nx 23.2.0-beta.4 → 23.2.0-beta.6

package/dist/src/command-line/migrate/migrate.js

@@ -7,16 +7,13 @@ exports.resolveInclude = resolveInclude;
 exports.parseMigrationsOptions = parseMigrationsOptions;
 exports.createFetcher = createFetcher;
 exports.generateMigrationsJsonAndUpdatePackageJson = generateMigrationsJsonAndUpdatePackageJson;
-exports.resolveAgenticRunId = resolveAgenticRunId;
 exports.formatSkippedPromptsNextStep = formatSkippedPromptsNextStep;
-exports.resolveCreateCommits = resolveCreateCommits;
-exports.confirmCommitsOnDefaultBranch = confirmCommitsOnDefaultBranch;
-exports.resolveShouldRunValidation = resolveShouldRunValidation;
 exports.executeMigrations = executeMigrations;
+exports.isSingleMigrationInvocation = isSingleMigrationInvocation;
 exports.migrate = migrate;
+exports.readLocalNxVersion = readLocalNxVersion;
 exports.runMigration = runMigration;
 exports.resolveMigrationForRun = resolveMigrationForRun;
-exports.resolveDocumentationFileToWorkspacePath = resolveDocumentationFileToWorkspacePath;
 exports.nxCliPath = nxCliPath;
 const tslib_1 = require("tslib");
 const pc = tslib_1.__importStar(require("picocolors"));
@@ -31,6 +28,7 @@ const util_1 = require("util");
 const fileutils_1 = require("../../utils/fileutils");
 const tar_1 = require("../../utils/tar");
 const write_formatted_json_file_1 = require("../../utils/write-formatted-json-file");
+const shell_quoting_1 = require("../../utils/shell-quoting");
 const logger_1 = require("../../utils/logger");
 const git_utils_1 = require("../../utils/git-utils");
 const command_line_utils_1 = require("../../utils/command-line-utils");
@@ -58,7 +56,6 @@ const multi_major_1 = require("./multi-major");
 const prompt_files_1 = require("./prompt-files");
 const command_object_1 = require("./command-object");
 const migrate_config_1 = require("./migrate-config");
-const handoff_gitignore_1 = require("./agentic/handoff-gitignore");
 const migrate_commits_1 = require("./migrate-commits");
 const migrate_output_1 = require("./migrate-output");
 const migration_shape_1 = require("./migration-shape");
@@ -69,6 +66,9 @@ Object.defineProperty(exports, "filterDowngradedUpdates", { enumerable: true, ge
 const version_utils_1 = require("./version-utils");
 Object.defineProperty(exports, "normalizeVersion", { enumerable: true, get: function () { return version_utils_1.normalizeVersion; } });
 const execute_migration_1 = require("./execute-migration");
+const sort_migrations_1 = require("./sort-migrations");
+const version_skew_guard_1 = require("./version-skew-guard");
+const versions_1 = require("../../utils/versions");
 tslib_1.__exportStar(require("./execute-migration"), exports);
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 function formatCommandFailure(command, error) {
@@ -671,6 +671,32 @@ async function parseTargetPackageAndVersion(args) {
     return { targetPackage: args, targetVersion: 'latest' };
 }
 async function parseMigrationsOptions(options, fetch) {
+    if (options.runMigration !== undefined) {
+        if (options.runMigration === '') {
+            throw new Error(`Error: '--run-migration' requires a migration id, e.g. '--run-migration=@nx/js:my-migration'.`);
+        }
+        if (options.runMigrations !== undefined) {
+            throw new Error(`Error: '--run-migration' (run a single migration) cannot be combined with '--run-migrations' (run the whole migrations file).`);
+        }
+        if (options.include) {
+            throw new Error(`Error: '--run-migration' cannot be combined with '--include'.`);
+        }
+        if (options.multiMajorMode) {
+            throw new Error(`Error: '--run-migration' cannot be combined with '--multi-major-mode'.`);
+        }
+        // `--if-exists` only applies to a whole-file run, so an explicit "on"
+        // conflicts. Its yargs default (false) is always present and is tolerated.
+        if (options.ifExists === true) {
+            throw new Error(`Error: '--run-migration' cannot be combined with '--if-exists'.`);
+        }
+        return {
+            type: 'runSingleMigration',
+            runMigration: options.runMigration,
+            agentic: options.agentic,
+            validate: options.validate,
+            interactive: options.interactive,
+        };
+    }
     if (options.runMigrations === '') {
         options.runMigrations = 'migrations.json';
     }
@@ -1593,136 +1619,22 @@ function showConnectToCloudMessage() {
         return false;
     }
 }
-function resolveAgenticRunId(migrations) {
-    return (0, semver_1.rsort)(migrations.map((m) => (0, version_utils_1.normalizeVersion)(m.version)))[0];
-}
 function formatSkippedPromptsNextStep(skipped) {
     return [
         'Some prompt migrations were skipped. Review and apply each of the following prompt files to the workspace, in the listed order:',
         ...skipped.map((m) => `  - ${m.prompt}`),
     ].join('\n');
 }
-/**
- * Resolves the effective `--create-commits` state once the agentic flow has
- * been resolved. The agent's outer prompt only embeds the impl-phase file list
- * when per-migration commits isolate each migration's diff, so the diff-context
- * flag returned here gates that section.
- */
-function resolveCreateCommits(args) {
-    const { createCommits, agenticKind, isGitRepo, commitPrefixIsCustom } = args;
-    // Explicit `--create-commits` without git is a hard error — the user asked
-    // for something we cannot deliver.
-    if (createCommits === true && !isGitRepo) {
-        return {
-            effective: false,
-            agenticHasDiffContext: false,
-            error: '`--create-commits` requires a git repository. Run `git init` first, or omit the flag.',
-        };
-    }
-    if (agenticKind === 'enabled') {
-        if (createCommits === false) {
-            return {
-                effective: false,
-                agenticHasDiffContext: false,
-                warning: "--no-create-commits was passed alongside --agentic. Without per-migration commits, the agent can't isolate the current migration's changes from earlier migrations in this run. Drop --no-create-commits for accurate per-migration review." +
-                    (commitPrefixIsCustom
-                        ? ' Note: the custom --commit-prefix value will have no effect because commits are disabled.'
