nx 23.3.0 → 24.0.0-beta.0

package/dist/src/nx-cloud/update-manager.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NxCloudClientUnavailableError = exports.NxCloudEnterpriseOutdatedError = void 0;
 exports.verifyOrUpdateNxCloudClient = verifyOrUpdateNxCloudClient;
 exports.getBundleInstallDefaultLocation = getBundleInstallDefaultLocation;
+exports.downloadAndExtractClientBundle = downloadAndExtractClientBundle;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const zlib_1 = require("zlib");
@@ -16,6 +17,7 @@ const tar = tslib_1.__importStar(require("tar-stream"));
 const cache_directory_1 = require("../utils/cache-directory");
 const is_ci_1 = require("../utils/is-ci");
 const crypto_1 = require("crypto");
+const native_1 = require("../native");
 const workspace_root_1 = require("../utils/workspace-root");
 class NxCloudEnterpriseOutdatedError extends Error {
     constructor(url) {
@@ -74,13 +76,13 @@ async function verifyOrUpdateNxCloudClient(options) {
         if (version === 'NX_ENTERPRISE_OUTDATED_IMAGE') {
             throw new NxCloudEnterpriseOutdatedError(apiUrl);
         }
-        const fullPath = await downloadAndExtractClientBundle(httpClient, runnerBundleInstallDirectory, version, url);
-        (0, debug_logger_1.debugLog)('Done: ', fullPath);
-        const nxCloudClient = require(fullPath);
+        const installedBundle = await downloadAndExtractClientBundle(httpClient, version, url);
+        (0, debug_logger_1.debugLog)('Done: ', installedBundle.fullPath);
+        const nxCloudClient = require(installedBundle.fullPath);
         if (nxCloudClient.commands === undefined) {
             throw new NxCloudEnterpriseOutdatedError(apiUrl);
         }
-        return { version, nxCloudClient };
+        return { version: installedBundle.version, nxCloudClient };
     }
     if (currentBundle === null) {
         throw new NxCloudClientUnavailableError();
@@ -114,6 +116,25 @@ function getBundleInstallDefaultLocation() {
     return (0, path_1.join)((0, is_ci_1.isCI)() ? (0, cache_directory_1.cacheDirectoryForWorkspace)(workspace_root_1.workspaceRoot) : cache_directory_1.cacheDir, 'cloud');
 }
 const runnerBundleInstallDirectory = getBundleInstallDefaultLocation();
+// Control files live outside the install directory. Released nx versions load
+// any directory there as a bundle, so they would `require` a state directory
+// placed inside it.
+const stateDirectory = (0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'nx.json'))
+    ? (0, path_1.join)(cache_directory_1.workspaceDataDirectory, 'nx-cloud')
+    : `${runnerBundleInstallDirectory}-state`;
+function ensureStateDirectory() {
+    (0, fs_1.mkdirSync)(stateDirectory, { recursive: true });
+}
+const downloadLockFilePath = (0, path_1.join)(stateDirectory, 'download.lock');
+// The record lives beside the lockfile rather than inside it. Windows
+// byte-range locks are mandatory and handle-scoped, so writing to a file this
+// process holds an exclusive lock on fails with ERROR_LOCK_VIOLATION. It also
+// matches the convention elsewhere in nx: project-graph.lock and run.json.lock
+// are never written to.
+const downloadRecordFilePath = (0, path_1.join)(stateDirectory, 'download.record');
+// A version names a directory that is created and later deleted, so a value
+// from the server must not be able to escape the install directory.
+const VALID_BUNDLE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function getLatestInstalledRunnerBundle() {
     if (!(0, fs_1.existsSync)(runnerBundleInstallDirectory)) {
         (0, fs_1.mkdirSync)(runnerBundleInstallDirectory, { recursive: true });
@@ -121,7 +142,9 @@ function getLatestInstalledRunnerBundle() {
     try {
         const installedBundles = (0, fs_1.readdirSync)(runnerBundleInstallDirectory)
             .filter((potentialDirectory) => {
-            return (0, fs_1.statSync)((0, path_1.join)(runnerBundleInstallDirectory, potentialDirectory)).isDirectory();
+            // '.tmp-*' directories are in-progress or crashed downloads
+            return (!potentialDirectory.startsWith('.') &&
+                (0, fs_1.statSync)((0, path_1.join)(runnerBundleInstallDirectory, potentialDirectory)).isDirectory());
         })
             .map((fileOrDirectory) => ({
             version: fileOrDirectory,
@@ -131,7 +154,13 @@ function getLatestInstalledRunnerBundle() {
             // No installed bundles
             return null;
         }
-        return installedBundles[0];
+        // A contended install can leave several bundles on disk. The record names
+        // the directory an install last completed in, which is the one to run.
+        // Without a record the directory name is all there is to go on and is read
+        // as the version, which is right for a bundle an older nx installed and
