nx 23.2.1 → 23.3.0-beta.1

package/dist/src/command-line/migrate/run/worker.js

@@ -7,7 +7,6 @@ const git_utils_1 = require("../../../utils/git-utils");
 const fileutils_1 = require("../../../utils/fileutils");
 const installation_directory_1 = require("../../../utils/installation-directory");
 const package_json_1 = require("../../../utils/package-json");
-const inception_1 = require("../agentic/inception");
 const print_dropped_agent_context_1 = require("../agentic/print-dropped-agent-context");
 const select_1 = require("../agentic/select");
 const types_1 = require("../agentic/types");
@@ -25,6 +24,8 @@ const state_lock_1 = require("./state-lock");
 const util_1 = require("./util");
 const text_1 = require("../text");
 const agent_output_1 = require("./agent-output");
+const agent_work_payload_1 = require("./agent-work-payload");
+const issues_1 = require("./issues");
 async function runSingleMigrationWorker(input) {
     const { root, runMigration, runId, commitPrefix, interactive, skipInstall, isVerbose, } = input;
     // The worker is a second CLI entry point: the run id reaches runDir() (where
@@ -317,22 +318,24 @@ async function runStandalone(root, migration, opts) {
     // and no "apply this manually" block for the user either.
     if ((0, migration_shape_1.isHybridMigration)(migration) && !skipAgentic) {
         emitOrPrintPrompt(root, migration, agentic.kind, {
-            logs,
-            changes,
-            agentContext,
-        }, resolvedCollection);
+            impl: {
+                logs,
+                changes,
+                agentContext,
+            },
+            resolvedCollection,
+        });
     }
 }
 async function runRecorded(root, runId, migration, skipInstall, isVerbose) {
     const dir = (0, run_state_1.runDir)(root, runId);
     // Version refusal (NewerRunStateFormatError) propagates.
     let state = (0, run_state_1.readRunState)(dir);
-    // A recorded run never resolves the agentic flow (the outer agent drives
-    // it); prompts are emitted for that agent or printed for a user hand-running
-    // the dispensed command.
-    const agenticKind = (0, inception_1.isInsideAgent)()
-        ? 'inside-agent'
-        : 'disabled';
+    // A recorded run never resolves the agentic flow: the outer agent drives it,
+    // and the dispensed command is part of the orchestrated protocol whoever
+    // re-runs it. Gating the block on ambient agent detection would park the
+    // step awaiting an outcome whose payload was never emitted.
+    const agenticKind = 'inside-agent';
     const migrationId = `${migration.package}:${migration.name}`;
     // The plan was read from the latest round's snapshot, so only that round's
     // step may match; a same-id step from an older round must not.
@@ -350,24 +353,71 @@ async function runRecorded(root, runId, migration, skipInstall, isVerbose) {
         startedAt: (0, util_1.nowIso)(),
     });
     // A prior attempt's generator half already ran, so this attempt must not
-    // reapply it against a tree that already holds its changes: a hybrid
-    // re-emits only its prompt, and a plain generator step has nothing left to
-    // do but the install and commit its previous attempt failed on.
-    // Read from the state the start transition returned: a delayed invocation
-    // may have claimed a later attempt whose flag its entry snapshot predates.
+    // reapply it against a tree that already holds its changes. Read from the
+    // state the start transition returned, not the entry snapshot: a delayed
+    // invocation may have claimed a later attempt whose flag `step` predates.
     const startedStep = state.steps.find((s) => s.id === step.id);
     const generatorAlreadyCompleted = startedStep.generatorCompleted === true;
     // The run records its own install policy because dispensed worker commands
     // are re-invoked by the loop and never carry the user's flags; an explicit
     // --skip-install on this invocation still applies on top of it.
     const effectiveSkipInstall = state.skipInstall === true || skipInstall;
+    // The run records the resolved validation policy at init; absent (a state
+    // predating the field) falls back to the same default init applies.
+    const shouldValidate = state.validate !== false;
+    // Called before a retry hands the step's work back: the prompt or validation
