nx 23.2.0-beta.5 → 23.2.0-beta.7

package/dist/src/native/index.js

@@ -1,15 +1,11 @@
 const { join, basename } = require('path');
-const {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-} = require('fs');
+const { copyFileSync, renameSync, statSync, unlinkSync } = require('fs');
+const { createHash } = require('crypto');
 const Module = require('module');
 const { nxVersion } = require('../utils/versions');
-const { getNativeFileCacheLocation } = require('./native-file-cache-location');
+const {
+  ensureSecureNativeFileCacheLocation,
+} = require('./native-file-cache-location');
 
 const MAX_COPY_RETRIES = 3;
 
@@ -73,6 +69,14 @@ function statsOrNull(path) {
   }
 }
 
+function removeIfPresent(path) {
+  try {
+    unlinkSync(path);
+  } catch {
+    // Ignore cleanup errors
+  }
+}
+
 function isNoExecError(e) {
   return e.code === 'EACCES' || e.code === 'EPERM';
 }
@@ -95,20 +99,44 @@ Module._load = function (request, parent, isMain) {
     const nativeLocation = require.resolve(modulePath);
     const fileName = basename(nativeLocation);
 
-    // we copy the file to a workspace-scoped tmp directory and prefix with nxVersion to avoid stale files being loaded
-    const nativeFileCacheLocation = getNativeFileCacheLocation();
+    // null when the cache dir cannot be created *and trusted*; loading in place
+    // from node_modules is safer than loading out of a directory we don't own.
+    const nativeFileCacheLocation = ensureSecureNativeFileCacheLocation();
+    if (!nativeFileCacheLocation) {
+      return originalLoad.apply(this, [nativeLocation, parent, isMain]);
+    }
+
+    // nxVersion alone is not enough: in a source checkout it is the placeholder
+    // 0.0.1 for every worktree, so hashing the resolved binding path keeps each
+    // checkout in its own entry.
+    const cacheKey =
+      nxVersion +
+      '-' +
+      createHash('sha256')
+        .update(nativeLocation)
+        .digest('hex')
+        .substring(0, 12);
+
     // This is a path to copy to, not the one that gets loaded
     const tmpTmpFile = join(
       nativeFileCacheLocation,
-      nxVersion + '-' + Math.random() + fileName
+      cacheKey + '-' + Math.random() + fileName
     );
     // This is the path that will get loaded
-    const tmpFile = join(nativeFileCacheLocation, nxVersion + '-' + fileName);
-    const expectedFileSize = statSync(nativeLocation).size;
+    const tmpFile = join(nativeFileCacheLocation, cacheKey + '-' + fileName);
+    const sourceStats = statSync(nativeLocation);
+    const expectedFileSize = sourceStats.size;
     const existingFileStats = statsOrNull(tmpFile);
 
-    // If the file to be loaded already exists, just load it
-    if (existingFileStats?.size === expectedFileSize) {
+    // Size alone does not detect a rebuilt binding: a small Rust edit routinely
+    // produces a byte-identical size. The copy is taken after the build, so a
+    // cache entry older than the source means the source was rebuilt since.
+    const isFresh =
+      existingFileStats?.size === expectedFileSize &&
+      existingFileStats.mtimeMs >= sourceStats.mtimeMs;
+
+    // If the file to be loaded already exists and is current, just load it
+    if (isFresh) {
       try {
         return originalLoad.apply(this, [tmpFile, parent, isMain]);
       } catch (e) {
@@ -119,20 +147,36 @@ Module._load = function (request, parent, isMain) {
         throw e;
       }
     }
-    if (!existsSync(nativeFileCacheLocation)) {
-      mkdirSync(nativeFileCacheLocation, { recursive: true });
-    }
 
     // Retry copying up to 3 times, validating after each copy
+    let attemptsMade = 0;
+    let cacheError = null;
     for (let attempt = 1; attempt <= MAX_COPY_RETRIES; attempt++) {
+      attemptsMade = attempt;
       // First copy to a unique location for each process
-      copyFileSync(nativeLocation, tmpTmpFile);
+      try {
+        copyFileSync(nativeLocation, tmpTmpFile);
+      } catch (e) {
+        // Permission errors won't heal on retry, and a throwing copy can still
+        // have left a partial file behind.
+        cacheError = e;
+        removeIfPresent(tmpTmpFile);
+        break;
+      }
 