-                        : ''),
-            };
-        }
-        // Without git we cannot soft-force commits the user didn't explicitly
-        // opt into. Degrade rather than error: continue the agentic run, but
-        // without per-file diff context (which depends on per-migration commits).
-        if (!isGitRepo) {
-            return {
-                effective: false,
-                agenticHasDiffContext: false,
-                warning: '`--agentic` enables per-migration commits by default, but the workspace is not a git repository. Continuing without commits — the agent will not receive per-file diff context. Run `git init` to enable.' +
-                    (commitPrefixIsCustom
-                        ? ' The custom --commit-prefix value will have no effect.'
-                        : ''),
-            };
-        }
-        return { effective: true, agenticHasDiffContext: true };
-    }
-    // Commits aren't enabled here. A custom prefix only reaches this path via
-    // nx.json (e.g. `migrate.commitPrefix` + `migrate.agentic` when the agentic
-    // flow resolves to disabled); surface that it has no effect rather than
-    // dropping it silently.
-    return {
-        effective: createCommits === true,
-        agenticHasDiffContext: false,
-        warning: commitPrefixIsCustom && createCommits !== true
-            ? 'A custom migrate commit prefix is configured, but commits are not enabled for this run, so it has no effect. Set `migrate.createCommits` to `true` (or pass `--create-commits`) to create a commit per migration.'
-            : undefined,
-    };
-}
-/**
- * Confirms before creating per-migration commits while the user sits on the
- * repository's default branch, so migrations don't silently commit there (most
- * relevant since `--agentic` enables commits by default). Only the default
- * branch triggers a prompt; a detached HEAD, a different branch, or an
- * unresolved default branch all proceed untouched. Callers gate this on
- * commits being effective and prompting being possible, so non-interactive
- * runs (CI, `--no-interactive`) never reach here.
- */
-async function confirmCommitsOnDefaultBranch(args) {
-    const { currentBranch, defaultBranch } = args;
-    if (!currentBranch || !defaultBranch || currentBranch !== defaultBranch) {
-        return true;
-    }
-    const { proceed } = await (0, safe_prompt_1.migratePrompt)([
-        {
-            name: 'proceed',
-            type: 'confirm',
-            message: `You're on the default branch '${currentBranch}'. nx migrate will create a commit for each migration on this branch. Continue?`,
-            initial: false,
-        },
-    ]);
-    return proceed;
-}
-/**
- * Resolves whether the framework-owned generic-validation agent step should run
- * after generator-only migrations.
- *
- * Default-on when the agentic flow resolved to `enabled`; silently ignored
- * otherwise (no warning emitted) — `--validate` requires an active agent
- * session by definition. An explicit `--no-validate` (`validate === false`)
- * opts out even when agentic is enabled.
- */
-function resolveShouldRunValidation(args) {
-    return args.validate !== false && args.agenticKind === 'enabled';
-}
 async function executeMigrations(root, migrations, isVerbose, shouldCreateCommits, commitPrefix, shouldSkipInstall = false, agentic, agenticHasDiffContext = false, shouldRunValidation = false) {
     const changedDepInstaller = new execute_migration_1.ChangedDepInstaller(root, shouldSkipInstall);
     const migrationsWithNoChanges = [];
-    const sortedMigrations = migrations.sort((a, b) => {
-        // Under `--agentic`, hoist the v23 migration that ignores
-        // `.nx/migrate-runs` to position 0 so its .gitignore update lands
-        // before any per-migration commit absorbs the run's handoff scratch.
-        // See `agentic/handoff-gitignore.ts` for the full rationale and the
-        // inline-fallback path that covers intra-pre-v23 agentic runs.
-        if (agentic?.kind === 'enabled') {
-            if ((0, handoff_gitignore_1.isHandoffGitignoreMigration)(a))
-                return -1;
-            if ((0, handoff_gitignore_1.isHandoffGitignoreMigration)(b))
-                return 1;
-        }
-        // special case for the split configuration migration to run first
-        if (a.name === '15-7-0-split-configuration-into-project-json-files') {
-            return -1;
-        }
-        if (b.name === '15-7-0-split-configuration-into-project-json-files') {
-            return 1;
-        }
-        return (0, semver_1.lt)((0, version_utils_1.normalizeVersion)(a.version), (0, version_utils_1.normalizeVersion)(b.version))
-            ? -1
-            : 1;
+    const sortedMigrations = (0, sort_migrations_1.sortMigrations)(migrations, {
+        hoistHandoffGitignore: agentic?.kind === 'enabled',
     });
     // Lazy-load the agentic chain so non-agentic runs don't pay its startup cost.
     let agenticRun;
     if (agentic?.kind === 'enabled' && sortedMigrations.length > 0) {
-        const { initRunDir } = require('./agentic/handoff');
+        const { initRunDir, resolveAgenticRunId } = require('./agentic/handoff');
         const { runAgenticPromptStep } = require('./agentic/run-step');
         agenticRun = {
             agentic,
@@ -1810,6 +1722,23 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
         // as a commit failure.
         return { kind: 'none' };
     }
+    // Records what a migration's deterministic phase produced. A migration that
+    // changed nothing must not attempt a commit: the absorbing `git add -A`
+    // would build a commit subject naming this no-op migration even though its
+    // content is entirely prior pending diffs, confusing `git log` / `git blame`
+    // attribution. Pending stays pending and the next change-producing migration
+    // absorbs it.