+    // may need the dependencies the earlier attempt's generator added.
+    const reinstallFromBaseline = () => recordingInstallFailure(dir, step.id, () => (0, util_1.installDepsChangedSinceDispense)(root, dir, startedStep, effectiveSkipInstall, `${(0, execute_migration_1.formatSingleMigrationRerunCommand)(migrationId)} --run-id=${runId}`));
     let outcome;
+    let awaitingKind;
+    const payloadPath = (0, agent_work_payload_1.agentWorkPayloadPath)(dir, step.id, startedStep.attempt);
     try {
-        if ((0, migration_shape_1.isPromptOnlyMigration)(migration) ||
-            (generatorAlreadyCompleted && (0, migration_shape_1.isHybridMigration)(migration))) {
-            emitOrPrintPrompt(root, migration, agenticKind);
+        if ((0, migration_shape_1.isPromptOnlyMigration)(migration)) {
+            emitOrPrintPrompt(root, migration, agenticKind, {
+                persistPath: payloadPath,
+            });
+            awaitingKind = 'migration-prompt';
+        }
+        else if (generatorAlreadyCompleted &&
+            startedStep.agenticWaived !== true &&
+            (0, migration_shape_1.isHybridMigration)(migration)) {
+            await reinstallFromBaseline();
+            const carried = (0, agent_work_payload_1.latestStoredAgentWorkPayload)(dir, step.id, startedStep.attempt, startedStep.generatorCompletedAtAttempt, {
+                migrationId,
+                kind: 'migration-prompt',
+                promptPath: migration.prompt,
+            });
+            if (carried) {
+                reemitCarriedAgentWork(migrationId, 'migration-prompt', payloadPath, carried);
+            }
+            else {
+                emitOrPrintPrompt(root, migration, agenticKind, {
+                    persistPath: payloadPath,
+                });
+            }
+            awaitingKind = 'migration-prompt';
+        }
+        else if (generatorAlreadyCompleted &&
+            startedStep.validationOwed === true) {
+            // The persisted flag is the only record that these changes still owe a
+            // validation pass: the decision needed the generator result, which is
+            // gone with the attempt that made it, and a true waiver never writes the
+            // flag. The commit stays with the fold, as on a first attempt.
+            await reinstallFromBaseline();
+            const carried = (0, agent_work_payload_1.latestStoredAgentWorkPayload)(dir, step.id, startedStep.attempt, startedStep.generatorCompletedAtAttempt, { migrationId, kind: 'generator-validation' });
+            if (carried) {
+                reemitCarriedAgentWork(migrationId, 'generator-validation', payloadPath, carried);
+            }
+            else {
+                emitValidationBlock(root, migration, undefined, {
+                    persistPath: payloadPath,
+                });
+            }
+            awaitingKind = 'generator-validation';
         }
         else if (generatorAlreadyCompleted) {
+            // Reached when the earlier attempt waived the AI step, or none was owed
+            // (no changes, validation off, or an older-nx state).
             state = await finishCompletedGenerator(dir, root, state, startedStep, migration, effectiveSkipInstall, runId);
             outcome = buildOutcome([], [], 'The generator ran in an earlier attempt; this attempt completed its install and commit.', root);
         }
@@ -375,22 +425,57 @@ async function runRecorded(root, runId, migration, skipInstall, isVerbose) {
             const installer = new execute_migration_1.ChangedDepInstaller(root, effectiveSkipInstall, `${(0, execute_migration_1.formatSingleMigrationRerunCommand)(migrationId)} --run-id=${runId}`);
             // Read once; the run and the hybrid documentation resolution share it.
             const resolvedCollection = (0, execute_migration_1.readMigrationCollection)(migration.package, root);
-            const { changes, nextSteps, agentContext, logs, madeChanges } = await (0, execute_migration_1.runNxOrAngularMigration)(root, migration, isVerbose, (0, migration_shape_1.isHybridMigration)(migration), resolvedCollection);
+            const { changes, nextSteps, agentContext, skipAgentic, logs, madeChanges, } = await (0, execute_migration_1.runNxOrAngularMigration)(root, migration, isVerbose, 
+            // Captured whenever an agent step may consume it: a hybrid's prompt