       // Validate the copy - check file size matches expected
       const copiedFileStats = statsOrNull(tmpTmpFile);
       if (copiedFileStats?.size === expectedFileSize) {
         // Copy succeeded, rename to final location and load
-        renameSync(tmpTmpFile, tmpFile);
+        try {
+          renameSync(tmpTmpFile, tmpFile);
+        } catch (e) {
+          // Unguarded, this throws out of `require` and native-bindings.js
+          // reports it as a missing optional dependency, which it is not.
+          cacheError = e;
+          removeIfPresent(tmpTmpFile);
+          break;
+        }
         try {
           return originalLoad.apply(this, [tmpFile, parent, isMain]);
         } catch (e) {
@@ -145,16 +189,15 @@ Module._load = function (request, parent, isMain) {
       }
 
       // Copy failed validation, clean up the malformed file
-      try {
-        unlinkSync(tmpTmpFile);
-      } catch {
-        // Ignore cleanup errors
-      }
+      removeIfPresent(tmpTmpFile);
     }
 
-    // All retries failed - warn and load from original location
+    // Name the errno: ENOSPC, EROFS, EACCES and EDQUOT are all actionable and
+    // otherwise indistinguishable.
     console.warn(
-      `Warning: Failed to copy native module to cache after ${MAX_COPY_RETRIES} attempts. ` +
+      `Warning: Failed to copy native module to cache after ${attemptsMade} attempt${
+        attemptsMade === 1 ? '' : 's'
+      }${cacheError ? ` (${cacheError.code ?? cacheError.message})` : ''}. ` +
         `Loading from original location instead. ` +
         `This may cause file locking issues on Windows.`
     );

package/dist/src/native/native-bindings.js

@@ -610,6 +610,7 @@ module.exports.getBinaryTarget = nativeBinding.getBinaryTarget
 module.exports.getDefaultMaxCacheSize = nativeBinding.getDefaultMaxCacheSize
 module.exports.getEventDimensions = nativeBinding.getEventDimensions
 module.exports.getFilesForOutputsBatch = nativeBinding.getFilesForOutputsBatch
+module.exports.getHardcodedIgnorePatterns = nativeBinding.getHardcodedIgnorePatterns
 module.exports.getMainWorktreeRoot = nativeBinding.getMainWorktreeRoot
 module.exports.getTransformableOutputs = nativeBinding.getTransformableOutputs
 module.exports.GroupType = nativeBinding.GroupType

package/dist/src/native/native-file-cache-location.d.ts

@@ -1 +1,17 @@
-export declare function getNativeFileCacheLocation(): string;
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+export declare const NATIVE_CACHE_ROOT: string;
+export declare function getNativeFileCacheLocationToDelete(): string | null;
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+export declare function ensureSecureNativeFileCacheLocation(cacheRoot?: string): string | null;