+    async function commitOrRecordNoChanges(m, madeChanges) {
+        if (!madeChanges) {
+            migrationsWithNoChanges.push(m);
+            return { kind: 'none' };
+        }
+        const commit = await attemptMigrationCommit(m);
+        if (commit.kind === 'landed' && commit.sha) {
+            logger_1.logger.info(pc.dim(`Committed as ${commit.sha}`));
+        }
+        return commit;
+    }
     const totalMigrations = sortedMigrations.length;
     let migrationIndex = 0;
     for (const m of sortedMigrations) {
@@ -1830,6 +1759,11 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
             const { resolvedCollection, documentationPath } = resolveMigrationForRun(root, m, !!agenticRun);
             let outcome;
             let commit = { kind: 'none' };
+            // Set when the migration returned `skipAgentic: true` and something was
+            // actually waived, so the end-of-run recaps can report it. A hybrid's
+            // prompt is owed in every agentic mode, so waiving it always counts; a
+            // generator-only migration only counts when validation would have run.
+            let waivedAgenticStep = false;
             if ((0, migration_shape_1.isPromptOnlyMigration)(m)) {
                 if (agenticRun) {
                     inAgenticStep = true;
@@ -1854,10 +1788,19 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
                 }
             }
             else if ((0, migration_shape_1.isHybridMigration)(m)) {
-                const { changes, nextSteps, agentContext, logs, madeChanges } = await (0, execute_migration_1.runNxOrAngularMigration)(root, m, isVerbose, 
+                const { changes, nextSteps, agentContext, skipAgentic, logs, madeChanges, } = await (0, execute_migration_1.runNxOrAngularMigration)(root, m, isVerbose, 
                 /* captureGeneratorOutput: */ !!agenticRun, resolvedCollection);
                 migrationEmittedNextSteps.push(...nextSteps);
-                if (agenticRun) {
+                if (skipAgentic) {
+                    // The generator reported the prompt half unnecessary, so nothing is
+                    // owed: no agent run, and no next-steps entry telling the user to
+                    // run the prompt themselves. Runs in all three agentic modes.
+                    (0, migrate_output_1.logWaivedAgenticStep)(m, agentContext);
+                    waivedAgenticStep = true;
+                    commit = await commitOrRecordNoChanges(m, madeChanges);
+                    outcome = madeChanges ? 'applied' : 'no-changes';
+                }
+                else if (agenticRun) {
                     // Install any deps the deterministic phase added/bumped before the
                     // agent runs — the prompt half may depend on them being present in
                     // node_modules.
@@ -1896,21 +1839,7 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
                         printDroppedAgentContext({ migration: m, agentContext });
                     }
                     skippedPrompts.push(m);
-                    if (!madeChanges) {
-                        migrationsWithNoChanges.push(m);
-                    }
-                    // Only attempt a commit when this migration's deterministic
-                    // phase actually produced changes. Otherwise the absorbing
-                    // `git add -A` would build a commit subject naming this no-op
-                    // migration even though its content is entirely prior pending
-                    // diffs — confusing `git log` / `git blame` attribution. Pending
-                    // stays pending and the next change-producing migration absorbs.
-                    if (madeChanges) {
-                        commit = await attemptMigrationCommit(m);
-                    }
-                    if (commit.kind === 'landed' && commit.sha) {
-                        logger_1.logger.info(pc.dim(`Committed as ${commit.sha}`));
-                    }
+                    commit = await commitOrRecordNoChanges(m, madeChanges);
                     outcome = 'deferred';
                 }
             }
@@ -1918,10 +1847,14 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
                 // Defer commit until validation succeeds; failed validation leaves
                 // changes uncommitted in the working tree for the user to review.
                 const validationRun = agenticRun && shouldRunValidation ? agenticRun : undefined;
-                const { changes, nextSteps, agentContext, logs, madeChanges } = await (0, execute_migration_1.runNxOrAngularMigration)(root, m, isVerbose, 
+                const { changes, nextSteps, agentContext, skipAgentic, logs, madeChanges, } = await (0, execute_migration_1.runNxOrAngularMigration)(root, m, isVerbose, 
                 /* captureGeneratorOutput: */ !!validationRun, resolvedCollection);
                 migrationEmittedNextSteps.push(...nextSteps);
-                const canRunValidation = !!validationRun && changes.length > 0;
+                // Whether a validation step was on the table at all. `skipAgentic`
+                // waives nothing when it wasn't, so the whole waived path hangs off
+                // this, not just the log line.
+                const validationApplies = !!validationRun && changes.length > 0;
+                const canRunValidation = validationApplies && !skipAgentic;
                 if (canRunValidation) {
                     // Install any deps the deterministic phase added/bumped before the
                     // validation agent runs — the agent may run tasks that need them.
@@ -1952,22 +1885,17 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
                     outcome = 'applied';
                 }
                 else {
-                    // Inner validation step didn't run. Surface `agentContext` under
-                    // `inside-agent` so the outer driving agent can ingest it.
-                    if (printDroppedAgentContext && agentContext.length > 0) {
-                        printDroppedAgentContext({ migration: m, agentContext });
+                    if (skipAgentic && validationApplies) {
+                        (0, migrate_output_1.logWaivedAgenticStep)(m, agentContext);
+                        waivedAgenticStep = true;
                     }
-                    if (!madeChanges) {
-                        migrationsWithNoChanges.push(m);
-                        outcome = 'no-changes';
-                    }
-                    else {
-                        commit = await attemptMigrationCommit(m);
-                        if (commit.kind === 'landed' && commit.sha) {
-                            logger_1.logger.info(pc.dim(`Committed as ${commit.sha}`));
-                        }
-                        outcome = 'applied';
+                    else if (printDroppedAgentContext && agentContext.length > 0) {
+                        // Inner validation step didn't run. Surface `agentContext` under
+                        // `inside-agent` so the outer driving agent can ingest it.
