nx 23.3.0 → 24.0.0-beta.0

package/dist/src/tasks-runner/task-orchestrator.js

@@ -78,11 +78,12 @@ class TaskOrchestrator {
             ? new native_1.RunningTasksService((0, db_connection_1.getLocalDbConnection)())
             : null;
         this.taskInvocationTracker = !native_1.IS_WASM
-            ? new native_1.TaskInvocationTracker((0, db_connection_1.getLocalDbConnection)(), Number(process.env.NX_INVOCATION_ROOT_PID ?? process.pid))
+            ? new native_1.TaskInvocationTracker((0, db_connection_1.getLocalDbConnection)(), (0, task_env_1.getInvocationRootPid)(), (0, task_env_1.getInvocationAncestorPids)())
             : null;
-        // Tracks tasks registered by THIS process so that recursive code paths
-        // (e.g. applyFromCacheOrRunBatch looping on incomplete batches) don't
-        // re-register and trip the DB uniqueness constraint.
+        // Task ids this process has already registered. Recursive code paths (e.g.
+        // applyFromCacheOrRunBatch looping on incomplete batches) re-enter the
+        // detector for the same task; skipping them saves a DB round trip. A task id
+        // is unique within one process, so it is enough to identify the row.
         this.registeredInvocations = new Set();
         this.tasksSchedule = new tasks_schedule_1.TasksSchedule(this.projectGraph, this.projects, this.taskGraph, this.options);
         // region internal state
@@ -316,39 +317,59 @@ class TaskOrchestrator {
         }
     }
     /**
-     * Registers a task invocation and checks for loops across nested Nx processes.
-     * Uses the task_invocations DB table keyed by root PID. registerTask() throws
-     * on unique constraint violation when a parent Nx process already registered
-     * this task — indicating an infinite loop.
+     * Registers a task invocation and checks for loops across nested Nx
+     * processes. registerTask() returns the invocation chain only when an
+     * *ancestor* Nx process is already running this task — a genuine loop.
+     * Sibling processes running the same task are legitimate and register
+     * without complaint.
+     *
+     * The overrides hash rides along with the task id so the tracker can tell an
+     * ancestor re-invoking a task with different arguments from one repeating
+     * the same invocation.
      */
     detectTaskInvocationLoop(task) {
         if (!this.taskInvocationTracker)
             return;
         if (this.registeredInvocations.has(task.id))
             return;
+        let chain;
         try {
-            this.taskInvocationTracker.registerTask(process.pid, task.id);
+            chain = this.taskInvocationTracker.registerTask(process.pid, task.id, (0, utils_1.hashTaskOverrides)(task));
+        }
+        catch {
+            // Loop detection is diagnostic only; a DB failure must not fail the run
+            // or be mistaken for a loop.
+            return;
+        }
+        if (!chain) {
             this.registeredInvocations.add(task.id);
+            return;
+        }
+        const chainDisplay = chain.map((r) => r.taskId).join(' -> ');
+        output_1.output.error({
+            title: 'Recursive task invocation detected',
+            bodyLines: [
+                `Nx detected a recursive loop of task invocations:`,
+                ``,
+                `  ${chainDisplay} -> ${task.id}`,
+                ``,
+                `Task "${task.id}" was already invoked by a parent Nx process in this chain.`,
+                `This typically happens when a task's command (e.g., "nx ${task.target.target} ${task.target.project}")`,
+                `triggers a chain of tasks that eventually re-invokes itself.`,
+                ``,
+                `To fix this, review the command configuration for the tasks in the chain above.`,
+            ],
+        });
+        process.exit(1);
+    }
+    releaseTaskInvocation(task) {
+        if (!this.registeredInvocations.delete(task.id))
+            return;
+        try {
+            this.taskInvocationTracker?.unregisterTask(process.pid, task.id);
         }
         catch {
-            // Unique constraint violation — task already invoked by an ancestor Nx process
-            const chain = this.taskInvocationTracker.getInvocationChain();
-            const chainDisplay = chain.map((r) => r.taskId).join(' -> ');
-            output_1.output.error({
-                title: 'Recursive task invocation detected',
-                bodyLines: [
-                    `Nx detected a recursive loop of task invocations:`,
-                    ``,
-                    `  ${chainDisplay} -> ${task.id}`,
-                    ``,
-                    `Task "${task.id}" was already invoked by a parent Nx process in this chain.`,
-                    `This typically happens when a task's command (e.g., "nx ${task.target.target} ${task.target.project}")`,
-                    `triggers a chain of tasks that eventually re-invokes itself.`,
-                    ``,
-                    `To fix this, review the command configuration for the tasks in the chain above.`,
-                ],
-            });
-            process.exit(1);
