,6 +11,7 @@ const configuration_1 = require("../config/configuration");
 const tree_1 = require("../generators/tree");
 const native_1 = require("../native");
 const fileutils_1 = require("../utils/fileutils");
+const is_sandbox_1 = require("../utils/is-sandbox");
 const nx_cloud_utils_1 = require("../utils/nx-cloud-utils");
 const output_1 = require("../utils/output");
 const constants_1 = require("./constants");
@@ -215,3 +217,30 @@ async function configureAgents(agents, workspaceRoot, useLatest) {
     modificationResults.messages.forEach((message) => output_1.output.log(message));
     modificationResults.errors.forEach((error) => output_1.output.error(error));
 }
+/**
+ * Explains a permission error thrown while writing agent configuration files.
+ *
+ * The errno alone does not identify the cause. Agent harnesses (e.g. Claude
+ * Code) deny writes to their own settings files from sandboxed shell commands,
+ * so `nx configure-ai-agents` run through an agent's bash tool fails with EPERM
+ * where the same command succeeds in a terminal — but a root-owned
+ * `.claude/settings.json` left by an earlier `sudo nx`, or a read-only
+ * checkout, produces the same errno with an unrelated remedy. The sandbox
+ * explanation is therefore only offered where a sandbox or an agent is
+ * actually detected, and the underlying message is kept either way.
+ */
+function agentConfigWriteBlockedLines(error) {
+    const err = error;
+    const target = err?.path ?? 'an agent configuration file';
+    return [
+        `Writing ${target} failed: ${err?.message ?? 'permission denied'}`,
+        ...((0, is_sandbox_1.isSandbox)() || (0, native_1.isAiAgent)()
+            ? [
+                "Agent sandboxes protect their own settings files from writes made by sandboxed shell commands, so this command cannot finish when run through an agent's bash tool.",
+                'To complete the AI agent setup, run `nx configure-ai-agents` from a regular terminal and relaunch the agent harness.',
+            ]
+            : [
+                'Check the ownership and mode of that path: an earlier `sudo nx` run or a read-only checkout produces this.',
+            ]),
+    ];
+}

package/dist/src/command-line/configure-ai-agents/configure-ai-agents.js

@@ -10,6 +10,7 @@ const pc = tslib_1.__importStar(require("picocolors"));
 const constants_1 = require("../../ai/constants");
 const detect_ai_agent_1 = require("../../ai/detect-ai-agent");
 const utils_1 = require("../../ai/utils");
+const permission_errors_1 = require("../../utils/permission-errors");
 const client_1 = require("../../daemon/client/client");
 const package_json_1 = require("../../utils/package-json");
 const output_1 = require("../../utils/output");
@@ -214,10 +215,18 @@ async function configureAiAgentsHandlerImpl(options) {
             }
             catch (e) {
                 configSpinner.fail('Failed to configure AI agents');
-                output_1.output.error({
-                    title: 'Error details:',
-                    bodyLines: [e.message],
-                });
+                if ((0, permission_errors_1.isPermissionDenied)(e)) {
+                    output_1.output.error({
+                        title: 'Nx was not permitted to write the AI agent configuration',
+                        bodyLines: (0, utils_1.agentConfigWriteBlockedLines)(e),
+                    });
+                }
+                else {
+                    output_1.output.error({
+                        title: 'Error details:',
+                        bodyLines: [e.message],
+                    });
+                }
                 process.exit(1);
             }
         }
@@ -310,10 +319,18 @@ async function configureAiAgentsHandlerImpl(options) {
     }
     catch (e) {
         configSpinner.fail('Failed to set up AI agents');
-        output_1.output.error({
-            title: 'Error details:',
-            bodyLines: [e.message],
-        });
+        if ((0, permission_errors_1.isPermissionDenied)(e)) {
+            output_1.output.error({
+                title: 'Nx was not permitted to write the AI agent configuration',
+                bodyLines: (0, utils_1.agentConfigWriteBlockedLines)(e),
+            });
+        }
+        else {
+            output_1.output.error({
+                title: 'Error details:',
+                bodyLines: [e.message],
+            });
+        }
         process.exit(1);
     }
 }