package/dist/src/native/native-file-cache-location.js

@@ -1,23 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNativeFileCacheLocation = getNativeFileCacheLocation;
-const os_1 = require("os");
+exports.NATIVE_CACHE_ROOT = void 0;
+exports.getNativeFileCacheLocationToDelete = getNativeFileCacheLocationToDelete;
+exports.ensureSecureNativeFileCacheLocation = ensureSecureNativeFileCacheLocation;
 const path_1 = require("path");
-const crypto_1 = require("crypto");
-const workspace_root_1 = require("../utils/workspace-root");
+const fs_1 = require("fs");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const versions_1 = require("../utils/versions");
-function getNativeFileCacheLocation() {
-    if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+const owned_private_dir_1 = require("../utils/owned-private-dir");
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+exports.NATIVE_CACHE_ROOT = (0, path_1.join)(nx_tmp_dir_1.NX_USER_TMP_DIR, 'native-cache');
+/**
+ * The configured cache dir, normalized. `resolve` strips a trailing slash, which
+ * would otherwise defeat the guards downstream: `lstat` on a path ending in `/`
+ * resolves a symlink rather than reporting it, and `O_NOFOLLOW` then opens the
+ * target. `NX_SOCKET_DIR` is normalized for the same reason.
+ */
+function configuredCacheDir() {
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+    return dir ? (0, path_1.resolve)(dir) : undefined;
+}
+function getNativeFileCacheLocationToDelete() {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        // Checked for ownership before it is handed to a recursive delete: being
+        // configured does not make it ours. Weaker than the load path below, which
+        // also enforces mode and validates the version directory.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(configured) ? configured : null;
     }
-    else {
-        const hash = (0, crypto_1.createHash)('sha256').update(workspace_root_1.workspaceRoot).update(versions_1.nxVersion);
+    return (0, owned_private_dir_1.isSafeSharedRoot)(nx_tmp_dir_1.NX_TMP_DIR).status === 'ok' &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(nx_tmp_dir_1.NX_USER_TMP_DIR) &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(exports.NATIVE_CACHE_ROOT)
+        ? (0, path_1.join)(exports.NATIVE_CACHE_ROOT, versions_1.nxVersion)
+        : null;
+}
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+function ensureSecureNativeFileCacheLocation(
+// Test seam: lets a spec plant a hostile directory under a root it controls.
+cacheRoot = exports.NATIVE_CACHE_ROOT) {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        const dir = configured;
         try {
-            hash.update((0, os_1.userInfo)().username);
+            // Held to the same 0700 bar as the default location: a `.node` is loaded
+            // out of here. Unlike NX_SOCKET_DIR it is not additionally refused for
+            // naming one of Nx's own roots, which is the only case that throws.
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(dir), { recursive: true });
+            const established = (0, owned_private_dir_1.ensureOwnedPrivateDir)(dir);
+            if (established.status !== 'ok') {
+                // The guard's own reason rather than a fixed sentence: `not-created
+                // (EACCES)` and `foreign-owner` are exactly what the catch below
+                // promises to tell apart, and one string for all of them cannot.
+                throw new owned_private_dir_1.DirectoryRefusedError(established.refusal);
+            }
+            return dir;
         }
         catch (e) {
-            // if there's no user, we only use the workspace root for the hash and move on
+            // Never discard a configured directory silently — the socket directory
+            // follows the same rule. A typo, EACCES or EROFS is otherwise
+            // indistinguishable from a working cache.
+            console.warn(`Nx could not use the configured native file cache directory ${dir} (${e?.code ?? e?.message ?? e}). Loading the native binding in place instead.`);
+            return null;
+        }
+    }
+    const userRoot = (0, path_1.dirname)(cacheRoot);
+    const sharedRoot = (0, path_1.dirname)(userRoot);
+    // Outermost first: the stable shared container must either belong to root or
+    // to us, and must be sticky if peers can write there. The uid directory then
+    // becomes the owner-only boundary for sockets and native-cache alike.
+    if ((0, owned_private_dir_1.ensureSafeSharedRoot)(sharedRoot).status !== 'ok') {
+        return null;
+    }
+    for (const root of [userRoot, cacheRoot]) {
+        if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(root).status !== 'ok') {
+            return null;
         }
-        return (0, path_1.join)((0, os_1.tmpdir)(), `nx-native-file-cache-${hash.digest('hex').substring(0, 7)}`);
     }
+    // Verified, not assumed: this is the directory we load a `.node` out of.
+    const versionDir = (0, path_1.join)(cacheRoot, versions_1.nxVersion);
+    if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(versionDir).status !== 'ok') {
+        return null;
+    }
+    return versionDir;
 }

package/dist/src/project-graph/plugins/isolation/isolated-plugin.d.ts

@@ -60,3 +60,4 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     shutdown(): void;
     private registerProcessMetrics;
 }
+export declare function getPluginWorkerSocketId(): string;