+            // Diagnostic only, like registration. A leftover row is swept as stale.
         }
     }
     // endregion Processing Scheduled Tasks
@@ -1186,31 +1207,45 @@ class TaskOrchestrator {
             await this.scheduleNextTasksAndReleaseThreads();
             return runningTask;
         }
-        const taskSpecificEnv = await this.processedTasks.get(task.id);
-        await this.preRunSteps([task], { groupId });
-        const pipeOutput = await this.pipeOutputCapture(task);
-        // obtain metadata
-        const temporaryOutputPath = this.cache.temporaryOutputPath(task);
-        // Deliberately not gated on `printsTaskOutput`, unlike `runTaskDirectly`.
-        // `SummaryTerminalOutputLifeCycle.printTaskTerminalOutput` is a no-op and it
-        // only reports at `endCommand`, which never runs for a task that does not
-        // end - so suppressing here would leave a `nx serve` under `summary` with a
-        // permanently silent terminal and no file to read yet. Streaming is the only
-        // channel a continuous task has.
-        const streamOutput = (0, output_1.isStaticOutputStyle)(this.specifiedOutputStyle)
-            ? false
-            : (0, utils_1.shouldStreamOutput)(task, this.initiatingProject);
-        let env = pipeOutput
-            ? (0, task_env_1.getEnvVariablesForTask)(task, taskSpecificEnv, (0, task_env_1.getForceColorForChild)(), this.options.skipNxCache, this.options.captureStderr, null, null)
-            : (0, task_env_1.getEnvVariablesForTask)(task, taskSpecificEnv, undefined, this.options.skipNxCache, this.options.captureStderr, temporaryOutputPath, streamOutput);
-        this.detectTaskInvocationLoop(task);
-        const childProcess = await this.runTask(task, streamOutput, env, temporaryOutputPath, pipeOutput);
+        // Claim the task before doing any of the work below. getRunningTasks()
+        // above is a check-then-act: until this row exists, a sibling Nx process
+        // asking the same question is told the task is not running and starts a
+        // duplicate of it.
         this.runningTasksService?.addRunningTask(task.id);
-        this.runningContinuousTasks.set(task.id, {
-            runningTask: childProcess,
-            groupId,
-            ownsRunningTasksService: true,
-        });
+        let childProcess;
+        try {
+            const taskSpecificEnv = await this.processedTasks.get(task.id);
+            await this.preRunSteps([task], { groupId });
+            const pipeOutput = await this.pipeOutputCapture(task);
+            // obtain metadata
+            const temporaryOutputPath = this.cache.temporaryOutputPath(task);
+            // Deliberately not gated on `printsTaskOutput`, unlike `runTaskDirectly`.
+            // `SummaryTerminalOutputLifeCycle.printTaskTerminalOutput` is a no-op and it
+            // only reports at `endCommand`, which never runs for a task that does not
+            // end - so suppressing here would leave a `nx serve` under `summary` with a
+            // permanently silent terminal and no file to read yet. Streaming is the only
+            // channel a continuous task has.
+            const streamOutput = (0, output_1.isStaticOutputStyle)(this.specifiedOutputStyle)
+                ? false
+                : (0, utils_1.shouldStreamOutput)(task, this.initiatingProject);
+            let env = pipeOutput
+                ? (0, task_env_1.getEnvVariablesForTask)(task, taskSpecificEnv, (0, task_env_1.getForceColorForChild)(), this.options.skipNxCache, this.options.captureStderr, null, null)
+                : (0, task_env_1.getEnvVariablesForTask)(task, taskSpecificEnv, undefined, this.options.skipNxCache, this.options.captureStderr, temporaryOutputPath, streamOutput);
+            this.detectTaskInvocationLoop(task);
+            childProcess = await this.runTask(task, streamOutput, env, temporaryOutputPath, pipeOutput);
+            this.runningContinuousTasks.set(task.id, {
+                runningTask: childProcess,
+                groupId,
+                ownsRunningTasksService: true,
+            });
+        }
+        catch (e) {
+            // Nothing owns the claim until runningContinuousTasks holds it — the
+            // release paths (completeContinuousTask, the signal handler) both iterate
+            // that map. Drop it here or siblings wait on a task no one is running.
+            this.runningTasksService?.removeRunningTask(task.id);
+            throw e;
+        }
         this.continuousTaskExitHandled.set(task.id, new Promise((resolve) => {
             childProcess.onExit(async (code) => {
                 await this.handleContinuousTaskExit(code, task, groupId, true);
@@ -1425,8 +1460,7 @@ class TaskOrchestrator {
             if (this.completedTasks.has(task.id))
                 continue;
             this.completedTasks.set(task.id, status);
-            this.taskInvocationTracker?.unregisterTask(task.id);
-            this.registeredInvocations.delete(task.id);
+            this.releaseTaskInvocation(task);
             if (this.tuiEnabled) {
                 this.options.lifeCycle.setTaskStatus(task.id, displayStatus ?? (0, native_1.parseTaskStatus)(status));
             }