package/dist/src/command-line/init/implementation/utils.js

@@ -196,14 +196,6 @@ function createNxJsonFromTurboJson(turboJson) {
             nxJson.targetDefaults = targetDefaults;
         }
     }
-    /**
-     * The fact that cacheDir was in use suggests the user had a reason for deviating from the default.
-     * We can't know what that reason was, nor if it would still be applicable in Nx, but we can at least
-     * improve discoverability of the relevant Nx option by explicitly including it with its default value.
-     */
-    if (turboJson.cacheDir) {
-        nxJson.cacheDirectory = '.nx/cache';
-    }
     const defaultBase = (0, deduce_default_base_1.deduceDefaultBase)();
     // Do not add defaultBase if it is inferred to be the Nx default value of main
     if (defaultBase !== 'main') {

package/dist/src/command-line/init/init-v2.js

@@ -30,11 +30,14 @@ const utils_1 = require("./implementation/utils");
 const provenance_1 = require("../../utils/provenance");
 const handle_import_1 = require("../../utils/handle-import");
 const native_1 = require("../../native");
+const utils_2 = require("../../ai/utils");
+const permission_errors_1 = require("../../utils/permission-errors");
 const detect_ai_agent_1 = require("../../ai/detect-ai-agent");
 const ab_testing_1 = require("../../utils/ab-testing");
 const analytics_prompt_1 = require("../../utils/analytics-prompt");
 const is_ci_1 = require("../../utils/is-ci");
 const ai_output_1 = require("./utils/ai-output");
+const is_sandbox_1 = require("../../utils/is-sandbox");
 async function initHandler(options, inner = false) {
     // Use environment variable to force local execution
     if (process.env.NX_USE_LOCAL === 'true' || inner) {
@@ -119,8 +122,15 @@ async function runInit(options, baseMeta) {
     }
     // AI agent mode: apply defaults for non-interactive operation
     const aiMode = (0, native_1.isAiAgent)();
+    const isSandboxed = (0, is_sandbox_1.isSandbox)();
     if (aiMode) {
         options.interactive = false; // Force non-interactive
+        if (isSandboxed) {
+            // During init, before configuring AI agents, the daemon and
+            // plugin socket connections are not available
+            process.env.NX_DAEMON = 'false';
+            process.env.NX_ISOLATE_PLUGINS = 'false';
+        }
         if (options.nxCloud === undefined) {
             options.nxCloud = false; // Default to skip Nx Cloud
         }
@@ -320,21 +330,38 @@ async function runInit(options, baseMeta) {
             await (0, configure_plugins_1.configurePlugins)(pluginsToInstall, updatePackageScripts, pmc, repoRoot, options.verbose);
         }
     }
-    const selectedAgents = await (0, ai_agent_prompts_1.determineAiAgents)(options.aiAgents, options.interactive && guided);
+    // AI agent mode configures the detected agent automatically (aiAgents is
+    // pre-filled above); interactive humans are always prompted — even in the
+    // minimum setup — since agent configuration also writes the sandbox
+    // allowances the Nx daemon needs when driven by an agent later.
+    const selectedAgents = await (0, ai_agent_prompts_1.determineAiAgents)(options.aiAgents, options.interactive);
     if (selectedAgents && selectedAgents.length > 0) {
-        const tree = new tree_1.FsTree(repoRoot, false);
-        const aiAgentsCallback = await (0, set_up_ai_agents_1.setupAiAgentsGenerator)(tree, {
-            directory: '.',
-            writeNxCloudRules: options.nxCloud !== false,
-            packageVersion: 'latest',
-            agents: [...selectedAgents],
-        });
-        const changes = tree.listChanges();
-        (0, tree_1.flushChanges)(repoRoot, changes);
-        if (aiAgentsCallback) {
-            const results = await aiAgentsCallback();
-            results.messages.forEach((m) => output_1.output.log(m));
-            results.errors.forEach((e) => output_1.output.error(e));
+        try {
+            const tree = new tree_1.FsTree(repoRoot, false);
+            const aiAgentsCallback = await (0, set_up_ai_agents_1.setupAiAgentsGenerator)(tree, {
+                directory: '.',
+                writeNxCloudRules: options.nxCloud !== false,
+                packageVersion: 'latest',
+                agents: [...selectedAgents],
+            });
+            const changes = tree.listChanges();
+            (0, tree_1.flushChanges)(repoRoot, changes);
+            if (aiAgentsCallback) {
+                const results = await aiAgentsCallback();
+                results.messages.forEach((m) => output_1.output.log(m));
+                results.errors.forEach((e) => output_1.output.error(e));
+            }
+        }
+        catch (e) {
+            if (!(0, permission_errors_1.isPermissionDenied)(e)) {
+                throw e;
+            }
+            // Don't fail the whole init over this — everything else succeeded.
+            // Warned rather than thrown so the rest of the init result still stands.
+            output_1.output.warn({
+                title: 'AI agent configuration could not be written from this process',
+                bodyLines: (0, utils_2.agentConfigWriteBlockedLines)(e),
+            });
         }
     }
     let nxCloudChoice;