+        // otherwise yields a version the server rejects, costing one more
+        // download.
+        return recordedBundle() ?? installedBundles[0];
     }
     catch (e) {
         console.log('Could not read runner bundle path:', e.message);
@@ -170,7 +199,7 @@ async function verifyCurrentBundle(httpClient, currentBundle) {
     });
 }
 function getLatestBundleVerificationTimestamp() {
-    const lockfilePath = (0, path_1.join)(runnerBundleInstallDirectory, 'verify.lock');
+    const lockfilePath = (0, path_1.join)(stateDirectory, 'verify.lock');
     if ((0, fs_1.existsSync)(lockfilePath)) {
         const timestampAsString = (0, fs_1.readFileSync)(lockfilePath, 'utf-8');
         let timestampAsNumber;
@@ -185,7 +214,8 @@ function getLatestBundleVerificationTimestamp() {
     return null;
 }
 function writeBundleVerificationLock() {
-    const lockfilePath = (0, path_1.join)(runnerBundleInstallDirectory, 'verify.lock');
+    const lockfilePath = (0, path_1.join)(stateDirectory, 'verify.lock');
+    ensureStateDirectory();
     (0, fs_1.writeFileSync)(lockfilePath, new Date().getTime().toString(), 'utf-8');
 }
 function getBundleContentHash(bundle) {
@@ -211,7 +241,118 @@ function hashDirectory(dir) {
     const combinedHashes = hashes.sort().join('');
     return (0, crypto_1.createHash)('sha256').update(combinedHashes).digest('hex');
 }
-async function downloadAndExtractClientBundle(httpClient, runnerBundleInstallDirectory, version, url) {
+async function downloadAndExtractClientBundle(httpClient, version, url) {
+    // Parallel nx processes race to install bundles, possibly at different
+    // versions. The first to take the lock downloads; the rest wait and adopt
+    // its bundle when an install completed during the wait at the version the
+    // server asked them for. Otherwise they download their own as a contended
+    // install, which publishes its own directory and skips cleanup, so the
+    // holder's bundle stays on disk for the process running from it - at the
+    // same version as well as a different one. The flock is released by the
+    // kernel if the holder dies, so no stale-lock cleanup is needed. Under WASM
+    // the lock is unavailable and downloads run unserialized.
+    if (!VALID_BUNDLE_VERSION.test(version)) {
+        throw new Error(`Invalid Nx Cloud client bundle version: ${version}`);
+    }
+    const recordBeforeContending = readDownloadRecord();
+    const lock = !native_1.IS_WASM ? new native_1.FileLock(downloadLockFilePath) : null;
+    let locked = lock?.locked;
+    let contended = false;
+    while (locked) {
+        (0, debug_logger_1.debugLog)('Another process is downloading the client bundle, waiting for it to complete');
+        await lock.wait();
+        // The holder may be running from a bundle whose record predates this call,
+        // so the wait alone makes the install contended.
+        contended = true;
+        const installedBundle = bundleInstalledSince(recordBeforeContending);
+        if (installedBundle) {
+            if (installedBundle.version === version) {
+                (0, debug_logger_1.debugLog)('Using client bundle downloaded by another process: ', installedBundle.version);
+                return installedBundle;
+            }
+            (0, debug_logger_1.debugLog)('Another process installed a different bundle: ', installedBundle.version);
+        }
+        // The other process failed or installed an older version, so this process
+        // still needs to download.
+        locked = lock.check();
+    }
+    lock?.lock();
+    try {
+        // A process that acquired the lock between the check above and lock() may
+        // have completed an install already.
+        const installedBundle = bundleInstalledSince(recordBeforeContending);
+        if (installedBundle) {
+            if (installedBundle.version === version) {
+                (0, debug_logger_1.debugLog)('Using client bundle downloaded by another process: ', installedBundle.version);
+                return installedBundle;
+            }
+            // A different version means that process is running from a bundle this
+            // one must not delete.
+            contended = true;
+            (0, debug_logger_1.debugLog)('Another process installed a different bundle: ', installedBundle.version);
+        }
+        const fullPath = await downloadAndExtractBundle(httpClient, version, url, contended);
+        return { version, fullPath };
+    }
+    finally {
+        lock?.unlock();
+    }
+}
+// Records "<serverVersion> <directoryName>", written only once an install has
+// COMPLETED. The directory is recorded separately because it cannot be derived
+// from the version - every install publishes its own (see