package/dist/src/tasks-runner/utils.d.ts

@@ -2,7 +2,6 @@ import { CustomHasher, ExecutorConfig } from '../config/misc-interfaces';
 import { ProjectGraph, ProjectGraphProjectNode } from '../config/project-graph';
 import { Task, TaskGraph } from '../config/task-graph';
 import { ProjectConfiguration, TargetConfiguration, TargetDependencyConfig } from '../config/workspace-json-project-json';
-import { LegacyDependsOnLocation } from './legacy-depends-on-warning';
 export type NormalizedTargetDependencyConfig = TargetDependencyConfig & {
     projects: string[];
 };
@@ -10,9 +9,8 @@ export declare function getDependencyConfigs({ project, target }: {
     project: string;
     target: string;
 }, extraTargetDependencies: Record<string, (TargetDependencyConfig | string)[]>, projectGraph: ProjectGraph, allTargetNames: string[]): NormalizedTargetDependencyConfig[] | undefined;
-export type DependsOnEntryLocation = LegacyDependsOnLocation;
-export declare function normalizeDependencyConfigDefinition(definition: string | TargetDependencyConfig, currentProject: string, graph: ProjectGraph, allTargetNames: string[], location?: DependsOnEntryLocation): NormalizedTargetDependencyConfig[];
-export declare function normalizeDependencyConfigProjects(dependencyConfig: TargetDependencyConfig, currentProject: string, graph: ProjectGraph, location?: DependsOnEntryLocation): NormalizedTargetDependencyConfig;
+export declare function normalizeDependencyConfigDefinition(definition: string | TargetDependencyConfig, currentProject: string, graph: ProjectGraph, allTargetNames: string[]): NormalizedTargetDependencyConfig[];
+export declare function normalizeDependencyConfigProjects(dependencyConfig: TargetDependencyConfig, currentProject: string, graph: ProjectGraph): NormalizedTargetDependencyConfig;
 export declare function expandDependencyConfigSyntaxSugar(dependencyConfigString: string | TargetDependencyConfig, graph: ProjectGraph, currentProject?: string): TargetDependencyConfig;
 export declare function expandWildcardTargetConfiguration(dependencyConfig: NormalizedTargetDependencyConfig, allTargetNames: string[]): NormalizedTargetDependencyConfig[];
 export declare function readProjectAndTargetFromTargetString(targetString: string, projects: Record<string, ProjectGraphProjectNode>, currentProject?: string): {
@@ -20,7 +18,7 @@ export declare function readProjectAndTargetFromTargetString(targetString: strin
     target: string;
 };
 export declare function getOutputs(p: Record<string, ProjectGraphProjectNode>, target: Task['target'], overrides: Task['overrides']): string[];
-export declare function normalizeTargetDependencyWithStringProjects(dependencyConfig: TargetDependencyConfig, currentProject?: string, location?: DependsOnEntryLocation): Omit<TargetDependencyConfig, 'projects'> & {
+export declare function normalizeTargetDependencyWithStringProjects(dependencyConfig: TargetDependencyConfig): Omit<TargetDependencyConfig, 'projects'> & {
     projects?: string[];
 };
 export declare function validateOutputs(outputs: string[]): void;
@@ -49,6 +47,8 @@ export declare function getExecutorForTask(task: Task, projects: Record<string,
     isNxExecutor: boolean;
 };
 export declare function getCustomHasher(task: Task, projects: Record<string, ProjectConfiguration>): CustomHasher | null;
+/** Test-only: forget which executors have been warned about. */
+export declare function resetCustomHasherDeprecationWarnings(): void;
 /**
  * `taskGraph` pruned to `required`, which must already hold its dependencies.
  * Unknown ids are ignored: a sync generator can remove a task after selection.
@@ -64,3 +64,18 @@ export declare function shouldStreamOutput(task: Task, initiatingProject: string
 export declare function isCacheableTask(task: Task): boolean;
 export declare function unparse(options: Object): string[];
 export declare function createTaskId(project: string, target: string, configuration: string | undefined): string;
+/**
+ * Distinguishes two invocations of the same task for the recursive invocation
+ * detector. The task id alone would report `nx run app:build --flag` invoked
+ * from within `app:build` as a loop, so the detector pairs the id with this
+ * hash and only treats an exact repeat as an immediate loop.
+ *
+ * The hash cannot decide recursion on its own. Arguments that accumulate
+ * through forwarding (`app:build` -> `app:build hello` -> `app:build hello
+ * hello`) hash differently on every hop, so the tracker also bounds how many
+ * ancestors may be running one task id.
+ *
+ * `__overrides_unparsed__` is dropped, matching how the task hasher treats it:
+ * it restates the other keys as raw argv, down to flag order and spelling.
+ */
+export declare function hashTaskOverrides(task: Task): string;

