nx 23.2.0 → 23.3.0-beta.0

package/dist/release/changelog-renderer/index.d.ts

@@ -106,5 +106,9 @@ export default class DefaultChangelogRenderer {
     protected groupChangesByScope(changes: ChangelogChange[]): Record<string, ChangelogChange[]>;
     protected extractBreakingChangeExplanation(message: string): string | null;
     private isBreakingChangeBoundary;
+    protected isAiAgentAuthor(author: {
+        name: string;
+        email: string;
+    }): boolean;
     protected formatName(name?: string): string;
 }

package/dist/release/changelog-renderer/index.js

@@ -3,6 +3,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const semver_1 = require("semver");
 // Stripped from breaking change explanations (e.g. bot/session markers).
 const HtmlCommentRegex = /<!--[\s\S]*?-->/g;
+// Keyed on email: agent display names track model versions (e.g. "Claude Opus
+// 5 (1M context)"), and a human contributor can share a name with an agent.
+const AiAgentAuthorEmails = new Set([
+    'noreply@anthropic.com',
+    'claude@anthropic.com',
+    'amp@ampcode.com',
+    'cursoragent@cursor.com',
+    'openhands@all-hands.dev',
+    'opendevin@all-hands.dev',
+]);
+// The Copilot coding agent's trailer is not always [bot]-suffixed.
+const CopilotAuthorEmailRegex = /^(?:\d+\+)?copilot@users\.noreply\.github\.com$/;
 class DefaultChangelogRenderer {
     /**
      * A ChangelogRenderer class takes in the determined changes and other relevant metadata
@@ -212,7 +224,7 @@ class DefaultChangelogRenderer {
             }
             for (const author of change.authors) {
                 const name = this.formatName(author.name);
-                if (!name || name.includes('[bot]')) {
+                if (!name || name.includes('[bot]') || this.isAiAgentAuthor(author)) {
                     continue;
                 }
                 if (!_authors.has(name)) {
@@ -371,6 +383,10 @@ class DefaultChangelogRenderer {
             // Git metadata delimiter following the body
             trimmed === '"');
     }
+    isAiAgentAuthor(author) {
+        const email = (author.email || '').trim().toLowerCase();
+        return (AiAgentAuthorEmails.has(email) || CopilotAuthorEmailRegex.test(email));
+    }
     formatName(name = '') {
         return name
             .split(' ')

package/dist/src/command-line/migrate/prompt-files.js

@@ -44,15 +44,8 @@ async function resolvePromptFiles(packageName, packageVersion, migrations, migra
         ? resolvedPromptFiles
         : undefined;
 }
-function isPromptPathWithinMigrationsDir(migrationsDir, promptRelPath) {
-    const rel = (0, path_1.relative)(migrationsDir, (0, path_1.join)(migrationsDir, promptRelPath));
-    return !((0, path_1.isAbsolute)(promptRelPath) ||
-        rel === '..' ||
-        rel.startsWith(`..${path_1.sep}`) ||
-        rel.startsWith(`..${path_1.posix.sep}`));
-}
 function assertPromptPathWithinMigrationsDir(migrationsDir, promptRelPath, packageName, packageVersion) {
-    if (!isPromptPathWithinMigrationsDir(migrationsDir, promptRelPath)) {
+    if (!(0, path_2.isContainedRelativePath)(promptRelPath)) {
         throw new Error(`Invalid prompt path "${promptRelPath}" in package "${packageName}@${packageVersion}": prompt paths must be relative and resolve within the package's migrations directory.`);
     }
 }
@@ -77,7 +70,7 @@ exports.PromptResolutionError = PromptResolutionError;
  * directory and point at an existing file.
  */
 function resolvePrompt(promptPath, migrationsDir) {
-    if (!isPromptPathWithinMigrationsDir(migrationsDir, promptPath)) {
+    if (!(0, path_2.isContainedRelativePath)(promptPath)) {
         throw new PromptResolutionError(promptPath, migrationsDir);
     }
     const resolvedPath = (0, path_1.join)(migrationsDir, promptPath);

package/dist/src/command-line/release/changelog.js

@@ -380,7 +380,9 @@ function createAPI(overrideReleaseConfig, ignoreNxJsonConfig) {
                 }
                 else {
                     const groupCacheKey = `${releaseGroup.name}:fixed`;
-                    const fromSHA = await getCachedFromSHA(groupCacheKey, releaseGroup.releaseTag.pattern, {}, workspacePreid ?? projectsPreid?.[Object.keys(projectsPreid)[0]], releaseGroup.releaseTag.checkAllBranchesWhen, releaseGroup.releaseTag.requireSemver, releaseGroup.releaseTag.strictPreid);
+                    const fromSHA = await getCachedFromSHA(groupCacheKey, releaseGroup.releaseTag.pattern, {
+                        releaseGroupName: releaseGroup.name,
+                    }, workspacePreid ?? projectsPreid?.[Object.keys(projectsPreid)[0]], releaseGroup.releaseTag.checkAllBranchesWhen, releaseGroup.releaseTag.requireSemver, releaseGroup.releaseTag.strictPreid);
                     if (!fromSHA) {
                         throw new Error(`Unable to determine the previous git tag. If this is the first release of your release group, use the --first-release option or set the "release.changelog.automaticFromRef" config property in nx.json to generate a changelog from the first commit. Otherwise, be sure to configure the "release.releaseTag.pattern" property in nx.json to match the structure of your repository's git tags.`);
                     }

package/dist/src/command-line/reset/reset.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetHandler = resetHandler;
 const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
 const client_1 = require("../../daemon/client/client");
 const tmp_dir_1 = require("../../daemon/tmp-dir");
 const cache_directory_1 = require("../../utils/cache-directory");
@@ -125,8 +124,7 @@ async function resetCloudClient() {
 }
 function removeInstalledNxCloudClient() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
-        const cloudClientDir = (0, update_manager_1.getBundleInstallDefaultLocation)();
-        (0, node_fs_1.rmSync)((0, node_path_1.join)(cloudClientDir, 'cloud'), { recursive: true, force: true });
+        (0, node_fs_1.rmSync)((0, update_manager_1.getBundleInstallDefaultLocation)(), { recursive: true, force: true });
     });
 }
 function cleanupCacheEntries() {