+// downloadAndExtractBundle), so several directories can carry the same
+// version. That also makes every record distinct, so a waiter can tell "an
+// install finished while I waited" from "this record is left over from a past
+// run" by comparing the record it read before contending. Timestamps cannot
+// answer that: filesystem mtime granularity is coarser than the race window.
+function readDownloadRecord() {
+    try {
+        return (0, fs_1.readFileSync)(downloadRecordFilePath, 'utf-8').trim();
+    }
+    catch {
+        return '';
+    }
+}
+function writeDownloadRecord(version, directoryName) {
+    ensureStateDirectory();
+    (0, fs_1.writeFileSync)(downloadRecordFilePath, `${version} ${directoryName}`, 'utf-8');
+}
+/**
+ * The bundle the record names, if it is still on disk. A record whose second
+ * field does not name a live directory resolves to null and leaves selection
+ * on its fallback, which is what a one-field record or anything else
+ * unexpected in the file has to do.
+ */
+function recordedBundle() {
+    const [version, directoryName] = readDownloadRecord().split(' ');
+    if (!version ||
+        !directoryName ||
+        !VALID_BUNDLE_VERSION.test(version) ||
+        !VALID_BUNDLE_VERSION.test(directoryName)) {
+        return null;
+    }
+    const fullPath = (0, path_1.join)(runnerBundleInstallDirectory, directoryName);
+    return (0, fs_1.existsSync)(fullPath) ? { version, fullPath } : null;
+}
+/**
+ * The bundle an install completed during this call, or null. Requires the
+ * record to have changed since `recordBefore` was read: a directory existing
+ * proves only that some earlier run left one there, and an install
+ * interrupted on a released nx leaves exactly that.
+ */
+function bundleInstalledSince(recordBefore) {
+    return readDownloadRecord() === recordBefore ? null : recordedBundle();
+}
+async function downloadAndExtractBundle(httpClient, version, url, contended) {
+    // Every install publishes its own directory. Two processes can be asked for
+    // the same version while one of them is already running from a completed
+    // install of it, so replacing <installDir>/<version> in place would delete
+    // that bundle out from under it - and a holder loading its client in the gap
+    // fails with MODULE_NOT_FOUND, which drops the task runner to running
+    // without Nx Cloud. A directory nothing else has seen cannot be in use.
+    const bundleDirectoryName = `${version}-${(0, crypto_1.randomUUID)()}`;
+    const bundleExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, bundleDirectoryName);
     let resp;
     try {
         resp = await httpClient.get(url, {
@@ -222,53 +363,99 @@ async function downloadAndExtractClientBundle(httpClient, runnerBundleInstallDir
         console.error('Error while updating Nx Cloud client bundle');
         throw e;
     }
-    const bundleExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, version);
-    if (!(0, fs_1.existsSync)(bundleExtractLocation)) {
-        (0, fs_1.mkdirSync)(bundleExtractLocation);
-    }
-    return new Promise((res, rej) => {
-        const extract = tar.extract();
-        extract.on('entry', function (headers, stream, next) {
-            if (headers.type === 'directory') {
-                const directoryPath = (0, path_1.join)(bundleExtractLocation, headers.name);
-                if (!(0, fs_1.existsSync)(directoryPath)) {
-                    (0, fs_1.mkdirSync)(directoryPath, { recursive: true });
-                }
-                next();
-                stream.resume();
-            }
-            else if (headers.type === 'file') {
-                const outputFilePath = (0, path_1.join)(bundleExtractLocation, headers.name);
-                const writeStream = (0, fs_1.createWriteStream)(outputFilePath);
-                // Surface disk errors through the pipeline instead of crashing
-                writeStream.on('error', (e) => extract.destroy(e));
-                stream.pipe(writeStream);
-                // Continue the tar stream after the write stream closes
-                writeStream.on('close', () => {
+    // Extract into a temp directory and rename into place afterwards, so a
+    // failed or interrupted download never leaves a partial bundle at the
+    // path other processes require it from.
+    const tempExtractLocation = (0, path_1.join)(runnerBundleInstallDirectory, `.tmp-${version}-${process.pid}`);
+    (0, fs_1.mkdirSync)(tempExtractLocation, { recursive: true });
+    try {
+        await new Promise((res, rej) => {
+            const extract = tar.extract();
+            extract.on('entry', function (headers, stream, next) {
+                if (headers.type === 'directory') {
+                    const directoryPath = (0, path_1.join)(tempExtractLocation, headers.name);