package/dist/src/tasks-runner/utils.js

@@ -17,6 +17,7 @@ exports.getExecutorNameForTask = getExecutorNameForTask;
 exports.expandInitiatingTasksThroughNoop = expandInitiatingTasksThroughNoop;
 exports.getExecutorForTask = getExecutorForTask;
 exports.getCustomHasher = getCustomHasher;
+exports.resetCustomHasherDeprecationWarnings = resetCustomHasherDeprecationWarnings;
 exports.pruneToSelectedTasks = pruneToSelectedTasks;
 exports.removeTasksFromTaskGraph = removeTasksFromTaskGraph;
 exports.calculateReverseDeps = calculateReverseDeps;
@@ -28,37 +29,35 @@ exports.shouldStreamOutput = shouldStreamOutput;
 exports.isCacheableTask = isCacheableTask;
 exports.unparse = unparse;
 exports.createTaskId = createTaskId;
+exports.hashTaskOverrides = hashTaskOverrides;
 const minimatch_1 = require("minimatch");
 const node_path_1 = require("node:path");
 const posix_1 = require("node:path/posix");
 const executor_utils_1 = require("../command-line/run/executor-utils");
+const file_hasher_1 = require("../hasher/file-hasher");
 const native_1 = require("../native");
 const fileutils_1 = require("../utils/fileutils");
 const find_matching_projects_1 = require("../utils/find-matching-projects");
-const legacy_depends_on_warning_1 = require("./legacy-depends-on-warning");
 const globs_1 = require("../utils/globs");
 const long_running_target_1 = require("../utils/long-running-target");
+const output_1 = require("../utils/output");
 const path_1 = require("../utils/path");
 const serialize_overrides_into_command_line_1 = require("../utils/serialize-overrides-into-command-line");
 const split_target_1 = require("../utils/split-target");
 const workspace_root_1 = require("../utils/workspace-root");
 const is_tui_enabled_1 = require("./is-tui-enabled");
 function getDependencyConfigs({ project, target }, extraTargetDependencies, projectGraph, allTargetNames) {
-    const legacyViolations = [];
-    const dependencyConfigs = (projectGraph.nodes[project].data?.targets[target]?.dependsOn ??
+    return (projectGraph.nodes[project].data?.targets[target]?.dependsOn ??
         // This is passed into `run-command` from programmatic invocations
         extraTargetDependencies[target] ??
-        []).flatMap((config, index) => normalizeDependencyConfigDefinition(config, project, projectGraph, allTargetNames, { ownerTarget: target, index, legacyViolations }));
-    if (legacyViolations.length) {
-        (0, legacy_depends_on_warning_1.flushLegacyDependsOnViolations)(project, target, legacyViolations, projectGraph.nodes[project]?.data?.root);
-    }
-    return dependencyConfigs;
+        []).flatMap((config) => normalizeDependencyConfigDefinition(config, project, projectGraph, allTargetNames));
 }
-function normalizeDependencyConfigDefinition(definition, currentProject, graph, allTargetNames, location) {
-    return expandWildcardTargetConfiguration(normalizeDependencyConfigProjects(expandDependencyConfigSyntaxSugar(definition, graph, currentProject), currentProject, graph, location), allTargetNames);
+function normalizeDependencyConfigDefinition(definition, currentProject, graph, allTargetNames) {
+    return expandWildcardTargetConfiguration(normalizeDependencyConfigProjects(expandDependencyConfigSyntaxSugar(definition, graph, currentProject), currentProject, graph), allTargetNames);
 }
-function normalizeDependencyConfigProjects(dependencyConfig, currentProject, graph, location) {
-    const noStringConfig = normalizeTargetDependencyWithStringProjects(dependencyConfig, currentProject, location);
+function normalizeDependencyConfigProjects(dependencyConfig, currentProject, graph) {
+    assertNotLegacyProjectsString(dependencyConfig, currentProject, graph);
+    const noStringConfig = normalizeTargetDependencyWithStringProjects(dependencyConfig);
     if (noStringConfig.projects) {
         dependencyConfig.projects = (0, find_matching_projects_1.findMatchingProjects)(noStringConfig.projects, graph.nodes);
     }
@@ -67,6 +66,13 @@ function normalizeDependencyConfigProjects(dependencyConfig, currentProject, gra
     }
     return dependencyConfig;
 }
+function assertNotLegacyProjectsString(dependencyConfig, currentProject, graph) {
+    const projects = dependencyConfig.projects;
+    if ((projects === 'self' || projects === 'dependencies') &&
+        !graph.nodes[projects]) {
+        throw new Error(`${currentProject} has a dependsOn entry using projects: '${projects}', which is no longer supported: ${JSON.stringify(dependencyConfig)}\nPlease run "nx repair" to repair your configuration`);
+    }
+}
 function expandDependencyConfigSyntaxSugar(dependencyConfigString, graph, currentProject) {
     if (typeof dependencyConfigString !== 'string') {
         return dependencyConfigString;
@@ -133,23 +139,9 @@ function readProjectAndTargetFromTargetString(targetString, projects, currentPro
 function getOutputs(p, target, overrides) {
     return getOutputsForTargetAndConfiguration(target, overrides, p[target.project]);