package/dist/src/command-line/reset/reset.js

@@ -8,7 +8,6 @@ const tmp_dir_1 = require("../../daemon/tmp-dir");
 const cache_directory_1 = require("../../utils/cache-directory");
 const output_1 = require("../../utils/output");
 const native_file_cache_location_1 = require("../../native/native-file-cache-location");
-const native_1 = require("../../native");
 const workspace_root_1 = require("../../utils/workspace-root");
 const client_2 = require("../../nx-cloud/utilities/client");
 const get_cloud_options_1 = require("../../nx-cloud/utilities/get-cloud-options");
@@ -133,8 +132,19 @@ function removeInstalledNxCloudClient() {
 function cleanupCacheEntries() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
         (0, node_fs_1.rmSync)(cache_directory_1.cacheDir, { recursive: true, force: true });
+        // `cacheDir` is the shared directory whenever sharing is available, so
+        // this is the checkout's own `.nx/cache`: still there from before the
+        // move, and still what a later run falls back to if `~/.nx` stops being
+        // reachable. Reset means both.
+        removeIfDistinct((0, cache_directory_1.cacheDirectoryForWorkspace)(workspace_root_1.workspaceRoot), cache_directory_1.cacheDir);
     });
 }
+/** Skips the no-op when the two resolve to one directory. */
+function removeIfDistinct(dir, from) {
+    if (dir !== from) {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+}
 function cleanupNativeFileCache() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
         // Null when the native cache root is not a real directory we own, which
@@ -148,20 +158,12 @@ function cleanupNativeFileCache() {
 function cleanupWorkspaceData() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
         (0, node_fs_1.rmSync)(cache_directory_1.workspaceDataDirectory, { recursive: true, force: true });
-        // If in a worktree, also clean the shared workspace data directory
-        // in the main repo where the DB actually lives
-        try {
-            const mainRoot = (0, native_1.getMainWorktreeRoot)(workspace_root_1.workspaceRoot);
-            if (mainRoot) {
-                const sharedDir = (0, cache_directory_1.workspaceDataDirectoryForWorkspace)(mainRoot);
-                if (sharedDir !== cache_directory_1.workspaceDataDirectory) {
-                    (0, node_fs_1.rmSync)(sharedDir, { recursive: true, force: true });
-                }
-            }
-        }
-        catch {
-            // Worktree detection is best-effort during reset
-        }
+        // Also clean wherever the DB actually lives, which is outside this
+        // checkout whenever the shared root is reachable. Resolved through the
+        // same decision the DB itself uses, so reset cannot delete a directory
+        // this process never wrote to -- a sandboxed agent that fell back to its
+        // own checkout, or a configured location, yields nothing extra.
+        removeIfDistinct((0, cache_directory_1.sharedDataDirectory)(workspace_root_1.workspaceRoot, 'workspace-data'), cache_directory_1.workspaceDataDirectory);
     });
 }
 async function incrementalBackoff(ms, maxDuration, callback) {