+                    if (!(0, fs_1.existsSync)(directoryPath)) {
+                        (0, fs_1.mkdirSync)(directoryPath, { recursive: true });
+                    }
                     next();
-                });
-                stream.resume();
-            }
-        });
-        extract.on('finish', function () {
-            removeOldClientBundles(version);
-            writeBundleVerificationLock();
-            res(bundleExtractLocation);
-        });
-        // pipeline propagates download/gunzip errors that .pipe() would leave
-        // uncaught
-        (0, stream_1.pipeline)(resp.data, (0, zlib_1.createGunzip)(), extract, (e) => {
-            if (e)
-                rej(e);
+                    stream.resume();
+                }
+                else if (headers.type === 'file') {
+                    const outputFilePath = (0, path_1.join)(tempExtractLocation, headers.name);
+                    const writeStream = (0, fs_1.createWriteStream)(outputFilePath);
+                    // Surface disk errors through the pipeline instead of crashing
+                    writeStream.on('error', (e) => extract.destroy(e));
+                    stream.pipe(writeStream);
+                    // Continue the tar stream after the write stream closes
+                    writeStream.on('close', () => {
+                        next();
+                    });
+                    stream.resume();
+                }
+                else {
+                    // Skipping the entry would publish an incomplete bundle.
+                    extract.destroy(new Error(`Unsupported ${headers.type} entry in Nx Cloud client bundle: ${headers.name}`));
+                }
+            });
+            extract.on('finish', function () {
+                res();
+            });
+            // pipeline propagates download/gunzip errors that .pipe() would leave
+            // uncaught
+            (0, stream_1.pipeline)(resp.data, (0, zlib_1.createGunzip)(), extract, (e) => {
+                if (e)
+                    rej(e);
+            });
         });
-    });
+        (0, fs_1.renameSync)(tempExtractLocation, bundleExtractLocation);
+        // Recorded only now: the record is the signal that a bundle at this
+        // version was installed by this process, which is what lets a waiter
+        // adopt it instead of downloading again, and it carries the directory
+        // that selection has to load from.
+        writeDownloadRecord(version, bundleDirectoryName);
+    }
+    catch (e) {
+        (0, fs_1.rmSync)(tempExtractLocation, { recursive: true, force: true });
+        throw e;
+    }
+    // On a contended install another process may be running from any bundle on
+    // disk, now including one at this same version, so nothing here can be shown
+    // to be unused and collection waits for a later uncontended install. Repeat
+    // contention accumulates directories until one of those runs. Bounding that
+    // means knowing which bundles are still loaded, which nothing on disk
+    // records today.
+    if (!contended) {
+        removeOldClientBundles(bundleDirectoryName);
+    }
+    writeBundleVerificationLock();
+    return bundleExtractLocation;
 }
-function removeOldClientBundles(currentInstallVersion) {
+function removeOldClientBundles(currentInstallDirectoryName) {
     const filesAndFolders = (0, fs_1.readdirSync)(runnerBundleInstallDirectory);
     for (let fileOrFolder of filesAndFolders) {
+        // A '.tmp-*' left by a crashed extract is reclaimed here, which is safe
+        // only because this runs after our own was renamed away and the download
+        // lock means no other process is extracting. Under WASM there is no lock,
+        // so a concurrent extract may still own that directory: leaving it costs
+        // disk, deleting it would fail that process's install.
+        if (fileOrFolder === currentInstallDirectoryName ||
+            (native_1.IS_WASM && fileOrFolder.startsWith('.tmp-'))) {
+            continue;
+        }
         const fileOrFolderPath = (0, path_1.join)(runnerBundleInstallDirectory, fileOrFolder);
-        if (fileOrFolder !== currentInstallVersion) {
-            (0, fs_1.rmSync)(fileOrFolderPath, { recursive: true });
+        // Another process's cleanup can remove an entry between the readdir above
+        // and these calls, so both tolerate it already being gone.
+        let isBundle;
+        try {
+            // Only directories are bundles. Files here, like the verify.lock a
+            // released nx writes, are left alone.
+            isBundle = (0, fs_1.statSync)(fileOrFolderPath).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isBundle) {
+            (0, fs_1.rmSync)(fileOrFolderPath, { recursive: true, force: true });
         }
     }
 }