+            // payload, or the validation pass over the generator's changes.
+            (0, migration_shape_1.isHybridMigration)(migration) || shouldValidate, resolvedCollection);
+            // Mirrors the classic loop's waiver semantics (migrate.ts): the two must
+            // agree on when an AI step was owed for skipAgentic to waive.
+            const validationApplies = shouldValidate && !(0, migration_shape_1.isHybridMigration)(migration) && changes.length > 0;
+            const waivedAgenticStep = skipAgentic && ((0, migration_shape_1.isHybridMigration)(migration) || validationApplies);
+            const validationOwed = validationApplies && !waivedAgenticStep;
+            const promptOwed = (0, migration_shape_1.isHybridMigration)(migration) && !waivedAgenticStep;
             // Recorded before the commit is attempted: from here on the changes are
             // in the tree, so a failed install or commit must leave a retry with
-            // only those left to do rather than running the generator again.
+            // only those left to do rather than running the generator again. The
+            // waiver and the owed validation ride along so that retry re-emits
+            // exactly the agent work this attempt decided was owed.
             state = transition(dir, {
                 type: 'markGeneratorCompleted',
                 stepId: step.id,
+                agenticWaived: waivedAgenticStep,
+                validationOwed,
+                madeChanges,
             });
-            if (!(0, migration_shape_1.isHybridMigration)(migration)) {
+            if (waivedAgenticStep) {
+                (0, migrate_output_1.logWaivedAgenticStep)(migration, agentContext);
+            }
+            else if (!(0, migration_shape_1.isHybridMigration)(migration) && !validationApplies) {
                 forwardDroppedAgentContext(migration, agentContext, agenticKind);
             }
+            // Stored before the install: a failed install fails the attempt, and
+            // the retry re-hands this payload instead of a context-free one.
+            const impl = { logs, changes, agentContext };
+            const owed = validationOwed
+                ? validationPayload(root, migration, impl, resolvedCollection)
+                : promptOwed
+                    ? promptPayload(root, migration, impl, resolvedCollection)
+                    : undefined;
+            if (owed) {
+                (0, agent_work_payload_1.persistAgentWorkPayload)(payloadPath, owed);
+            }
             const install = () => recordingInstallFailure(dir, step.id, () => installer.installDepsIfChanged());
             // Commits follow the run config, not CLI flags, and only when the
-            // generator changed something: a no-op step must not create a commit (nor
-            // a ledger entry) that absorbs prior pending diffs under its name.
-            if (state.createCommits && madeChanges) {
+            // generator changed something: a no-op step's commit would absorb prior
+            // pending diffs under its name. A step handing work back defers its
+            // commit to the fold, so the migration lands as one commit and a failed
+            // hand-back leaves the changes uncommitted for review, as in the classic
+            // loop. The install still runs first: the agent may run tasks that need
+            // what the generator added.
+            if (state.createCommits &&
+                madeChanges &&
+                !validationOwed &&
+                !promptOwed) {
                 state = await commitStepChanges(dir, root, state, step, migration, install);
             }
             else {
@@ -403,12 +488,13 @@ async function runRecorded(root, runId, migration, skipInstall, isVerbose) {
                 (0, util_1.recordInstallLanded)(root, dir, step.id);
             }
             printNextSteps(migration, nextSteps);
-            if ((0, migration_shape_1.isHybridMigration)(migration)) {
-                emitOrPrintPrompt(root, migration, agenticKind, {
-                    logs,
-                    changes,
-                    agentContext,
-                }, resolvedCollection);
+            if (validationOwed) {
+                emitValidationPayload(migrationId, owed);
+                awaitingKind = 'generator-validation';