package/dist/src/daemon/client/daemon-environment.d.ts

@@ -62,3 +62,13 @@ export declare function getAppliedDaemonClientEnv(): {
  * previous client is stale all the same.
  */
 export declare function applyDaemonEnvFromClient(newEnv: NodeJS.ProcessEnv): string[];
+/**
+ * Yarn Berry creates a fresh BERRY_BIN_FOLDER for every invocation and puts it
+ * first on PATH. The wrappers inside are runtime state the daemon and workers
+ * must receive, but the folder's random name is not project-graph identity:
+ * two invocations whose environments differ only by it would compute the same
+ * graph. Strips the folder from PATH and pins the var to a sentinel so such
+ * environments compare equal. Returns a copy; never mutates runtime env.
+ */
+export declare function normalizeDaemonEnvironmentForGraph(env: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+export declare function getChangedEnvKeys(before: NodeJS.ProcessEnv, after: NodeJS.ProcessEnv): string[];

package/dist/src/daemon/client/daemon-environment.js

@@ -6,6 +6,8 @@ exports.getDaemonClientEnvGeneration = getDaemonClientEnvGeneration;
 exports.getDaemonSpawnEnv = getDaemonSpawnEnv;
 exports.getAppliedDaemonClientEnv = getAppliedDaemonClientEnv;
 exports.applyDaemonEnvFromClient = applyDaemonEnvFromClient;
+exports.normalizeDaemonEnvironmentForGraph = normalizeDaemonEnvironmentForGraph;
+exports.getChangedEnvKeys = getChangedEnvKeys;
 const file_hasher_1 = require("../../hasher/file-hasher");
 const DAEMON_ENV_REQUIRED_SETTINGS = {
     NX_PROJECT_GLOB_CACHE: 'false',
@@ -376,3 +378,45 @@ function applyDaemonEnvFromClient(newEnv) {
     appliedClientEnv = { ...newEnv };
     return [...changedKeys];
 }
+const BERRY_BIN_FOLDER_GRAPH_IDENTITY = '<YARN_BERRY_BIN_FOLDER>';
+/**
+ * Yarn Berry creates a fresh BERRY_BIN_FOLDER for every invocation and puts it
+ * first on PATH. The wrappers inside are runtime state the daemon and workers
+ * must receive, but the folder's random name is not project-graph identity:
+ * two invocations whose environments differ only by it would compute the same
+ * graph. Strips the folder from PATH and pins the var to a sentinel so such
+ * environments compare equal. Returns a copy; never mutates runtime env.
+ */
+function normalizeDaemonEnvironmentForGraph(env, platform = process.platform) {
+    const normalized = { ...env };
+    const berryBinFolder = normalized.BERRY_BIN_FOLDER;
+    if (!berryBinFolder) {
+        return normalized;
+    }
+    const pathKey = Object.keys(normalized).find((key) => key.toUpperCase() === 'PATH');
+    if (pathKey && normalized[pathKey]) {
+        const pathDelimiter = platform === 'win32' ? ';' : ':';
+        const canonicalize = (value) => {
+            const withPlatformSeparators = platform === 'win32' ? value.replaceAll('/', '\\') : value;
+            return platform === 'win32'
+                ? withPlatformSeparators.toLowerCase()
+                : withPlatformSeparators;
+        };
+        const canonicalBerryBinFolder = canonicalize(berryBinFolder);
+        normalized[pathKey] = normalized[pathKey]
+            .split(pathDelimiter)
+            .filter((entry) => canonicalize(entry) !== canonicalBerryBinFolder)
+            .join(pathDelimiter);
+    }
+    normalized.BERRY_BIN_FOLDER = BERRY_BIN_FOLDER_GRAPH_IDENTITY;
+    return normalized;
+}
+function getChangedEnvKeys(before, after) {
+    const changedKeys = [];
+    for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+        if (before[key] !== after[key]) {
+            changedKeys.push(key);
+        }
+    }
+    return changedKeys;
+}

package/dist/src/daemon/server/handle-client-env.js

@@ -29,12 +29,30 @@ async function handleClientEnv(env) {
     while (inFlightApply) {
         await inFlightApply;
     }
+    const graphEnvBefore = (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(process.env);
+    const previousClientEnv = (0, daemon_environment_1.getAppliedDaemonClientEnv)()?.env;
     const changedEnvKeys = (0, daemon_environment_1.applyDaemonEnvFromClient)(env);
     if (changedEnvKeys.length === 0) {
         return;
     }
-    logger_1.serverLogger.log(`Graph recompute necessary due to env variable refresh. Changed keys: ${changedEnvKeys.join(', ')}`);
-    const apply = applyEnvChange(env);
+    // Runtime changes always reach the workers, but only changes that survive
+    // graph normalization (e.g. Yarn Berry's per-invocation BERRY_BIN_FOLDER
+    // does not) invalidate the computed graph.
+    const graphChangedKeys = new Set([
+        ...(0, daemon_environment_1.getChangedEnvKeys)(graphEnvBefore, (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(process.env)),
+        ...(previousClientEnv
+            ? (0, daemon_environment_1.getChangedEnvKeys)((0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(previousClientEnv), (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(env))
+            : []),
+    ]);
+    if (graphChangedKeys.size > 0) {
+        logger_1.serverLogger.log(`Graph recompute necessary due to env variable refresh. Changed keys: ${[
+            ...graphChangedKeys,
+        ].join(', ')}`);
+    }
+    else {
+        logger_1.serverLogger.log(`Env variable refresh changed only runtime values (${changedEnvKeys.join(', ')}); graph identity is unchanged, keeping the cached graph.`);
+    }
+    const apply = applyEnvChange(env, graphChangedKeys.size > 0);
     inFlightApply = apply;
     try {
         await apply;
@@ -45,8 +63,11 @@ async function handleClientEnv(env) {
         }
     }
 }
-async function applyEnvChange(env) {
+async function applyEnvChange(env, invalidateGraph) {
     await forwardEnvToPluginWorkers(env);
+    if (!invalidateGraph) {
+        return;
+    }
     // Discarding the cached graph makes the next request recompute under the
     // new env, and chains any in-flight compute (started under the old env) to
     // that successor.