package/dist/src/project-graph/affected/affected-tasks.js

@@ -148,6 +148,7 @@ async function selectAffectedTasks(projectGraph, nxJson, planningContext, reques
     const dependencies = dependencyChanges(projectGraph, touchedFiles, nxJson, packageJson);
     const namedProjects = new Set(dependencies.projects);
     const projects = (0, project_graph_1.readProjectsConfigurationFromProjectGraph)(projectGraph).projects;
+    // TODO(v25): remove custom hasher support.
     const customHashed = new Set(taskIds.filter((id) => hasCustomHasher(taskGraph.tasks[id], projects)));
     const options = {
         projectGlobPatterns: await (0, affected_projects_1.getProjectGlobPatterns)(nxJson),

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -351,6 +351,13 @@ class IsolatedPlugin {
         this.shutdown();
     }
     async setWorkerEnv(env) {
+        // A restart may have spawned under the previous client env but not yet
+        // finished loading. Wait for that worker so it receives the update too.
+        // Do not start a stopped worker solely to forward env: its next spawn
+        // will inherit the daemon's already-updated environment.
+        if (!this._alive && this._connectPromise) {
+            await this._connectPromise;
+        }
         if (!this._alive) {
             return;
         }

package/dist/src/tasks-runner/create-task-graph.d.ts

@@ -25,6 +25,8 @@ export declare class ProcessTasks {
     readonly continuousDependencies: {
         [k: string]: string[];
     };
+    private readonly continuousEdgesWithoutInputs;
+    private readonly continuousEdgesWithInputs;
     readonly dependencyOverrides: DependencyOverrides;
     private readonly allTargetNames;
     constructor(extraTargetDependencies: TargetDependencies, projectGraph: ProjectGraph, recordDependencyOverrides?: boolean);
@@ -33,6 +35,14 @@ export declare class ProcessTasks {
     private processTasksForMultipleProjects;
     private processTasksForSingleProject;
     private processTasksForDependencies;
+    private addContinuousEdge;
+    /**
+     * Continuous edges every `dependsOn` path into which has `inputs: false`.
+     * Undefined when there are none, so graphs without the option are unchanged.
+     */
+    continuousDependenciesWithoutInputs(): {
+        [k: string]: string[];
+    } | undefined;
     private recordEdge;
     private createDummyTask;
     createTask(id: string, project: ProjectGraphProjectNode, target: string, resolvedConfiguration: string | undefined, overrides: Record<string, unknown>): Task;