+            }
+            else if (promptOwed) {
+                emitPromptForOuterAgent(migrationId, owed, true);
+                awaitingKind = 'migration-prompt';
             }
             else {
                 outcome = buildOutcome(changes, nextSteps, migration.description, root);
@@ -426,14 +512,14 @@ async function runRecorded(root, runId, migration, skipInstall, isVerbose) {
         });
         throw e;
     }
-    // A prompt half (prompt-only, or the prompt phase of a hybrid) is applied by
-    // a separate actor, so the step parks in awaiting-prompt-outcome and this
-    // process exits successfully.
-    if ((0, migration_shape_1.isPromptOnlyMigration)(migration) || (0, migration_shape_1.isHybridMigration)(migration)) {
+    // Handed-back work is applied by a separate actor, so parking exits
+    // successfully rather than failing the step.
+    if (awaitingKind !== undefined) {
         transition(dir, {
             type: 'awaitPromptOutcome',
             stepId: step.id,
             finishedAt: (0, util_1.nowIso)(),
+            awaitingKind,
         });
         return;
     }
@@ -478,7 +564,10 @@ async function recordingInstallFailure(dir, stepId, install) {
 async function finishCompletedGenerator(dir, root, state, step, migration, skipInstall, runId) {
     const migrationId = `${migration.package}:${migration.name}`;
     const installDeps = () => recordingInstallFailure(dir, step.id, () => (0, util_1.installDepsChangedSinceDispense)(root, dir, step, skipInstall, `${(0, execute_migration_1.formatSingleMigrationRerunCommand)(migrationId)} --run-id=${runId}`));
-    if (!state.createCommits) {
+    // Same no-op guard as the first attempt. Only an explicit false skips the
+    // commit: absent means an older nx wrote the marker without recording the
+    // answer, and the commit is kept as that version's retries did.
+    if (!state.createCommits || step.generatorMadeChanges === false) {
         await installDeps();
         return state;
     }
@@ -506,12 +595,14 @@ async function commitStepChanges(dir, root, state, step, migration, installDeps)
     const entry = (0, state_machine_1.commitResultToLedgerEntry)(result, step.id, absorbedStepIds);
     return entry ? appendCommit(dir, entry) : state;
 }
-// Appends a ledger entry to the freshest on-disk state under the lock. The git
-// commit itself already ran outside the lock; only this pure append is locked.
+// The git commit itself already ran outside the lock; only this pure append is
+// locked. A landed entry carries the resolved issues of every step it names,
+// same as the orchestrator's fold and adopt appends: an absorbed step's
+// resolutions would otherwise land unattached.
 function appendCommit(dir, entry) {
     return (0, state_lock_1.updateRunState)(dir, (fresh) => ({
         ...fresh,
-        commits: [...fresh.commits, entry],
+        commits: [...fresh.commits, (0, issues_1.attachIssueIdsToCommitEntry)(fresh, entry)],
     }));
 }
 function buildOutcome(changes, nextSteps, description, root) {
@@ -598,32 +689,60 @@ function printNextSteps(migration, nextSteps) {
         bodyLines: nextSteps.map((line) => `- ${(0, text_1.singleLine)(line)}`),
     });
 }
-function emitOrPrintPrompt(root, migration, agenticKind, impl, resolvedCollection) {
+function emitOrPrintPrompt(root, migration, agenticKind, opts = {}) {
     const migrationId = `${migration.package}:${migration.name}`;
-    const promptPath = migration.prompt;
-    const documentationPath = resolveDocumentationPath(root, migration, resolvedCollection);
     if (agenticKind === 'inside-agent') {
-        emitPromptForOuterAgent(migrationId, promptPath, documentationPath, impl);
+        const payload = promptPayload(root, migration, opts.impl, opts.resolvedCollection);
+        if (opts.persistPath) {
+            (0, agent_work_payload_1.persistAgentWorkPayload)(opts.persistPath, payload);
+        }
+        emitPromptForOuterAgent(migrationId, payload, opts.persistPath !== undefined);
     }
     else {
-        printPromptForUser(root, migration, promptPath, documentationPath);
+        printPromptForUser(root, migration, migration.prompt, resolveDocumentationPath(root, migration, opts.resolvedCollection));
     }
 }
-function emitPromptForOuterAgent(migrationId, promptPath, documentationPath, impl) {