 }
-function normalizeTargetDependencyWithStringProjects(dependencyConfig, currentProject, location) {
+function normalizeTargetDependencyWithStringProjects(dependencyConfig) {
     if (typeof dependencyConfig.projects === 'string') {
-        // TODO(v24): Remove the `self` / `dependencies` magic-string shim.
-        // The v16 `update-depends-on-to-tokens` migration already rewrites
-        // these to the modern shape, and `nx repair` will re-run it on demand.
-        if (dependencyConfig.projects === 'self') {
-            (0, legacy_depends_on_warning_1.warnLegacyDependsOnMagicString)(currentProject, dependencyConfig, location);
-            delete dependencyConfig.projects;
-        }
-        else if (dependencyConfig.projects === 'dependencies') {
-            (0, legacy_depends_on_warning_1.warnLegacyDependsOnMagicString)(currentProject, dependencyConfig, location);
-            dependencyConfig.dependencies = true;
-            delete dependencyConfig.projects;
-        }
-        else {
-            dependencyConfig.projects = [dependencyConfig.projects];
-        }
+        dependencyConfig.projects = [dependencyConfig.projects];
     }
     return dependencyConfig;
 }
@@ -341,9 +333,33 @@ function getExecutorForTask(task, projects) {
     const [nodeModule, executorName] = (0, executor_utils_1.parseExecutor)(executor);
     return (0, executor_utils_1.getExecutorInformation)(nodeModule, executorName, workspace_root_1.workspaceRoot, projects);
 }
+// TODO(v25): remove custom hasher support.
 function getCustomHasher(task, projects) {
     const factory = getExecutorForTask(task, projects).hasherFactory;
-    return factory ? factory() : null;
+    if (!factory) {
+        return null;
+    }
+    warnCustomHasherDeprecation(projects[task.target.project].targets[task.target.target].executor);
+    return factory();
+}
+const customHasherDeprecationWarned = new Set();
+function warnCustomHasherDeprecation(executor) {
+    if (customHasherDeprecationWarned.has(executor)) {
+        return;
+    }
+    customHasherDeprecationWarned.add(executor);
+    output_1.output.warn({
+        title: `The "${executor}" executor uses a custom hasher, which is deprecated and will be removed in Nx 25.`,
+        bodyLines: [
+            'Replace the custom hasher with target inputs, following the migration guide:',
+            'https://nx.dev/docs/kb/local-executors#replace-a-custom-hasher-with-inputs',
+            'If the executor comes from a third-party plugin, report this to its maintainers.',
+        ],
+    });
+}
+/** Test-only: forget which executors have been warned about. */
+function resetCustomHasherDeprecationWarnings() {
+    customHasherDeprecationWarned.clear();
 }
 /**
  * `taskGraph` pruned to `required`, which must already hold its dependencies.
@@ -355,13 +371,29 @@ function pruneToSelectedTasks(taskGraph, required) {
 }
 function removeTasksFromTaskGraph(graph, ids) {
     const newGraph = removeIdsFromTaskGraph(graph, ids, graph.tasks);
+    const continuousDependenciesWithoutInputs = pruneEdges(graph.continuousDependenciesWithoutInputs, newGraph.mapWithIds);
     return {
         dependencies: newGraph.dependencies,
         continuousDependencies: newGraph.continuousDependencies,
+        ...(continuousDependenciesWithoutInputs
+            ? { continuousDependenciesWithoutInputs }
+            : {}),
         roots: newGraph.roots,
         tasks: newGraph.mapWithIds,
     };
 }
+function pruneEdges(edges, kept) {
+    let pruned;
+    for (const [id, deps] of Object.entries(edges ?? {})) {
+        if (!(id in kept))
+            continue;
+        const keptDeps = deps.filter((dep) => dep in kept);
+        if (keptDeps.length > 0) {
+            (pruned ??= {})[id] = keptDeps;
+        }
+    }
+    return pruned;
+}
 function removeIdsFromTaskGraph(graph, ids, mapWithIds) {
     const filteredMapWithIds = {};
     const dependencies = {};
@@ -457,3 +489,22 @@ function createTaskId(project, target, configuration) {
     }
     return id;
 }
+/**
+ * Distinguishes two invocations of the same task for the recursive invocation
+ * detector. The task id alone would report `nx run app:build --flag` invoked
+ * from within `app:build` as a loop, so the detector pairs the id with this
+ * hash and only treats an exact repeat as an immediate loop.
+ *
+ * The hash cannot decide recursion on its own. Arguments that accumulate
+ * through forwarding (`app:build` -> `app:build hello` -> `app:build hello
+ * hello`) hash differently on every hop, so the tracker also bounds how many
+ * ancestors may be running one task id.
+ *
+ * `__overrides_unparsed__` is dropped, matching how the task hasher treats it:
+ * it restates the other keys as raw argv, down to flag order and spelling.
+ */
+function hashTaskOverrides(task) {
+    const overrides = { ...task.overrides };
+    delete overrides['__overrides_unparsed__'];
+    return (0, file_hasher_1.hashObject)(overrides);
+}