package/dist/src/tasks-runner/create-task-graph.js

@@ -20,6 +20,11 @@ class ProcessTasks {
         this.tasks = {};
         this.dependencies = {};
         this.continuousDependencies = {};
+        // `from\0to` continuous edges by whether their `dependsOn` entry has
+        // `inputs: false`. Keyed from the creator's target, like `recordEdge`, so
+        // an edge through a dummy task names the real task.
+        this.continuousEdgesWithoutInputs = new Set();
+        this.continuousEdgesWithInputs = new Set();
         this.dependencyOverrides = {};
         const allTargetNames = new Set();
         for (const projectName in projectGraph.nodes) {
@@ -132,7 +137,7 @@ class ProcessTasks {
             if (task.id !== selfTaskId) {
                 this.recordEdge(task, selfTaskId, taskOverrides);
                 if (this.tasks[selfTaskId].continuous) {
-                    this.continuousDependencies[task.id].push(selfTaskId);
+                    this.addContinuousEdge(task, selfTaskId, dependencyConfig);
                 }
                 else {
                     this.dependencies[task.id].push(selfTaskId);
@@ -156,7 +161,7 @@ class ProcessTasks {
                 if (task.id !== depTargetId) {
                     this.recordEdge(task, depTargetId, taskOverrides);
                     if (depTargetConfiguration.continuous) {
-                        this.continuousDependencies[task.id].push(depTargetId);
+                        this.addContinuousEdge(task, depTargetId, dependencyConfig);
                     }
                     else {
                         this.dependencies[task.id].push(depTargetId);
@@ -186,6 +191,32 @@ class ProcessTasks {
             }
         }
     }
+    addContinuousEdge(task, dependencyId, dependencyConfig) {
+        this.continuousDependencies[task.id].push(dependencyId);
+        const { project, target, configuration } = task.target;
+        const edge = `${(0, utils_1.createTaskId)(project, target, configuration)}\0${dependencyId}`;
+        (dependencyConfig.inputs === false
+            ? this.continuousEdgesWithoutInputs
+            : this.continuousEdgesWithInputs).add(edge);
+    }
+    /**
+     * Continuous edges every `dependsOn` path into which has `inputs: false`.
+     * Undefined when there are none, so graphs without the option are unchanged.
+     */
+    continuousDependenciesWithoutInputs() {
+        let without;
+        for (const [taskId, deps] of Object.entries(this.continuousDependencies)) {
+            const excluded = deps.filter((dep) => {
+                const edge = `${taskId}\0${dep}`;
+                return (this.continuousEdgesWithoutInputs.has(edge) &&
+                    !this.continuousEdgesWithInputs.has(edge));
+            });
+            if (excluded.length > 0) {
+                (without ??= {})[taskId] = excluded;
+            }
+        }
+        return without;
+    }
     recordEdge(task, dependencyId, overrides) {
         if (!this.recordDependencyOverrides) {
             return;
@@ -276,11 +307,15 @@ function filterTaskGraphToSelection(projectGraph, taskGraph, dependencyOverrides
 }
 function buildTaskGraph(p, projectNames, targets, configuration, overrides, excludeTaskDependencies) {
     const roots = p.processTasks(projectNames, targets, configuration, overrides, excludeTaskDependencies);
+    const continuousDependenciesWithoutInputs = p.continuousDependenciesWithoutInputs();
     return {
         roots,
         tasks: p.tasks,
         dependencies: p.dependencies,
         continuousDependencies: p.continuousDependencies,
+        ...(continuousDependenciesWithoutInputs
+            ? { continuousDependenciesWithoutInputs }
+            : {}),
     };
 }
 function interpolateOverrides(args, projectName, project) {

package/dist/src/tasks-runner/task-env.d.ts

@@ -37,6 +37,16 @@ export declare function getTaskSpecificEnv(task: Task, graph: ProjectGraph): Nod
  */
 export declare function getGraphTimeDotEnvForTask(projectRoot: string, target: string, configuration?: string, nonAtomizedTarget?: string, baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare function getEnvVariablesForTask(task: Task, taskSpecificEnv: NodeJS.ProcessEnv, forceColor: string, skipNxCache: boolean, captureStderr: boolean, outputPath: string, streamOutput: boolean): NodeJS.ProcessEnv;
+/**
+ * Pids of the nx processes this one is nested inside, outermost first. Empty
+ * for a root invocation.
+ */
+export declare function getInvocationAncestorPids(): number[];
+/**
+ * Pid of the outermost nx process in this tree, which is this process when it
+ * is the root.
+ */
+export declare function getInvocationRootPid(): number;
 /**
  * This function loads one or more .env files and expands the variables in them.
  * When multiple files are provided, all files are loaded first, then variable