package/dist/src/nx-cloud/update-manager.js

@@ -12,6 +12,7 @@ const axios_1 = require("./utilities/axios");
 const debug_logger_1 = require("./debug-logger");
 const tar = tslib_1.__importStar(require("tar-stream"));
 const cache_directory_1 = require("../utils/cache-directory");
+const is_ci_1 = require("../utils/is-ci");
 const crypto_1 = require("crypto");
 const workspace_root_1 = require("../utils/workspace-root");
 class NxCloudEnterpriseOutdatedError extends Error {
@@ -106,9 +107,9 @@ function getBundleInstallDefaultLocation() {
     if ((0, fs_1.existsSync)(legacyPath)) {
         return legacyPath;
     }
-    else {
-        return (0, path_1.join)(cache_directory_1.cacheDir, 'cloud');
-    }
+    // The bundle `require`s a bare `nx`, so it must sit where that resolves: on CI
+    // the shared per-user root is outside the checkout (NXC-4944).
+    return (0, path_1.join)((0, is_ci_1.isCI)() ? (0, cache_directory_1.cacheDirectoryForWorkspace)(workspace_root_1.workspaceRoot) : cache_directory_1.cacheDir, 'cloud');
 }
 const runnerBundleInstallDirectory = getBundleInstallDefaultLocation();
 function getLatestInstalledRunnerBundle() {

package/dist/src/plugins/js/lock-file/pruned-output.d.ts

@@ -42,15 +42,16 @@ type PrunedPnpmConfig = {
  * file is inert, verified installable with identical module resolution on
  * pnpm 9, 10 and 11.
  *
- * pnpm 11+ reads build approvals (`allowBuilds`), `supportedArchitectures` and
- * `patchedDependencies` only from pnpm-workspace.yaml, so those are carried
- * from the workspace root; pass `prunedLockfileContent` to scope the approvals
- * to the packages the pruned lockfile keeps (an approval for an absent package
- * is inert either way, this only keeps the emitted file accurate). On
- * pnpm <=10, which reads them from the emitted package.json instead (see
- * `getPrunedPnpmPackageJsonBuildSettings`), or when the workspace declares
- * none, the file holds only `packages: []`. Resolution-time config stays out:
- * the pruned lockfile bakes it in (`stripPrunedLockfilePnpmConfig`).
+ * On pnpm 11+, this file carries declared `minimumReleaseAge`,
+ * `minimumReleaseAgeExclude`, `minimumReleaseAgeStrict`, build approvals,
+ * `supportedArchitectures`, and applicable `patchedDependencies` from the
+ * workspace root. Approvals and patches are scoped to the pruned lockfile.
+ *
+ * On pnpm <=10, only build approvals, `supportedArchitectures`, and
+ * `patchedDependencies` are emitted in `package.json`.
+ *
+ * Settings encoded in the pruned resolution, such as `overrides` and
+ * `packageExtensions`, are not copied (`stripPrunedLockfilePnpmConfig`).
  *
  * The major is the build machine's pnpm, which is all that is knowable at
  * build time: an output built on pnpm <=10 but deployed on pnpm 11+ will not

package/dist/src/plugins/js/lock-file/pruned-output.js

@@ -107,15 +107,16 @@ function dropInheritedPnpmPatchedDependencies(packageJson) {
  * file is inert, verified installable with identical module resolution on
  * pnpm 9, 10 and 11.
  *
- * pnpm 11+ reads build approvals (`allowBuilds`), `supportedArchitectures` and
- * `patchedDependencies` only from pnpm-workspace.yaml, so those are carried
- * from the workspace root; pass `prunedLockfileContent` to scope the approvals
- * to the packages the pruned lockfile keeps (an approval for an absent package
- * is inert either way, this only keeps the emitted file accurate). On
- * pnpm <=10, which reads them from the emitted package.json instead (see
- * `getPrunedPnpmPackageJsonBuildSettings`), or when the workspace declares
- * none, the file holds only `packages: []`. Resolution-time config stays out:
- * the pruned lockfile bakes it in (`stripPrunedLockfilePnpmConfig`).
+ * On pnpm 11+, this file carries declared `minimumReleaseAge`,
+ * `minimumReleaseAgeExclude`, `minimumReleaseAgeStrict`, build approvals,
+ * `supportedArchitectures`, and applicable `patchedDependencies` from the
+ * workspace root. Approvals and patches are scoped to the pruned lockfile.
+ *
+ * On pnpm <=10, only build approvals, `supportedArchitectures`, and
+ * `patchedDependencies` are emitted in `package.json`.
+ *
+ * Settings encoded in the pruned resolution, such as `overrides` and
+ * `packageExtensions`, are not copied (`stripPrunedLockfilePnpmConfig`).
  *
  * The major is the build machine's pnpm, which is all that is knowable at
  * build time: an output built on pnpm <=10 but deployed on pnpm 11+ will not
@@ -129,6 +130,29 @@ function getPrunedPnpmInstallSettingsYaml(workspaceRootPath = workspace_root_1.w
     // list is accepted by pnpm 9-11 without pulling any importer into the install.
     return dump({ packages: [], ...settings });
 }
+/**
+ * pnpm-workspace.yaml fields carried verbatim from the workspace root to the
+ * pruned output, with no interpretation beyond "declared or not" (unlike
+ * `allowBuilds`, filtered to the pruned lockfile, and `patchedDependencies`,
+ * resolved against it):
+ * - `supportedArchitectures`.
+ * - `minimumReleaseAge`/`minimumReleaseAgeExclude`: silently dropping these
+ *   falls back to pnpm's own default cutoff instead of the workspace's,
+ *   which can reject lockfile entries the workspace itself allows (or vice
+ *   versa).
+ * - `minimumReleaseAgeStrict`: starting with pnpm 11.0.0, a declared
+ *   `minimumReleaseAge` enables strict mode unless `minimumReleaseAgeStrict:
+ *   false` is also declared. Dropping an explicit `false` here would
+ *   silently re-enable strict mode in the pruned output and make its
+ *   install reject an immature exact dependency the source workspace
+ *   accepted.
+ */
+const STRAIGHT_COPY_WORKSPACE_SETTINGS = [
+    'supportedArchitectures',
+    'minimumReleaseAge',
+    'minimumReleaseAgeExclude',
+    'minimumReleaseAgeStrict',
+];
 /**
  * The settings `getPrunedPnpmInstallSettingsYaml` emits, before serialization,
  * so a caller can tell which of them the workspace actually declares. Null when
@@ -155,7 +179,7 @@ function getPrunedPnpmWorkspaceSettings(workspaceRootPath, prunedLockfileContent
     }
     catch {
         // Unreadable or malformed pnpm-workspace.yaml: skip rather than guess.
-        logger_1.logger.warn('Could not read the workspace root pnpm-workspace.yaml; the pruned output will not declare pnpm install settings (build-script approvals, supportedArchitectures, patchedDependencies).');
+        logger_1.logger.warn('Could not read the workspace root pnpm-workspace.yaml; the pruned output will not declare pnpm install settings (build-script approvals, supportedArchitectures, minimumReleaseAge, patchedDependencies).');
         return null;
     }
     const settings = {};
@@ -167,8 +191,8 @@ function getPrunedPnpmWorkspaceSettings(workspaceRootPath, prunedLockfileContent
             settings.allowBuilds = allowBuilds;
         }
     }
-    if (rootSettings.supportedArchitectures) {
-        settings.supportedArchitectures = rootSettings.supportedArchitectures;
+    for (const field of STRAIGHT_COPY_WORKSPACE_SETTINGS) {
+        assignDefined(settings, rootSettings, field);
     }
     const patchedDependencies = precomputed?.patchedDependencies ??
         (prunedLockfileContent
@@ -216,7 +240,7 @@ function getPnpmMajor(workspaceRootPath) {
 function getPnpmMajorOrWarn(workspaceRootPath) {
     const pnpmMajor = getPnpmMajor(workspaceRootPath);
     if (pnpmMajor === null) {
-        logger_1.logger.warn('Could not determine the pnpm version. The pruned output will not carry pnpm build-script approvals, supportedArchitectures, or patchedDependencies declarations; patch files still ship.');
+        logger_1.logger.warn('Could not determine the pnpm version. The pruned output will not carry pnpm build-script approvals, supportedArchitectures, minimumReleaseAge, or patchedDependencies declarations; patch files still ship.');
     }
     return pnpmMajor;
 }