package/dist/src/ultracache/overrides.js

@@ -19,6 +19,7 @@ function customHasherTaskIds(projectGraph, taskGraph) {
         return memoized;
     }
     const projects = (0, project_graph_1.readProjectsConfigurationFromProjectGraph)(projectGraph).projects;
+    // TODO(v25): remove custom hasher support.
     const ids = Object.values(taskGraph.tasks)
         .filter((task) => {
         try {
@@ -48,6 +49,9 @@ function getUltracacheSettings(taskGraph) {
 function ultracacheEligibilityOptions(projectGraph, taskGraph) {
     return {
         customHasherTaskIds: customHasherTaskIds(projectGraph, taskGraph),
+        continuousTaskIds: Object.values(taskGraph.tasks)
+            .filter((task) => task.continuous)
+            .map((task) => task.id),
     };
 }
 /**

package/dist/src/utils/owned-private-dir.d.ts

@@ -25,7 +25,7 @@ export type OwnedRealDir = string & {
 export type OwnedPrivateDir = string & {
     readonly [ownedPrivateDirBrand]: true;
 };
-/** Why a guard refused a directory. Data, not a sentence: `remedyFor` decides on it. */
+/** Why a guard refused a directory. Data, not a sentence. */
 export type DirRefusal = {
     kind: 'not-created';
     dir: string;
@@ -65,8 +65,6 @@ export type GuardResult<T> = {
 };
 /** The user-facing sentence for a refusal. The only place wording is decided. */
 export declare function describeRefusal(r: DirRefusal): string;
-/** What the user can do about a refusal, or `undefined` when there is nothing. */
-export declare function remedyFor(r: DirRefusal): string | undefined;
 /** One refusal as an `Error`, so several can travel in an `AggregateError`. */
 export declare class DirectoryRefusedError extends Error {
     readonly refusal: DirRefusal;
@@ -98,20 +96,6 @@ export declare function canonicalDir(dir: string): string;
  * verified private directory beneath it.
  */
 export declare function isSafeSharedRoot(dir: string): GuardResult<SafeSharedRoot>;
-/**
- * Whether other users on this machine can write into `dir`. Gates whether a
- * refusal message may cite other users, so it must not over-report: `false` on
- * Windows, where libuv synthesizes `st_mode` from the READONLY attribute and
- * reports an ordinary per-account directory as `0666`, and `false` on a path
- * that cannot be inspected.
- *
- * `statSync`, not `lstatSync`: the question is about the directory that will be
- * used, not the link pointing at it. Link modes mislead in both directions —
- * Linux creates symlinks `0777`, macOS applies the umask. Nothing here decides
- * whether a path is accepted, so following the link costs nothing the guards
- * do not already re-check.
- */
-export declare function isPeerWritable(dir: string): boolean;
 /**
  * Create a shared container as sticky + world-writable if it does not exist,
  * and report whether the resulting path is safe for the current user.

package/dist/src/utils/owned-private-dir.js

@@ -2,14 +2,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DirectoryRefusedError = void 0;
 exports.describeRefusal = describeRefusal;
-exports.remedyFor = remedyFor;
 exports.canonicalDir = canonicalDir;
 exports.isSafeSharedRoot = isSafeSharedRoot;
-exports.isPeerWritable = isPeerWritable;
 exports.ensureSafeSharedRoot = ensureSafeSharedRoot;
 exports.isOwnedRealDirectory = isOwnedRealDirectory;
 exports.getUserSegment = getUserSegment;
 exports.ensureOwnedPrivateDir = ensureOwnedPrivateDir;
+/**
+ * Directory guards for Nx's runtime state: create a directory only when it is
+ * ours and unreachable by other users on this machine.
+ *
+ * `native/utils/owned_dir.rs` implements the same rules and must change with
+ * this file. This copy exists because the native binding loader has to place
+ * and lock down the `.node` before Rust can be called, and `cache-directory.ts`,
+ * `git-utils.ts` and `nx-tmp-dir.ts` share it. Node builtins only, for the
+ * loader's sake.
+ */
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