package/dist/src/tasks-runner/task-env.js

@@ -5,6 +5,8 @@ exports.getEnvVariablesForBatchProcess = getEnvVariablesForBatchProcess;
 exports.getTaskSpecificEnv = getTaskSpecificEnv;
 exports.getGraphTimeDotEnvForTask = getGraphTimeDotEnvForTask;
 exports.getEnvVariablesForTask = getEnvVariablesForTask;
+exports.getInvocationAncestorPids = getInvocationAncestorPids;
+exports.getInvocationRootPid = getInvocationRootPid;
 exports.loadAndExpandDotEnvFile = loadAndExpandDotEnvFile;
 exports.unloadDotEnvFile = unloadDotEnvFile;
 exports.getEnvFilesForTask = getEnvFilesForTask;
@@ -128,6 +130,10 @@ function getNxEnvVariablesForForkedProcess(forceColor, skipNxCache, captureStder
         FORCE_COLOR: forceColor,
         NX_WORKSPACE_ROOT: workspace_root_1.workspaceRoot,
         NX_SKIP_NX_CACHE: skipNxCache ? 'true' : undefined,
+        // pids of the forked process's ancestor nx processes, outermost first.
+        // Only an ancestor re-invoking a task is a loop — sibling nx processes
+        // running the same task are legitimate.
+        NX_INVOCATION_ANCESTOR_PIDS: appendAncestorPid(process.env.NX_INVOCATION_ANCESTOR_PIDS),
     };
     if (outputPath) {
         env.NX_TERMINAL_OUTPUT_PATH = outputPath;
@@ -140,6 +146,26 @@ function getNxEnvVariablesForForkedProcess(forceColor, skipNxCache, captureStder
     }
     return env;
 }
+function appendAncestorPid(inherited) {
+    return inherited ? `${inherited},${process.pid}` : String(process.pid);
+}
+/**
+ * Pids of the nx processes this one is nested inside, outermost first. Empty
+ * for a root invocation.
+ */
+function getInvocationAncestorPids() {
+    return (process.env.NX_INVOCATION_ANCESTOR_PIDS ?? '')
+        .split(',')
+        .map((pid) => Number(pid))
+        .filter((pid) => Number.isInteger(pid) && pid > 0);
+}
+/**
+ * Pid of the outermost nx process in this tree, which is this process when it
+ * is the root.
+ */
+function getInvocationRootPid() {
+    return getInvocationAncestorPids()[0] ?? process.pid;
+}
 function getNxEnvVariablesForTask(task, forceColor, skipNxCache, captureStderr, outputPath, streamOutput) {
     const env = {
         NX_TASK_TARGET_PROJECT: task.target.project,
@@ -153,16 +179,11 @@ function getNxEnvVariablesForTask(task, forceColor, skipNxCache, captureStderr,
     if (task.target.target === 'test') {
         env.NX_TERMINAL_CAPTURE_STDERR = 'true';
     }
-    // Pass the root Nx process PID to nested processes for DB-based loop detection.
-    // The root PID is used as a key in the task_invocations table to track which tasks
-    // have been invoked across nested Nx processes.
     return {
         ...getNxEnvVariablesForForkedProcess(forceColor, skipNxCache, captureStderr, outputPath, streamOutput),
         ...env,
         // Ensure the TUI does not get spawned within the TUI if ever tasks invoke Nx again
         NX_TUI: 'false',
-        // tracks the root PID for child nx tasks, used to verify nx is infinitely recursing through the same tasks
-        NX_INVOCATION_ROOT_PID: process.env.NX_INVOCATION_ROOT_PID ?? String(process.pid),
     };
 }
 /**

package/dist/src/tasks-runner/task-orchestrator.d.ts

@@ -94,12 +94,18 @@ export declare class TaskOrchestrator {
     private processTask;
     processAllScheduledTasks(): void;
     /**
-     * Registers a task invocation and checks for loops across nested Nx processes.
-     * Uses the task_invocations DB table keyed by root PID. registerTask() throws
-     * on unique constraint violation when a parent Nx process already registered
-     * this task — indicating an infinite loop.
+     * Registers a task invocation and checks for loops across nested Nx
+     * processes. registerTask() returns the invocation chain only when an
+     * *ancestor* Nx process is already running this task — a genuine loop.
+     * Sibling processes running the same task are legitimate and register
+     * without complaint.
+     *
+     * The overrides hash rides along with the task id so the tracker can tell an
+     * ancestor re-invoking a task with different arguments from one repeating
+     * the same invocation.
      */
     private detectTaskInvocationLoop;
+    private releaseTaskInvocation;
     private applyCachedResults;
     /**
      * Batch cache lookup + filter to successful entries. Handles both