package/dist/src/project-graph/plugins/isolation/isolated-plugin.d.ts

@@ -1,3 +1,5 @@
+import { ChildProcess } from 'child_process';
+import { Socket } from 'net';
 import type { PluginConfiguration } from '../../../config/nx-json';
 import type { ProjectGraph } from '../../../config/project-graph';
 import type { RawProjectGraphDependency } from '../../project-graph-builder';
@@ -40,6 +42,13 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     static load(plugin: PluginConfiguration, root: string, index?: number): Promise<IsolatedPlugin>;
     private constructor();
     private spawnAndConnect;
+    /**
+     * Drops the worker from service without judging why. The next hook call
+     * respawns it through `ensureAlive`.
+     */
+    private markUnusable;
+    private failPendingRequests;
+    private handleFramingFailure;
     /**
      * Ensures the worker is alive, restarting it if necessary.
      * Called before each hook execution to handle plugins that were
@@ -61,6 +70,7 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     private registerProcessMetrics;
 }
 export declare function getPluginWorkerSocketId(): string;
+export declare function connectToWorker(worker: ChildProcess, ipcPath: string, name: string): Promise<Socket>;
 /**
  * Marks a failure to *start or reach* a worker, as distinct from a plugin that
  * loaded and then threw. Only the former can be retried in-process: swallowing
@@ -75,5 +85,11 @@ export declare const PLUGIN_WORKER_STARTUP_FAILURE: unique symbol;
  * also degrading for an OOM kill or a broken install.
  */
 export declare const PLUGIN_WORKER_SOCKET_REFUSED: unique symbol;
+/**
+ * Describes how a worker died for an error message. A `null` code with a signal
+ * is an outside kill rather than anything the worker chose, and SIGKILL is what
+ * an out-of-memory kill looks like, so both are called out by name.
+ */
+export declare function describeWorkerExit(code: number | null, signal: NodeJS.Signals | null): string;
 export declare function isPluginWorkerStartupFailure(error: unknown): boolean;
 export declare function isPluginWorkerSocketRefusal(error: unknown): boolean;