@@ -56,42 +64,6 @@ function describeRefusal(r) {
         }
     }
 }
-/** Single-quoted for a shell, so a path with a space or quote survives a paste. */
-const shellQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-/** What the user can do about a refusal, or `undefined` when there is nothing. */
-function remedyFor(r) {
-    switch (r.kind) {
-        case 'not-a-directory':
-            return r.symlink
-                ? `${r.dir} is a symlink where Nx expects a directory. If you did not create it, treat it as hostile: remove the link itself (not what it points at) and run the command again.`
-                : undefined;
-        case 'foreign-owner':
-            return `${r.dir} belongs to another user on this machine, so Nx cannot keep its own directory there. Set NX_SOCKET_DIR to a short directory your user owns, or move it aside — which you can do yourself if you own the directory it sits in, and otherwise needs an administrator.`;
-        case 'not-tightenable':
-            // Both producers reach here having already established that the directory
-            // is ours, so `chmod` is the user's to run. Names no cause: one producer
-            // is a mount that discards the mode, the other is any `chmod` failure.
-            return `${r.dir} is reachable by other users (mode ${asMode(r.mode)}) and Nx could not restrict it. Run \`chmod 0700 ${shellQuote(r.dir)}\` and try again; if the mode does not stick, set NX_SOCKET_DIR to a short directory on a filesystem that keeps POSIX permissions.`;
-        case 'foreign-shared-container':
-            // Unreachable today: `isSafeSharedRoot` denies with this kind only when
-            // `stats.uid !== 0`, so a root-owned container never reaches here.
-            if (r.uid === 0) {
-                return undefined;
-            }
-            const q = shellQuote(r.dir);
-            return `${r.dir} belongs to another user on this machine, so Nx cannot keep a private directory beneath it. Ask an administrator to hand it to root with \`sudo chown root ${q} && sudo chmod 1777 ${q}\`; every user can then keep their own directory under it.`;
-        case 'not-created':
-        case 'not-inspectable':
-        case 'peer-writable-not-sticky':
-            return undefined;
-        default: {
-            // Matches `describeRefusal`'s arm, so a new kind cannot ship with a
-            // sentence and no advice — which is how `not-tightenable` went unadvised.
-            const unhandled = r;
-            return undefined;
-        }
-    }
-}
 /** One refusal as an `Error`, so several can travel in an `AggregateError`. */
 class DirectoryRefusedError extends Error {
     constructor(refusal) {
@@ -207,30 +179,6 @@ function isSafeSharedRoot(dir) {
         return deny({ kind: 'not-inspectable', dir, code: e?.code });
     }
 }
-/**
- * Whether other users on this machine can write into `dir`. Gates whether a
- * refusal message may cite other users, so it must not over-report: `false` on
- * Windows, where libuv synthesizes `st_mode` from the READONLY attribute and
- * reports an ordinary per-account directory as `0666`, and `false` on a path
- * that cannot be inspected.
- *
- * `statSync`, not `lstatSync`: the question is about the directory that will be
- * used, not the link pointing at it. Link modes mislead in both directions —
- * Linux creates symlinks `0777`, macOS applies the umask. Nothing here decides
- * whether a path is accepted, so following the link costs nothing the guards
- * do not already re-check.
- */
-function isPeerWritable(dir) {
-    if (process.platform === 'win32') {
-        return false;
-    }
-    try {
-        return !!((0, node_fs_1.statSync)(dir).mode & 0o022);
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Create a shared container as sticky + world-writable if it does not exist,
  * and report whether the resulting path is safe for the current user.