+                        printDroppedAgentContext({ migration: m, agentContext });
                     }
+                    commit = await commitOrRecordNoChanges(m, madeChanges);
+                    outcome = madeChanges ? 'applied' : 'no-changes';
                 }
             }
             outcomes.push({
@@ -1975,6 +1903,7 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
                 status: 'completed',
                 kind: outcome,
                 commit,
+                waivedAgenticStep,
             });
             logger_1.logger.info('');
         }
@@ -2037,7 +1966,7 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
         await installDepsIfChanged();
     }
     if (changedDepInstaller.skippedInstall) {
-        logSkippedPostMigrationInstall(root);
+        (0, execute_migration_1.logSkippedPostMigrationInstall)(root);
     }
     // Combined-view next-steps array kept for back-compat with repair.ts, which
     // consumes the single `nextSteps` field.
@@ -2053,6 +1982,7 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
         skippedPrompts,
         migrationEmittedNextSteps,
         committedShasCount: (0, migrate_output_1.countLandedCommits)(outcomes),
+        waivedAgenticStepsCount: (0, migrate_output_1.countWaivedAgenticSteps)(outcomes),
         // Migrations whose commits failed and never got absorbed by a later
         // commit. The caller surfaces them so a successful run doesn't claim
         // "up to date" while leaving uncommitted diffs in the working tree.
@@ -2060,13 +1990,18 @@ async function executeMigrations(root, migrations, isVerbose, shouldCreateCommit
         retainedAtSuccess: (0, migrate_output_1.retainedMigrations)(outcomes).map((p) => `${p.package}: ${p.name}`),
     };
 }
-function logSkippedPostMigrationInstall(root) {
-    const packageManager = (0, package_manager_1.detectPackageManager)(root);
-    const installCommand = (0, package_manager_1.getPackageManagerCommand)(packageManager, root).install;
-    output_1.output.warn({
-        title: 'Migrations updated your dependencies, but the install was skipped',
-        bodyLines: [`Run "${installCommand}" to install the updated dependencies.`],
-    });
+// nx is located at spawn time, after the gated pre-install, so the child runs
+// the bytes that install put in place.
+function handOffToLocalNx(args) {
+    const exitCode = runOrReturnExitCode(() => (0, child_process_2.runNxArgvSync)(['migrate', ...args], {
+        stdio: ['inherit', 'inherit', 'inherit'],
+        env: {
+            ...process.env,
+            NX_MIGRATE_SKIP_INSTALL: 'true',
+            NX_MIGRATE_USE_LOCAL: 'true',
+        },
+    }));
+    return exitCode !== 0 ? exitCode : undefined;
 }
 async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, commitPrefix, shouldSkipInstall = false) {
     if (!shouldSkipInstall && !process.env.NX_MIGRATE_SKIP_INSTALL) {
@@ -2075,18 +2010,7 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
     if (!__dirname.startsWith(workspace_root_1.workspaceRoot)) {
         // we are running from a temp installation with nx latest, switch to running
         // from local installation
-        const exitCode = runOrReturnExitCode(() => (0, child_process_2.runNxSync)(`migrate ${args.join(' ')}`, {
-            stdio: ['inherit', 'inherit', 'inherit'],
-            env: {
-                ...process.env,
-                NX_MIGRATE_SKIP_INSTALL: 'true',
-                NX_MIGRATE_USE_LOCAL: 'true',
-            },
-        }));
-        if (exitCode !== 0) {
-            return exitCode;
-        }
-        return;
+        return handOffToLocalNx(args);
     }
     const migrationsExists = (0, fileutils_1.fileExists)(opts.runMigrations);
     if (opts.ifExists && !migrationsExists) {
@@ -2098,12 +2022,13 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
     else if (!opts.ifExists && !migrationsExists) {
         throw new Error(`File '${opts.runMigrations}' doesn't exist, can't run migrations. Use flag --if-exists to run migrations only if the file exists`);
     }
-    const migrations = (0, fileutils_1.readJsonFile)((0, path_1.join)(root, opts.runMigrations)).migrations;
+    const migrationsJson = (0, fileutils_1.readJsonFile)((0, path_1.join)(root, opts.runMigrations));
+    const migrations = migrationsJson.migrations;
     (0, migrate_analytics_1.reportMigrateRunStart)({
         createCommits: shouldCreateCommits ?? false,
         migrationCount: migrations.length,
     });
-    const { resolveAgentic } = require('./agentic/select');
+    const { resolveAgentic, resolveShouldRunValidation } = require('./agentic/select');
     let agentic;
     try {
         agentic = await resolveAgentic({
@@ -2116,7 +2041,7 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
         (0, migrate_analytics_1.reportMigrateRunError)({ code: 'agentic', error: e });
         throw e;
     }
-    const { effective: effectiveCreateCommits, agenticHasDiffContext, warning: createCommitsWarning, error: createCommitsError, } = resolveCreateCommits({
+    const { effective: effectiveCreateCommits, agenticHasDiffContext, warning: createCommitsWarning, error: createCommitsError, } = (0, migrate_commits_1.resolveCreateCommits)({
         createCommits: shouldCreateCommits,
         agenticKind: agentic.kind,
         isGitRepo: (0, git_utils_1.isGitRepository)(root),
@@ -2133,7 +2058,7 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
         // `getBaseRef` may carry an `origin/` prefix (set by the CI-workflow
         // generator); compare against the local branch name.