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLUGIN_WORKER_SOCKET_REFUSED = exports.PLUGIN_WORKER_STARTUP_FAILURE = exports.IsolatedPlugin = void 0;
 exports.getPluginWorkerSocketId = getPluginWorkerSocketId;
+exports.connectToWorker = connectToWorker;
+exports.describeWorkerExit = describeWorkerExit;
 exports.isPluginWorkerStartupFailure = isPluginWorkerStartupFailure;
 exports.isPluginWorkerSocketRefusal = isPluginWorkerSocketRefusal;
 const child_process_1 = require("child_process");
@@ -93,32 +95,51 @@ class IsolatedPlugin {
         this.worker = worker;
         this.socket = socket;
         this.registerProcessMetrics();
-        this.exitHandler = () => {
-            this._alive = false;
-            this._connectPromise = null;
-            if (this.worker?.stdout) {
-                this.worker.stdout.unpipe(process.stdout);
-            }
-            if (this.worker?.stderr) {
-                this.worker.stderr.unpipe(process.stderr);
-            }
-            // Reject all pending requests
-            const error = new Error(`Plugin worker "${this.name}" exited unexpectedly.`);
-            for (const { onError } of this.responseHandlers.values()) {
-                onError(error);
-            }
-            this.responseHandlers.clear();
+        this.exitHandler = (code, signal) => {
+            this.markUnusable();
+            this.failPendingRequests(new Error(`Plugin worker "${this.name}" exited unexpectedly ${describeWorkerExit(code, signal)}.`));
         };
         worker.on('exit', this.exitHandler);
         socket.on('data', (0, consume_messages_from_socket_1.consumeMessagesFromSocket)(this.handleSocketData, (err) => {
-            // Nothing else settles the pending hook promises on a framing
-            // failure, so surface it the same way a dead worker would.
-            this.exitHandler?.();
-            socket.destroy();
-            console.error(err.message);
+            // The worker may still be running here; it is the stream that failed, so
+            // reporting this as an exit would send whoever reads it hunting for a
+            // dead process.
+            this.handleFramingFailure(socket, err);
         }));
         return this.sendLoadMessage();
     }
+    /**
+     * Drops the worker from service without judging why. The next hook call
+     * respawns it through `ensureAlive`.
+     */
+    markUnusable() {
+        this._alive = false;
+        this._connectPromise = null;
+        if (this.worker?.stdout) {
+            this.worker.stdout.unpipe(process.stdout);
+        }
+        if (this.worker?.stderr) {
+            this.worker.stderr.unpipe(process.stderr);
+        }
+    }
+    failPendingRequests(error) {
+        for (const { onError } of this.responseHandlers.values()) {
+            onError(error);
+        }
+        this.responseHandlers.clear();
+    }
+    handleFramingFailure(socket, error) {
+        const framingError = new Error(`Plugin worker "${this.name}" sent a message the host could not read, ` +
+            `so its connection was dropped. ${error.message}`);
+        this.markUnusable();
+        socket.destroy();
+        if (this.responseHandlers.size === 0) {
+            console.error(framingError.message);
+        }
+        else {
+            this.failPendingRequests(framingError);
+        }
+    }
     /**
      * Ensures the worker is alive, restarting it if necessary.
      * Called before each hook execution to handle plugins that were
@@ -430,7 +451,7 @@ async function connectToWorker(worker, ipcPath, name) {
     let earlyExitError = null;
     // If the worker exits before we connect, abort polling immediately
     // rather than burning through attempts against a dead socket.
-    worker.once('exit', (code) => {
+    worker.once('exit', (code, signal) => {
         if (!abortController.signal.aborted) {
             // The worker sets this code only after an EPERM/EACCES on its own bind,
             // so it is proof of a refusal rather than an inference from the
@@ -438,7 +459,7 @@ async function connectToWorker(worker, ipcPath, name) {
             // sets no variable `isSandbox()` reads.
             const refused = code === socket_refused_exit_code_1.SOCKET_REFUSED_EXIT_CODE;
             earlyExitError = markWorkerStartupFailure(new Error([
-                `Plugin worker for "${name}" exited with code ${code} before the connection was established.`,
+                `Plugin worker for "${name}" exited ${describeWorkerExit(code, signal)} before the connection was established.`,
                 // The worker's own stderr may be lost with the process, so the
                 // cause and the fix are repeated here.
                 ...(refused || (0, is_sandbox_1.isSandbox)()
@@ -476,6 +497,22 @@ exports.PLUGIN_WORKER_STARTUP_FAILURE = Symbol.for('nx.pluginWorkerStartupFailur
  * also degrading for an OOM kill or a broken install.
  */
 exports.PLUGIN_WORKER_SOCKET_REFUSED = Symbol.for('nx.pluginWorkerSocketRefused');
+/**
+ * Describes how a worker died for an error message. A `null` code with a signal
+ * is an outside kill rather than anything the worker chose, and SIGKILL is what
+ * an out-of-memory kill looks like, so both are called out by name.
+ */
+function describeWorkerExit(code, signal) {
+    if (signal) {
+        return signal === 'SIGKILL'
+            ? `(killed by ${signal}, commonly an out-of-memory kill)`
+            : `(killed by ${signal})`;
+    }
+    if (code !== null) {
+        return `(exit code ${code})`;
+    }
+    return '(no exit code or signal reported)';
+}
 function markWorkerStartupFailure(error, refused = false) {
     error[exports.PLUGIN_WORKER_STARTUP_FAILURE] = true;
     if (refused) {

package/dist/src/tasks-runner/forked-process-task-runner.d.ts

@@ -11,6 +11,8 @@ export declare class ForkedProcessTaskRunner {
     cliPath: string;
     private readonly verbose;
     private processes;
+    private processMessageHandler;
+    private processExitHandler;
     private finishedProcesses;
     private pseudoTerminals;
     constructor(options: DefaultTasksRunnerOptions, tuiEnabled: boolean);
@@ -39,4 +41,5 @@ export declare class ForkedProcessTaskRunner {
     private writeTerminalOutput;
     cleanup(signal?: NodeJS.Signals): Promise<void>;
     private setupProcessEventListeners;
+    removeProcessEventListeners(): void;
 }

package/dist/src/tasks-runner/forked-process-task-runner.js

@@ -269,7 +269,7 @@ class ForkedProcessTaskRunner {
         this.cleanUpBatchProcesses();
     }
     setupProcessEventListeners() {
-        const messageHandler = (message) => {
+        this.processMessageHandler = (message) => {
             this.pseudoTerminals.forEach((p) => {
                 p.sendMessageToChildren(message);
             });
@@ -279,21 +279,30 @@ class ForkedProcessTaskRunner {
                 }
             });
         };
+        this.processExitHandler = () => {
+            this.cleanup();
+            process.off('message', this.processMessageHandler);
+        };
         // When the nx process gets a message, it will be sent into the task's process
-        process.on('message', messageHandler);
+        process.on('message', this.processMessageHandler);
         // Terminate any task processes on exit (sync, last resort).
         // cleanup() is async but the initial signal dispatch is synchronous
         // (killProcessTreeGraceful snapshots and signals before the async
         // grace period). The grace period won't complete here, but each
         // child also has its own sync exit handler as a final fallback.
-        process.once('exit', () => {
-            this.cleanup();
-            process.off('message', messageHandler);
-        });
+        process.once('exit', this.processExitHandler);
         // No SIGINT/SIGTERM/SIGHUP handlers here. The orchestrator's
         // setupSignalHandlers() owns signal dispatch and calls FPTR.cleanup()
         // in the direct path; in the forked path the process is detached
         // and never receives these signals from the OS.
     }
+    // Long-lived processes (Nx Cloud agents) create a runner per invocation;
+    // without this each instance stays reachable from `process` forever.
+    // Call only after cleanup(): the exit handler is the last-resort child
+    // kill, so it must not be removed while children may still be alive.
+    removeProcessEventListeners() {
+        process.off('message', this.processMessageHandler);
+        process.off('exit', this.processExitHandler);
+    }
 }
 exports.ForkedProcessTaskRunner = ForkedProcessTaskRunner;