package/dist/src/utils/perf-hooks.d.ts

@@ -1,3 +1,4 @@
+// tsc doesn't emit hand-written .d.ts files; assets.json copies this one into dist.
 import type { EventParameters } from '../analytics/analytics';
 
 export interface TrackedDetail extends EventParameters {

package/dist/src/utils/plugins/core-plugins.js

@@ -80,7 +80,7 @@ exports.CORE_PLUGINS = [
     },
     {
         name: '@nx/remix',
-        capabilities: 'executors,generators',
+        capabilities: 'generators',
     },
     {
         name: '@nx/rollup',

package/dist/src/utils/string-similarity.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Computes the Levenshtein edit distance between two strings, i.e. the minimum
+ * number of single-character insertions, deletions, or substitutions required
+ * to turn `a` into `b`.
+ */
+export declare function levenshteinDistance(a: string, b: string): number;
+/**
+ * Ranks every candidate by how closely it resembles `input`, from closest to
+ * furthest, tie-broken alphabetically so the order is deterministic. Each entry
+ * keeps its computed distance so callers can reuse it (e.g. to both pick the
+ * closest match and order a list) without recomputing.
+ */
+export declare function rankByDistance(input: string, candidates: readonly string[]): {
+    candidate: string;
+    distance: number;
+}[];
+/**
+ * Whether a candidate at edit `distance` from `input` is close enough to be a
+ * useful suggestion. Exposed so callers that already have a distance (e.g. from
+ * `rankByDistance`) can gate on it without recomputing.
+ */
+export declare function isWithinSuggestionThreshold(input: string, candidate: string, distance: number): boolean;
+/**
+ * Ranks the candidates that are similar enough to `input` to be worth
+ * suggesting, closest first (ties broken alphabetically). Each entry keeps its
+ * distance so callers can compare suggestions found for different forms of the
+ * same input without recomputing.
+ */
+export declare function rankSuggestions(input: string, candidates: readonly string[]): {
+    candidate: string;
+    distance: number;
+}[];
+/**
+ * Returns up to `limit` candidates that most closely resemble `input`, sorted
+ * from closest to furthest. Candidates that are not similar enough to be a
+ * useful suggestion are excluded.
+ */
+export declare function findClosestMatches(input: string, candidates: readonly string[], limit?: number): string[];