         const defaultBranch = (0, command_line_utils_1.getBaseRef)((0, configuration_1.readNxJson)(root)).replace(/^origin\//, '');
-        const proceed = await confirmCommitsOnDefaultBranch({
+        const proceed = await (0, migrate_commits_1.confirmCommitsOnDefaultBranch)({
             currentBranch,
             defaultBranch,
         });
@@ -2161,8 +2086,9 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
         (0, migrate_commits_1.commitCheckpointBeforeMigrations)(root, commitPrefix);
     }
     if (agentic.kind === 'enabled') {
+        const { applyAgenticHandoffGitignoreFallback } = require('./agentic/handoff-gitignore');
         const { packageJson: nxPackageJson } = (0, package_json_1.readModulePackageJson)('nx', (0, installation_directory_1.getNxRequirePaths)(root));
-        await (0, handoff_gitignore_1.applyAgenticHandoffGitignoreFallback)({
+        await applyAgenticHandoffGitignoreFallback({
             migrations,
             installedNxVersion: nxPackageJson.version,
             effectiveCreateCommits,
@@ -2170,7 +2096,7 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
             root,
         });
     }
-    const { migrationsWithNoChanges, skippedPromptsCount, notRunMigrationsCount, skippedPrompts, migrationEmittedNextSteps, committedShasCount, retainedAtSuccess, } = await executeMigrations(root, migrations, isVerbose, effectiveCreateCommits, commitPrefix, shouldSkipInstall, agentic, agenticHasDiffContext, shouldRunValidation);
+    const { migrationsWithNoChanges, skippedPromptsCount, notRunMigrationsCount, skippedPrompts, migrationEmittedNextSteps, committedShasCount, waivedAgenticStepsCount, retainedAtSuccess, } = await executeMigrations(root, migrations, isVerbose, effectiveCreateCommits, commitPrefix, shouldSkipInstall, agentic, agenticHasDiffContext, shouldRunValidation);
     const ranWithChangesCount = migrations.length - notRunMigrationsCount - migrationsWithNoChanges.length;
     // The "applied" tally counts fully-completed migrations — those that
     // left no deferred work behind. Hybrid migrations whose prompt half was
@@ -2181,6 +2107,7 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
         appliedCount,
         committedShasCount,
         skippedPromptsCount,
+        waivedAgenticStepsCount,
         insideAgent,
     });
     const tallyBody = tallyLine ? [tallyLine] : undefined;
@@ -2262,18 +2189,26 @@ async function runMigrations(root, opts, args, isVerbose, shouldCreateCommits, c
         appliedCount,
     });
 }
+function isSingleMigrationInvocation(args) {
+    return args.runMigration !== undefined;
+}
 async function migrate(root, args, rawArgs) {
     await client_1.daemonClient.stop();
     return (0, handle_errors_1.handleErrors)(process.env.NX_VERBOSE_LOGGING === 'true', async () => {
         const mergedArgs = (0, migrate_config_1.applyNxJsonMigrateDefaults)(args, (0, configuration_1.readNxJson)().migrate);
-        (0, migrate_config_1.assertCommitPrefixHasCommits)(mergedArgs);
+        // A single-migration invocation resolves its commit config downstream via
+        // resolveCreateCommits, so this assert must not fire for it.
+        const singleMigration = isSingleMigrationInvocation(mergedArgs);
+        if (!singleMigration) {
+            (0, migrate_config_1.assertCommitPrefixHasCommits)(mergedArgs);
+        }
         // One fetcher (registry-first, install fallback) shared by the `--include`
         // eligibility gate and the migration cascade so package metadata is fetched
         // at most once per package/version.
         const fetch = createFetcher((0, package_manager_1.getPackageManagerCommand)());
-        // `--run-migrations` without a value parses as '' - undefined means the
-        // generate phase.
-        const isGenerateInvocation = mergedArgs['runMigrations'] === undefined;
+        // `--run-migrations` without a value parses as '', so only undefined (and
+        // no single-migration flag) means the generate phase.
+        const isGenerateInvocation = mergedArgs['runMigrations'] === undefined && !singleMigration;
         let opts;
         try {
             opts = await parseMigrationsOptions(mergedArgs, fetch);
@@ -2282,36 +2217,289 @@ async function migrate(root, args, rawArgs) {
             if (isGenerateInvocation) {
                 (0, migrate_analytics_1.reportMigrateGenerateError)('resolve_version', e);
             }
+            else if (singleMigration) {
+                (0, migrate_analytics_1.reportMigrateRunError)({ code: 'other', error: e });
+            }
             throw e;
         }
-        if (opts.type === 'generateMigrations') {
-            await generateMigrationsJsonAndUpdatePackageJson(root, opts, fetch);
+        switch (opts.type) {
+            case 'generateMigrations':
+                await generateMigrationsJsonAndUpdatePackageJson(root, opts, fetch);
+                return;
+            case 'runSingleMigration':
+                try {
+                    return await runSingleMigrationFromCli(root, opts, rawArgs, mergedArgs);
+                }
+                catch (e) {
+                    // `runInstall` already logged the remediation; returning instead of
+                    // rethrowing keeps `handleErrors` from printing a stack over it.
+                    if (e instanceof execute_migration_1.NpmPeerDepsInstallError) {
+                        (0, migrate_analytics_1.reportMigrateRunError)({ code: 'npm_install', error: e });
+                        return 1;
+                    }
+                    (0, migrate_analytics_1.reportMigrateRunError)({ code: 'other', error: e });
+                    throw e;
+                }
+            case 'runMigrations':
+                try {
+                    return await runMigrations(root, opts, rawArgs, mergedArgs['verbose'], mergedArgs['createCommits'], mergedArgs['commitPrefix'] ?? command_object_1.DEFAULT_MIGRATION_COMMIT_PREFIX, mergedArgs['skipInstall']);
+                }
+                catch (e) {
+                    if (e instanceof execute_migration_1.NpmPeerDepsInstallError) {
+                        (0, migrate_analytics_1.reportMigrateRunError)({ code: 'npm_install', error: e });
+                        return 1;
+                    }
+                    (0, migrate_analytics_1.reportMigrateRunError)({ code: 'other', error: e });
+                    throw e;
+                }
+            default: {
+                // `unhandled: never` makes a new invocation type a compile error here
+                // rather than a silent fall-through.
+                const unhandled = opts;
+                throw new Error(`Unhandled migrate invocation type: ${JSON.stringify(unhandled)}`);
+            }
         }
-        else {
-            try {
-                return await runMigrations(root, opts, rawArgs, mergedArgs['verbose'], mergedArgs['createCommits'], mergedArgs['commitPrefix'] ?? command_object_1.DEFAULT_MIGRATION_COMMIT_PREFIX, mergedArgs['skipInstall']);
+    });
+}
+// Evaluated manifest code can throw any value: a null-prototype object defeats
+// String() (the Object.prototype.toString rung catches it), and a revoked
+// proxy defeats that too. Interpolating either in a catch would throw again
+// and escape the catch.