package/dist/src/tasks-runner/init-tasks-runner.js

@@ -9,6 +9,7 @@ const life_cycle_1 = require("./life-cycle");
 const task_orchestrator_1 = require("./task-orchestrator");
 const create_task_hasher_1 = require("../hasher/create-task-hasher");
 const client_1 = require("../daemon/client/client");
+const shared_running_task_1 = require("./running-tasks/shared-running-task");
 const task_results_life_cycle_1 = require("./life-cycles/task-results-life-cycle");
 async function createOrchestrator(tasks, projectGraph, fullTaskGraph, nxJson, lifeCycle) {
     (0, dotenv_1.loadRootEnvFiles)();
@@ -47,6 +48,11 @@ async function createOrchestrator(tasks, projectGraph, fullTaskGraph, nxJson, li
     orchestrator.processAllScheduledTasks();
     return orchestrator;
 }
+// Nothing awaits the dispose chains below, so an unhandled rejection would take
+// down a long-lived agent process.
+function logDisposeFailure(e) {
+    console.error('Failed to dispose the task orchestrator:', e);
+}
 async function runDiscreteTasks(tasks, projectGraph, fullTaskGraph, nxJson, lifeCycle) {
     const orchestrator = await createOrchestrator(tasks, projectGraph, fullTaskGraph, nxJson, lifeCycle);
     let groupId = 0;
@@ -75,12 +81,36 @@ async function runDiscreteTasks(tasks, projectGraph, fullTaskGraph, nxJson, life
             return [hit];
         return [await orchestrator.runTaskDirectly(true, task, groupId++)];
     });
-    return [...batchResults, ...taskResults];
+    const results = [...batchResults, ...taskResults];
+    // Callers like Nx Cloud agents create an orchestrator per invocation in a
+    // long-lived process; release its process-level listeners once all tasks
+    // settle, otherwise every invocation's orchestrator stays reachable forever.
+    // Not awaited, so callers keep consuming handles as they settle; the forked
+    // runner's exit handler still reaps children until dispose() runs.
+    Promise.allSettled(results)
+        .then(() => orchestrator.dispose())
+        .catch(logDisposeFailure);
+    return results;
 }
 async function runContinuousTasks(tasks, projectGraph, fullTaskGraph, nxJson, lifeCycle) {
     const orchestrator = await createOrchestrator(tasks, projectGraph, fullTaskGraph, nxJson, lifeCycle);
-    return tasks.reduce((current, task, index) => {
+    const runningTasks = tasks.reduce((current, task, index) => {
         current[task.id] = orchestrator.startContinuousTask(task, index);
         return current;
     }, {});
+    // Unlike runDiscreteTasks, this must resolve at task start: callers keep
+    // the RunningTask handles to kill later, so disposal has to be deferred
+    // until every task actually exits.
+    Promise.allSettled(Object.entries(runningTasks).map(async ([taskId, promise]) => {
+        const runningTask = await promise;
+        // A shared task is owned by another nx process; this orchestrator has
+        // no child to protect for it, so disposal does not wait on it.
+        if (runningTask instanceof shared_running_task_1.SharedRunningTask) {
+            return;
+        }
+        await orchestrator.waitForContinuousTaskExit(taskId);
+    }))
+        .then(() => orchestrator.dispose())
+        .catch(logDisposeFailure);
+    return runningTasks;
 }

package/dist/src/tasks-runner/life-cycles/task-history-life-cycle.js

@@ -22,6 +22,8 @@ function getTasksHistoryLifeCycle() {
 class TaskHistoryLifeCycle {
     constructor() {
         this.startTimings = {};
+        // Holds no terminalOutput: this singleton outlives every run in the
+        // process, and agents complete thousands of tasks in one process.
         this.pendingResults = new Map();
         this.taskRuns = new Map();
         this.taskHistory = (0, task_history_1.getTaskHistory)();
@@ -36,25 +38,28 @@ class TaskHistoryLifeCycle {
         }
     }
     async endTasks(taskResults) {
-        for (const taskResult of taskResults) {
-            this.pendingResults.set(taskResult.task.id, taskResult);
+        for (const { task, code, status } of taskResults) {
+            this.pendingResults.set(task.id, { task, code, status });
         }
     }
     async endCommand() {
+        const pendingResults = Array.from(this.pendingResults.values());
+        this.pendingResults.clear();
         if (!this.taskHistory) {
             return;
         }
         // Build TaskRun objects now — task.hash is guaranteed to be set by this point
-        for (const [, taskResult] of this.pendingResults) {
-            this.taskRuns.set(taskResult.task.hash, {
-                hash: taskResult.task.hash,
-                target: taskResult.task.target,
-                code: taskResult.code,
-                status: taskResult.status,
-                start: taskResult.task.startTime ?? this.startTimings[taskResult.task.id],
-                end: taskResult.task.endTime ?? Date.now(),
-                cacheable: taskResult.task.cache === true,
+        for (const { task, code, status } of pendingResults) {
+            this.taskRuns.set(task.hash, {
+                hash: task.hash,
+                target: task.target,
+                code,
+                status,
+                start: task.startTime ?? this.startTimings[task.id],
+                end: task.endTime ?? Date.now(),
+                cacheable: task.cache === true,
             });
+            delete this.startTimings[task.id];
         }
         const runs = [];
         // Only check for flaky tasks among cacheable tasks

package/dist/src/tasks-runner/running-tasks/batch-process.js

@@ -233,6 +233,9 @@ class BatchProcess {
             this.capturedOutputFd = undefined;
         }
     }
+    // Resolves on the CompleteBatchExecution message, not process exit: the
+    // child can outlive its results (open handles keep it alive), so callers
+    // must not treat a settled batch as an exited process.
     async getResults() {
         return Promise.race([
             new Promise((_, rej) => {

package/dist/src/tasks-runner/running-tasks/shared-running-task.d.ts

@@ -3,6 +3,7 @@ import { RunningTasksService } from '../../native';
 export declare class SharedRunningTask implements RunningTask {
     private runningTasksService;
     private exitCallbacks;
+    private detached;
     constructor(runningTasksService: RunningTasksService, taskId: string);
     getResults(): Promise<{
         code: number;