-    const payload = { migrationId, prompt: promptPath };
+function promptPayload(root, migration, impl, resolvedCollection) {
+    const payload = {
+        migrationId: `${migration.package}:${migration.name}`,
+        prompt: migration.prompt,
+    };
+    const documentationPath = resolveDocumentationPath(root, migration, resolvedCollection);
     if (documentationPath)
         payload.documentationPath = documentationPath;
-    if (impl) {
-        payload.impl = {
-            logs: impl.logs,
-            changes: impl.changes.map((c) => ({ type: c.type, path: c.path })),
-            ...(impl.agentContext.length > 0
-                ? { agentContext: impl.agentContext }
-                : {}),
-        };
-    }
+    if (impl)
+        payload.impl = implPayload(impl);
+    return payload;
+}
+const PROMPT_NOT_APPLIED = `The following prompt-based migration was not applied automatically.`;
+// Recorded steps hand work back through the orchestrator, per the runbook's loop.
+const RUN_NEXT_FIRST = `Run the dispensed "next" command first: its response restates this work and names the handoff file to write.`;
+const CHANGES_AWAIT_VALIDATION = `The following migration's generator ran in an earlier attempt and its changes still await validation.`;
+function emitPromptForOuterAgent(migrationId, payload, recorded) {
+    (0, agent_output_1.logToAgent)({
+        title: recorded
+            ? `${PROMPT_NOT_APPLIED} ${RUN_NEXT_FIRST}`
+            : `${PROMPT_NOT_APPLIED} Apply it to this workspace, then continue.`,
+    });
+    (0, agent_output_1.emitPromptBlock)(migrationId, payload);
+}
+function implPayload(impl) {
+    return {
+        logs: impl.logs,
+        changes: impl.changes.map((c) => ({ type: c.type, path: c.path })),
+        ...(impl.agentContext.length > 0
+            ? { agentContext: impl.agentContext }
+            : {}),
+    };
+}
+// Re-hands what an earlier attempt stored. The payload is re-persisted under
+// this attempt because the dispense reads only the current attempt's file.
+function reemitCarriedAgentWork(migrationId, kind, payloadPath, payload) {
+    (0, agent_work_payload_1.persistAgentWorkPayload)(payloadPath, payload);
     (0, agent_output_1.logToAgent)({
-        title: `The following prompt-based migration was not applied automatically. Apply it to this workspace, then continue.`,
+        title: `${kind === 'migration-prompt'
+            ? PROMPT_NOT_APPLIED
+            : CHANGES_AWAIT_VALIDATION} ${RUN_NEXT_FIRST}`,
     });
     (0, agent_output_1.emitPromptBlock)(migrationId, payload);
 }
@@ -660,6 +779,37 @@ function printPromptForUser(root, migration, promptPath, documentationPath) {
         bodyLines,
     });
 }
+// `impl` is absent on a retry whose earlier attempt left no stored payload;
+// the emission then points at the tree.
+function emitValidationBlock(root, migration, impl, opts = {}) {
+    const payload = validationPayload(root, migration, impl, opts.resolvedCollection);
+    if (opts.persistPath) {
+        (0, agent_work_payload_1.persistAgentWorkPayload)(opts.persistPath, payload);
+    }
+    emitValidationPayload(`${migration.package}:${migration.name}`, payload);
+}
+function emitValidationPayload(migrationId, payload) {
+    (0, agent_output_1.logToAgent)({
+        title: payload.impl !== undefined
+            ? `The following migration's generator ran without an AI-driven part. ${RUN_NEXT_FIRST}`
+            : `${CHANGES_AWAIT_VALIDATION} ${RUN_NEXT_FIRST} Inspect the changes with git.`,
+    });
+    (0, agent_output_1.emitPromptBlock)(migrationId, payload);
+}
+function validationPayload(root, migration, impl, resolvedCollection) {
+    // `kind` is what tells the block apart from an applied-prompt payload,
+    // which carries `prompt` instead.
+    const payload = {
+        migrationId: `${migration.package}:${migration.name}`,
+        kind: 'generator-validation',
+    };
+    const documentationPath = resolveDocumentationPath(root, migration, resolvedCollection);
+    if (documentationPath)
+        payload.documentationPath = documentationPath;
+    if (impl)
+        payload.impl = implPayload(impl);
+    return payload;
+}
 // Non-fatal: documentation is supplementary, so a failure warns and the
 // prompt still runs without it.
 function resolveDocumentationPath(root, migration, resolvedCollection) {