+function stringifyCaught(e) {
+    try {
+        return String(e);
+    }
+    catch {
+        try {
+            return Object.prototype.toString.call(e);
+        }
+        catch {
+            return '<unprintable value>';
+        }
+    }
+}
+// A resolver-based lookup (including `resolvePackageJsonWithoutCachePollution`,
+// which does defeat Node's package self-reference) is the wrong tool here:
+// resolvers fall back to NODE_PATH after the explicit paths, and NODE_PATH
+// names the temp installation when this runs there. The scan below reads its
+// candidate directories itself, so neither NODE_PATH nor self-reference can
+// reach it; `getNxBin` (utils/child-process.ts), which locates the nx the
+// hand-off spawns, avoids resolvers for the same reason, over a narrower set
+// of directories: it skips `.nx/installation`, declines a root without a
+// package.json, and stops at the nearest install rather than reading past an
+// unusable one. The PnP branch below stays bespoke either way: a resolver
+// cannot see into the zip cache without the PnP runtime.
+function readLocalNxVersion(root) {
+    // A PnP manifest is consulted only when yarn drives the hand-off:
+    // `getRunNxBaseCommand` builds the hand-off command through this same
+    // detectPackageManager call (which answers from nx.json's
+    // cli.packageManager first, before any lockfile), and yarn is the one
+    // package manager that executes the manifest's nx. That mirror alone
+    // cannot see a switch off yarn, because yarn.lock survives one and
+    // outranks all but bun's lockfiles in the detection order, while .pnp.cjs
+    // lingers only on a switch to another package manager (yarn removes it
+    // when moving to node_modules linking). A rival lockfile beside the
+    // manifest is therefore read as evidence of such a switch, though not
+    // proof, since `pnpm install --lockfile-only` writes one without
+    // installing: on a scan miss the manifest still answers rather than
+    // failing the guards, and a rival install over a still-live PnP
+    // workspace is read over the PnP nx the yarn spawn executes, because
+    // preferring the manifest would judge the dead install that a completed
+    // switch leaves behind and refuse persistently. The known misread left
+    // is yarn classic driving a workspace with a leftover Berry manifest
+    // and no other lockfile; telling the two yarns apart from disk is not
+    // worth the fragility, and a `yarn node` runtime probe was rejected
+    // because its stdout is forgeable through an inherited NODE_OPTIONS
+    // preload and a hung descendant holding the output pipe outlives a
+    // subprocess timeout on this synchronous path.
+    const pnpManifest = ['.pnp.cjs', '.pnp.js']
+        .map((f) => (0, path_1.join)(root, f))
+        .find((f) => (0, fs_1.existsSync)(f));
+    if (pnpManifest) {
+        const competingLockfile = [
+            'package-lock.json',
+            'npm-shrinkwrap.json',
+            'pnpm-lock.yaml',
+            'bun.lockb',
+            'bun.lock',
+        ].some((f) => (0, fs_1.existsSync)((0, path_1.join)(root, f)));
+        if (competingLockfile) {
+            const version = scanNodeModulesForNxVersion(root);
+            if (version) {
+                return version;
             }
-            catch (e) {
-                // The remediation guidance is already logged by `runInstall`; swallow
-                // the error here so `handleErrors` doesn't print a noisy stack after
-                // the friendly output.
-                if (e instanceof execute_migration_1.NpmPeerDepsInstallError) {
-                    (0, migrate_analytics_1.reportMigrateRunError)({ code: 'npm_install', error: e });
-                    return 1;
+        }
+        try {
+            if ((0, package_manager_1.detectPackageManager)(root) === 'yarn') {
+                // Compiled manually rather than required: a require would serve the
+                // stale cached copy the runtime loaded at startup. new Function does
+                // not strip a leading shebang like the CJS loader, so drop it here.
+                const manifestModule = {
+                    exports: {},
+                };
+                new Function('module', 'exports', 'require', '__dirname', '__filename', (0, fs_1.readFileSync)(pnpManifest, 'utf-8').replace(/^#!.*/, ''))(manifestModule, manifestModule.exports, require, root, pnpManifest);
+                const packageJsonPath = manifestModule.exports.resolveRequest('nx/package.json', (0, path_1.join)(root, 'package.json'));
+                if (packageJsonPath) {
+                    // A resolving manifest names the install the yarn spawn runs, so
+                    // every branch below returns rather than falling through to the
+                    // ancestor scan.
+                    try {
+                        const { version } = (0, fileutils_1.readJsonFile)(packageJsonPath);
+                        if (typeof version === 'string') {
+                            logger_1.logger.verbose(`Read the workspace's nx version ${version} from '${packageJsonPath}'.`);
+                            return version;
+                        }
+                        logger_1.logger.verbose(`'${packageJsonPath}' does not declare a usable version.`);
+                        return undefined;
+                    }
+                    catch (readError) {
+                        // A zip-served path (installs with scripts disabled keep nx
+                        // zipped) cannot be read without the PnP runtime's zip fs, but
+                        // the manifest's own locator still names the version (e.g.
+                        // 'virtual:<hash>#npm:23.1.0').
+                        let version;
+                        try {
+                            const reference = manifestModule.exports.findPackageLocator?.(packageJsonPath)?.reference;
+                            version =
+                                typeof reference === 'string'
+                                    ? reference.match(/npm:([^#:]+)/)?.[1]
+                                    : undefined;
+                        }
+                        catch (locatorError) {
+                            logger_1.logger.verbose(`Could not read the nx locator from the PnP manifest '${pnpManifest}': ${stringifyCaught(locatorError)}`);
+                        }
+                        if (version && (0, semver_1.valid)(version)) {
+                            logger_1.logger.verbose(`Read the workspace's nx version ${version} from the locator in the PnP manifest '${pnpManifest}'.`);
+                            return version;
+                        }
+                        logger_1.logger.verbose(`Could not read the workspace's nx version through the PnP manifest '${pnpManifest}': ${stringifyCaught(readError)}`);
+                        return undefined;
+                    }
                 }
-                (0, migrate_analytics_1.reportMigrateRunError)({ code: 'other', error: e });
-                throw e;
             }
         }
+        catch (e) {
+            // Degrade to the full scan: neither a failed detection nor an
+            // unevaluable manifest can name the spawn's nx.