package/dist/src/tasks-runner/running-tasks/shared-running-task.js

@@ -5,7 +5,11 @@ class SharedRunningTask {
     constructor(runningTasksService, taskId) {
         this.runningTasksService = runningTasksService;
         this.exitCallbacks = [];
+        this.detached = false;
         this.waitForTaskToFinish(taskId).then(() => {
+            if (this.detached) {
+                return;
+            }
             // notify exit callbacks
             this.exitCallbacks.forEach((cb) => cb(0));
         });
@@ -13,8 +17,14 @@ class SharedRunningTask {
     async getResults() {
         throw new Error('Results cannot be retrieved from a shared task');
     }
+    // Detaches from the shared task; the owning process keeps running it.
     kill() {
+        if (this.detached) {
+            return;
+        }
+        this.detached = true;
         this.exitCallbacks.forEach((cb) => cb(0));
+        this.exitCallbacks = [];
     }
     onExit(cb) {
         this.exitCallbacks.push(cb);
@@ -24,7 +34,8 @@ class SharedRunningTask {
         // wait for the running task to finish
         do {
             await new Promise((resolve) => setTimeout(resolve, 100));
-        } while (this.runningTasksService.getRunningTasks([taskId]).length);
+        } while (!this.detached &&
+            this.runningTasksService.getRunningTasks([taskId]).length);
     }
 }
 exports.SharedRunningTask = SharedRunningTask;

package/dist/src/tasks-runner/task-orchestrator.d.ts

@@ -56,6 +56,7 @@ export declare class TaskOrchestrator {
     private discreteTaskExitHandled;
     private continuousTaskExitHandled;
     private cleanupPromise;
+    private signalHandlers;
     constructor(hasher: TaskHasher, initiatingProject: string | undefined, initiatingTasks: Task[], projectGraph: ProjectGraph, taskGraph: TaskGraph, nxJson: NxJsonConfiguration, options: NxArgs & DefaultTasksRunnerOptions, bail: boolean, daemon: DaemonClient, outputStyle: string, fullTaskGraph?: TaskGraph);
     init(): Promise<void>;
     run(): Promise<{
@@ -251,6 +252,8 @@ export declare class TaskOrchestrator {
     private cleanup;
     private performCleanup;
     private setupSignalHandlers;
+    waitForContinuousTaskExit(taskId: string): Promise<void>;
+    dispose(): Promise<void>;
     private cleanUpUnneededContinuousTasks;
 }
 export declare function getThreadPoolSize(options: NxArgs & DefaultTasksRunnerOptions, taskGraph: TaskGraph): {

package/dist/src/tasks-runner/task-orchestrator.js

@@ -105,6 +105,7 @@ class TaskOrchestrator {
         this.discreteTaskExitHandled = new Map();
         this.continuousTaskExitHandled = new Map();
         this.cleanupPromise = null;
+        this.signalHandlers = [];
     }
     async init() {
         this.setupSignalHandlers();
@@ -159,6 +160,7 @@ class TaskOrchestrator {
             this.cache.removeOldCacheRecords();
         }
         await this.cleanup();
+        await this.dispose();
         // Public API (defaultTasksRunner) returns a plain object keyed by
         // task id. Internal state is a Map for faster lookup.
         return Object.fromEntries(this.completedTasks);
@@ -1474,9 +1476,35 @@ class TaskOrchestrator {
                 }
             });
         };
-        process.on('SIGINT', () => handleSignal('SIGINT'));
-        process.on('SIGTERM', () => handleSignal('SIGTERM'));
-        process.on('SIGHUP', () => handleSignal('SIGHUP'));
+        for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+            const handler = () => handleSignal(signal);
+            this.signalHandlers.push([signal, handler]);
+            process.on(signal, handler);
+        }
+    }
+    // Registered at child creation, so unlike subscribing to RunningTask.onExit
+    // after the fact it cannot miss an exit that already happened.
+    waitForContinuousTaskExit(taskId) {
+        return this.continuousTaskExitHandled.get(taskId) ?? Promise.resolve();
+    }
+    // Releases the process-level listeners registered by setupSignalHandlers.
+    // Each closes over `this`, so a long-lived caller (an Nx Cloud agent creates
+    // an orchestrator per invocation) leaks whole orchestrators until they run.
+    async dispose() {
+        // The forked runner's exit handler is the last-resort kill for child
+        // processes, and a batch child can outlive its results message. Reap
+        // children first so removing the handler cannot orphan a live one.
+        try {
+            await this.forkedProcessTaskRunner.cleanup();
+        }
+        catch (e) {
+            console.error('Failed to clean up child processes on dispose:', e);
+        }
+        for (const [signal, handler] of this.signalHandlers) {
+            process.off(signal, handler);
+        }
+        this.signalHandlers = [];
+        this.forkedProcessTaskRunner.removeProcessEventListeners();
     }
     cleanUpUnneededContinuousTasks() {
         const incompleteTasks = this.tasksSchedule.getIncompleteTasks();

package/dist/src/utils/min-release-age/behavior/pnpm.js

@@ -9,6 +9,14 @@ const errors_1 = require("../errors");
 const pick_1 = require("../pick");
 // Ordered newest-bound-first so the first matching row applies.
 const PNPM_BEHAVIOR_ROWS = [
+    {
+        minVersion: '12.0.0',
+        major: 12,
+        strictMode: 'default-loose',
+        strictAutoOnWhenExplicit: true,
+        excludeGrammar: 'v2-globs-unions',
+        writesExcludes: true,
+    },
     {
         minVersion: '11.1.3',
         major: 11,
@@ -134,7 +142,7 @@ function toBoolean(value) {
 async function readPnpmPolicy(root, pmVersion) {
     // A pnpm major newer than the table knows can behave differently; defer to a
     // real install rather than guessing.
-    if ((0, semver_1.gte)(pmVersion, '12.0.0')) {
+    if ((0, semver_1.gte)(pmVersion, '13.0.0')) {
         return {
             outcome: 'ambiguous',
             reason: `pnpm ${pmVersion} is newer than the known cooldown behavior table.`,
@@ -155,15 +163,15 @@ async function readPnpmPolicy(root, pmVersion) {
     }
     const { windowMinutes: explicitWindow, excludes, strictExplicit, ignoreMissingTimeExplicit, } = parseCooldownConfig(config);
     // An explicitly configured window (from whatever surface pnpm honors) wins;
-    // otherwise v11 falls back to its built-in 1440-minute (1 day) default, while
-    // v10 has no default (no cooldown).
+    // otherwise v11 and v12 fall back to the built-in 1440-minute (1 day) default,
+    // while v10 has no default (no cooldown).
     let windowMinutes;
     let windowExplicit;
     if (explicitWindow !== undefined) {
         windowMinutes = explicitWindow;
         windowExplicit = true;
     }
-    else if (row.major === 11) {
+    else if (row.major >= 11) {
         windowMinutes = 1440;
         windowExplicit = false;
     }
@@ -178,14 +186,14 @@ async function readPnpmPolicy(root, pmVersion) {
     const cutoffMs = Date.now() - windowMs;
     const sourceDescription = `pnpm minimumReleaseAge (${windowMinutes} min)`;
     const strict = resolveStrict(row, strictExplicit, windowExplicit);
-    // v10 always errors on missing time; v11 defaults to skip unless a surface
-    // explicitly disabled it.
-    const ignoreMissingTime = row.major === 11 ? (ignoreMissingTimeExplicit ?? true) : false;
+    // v10 always errors on missing time; v11 and above default to skip unless a
+    // surface explicitly disabled it.
+    const ignoreMissingTime = row.major >= 11 ? (ignoreMissingTimeExplicit ?? true) : false;
     const behavior = {
         packageManager: 'pnpm',
         strict,
-        // Loose fallback only exists on v11 when strict is off.
-        looseFallback: row.major === 11 && !strict,
+        // Loose fallback only exists from v11 onwards when strict is off.
+        looseFallback: row.major >= 11 && !strict,
         writesExcludes: row.writesExcludes,
         missingTimeMap: row.major === 10 ? 'error' : ignoreMissingTime ? 'skip' : 'error',
     };