package/dist/src/command-line/nx-cloud/connect/connect-to-nx-cloud.js

@@ -249,7 +249,11 @@ function utmContentForCommand(command) {
 async function nxCloudPrompt(key, utmContent) {
     const { message, choices, initial, footer, hint } = ab_testing_1.messages.getPrompt(key);
     // No separate footer/hint slot, so both are folded into the message.
-    const suffix = [hint, footer && `${footer} ${(0, ab_testing_1.nxCloudHyperlink)(utmContent)}`]
+    const suffix = [
+        hint,
+        footer && `${footer} ${(0, ab_testing_1.nxCloudHyperlink)(utmContent)}`,
+        `See it in action: ${(0, ab_testing_1.nxCloudDemoHyperlink)(utmContent)}`,
+    ]
         .filter(Boolean)
         .map((t) => pc.dim(t));
     return (await (0, prompt_helpers_1.selectPrompt)({

package/dist/src/command-line/release/publish.js

@@ -207,15 +207,22 @@ async function runPublishOnProjects(args, projectGraph, nxJson, projectNames, ex
      * NOTE: Force TUI to be disabled for now.
      */
     process.env.NX_TUI = 'false';
+    const publishOutputStyle = args.specifiedOutputStyle ?? 'static';
     const { taskResults } = await (0, run_command_1.runCommandForTasks)(projectsWithTarget, projectGraph, { nxJson }, {
         targets: [requiredTargetName],
+        ...args,
         // Everything this command reports — the registry, the tag, the
         // package.json diff, the dry-run summary — is printed from inside the
         // task, so the failures-only default would swallow all of it (under
-        // --dry-run every task succeeds by definition). An explicit
-        // --output-style still wins, since it comes in through the spread.
-        outputStyle: 'static',
-        ...args,
+        // --dry-run every task succeeds by definition). Set after the spread and
+        // on all three fields: the middleware always writes `resolvedOutputStyle`,
+        // so a value placed before it would be overwritten on every run, and the
+        // renderer reads the new fields rather than the deprecated one. A style
+        // the user actually named still wins, which is what `specifiedOutputStyle`
+        // being set means.
+        outputStyle: publishOutputStyle,
+        specifiedOutputStyle: publishOutputStyle,
+        resolvedOutputStyle: publishOutputStyle,
         // It is possible for workspaces to have circular dependencies between packages and still release them to a registry
         nxIgnoreCycles: true,
     }, overrides, null, {}, extraOptions);

package/dist/src/command-line/release/utils/remote-release-clients/github.js

@@ -227,14 +227,14 @@ class GithubRemoteReleaseClient extends remote_release_client_1.RemoteReleaseCli
                         `---`,
                         `Request Data:`,
                         `Repo: ${this.getRemoteRepoData()?.slug}`,
-                        `Token Header Data: ${this.tokenHeader}`,
+                        `Token Header: ${this.getRedactedTokenHeader()}`,
                         `Body: ${JSON.stringify(result.requestData)}`,
                     ],
                 });
             }
             else {
-                console.log(error);
-                console.error(`An unknown error occurred while trying to create a release on GitHub, please report this on https://github.com/nrwl/nx (NOTE: make sure to redact your GitHub token from the error message!)`);
+                console.log(this.inspectWithRedactedToken(error));
+                console.error(`An unknown error occurred while trying to create a release on GitHub, please report this on https://github.com/nrwl/nx (NOTE: your GitHub token is redacted above, but please double-check before sharing)`);
             }
         }
         const shouldContinueInGitHub = await this.promptForContinueInGitHub();

package/dist/src/command-line/release/utils/remote-release-clients/gitlab.js

@@ -143,14 +143,14 @@ class GitLabRemoteReleaseClient extends remote_release_client_1.RemoteReleaseCli
                         `---`,
                         `Request Data:`,
                         `Repo: ${this.getRemoteRepoData()?.slug}`,
-                        `Token Header Data: ${this.tokenHeader}`,
+                        `Token Header: ${this.getRedactedTokenHeader()}`,
                         `Body: ${JSON.stringify(result.requestData)}`,
                     ],
                 });
             }
             else {
-                console.log(error);
-                console.error(`An unknown error occurred while trying to create a release on GitLab, please report this on https://github.com/nrwl/nx (NOTE: make sure to redact your GitLab token from the error message!)`);
+                console.log(this.inspectWithRedactedToken(error));
+                console.error(`An unknown error occurred while trying to create a release on GitLab, please report this on https://github.com/nrwl/nx (NOTE: your GitLab token is redacted above, but please double-check before sharing)`);
             }
         }
         const shouldContinueInGitLab = await this.promptForContinueInGitLab();

package/dist/src/command-line/release/utils/remote-release-clients/remote-release-client.d.ts