+            logger_1.logger.verbose(`Could not read the workspace's nx version through the PnP manifest '${pnpManifest}': ${stringifyCaught(e)}`);
+        }
+    }
+    return scanNodeModulesForNxVersion(root);
+}
+// The workspace's own install locations first (.nx/installation, root), then
+// ancestor directories: package-manager executable lookup ascends (npx and
+// bun always, pnpm and yarn inside an outer workspace) and hoisted layouts
+// install nx above the workspace root. `getNxBin` ascends too, so an ancestor
+// read here is usually the one the hand-off spawns. They diverge for a
+// `.nx/installation` workspace, which `getNxBin` declines, and where the only
+// nx found sits past the package manager's own lookup boundary and the spawn
+// has fallen back to that manager: yarn then reports "command not found"
+// while pnpm exec lands on an nx on PATH. The version read here is therefore
+// the readable answer, not necessarily the executed one.
+function scanNodeModulesForNxVersion(root) {
+    const searchPaths = [...(0, installation_directory_1.getNxRequirePaths)(root)];
+    for (let dir = (0, path_1.dirname)(root);; dir = (0, path_1.dirname)(dir)) {
+        searchPaths.push(dir);
+        if (dir === (0, path_1.dirname)(dir)) {
+            break;
+        }
+    }
+    return readNxVersionFromNodeModules(searchPaths);
+}
+function readNxVersionFromNodeModules(searchPaths) {
+    for (const searchPath of searchPaths) {
+        const packageJsonPath = (0, path_1.join)(searchPath, 'node_modules', 'nx', 'package.json');
+        try {
+            if ((0, fs_1.existsSync)(packageJsonPath)) {
+                const { version } = (0, fileutils_1.readJsonFile)(packageJsonPath);
+                if (typeof version === 'string') {
+                    logger_1.logger.verbose(`Resolved nx version ${version} from '${packageJsonPath}'.`);
+                    return version;
+                }
+                logger_1.logger.verbose(`'${packageJsonPath}' does not declare a usable version; continuing the search.`);
+            }
+        }
+        catch (e) {
+            logger_1.logger.verbose(`Could not read the workspace's installed nx version from '${packageJsonPath}': ${e}`);
+        }
+    }
+    return undefined;
+}
+// Keeps `--run-migration` behaving like `--run-migrations` when invoked from
+// a temp `nx@latest` install: same pre-install, same local-nx hand-off.
+async function runSingleMigrationFromCli(root, opts, args, mergedArgs) {
+    const shouldSkipInstall = mergedArgs['skipInstall'] ?? false;
+    if (!shouldSkipInstall && !process.env.NX_MIGRATE_SKIP_INSTALL) {
+        await (0, execute_migration_1.runInstall)(undefined, 'pre-migration', (0, execute_migration_1.formatSingleMigrationRerunCommand)(opts.runMigration));
+    }
+    if (!__dirname.startsWith(workspace_root_1.workspaceRoot)) {
+        // Must stay after the pre-install: it reads the version that install may
+        // have just updated, so checking earlier would falsely refuse a workspace
+        // whose package.json bump was not installed yet.
+        (0, version_skew_guard_1.assertWorkspaceNxSupportsNewMigrateFlags)({
+            argv: args,
+            // `workspaceRoot`, not `root`: the migrate flow's `root` is the
+            // invocation directory, which may sit below the workspace the hand-off
+            // resolves nx in.
+            readLocalNxVersion: () => readLocalNxVersion(workspace_root_1.workspaceRoot),
+        });
+        return handOffToLocalNx(args);
+    }
+    // The worker resolves the agentic flow, the effective commit config, and
+    // the default-branch confirmation itself; hand it the raw flags.
+    // Lazy-load run/ so plain migrate and repair runs don't pay for the agentic
+    // selection chain its barrel pulls in eagerly.
+    const { runSingleMigrationWorker } = require('./run');
+    await runSingleMigrationWorker({
+        root,
+        runMigration: opts.runMigration,
+        agentic: opts.agentic,
+        validate: opts.validate,
+        createCommits: mergedArgs['createCommits'],
+        commitPrefix: mergedArgs['commitPrefix'] ??
+            command_object_1.DEFAULT_MIGRATION_COMMIT_PREFIX,
+        interactive: opts.interactive,
+        skipInstall: shouldSkipInstall,
+        isVerbose: mergedArgs['verbose'] ?? false,
     });
 }
 async function runMigration() {
     return (0, handle_errors_1.handleErrors)(process.env.NX_VERBOSE_LOGGING === 'true', async () => {
-        const runLocalMigrate = () => runOrReturnExitCode(() => (0, child_process_2.runNxSync)(`_migrate ${process.argv.slice(3).join(' ')}`, {
+        // Spawning `nx _migrate` re-resolves the workspace's nx, normally the
+        // very installation running this code: bin/nx.ts delegated the outer
+        // `migrate` command to it, while `_migrate` skips that delegation. A
+        // new-flag invocation reaching this fallback therefore lands on an nx
+        // that parsed the flags, so it needs no capability check. Two lookups
+        // can still diverge from the running install, both properties of the
+        // spawn machinery rather than of this fallback: a `.nx/installation`
+        // beside a root package.json, and, once the spawn falls back to the
+        // package manager, a lookup that misses the workspace install and lands
+        // on an nx on PATH (pnpm exec).