package/dist/src/utils/package-json.js

@@ -23,6 +23,7 @@ const target_merging_1 = require("../project-graph/utils/project-configuration/t
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const has_nx_js_plugin_1 = require("./has-nx-js-plugin");
+const path_2 = require("./path");
 const installation_directory_1 = require("./installation-directory");
 const package_manager_1 = require("./package-manager");
 const workspace_root_1 = require("./workspace-root");
@@ -35,15 +36,25 @@ function normalizePackageGroup(packageGroup) {
         }));
 }
 function readNxMigrateConfig(json) {
+    // Registry fetching uses this value to build a temporary extraction path.
+    // Reject unsupported absolute paths and escaping parent traversal before extraction.
+    const assertContained = (migrations) => {
+        if (!(0, path_2.isContainedRelativePath)(migrations)) {
+            throw new Error(`Invalid migrations path "${migrations}" in package "${json.name ?? 'unknown'}@${json.version ?? 'unknown'}": migration paths must not be absolute or escape their base directory through parent traversal.`);
+        }
+        return migrations;
+    };
     const parseNxMigrationsConfig = (fromJson) => {
         if (!fromJson) {
             return {};
         }
         if (typeof fromJson === 'string') {
-            return { migrations: fromJson, packageGroup: [] };
+            return { migrations: assertContained(fromJson), packageGroup: [] };
         }
         return {
-            ...(fromJson.migrations ? { migrations: fromJson.migrations } : {}),
+            ...(fromJson.migrations
+                ? { migrations: assertContained(fromJson.migrations) }
+                : {}),
             ...(fromJson.packageGroup
                 ? { packageGroup: normalizePackageGroup(fromJson.packageGroup) }
                 : {}),

package/dist/src/utils/params.js

@@ -443,7 +443,7 @@ function applyVerbosity(options, schema, isVerbose) {
 }
 function combineOptionsForExecutor(commandLineOpts, config, target, schema, defaultProjectName, relativeCwd, isVerbose = false) {
     const r = convertAliases(coerceTypesInOptions(convertToCamelCase(commandLineOpts, schema), schema), schema, false);
-    let combined = target.options || {};
+    let combined = { ...target.options };
     if (config && target.configurations && target.configurations[config]) {
         Object.assign(combined, target.configurations[config]);
     }

package/dist/src/utils/path.d.ts

@@ -8,6 +8,12 @@ export declare function normalizePath(osSpecificPath: string): string;
  * This should not be used to read files on disk because of the removal of Windows drive letters.
  */
 export declare function joinPathFragments(...fragments: string[]): string;
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+export declare function isContainedRelativePath(relativePath: string): boolean;
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/dist/src/utils/path.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizePath = normalizePath;
 exports.joinPathFragments = joinPathFragments;
+exports.isContainedRelativePath = isContainedRelativePath;
 exports.getCwd = getCwd;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
@@ -23,6 +24,20 @@ function normalizePath(osSpecificPath) {
 function joinPathFragments(...fragments) {
     return normalizePath(path.join(...fragments));
 }
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+function isContainedRelativePath(relativePath) {
+    if (path.isAbsolute(relativePath)) {
+        return false;
+    }
+    const normalized = path.normalize(relativePath);
+    return !(normalized === '..' ||
+        normalized.startsWith(`..${path.sep}`) ||
+        normalized.startsWith(`..${path.posix.sep}`));
+}
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.2.0",
+  "version": "23.3.0-beta.0",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -185,16 +185,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.2.0",
-    "@nx/nx-darwin-x64": "23.2.0",
-    "@nx/nx-freebsd-x64": "23.2.0",
-    "@nx/nx-linux-arm-gnueabihf": "23.2.0",
-    "@nx/nx-linux-arm64-gnu": "23.2.0",
-    "@nx/nx-linux-arm64-musl": "23.2.0",
-    "@nx/nx-linux-x64-gnu": "23.2.0",
-    "@nx/nx-linux-x64-musl": "23.2.0",
-    "@nx/nx-win32-arm64-msvc": "23.2.0",
-    "@nx/nx-win32-x64-msvc": "23.2.0"
+    "@nx/nx-darwin-arm64": "23.3.0-beta.0",
+    "@nx/nx-darwin-x64": "23.3.0-beta.0",
+    "@nx/nx-freebsd-x64": "23.3.0-beta.0",
+    "@nx/nx-linux-arm-gnueabihf": "23.3.0-beta.0",
+    "@nx/nx-linux-arm64-gnu": "23.3.0-beta.0",
+    "@nx/nx-linux-arm64-musl": "23.3.0-beta.0",
+    "@nx/nx-linux-x64-gnu": "23.3.0-beta.0",
+    "@nx/nx-linux-x64-musl": "23.3.0-beta.0",
+    "@nx/nx-win32-arm64-msvc": "23.3.0-beta.0",
+    "@nx/nx-win32-x64-msvc": "23.3.0-beta.0"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",