@@ -44,6 +44,8 @@ export declare abstract class RemoteReleaseClient<RemoteRelease extends Record<s
         headerName: string;
     } | null);
     getRemoteRepoData<T extends RemoteRepoData>(): T | null;
+    protected inspectWithRedactedToken(error: unknown): string;
+    protected getRedactedTokenHeader(): string;
     /**
      * Create a post git task that will be executed by nx release changelog after performing any relevant
      * git operations, if the user has opted into remote release creation.

package/dist/src/command-line/release/utils/remote-release-clients/remote-release-client.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RemoteReleaseClient = void 0;
 exports.createRemoteReleaseClient = createRemoteReleaseClient;
 const tslib_1 = require("tslib");
+const node_util_1 = require("node:util");
 const axios_1 = tslib_1.__importDefault(require("axios"));
 const handle_import_1 = require("../../../../utils/handle-import");
 const print_changes_1 = require("../print-changes");
@@ -30,6 +31,40 @@ class RemoteReleaseClient {
     getRemoteRepoData() {
         return this.remoteRepoData;
     }
+    inspectWithRedactedToken(error) {
+        const inspected = (0, node_util_1.inspect)(error);
+        // The dump can hold a different string than the raw token: axios trims
+        // header values and inspect() escapes the result, while message/stack keep
+        // it bare. Redact every rendering; the Set collapses them for an ordinary
+        // token. The CR/LF needle is belt-and-braces — node rejects such headers.
+        const token = this.tokenData?.token?.trim();
+        if (!token) {
+            return inspected;
+        }
+        const needles = new Set([
+            token,
+            token.replace(/[\r\n]/g, ''),
+            (0, node_util_1.inspect)(token).slice(1, -1),
+        ]);
+        // inspect() renders a long string carrying a line break as concatenated
+        // per-line chunks, which no whole-token needle spans. Redact the lines too,
+        // skipping fragments short enough to collide with ordinary dump text.
+        for (const line of token.split(/[\r\n]+/)) {
+            if (line.length >= 8) {
+                needles.add(line);
+            }
+        }
+        return [...needles].reduce((text, needle) => text.split(needle).join('<redacted>'), inspected);
+    }
+    getRedactedTokenHeader() {
+        if (!this.tokenData) {
+            return 'none';
+        }
+        const { headerName } = this.tokenData;
+        return headerName === 'Authorization'
+            ? `${headerName}: Bearer <redacted>`
+            : `${headerName}: <redacted>`;
+    }
     /**
      * Make an (optionally authenticated) API request to the remote release provider
      */

package/dist/src/command-line/yargs-utils/shared-options.d.ts

@@ -67,7 +67,7 @@ export declare function withOverrides<T extends {
 }>(args: T, commandLevel?: number): T & {
     __overrides_unparsed__: string[];
 };
-declare const allOutputStyles: readonly ['tui', 'dynamic', 'dynamic-legacy', 'static', 'static-failures-only', 'stream', 'stream-without-prefixes'];
+declare const allOutputStyles: readonly ['tui', 'dynamic', 'dynamic-legacy', 'static', 'static-failures-only', 'summary', 'stream', 'stream-without-prefixes'];
 export type OutputStyle = (typeof allOutputStyles)[number];
 export declare function withOutputStyleOption<T>(yargs: Argv<T>, choices?: ReadonlyArray<OutputStyle>): Argv<T & {
     outputStyle: OutputStyle;