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IsolatedPlugin = void 0;
+exports.getPluginWorkerSocketId = getPluginWorkerSocketId;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const net_1 = require("net");
 const path = require("path");
 const logger_1 = require("../../../daemon/logger");
@@ -12,6 +14,7 @@ const installation_directory_1 = require("../../../utils/installation-directory"
 const logger_2 = require("../../../utils/logger");
 const progress_topics_1 = require("../../../utils/progress-topics");
 const wait_for_socket_connection_1 = require("../../../utils/wait-for-socket-connection");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const resolve_plugin_1 = require("../resolve-plugin");
 const messaging_1 = require("./messaging");
 const plugin_lifecycle_manager_1 = require("./plugin-lifecycle-manager");
@@ -336,6 +339,10 @@ class IsolatedPlugin {
 exports.IsolatedPlugin = IsolatedPlugin;
 // --- Worker Spawning Utilities ---
 global.nxPluginWorkerCount ??= 0;
+function getPluginWorkerSocketId() {
+    const counter = global.nxPluginWorkerCount++;
+    return `${process.pid}-${counter.toString(36)}-${(0, crypto_1.randomBytes)(4).toString('hex')}`;
+}
 async function startPluginWorker(name) {
     performance.mark(`start-plugin-worker:${name}`);
     const isWorkerTypescript = path.extname(__filename) === '.ts';
@@ -352,7 +359,14 @@ async function startPluginWorker(name) {
             }
             : {}),
     };
-    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)([process.pid, global.nxPluginWorkerCount++, performance.now()].join('-'));
+    // Keep the host pid readable for diagnostics, the counter collision-free
+    // within this process, and entropy for a reused pid across process runs. The
+    // suffix is a base36 counter plus four random bytes: eleven characters after
+    // the pid until the counter passes 36, and fixed-length where the
+    // `performance.now()` stamp it replaced varied with process uptime. That
+    // keeps the socket path inside the 95-character budget `assertValidSocketPath`
+    // enforces.
+    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)(getPluginWorkerSocketId());
     const worker = (0, child_process_1.spawn)(process.execPath, [
         // Spawn the worker with the same resolve conditions Nx uses for plugin
         // entries so the plugin's transitive workspace imports resolve to source.
@@ -361,6 +375,9 @@ async function startPluginWorker(name) {
         workerPath,
         ipcPath,
         name,
+        // The host's root. The worker validates against this rather than re-resolving,
+        // so the two agree by construction.
+        workspace_root_1.workspaceRoot,
     ], {
         stdio: ['ignore', 'pipe', 'pipe'],
         env,

package/dist/src/project-graph/plugins/isolation/messaging.d.ts

@@ -107,10 +107,23 @@ type PluginMessageDefs = DefineMessages<{
         };
     };
 }>;
+/**
+ * The sender's workspace root. Only the *worker* asserts on it, for host→worker
+ * messages; results and notifications carry the field but the host does not
+ * check it. The daemon channel is checked in the same one direction — the
+ * server validates inbound client messages and the client does not validate
+ * responses — so the two are alike rather than one being weaker.
+ * Optional and stamped centrally in `sendMessageOverSocket`, so the many
+ * message constructors need not set it; undefined is treated as not foreign,
+ * which is why this detects a shared socket directory rather than an attacker.
+ */
+export type WorkspaceStampedMessage = {
+    workspaceRoot?: string;
+};
 /** Union of all plugin worker message types */
-export type PluginWorkerMessage = AllMessages<PluginMessageDefs>;
+export type PluginWorkerMessage = AllMessages<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Union of all plugin worker result types */
-export type PluginWorkerResult = AllResults<PluginMessageDefs>;
+export type PluginWorkerResult = AllResults<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Result type for the load message */
 export type PluginWorkerLoadResult = ResultOf<PluginMessageDefs, 'load'>;
 /**
@@ -122,7 +135,7 @@ export type PluginWorkerEmitLogNotification = {
     type: 'emitLog';
     level: 'log' | 'warn' | 'error';
     message: string;
-};
+} & WorkspaceStampedMessage;
 export type PluginWorkerNotification = PluginWorkerEmitLogNotification;
 export declare function isPluginWorkerNotification(message: Serializable): message is PluginWorkerNotification;
 export declare function isPluginWorkerMessage(message: Serializable): message is PluginWorkerMessage;

package/dist/src/project-graph/plugins/isolation/messaging.js

@@ -7,6 +7,7 @@ exports.consumeMessage = consumeMessage;
 exports.sendMessageOverSocket = sendMessageOverSocket;
 const socket_utils_1 = require("../../../daemon/socket-utils");
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const NOTIFICATION_TYPES = [
     'emitLog',
 ];
@@ -81,6 +82,8 @@ async function consumeMessage(socket, raw, handlers) {
  * Sends a message over the socket with proper formatting.
  */
 function sendMessageOverSocket(socket, message) {
+    // Stamped here rather than in each constructor, mirroring the daemon.
+    message.workspaceRoot = workspace_root_1.workspaceRoot;
     socket.write((0, socket_utils_1.serialize)(message));
     socket.write(consume_messages_from_socket_1.MESSAGE_END_SEQ);
 }