+        const forwardedArgv = process.argv.slice(3);
+        const runLocalMigrate = () => runOrReturnExitCode(() => (0, child_process_2.runNxArgvSync)(['_migrate', ...forwardedArgv], {
             stdio: ['inherit', 'inherit', 'inherit'],
         }));
         if (process.env.NX_USE_LOCAL !== 'true' &&
             process.env.NX_MIGRATE_USE_LOCAL === undefined) {
+            // The version spec mirrors nxCliPath's; keep the two in sync.
+            const cliVersionSpec = process.env.NX_MIGRATE_CLI_VERSION || 'latest';
+            const target = await (0, version_skew_guard_1.resolveNewMigrateFlagsRunTarget)({
+                argv: process.argv.slice(3),
+                cliVersionSpec,
+                fromEnvOverride: !!process.env.NX_MIGRATE_CLI_VERSION,
+                ownNxVersion: versions_1.nxVersion,
+                resolveVersion: (spec) => 
+                // A probe must not prompt, write pnpm excludes, or install; a
+                // minimum-release-age violation surfaces as a rejection and
+                // routes local.
+                (0, resolve_package_version_1.resolvePackageVersionRespectingMinReleaseAge)('nx', spec, {
+                    applySideEffects: false,
+                }),
+                readLocalNxVersion: () => readLocalNxVersion(workspace_root_1.workspaceRoot),
+            });
+            if (target === 'local-nx') {
+                return runLocalMigrate();
+            }
             const p = await nxCliPath();
             if (p === null) {
                 return runLocalMigrate();
@@ -2322,14 +2510,26 @@ async function runMigration() {
                 process.env.npm_config_registry.match(/^https:\/\/registry\.(npmjs\.org|yarnpkg\.com)/)) {
                 delete process.env.npm_config_registry;
             }
-            // Intentionally not runNxSync: `p` is an nx CLI freshly installed into a
-            // temp dir by nxCliPath() (latest, or NX_MIGRATE_CLI_VERSION), so
-            // migrations run with an up-to-date migrate implementation instead of
-            // the workspace's current nx.
-            return runOrReturnExitCode(() => (0, child_process_1.execSync)(`${p} _migrate ${process.argv.slice(3).join(' ')}`, {
-                stdio: ['inherit', 'inherit', 'inherit'],
-                windowsHide: true,
-            }));
+            // Intentionally not the workspace's nx: `p` is an nx CLI freshly
+            // installed into a temp dir by nxCliPath() (latest, or
+            // NX_MIGRATE_CLI_VERSION), so migrations run with an up-to-date migrate
+            // implementation. `p` is <tmpDir>/node_modules/.bin/nx, a shell shim;
+            // spawning the entry point that install's own manifest names instead
+            // keeps the forwarded argv out of a shell. That install declares nx
+            // itself, so it is read without ascending: an nx above the temp dir is
+            // one nothing asked for, and the shim below is the answer instead.
+            const tempNxEntry = (0, child_process_2.readInstalledNxBin)((0, path_1.dirname)((0, path_1.dirname)((0, path_1.dirname)(p))));
+            return runOrReturnExitCode(() => tempNxEntry
+                ? (0, child_process_2.runNxArgvSync)(['_migrate', ...forwardedArgv], {
+                    stdio: ['inherit', 'inherit', 'inherit'],
+                    nxBin: tempNxEntry,
+                })
+                : (0, child_process_1.execSync)(`${(0, shell_quoting_1.quoteShellArg)(p)} _migrate ${forwardedArgv
+                    .map(shell_quoting_1.quoteShellArg)
+                    .join(' ')}`, {
+                    stdio: ['inherit', 'inherit', 'inherit'],
+                    windowsHide: true,
+                }));
         }
         return runLocalMigrate();
     });
@@ -2365,7 +2565,7 @@ function resolveMigrationForRun(root, migration, resolveDocumentation) {
     let documentationPath;
     if (resolveDocumentation && migration.documentation) {
         documentationPath = resolvedCollection
-            ? resolveDocumentationFileToWorkspacePath(root, (0, path_1.dirname)(resolvedCollection.collectionPath), migration.documentation)
+            ? (0, execute_migration_1.resolveDocumentationFileToWorkspacePath)(root, (0, path_1.dirname)(resolvedCollection.collectionPath), migration.documentation)
             : undefined;
         if (!documentationPath) {
             logger_1.logger.warn(`Could not resolve the "documentation" file "${migration.documentation}" declared for migration "${migration.package}: ${migration.name}". It will be skipped as additional context for the AI agent.`);
@@ -2373,24 +2573,6 @@ function resolveMigrationForRun(root, migration, resolveDocumentation) {
     }
     return { resolvedCollection, documentationPath };
 }
-// Resolves a `documentation` path (relative to the package's migrations dir) to
-// a workspace-relative path - or the absolute path when it resolves outside the
-// workspace (unusual hoisted/symlinked layouts). The agent runs with cwd =
-// workspace root, so the workspace-relative form is preferred. Returns
-// undefined when the file can't be resolved.
-function resolveDocumentationFileToWorkspacePath(root, migrationsDir, documentation) {
-    let documentationFile;
-    try {
-        documentationFile = require.resolve(documentation, {
-            paths: [migrationsDir],
-        });
-    }
-    catch {
-        return undefined;
-    }
-    const relativePath = (0, path_1.relative)(root, documentationFile);
-    return relativePath.startsWith('..') ? documentationFile : relativePath;
-}
 async function nxCliPath(nxWorkspaceRoot) {
     const version = process.env.NX_MIGRATE_CLI_VERSION || 'latest';
     const isVerbose = process.env.NX_VERBOSE_LOGGING === 'true';
@@ -2441,7 +2623,7 @@ async function nxCliPath(nxWorkspaceRoot) {
         return (0, path_1.join)(tmpDir, `node_modules`, '.bin', 'nx');
     }
     catch (e) {
-        console.error(`Failed to install the ${version} version of the migration script. Using the current version.`);
+        console.error(`Failed to install the ${version} version of the migration script. Falling back to the workspace's installed nx.`);
         if (isVerbose) {
             console.error(e);
         }