package/dist/src/command-line/yargs-utils/shared-options.js

@@ -17,6 +17,7 @@ exports.parseNewlines = parseNewlines;
 exports.parseCSV = parseCSV;
 exports.readParallelFromArgsAndEnv = readParallelFromArgsAndEnv;
 const nx_json_1 = require("../../config/nx-json");
+const native_1 = require("../../native");
 const is_tui_enabled_1 = require("../../tasks-runner/is-tui-enabled");
 const node_os_1 = require("node:os");
 exports.defaultYargsParserConfiguration = {
@@ -273,6 +274,7 @@ const allOutputStyles = [
     'dynamic-legacy',
     'static',
     'static-failures-only',
+    'summary',
     'stream',
     'stream-without-prefixes',
 ];
@@ -282,12 +284,13 @@ function withOutputStyleOption(yargs, choices = [
     'tui',
     'static',
     'static-failures-only',
+    'summary',
     'stream',
     'stream-without-prefixes',
 ]) {
     return yargs
         .option('outputStyle', {
-        describe: `Defines how Nx emits outputs tasks logs. **tui**: enables the Nx Terminal UI, recommended for local development environments. **dynamic-legacy**: use dynamic-legacy output life cycle, previous content is overwritten or modified as new outputs are added, display minimal logs by default, always show errors. This output format is recommended for local development environments where tui is not supported. **static**: uses static output life cycle, no previous content is rewritten or modified as new outputs are added, and every task prints its full output regardless of status. **static-failures-only**: same as **static**, but successful and cached tasks collapse to a single line, so only failing tasks (and, for a single-project run, the project you asked for) print their full output. This is what Nx uses by default in CI and other non-interactive environments. **stream**: nx by default logs output to an internal output stream, enable this option to stream logs to stdout / stderr. **stream-without-prefixes**: nx prefixes the project name the target is running on, use this option remove the project name prefix from output.`,
+        describe: `Defines how Nx emits outputs tasks logs. **tui**: enables the Nx Terminal UI, recommended for local development environments. **dynamic-legacy**: use dynamic-legacy output life cycle, previous content is overwritten or modified as new outputs are added, display minimal logs by default, always show errors. This output format is recommended for local development environments where tui is not supported. **static**: uses static output life cycle, no previous content is rewritten or modified as new outputs are added, and every task prints its full output regardless of status. **static-failures-only**: same as **static**, but successful and cached tasks collapse to a single line, so only failing tasks (and, for a single-project run, the project you asked for) print their full output. This is what Nx uses by default in CI and other non-interactive environments. **summary**: prints only run counts and one line per failing task, naming the file on disk that holds its full output. No task output is printed inline, so the size of a run's output does not depend on how much its tasks logged. This is the default when Nx detects it is being driven by an AI agent. **stream**: nx by default logs output to an internal output stream, enable this option to stream logs to stdout / stderr. **stream-without-prefixes**: nx prefixes the project name the target is running on, use this option remove the project name prefix from output.`,
         type: 'string',
         choices,
     })
@@ -298,16 +301,31 @@ function withOutputStyleOption(yargs, choices = [
                 choices.includes(process.env.NX_DEFAULT_OUTPUT_STYLE)) {
                 args.outputStyle = process.env.NX_DEFAULT_OUTPUT_STYLE;
             }
+            // Everything above this line is the user naming a style; everything
+            // below infers one. Splitting them here is what lets the rest of the
+            // codebase ask either question without re-deriving it from a single
+            // overloaded field.
+            args.specifiedOutputStyle = args.outputStyle;
         },
         (args) => {
+            // Resolution, in precedence order. `shouldUseTui` reads
+            // `specifiedOutputStyle`, so it sees only what the user named and is
+            // not fed a value inferred here - which is what used to make this
+            // ordering circular. It also reads `NX_TUI` before its own agent check,
+            // so an explicit opt-in beats the agent default without needing a
+            // special case: agent detection is ambient (`REPL_ID` is exported into
+            // a human's shell), and a human asking for a renderer outranks it.
             const useTui = (0, is_tui_enabled_1.shouldUseTui)((0, nx_json_1.readNxJson)(), args);
+            process.env.NX_TUI = useTui.toString();
+            const resolved = args.outputStyle ??
+                (useTui ? 'tui' : (0, native_1.isAiAgent)() ? 'summary' : 'static-failures-only');
+            args.resolvedOutputStyle = resolved;
+            // `outputStyle` stays what yargs parsed, except for the TUI, whose
+            // `check` runs after kebab-case normalization and needs both spellings.
             if (useTui) {
-                // We have to set both of these because `check` runs after the normalization that
-                // handles the kebab-case'd args -> camelCase'd args translation.
                 args['output-style'] = 'tui';
                 args.outputStyle = 'tui';
             }
-            process.env.NX_TUI = useTui.toString();
         },
     ]);
 }

package/dist/src/config/workspace-json-project-json.d.ts

@@ -182,9 +182,11 @@ export type InputDefinition = {
     input: string;
 } | {
     fileset: string;
+    includeIgnored?: boolean;
 } | {
     fileset: string;
     dependencies: true;
+    includeIgnored?: boolean;
 } | {
     runtime: string;
 } | {