package/dist/src/project-graph/plugins/isolation/plugin-worker.js

@@ -7,6 +7,7 @@ node_perf_hooks_1.performance.mark(`plugin worker ${process.pid} code loading --
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
 const logger_1 = require("../../../utils/logger");
 const serializable_error_1 = require("../../../utils/serializable-error");
+const daemon_message_1 = require("../../../daemon/message-types/daemon-message");
 const messaging_1 = require("./messaging");
 const worker_streaming_1 = require("./worker-streaming");
 const fs_1 = require("fs");
@@ -23,6 +24,19 @@ global.NX_PLUGIN_WORKER = true;
 let plugin;
 const socketPath = process.argv[2];
 const expectedPluginName = process.argv[3];
+// The host's root, passed explicitly rather than re-resolved: a host that set
+// its root at runtime would resolve a different one here and drop every
+// legitimate message as foreign.
+const hostWorkspaceRoot = process.argv[4];
+// Positional, so inserting an argument host-side shifts all of them — and the
+// symptom is silent and total: an undefined hostWorkspaceRoot makes every
+// message look foreign while the host waits out its plugin timeout.
+if (!socketPath || !expectedPluginName || !hostWorkspaceRoot) {
+    console.error(`[plugin-worker] started with an incomplete argument list ` +
+        `(socketPath=${socketPath}, pluginName=${expectedPluginName}, hostWorkspaceRoot=${hostWorkspaceRoot}). ` +
+        `This is an Nx bug — please report it at https://github.com/nrwl/nx/issues.`);
+    process.exit(1);
+}
 const CONNECT_TIMEOUT_MS = 30_000;
 let connectErrorTimeout = setErrorTimeout(CONNECT_TIMEOUT_MS, `The plugin worker for ${expectedPluginName} is exiting as it was not connected to within ${CONNECT_TIMEOUT_MS / 1000} seconds. ` +
     'Plugin workers expect to receive a socket connection from the parent process shortly after being started. ' +
@@ -45,6 +59,16 @@ const server = (0, net_1.createServer)((socket) => {
         if (!(0, messaging_1.isPluginWorkerMessage)(message)) {
             return;
         }
+        // Same check the daemon applies to its own socket. Dropped rather than thrown:
+        // a stray foreign message must not kill a worker serving its host. The daemon
+        // has a response channel and surfaces it to the client instead.
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(message, hostWorkspaceRoot, `The Nx plugin worker "${expectedPluginName}" (pid: ${process.pid})`);
+        }
+        catch (e) {
+            logger_1.logger.verbose(`[plugin-worker] ignored a "${message.type}" message: ${e instanceof Error ? e.message : e}`);
+            return;
+        }
         return (0, messaging_1.consumeMessage)(socket, message, {
             load: async ({ plugin: pluginConfiguration, root, name, pluginPath, shouldRegisterTSTranspiler, }) => {
                 loadErrorTimeout?.clear();
@@ -104,8 +128,24 @@ const server = (0, net_1.createServer)((socket) => {
         process.exit(0);
     });
 });
-server.listen(socketPath);
-logger_1.logger.verbose(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) listening on ${socketPath}`);
+server.on('error', (err) => {
+    // Without this the host only sees "exited before the connection was
+    // established"; the errno distinguishes a denied bind from EADDRINUSE.
+    console.error(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) failed to listen on ${socketPath}: ${err.message}`);
+    process.exit(1);
+});
+// A worker killed without its 'end' handler leaves the socket behind. Colliding
+// takes a recycled host pid landing on the same counter *and* the same 4 random
+// bytes; the random component is what this unlink rests on, and on Windows it is
+// the only barrier, since the endpoint is a namespace object and the mode never
+// applies. A failed bind surfaces through the error handler above.
+try {
+    (0, fs_1.unlinkSync)(socketPath);
+}
+catch { }
+server.listen(socketPath, () => {
+    logger_1.logger.verbose(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) listening on ${socketPath}`);
+});
 async function withErrorHandling(cb) {
     try {
         const result = await cb();
@@ -136,15 +176,25 @@ function setErrorTimeout(timeoutMs, errorMessage) {
         },
     };
 }
-const exitHandler = (exitCode) => () => {
+const cleanup = () => {
     server.close();
     try {
         (0, fs_1.unlinkSync)(socketPath);
     }
     catch (e) { }
-    process.exit(exitCode);
 };
-const events = ['SIGINT', 'SIGTERM', 'SIGQUIT', 'exit'];
-events.forEach((event) => process.once(event, exitHandler(0)));
-process.once('uncaughtException', exitHandler(1));
-process.once('unhandledRejection', exitHandler(1));
+const events = ['SIGINT', 'SIGTERM', 'SIGQUIT'];
+events.forEach((event) => process.once(event, () => {
+    cleanup();
+    process.exit(0);
+}));
+// Cleanup only: process.exit() here would override the real exit code.
+process.once('exit', cleanup);
+const fatalHandler = (error) => {
+    // Registering this handler suppresses Node's default reporting.
+    console.error(error);
+    cleanup();
+    process.exit(1);
+};
+process.once('uncaughtException', fatalHandler);
+process.once('unhandledRejection', fatalHandler);

package/dist/src/project-graph/project-graph.js

@@ -354,6 +354,26 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                 (0, tmp_dir_1.markDaemonAsDisabled)(e.message);
                 return buildProjectGraphAndSourceMapsWithoutDaemon();
             }
+            if (e.daemonPermissionError) {
+                // Deliberately not disabled: unlike the inotify limit above, a socket
+                // owned by someone else stops being there when it is removed or the
+                // machine reboots, and disabling until `nx reset` would outlive the
+                // cause and hide the fix from anyone who followed the advice.
+                // The first line carries the errno, and it is the one token that tells
+                // the two causes apart: EACCES is a socket owned by someone else (delete
+                // it), EPERM is a sandbox refusing the connect syscall (allow unix
+                // sockets under the Nx socket root). The message hedges between exactly
+                // those two because it cannot tell them apart, and this branch does not
+                // call writeDaemonLogs, so dropping the line loses the errno for good.
+                const [summary, ...details] = e.message.split('\n');
+                output_1.output.note({
+                    title: `${summary} Continuing without the daemon.`,
+                    // The blank line after the summary separates paragraphs when the
+                    // message is printed as one blob; as bodyLines it is a leading gap.
+                    bodyLines: details[0] === '' ? details.slice(1) : details,
+                });
+                return buildProjectGraphAndSourceMapsWithoutDaemon();
+            }
             if (e.internalDaemonError) {
                 const errorLogFile = (0, tmp_dir_1.writeDaemonLogs)(e.message);
                 output_1.output.warn({

package/dist/src/utils/child-process.d.ts

@@ -1,7 +1,37 @@
-import { type ExecOptions, type ExecSyncOptions } from 'child_process';
+import { type ExecOptions, type ExecSyncOptions, type SpawnSyncOptions } from 'child_process';
 import { PackageManagerCommands } from './package-manager';
 import { ChildProcess } from '../native';
 export declare function getRunNxBaseCommand(packageManagerCommand?: PackageManagerCommands, cwd?: string): string;
+/**
+ * Locate an nx entry point to spawn for the workspace at `root`, so a caller
+ * can run it directly instead of going through a shell. `findInstalledNxBin`
+ * decides which one.
+ *
+ * Null means nothing may be spawned directly, leaving the caller to fall back
+ * to `getRunNxBaseCommand`. Null is therefore always safe: it costs the
+ * argument fidelity a direct spawn buys, never the ability to run.
+ */
+export declare function getNxBin(root?: string): string | null;
+/**
+ * The entry point the nx installed directly under `dir` names, with no ascent
+ * to `dir`'s ancestors. For an installation that declares nx itself, such as
+ * the temp CLI `nx migrate` builds, an ancestor's nx is never the right answer.
+ */
+export declare function readInstalledNxBin(dir: string): string | null;
+/**
+ * Run a nx command, passing the arguments through as an argv array.
+ *
+ * When `getNxBin` names an entry point, the child is spawned directly with no
+ * shell in between, so every argument reaches the child exactly as provided:
+ * shell metacharacters (`(`, `%`, `^`, spaces, quotes) are data, not syntax.
+ * Otherwise falls back to the package-manager + shell path, where every
+ * argument goes through `quoteShellArg` and the Windows limits it documents
+ * apply.
+ */
+export declare function runNxArgvSync(argv: string[], options?: SpawnSyncOptions & {
+    cwd?: string;
+    nxBin?: string;
+}): void;
 export declare function runNxSync(cmd: string, options?: ExecSyncOptions & {
     cwd?: string;
     packageManagerCommand?: PackageManagerCommands;