feat(core): add TaskFileResolver primitive; refactor show target --check to use it by polygraph-snapshot-app[bot] · Pull Request #35583 · nrwl/nx

polygraph-snapshot-app · 2026-05-05T21:47:26Z

Summary

Adds a small generic TaskFileResolver primitive (exported from devkit-internals,
not devkit-exports) that lets callers ask whether a workspace-relative path is a
declared input or output of a given task. Refactors nx show target ... --check
(both inputs and outputs) to use it instead of duplicating the input/output
reconciliation logic.

This supersedes the earlier verifySandboxViolations API: that high-level helper
has been removed in favor of this lower-level primitive. Consumers (the nx-cloud
light client) own their own report schemas and call the primitive per file.

API

interface TaskFileResolver {
  isInput(taskId: string, file: string): boolean;
  isOutput(taskId: string, file: string): boolean;
  getInputs(taskId: string): string[];
  getRawInputs(taskId: string): HashInputs;
  getOutputs(taskId: string): string[];
  /**
   * Static validation for `dependentTasksOutputFiles` inputs: matches a path
   * against each declared dep-outputs glob ANDed with each upstream task's
   * declared outputs. Works without the upstream having actually run.
   */
  matchesDependentTaskOutputs(taskId: string, file: string): boolean;
}
function createTaskFileResolver(opts: {
  projectGraph: ProjectGraph;
  nxJson?: NxJsonConfiguration;
  workspaceRoot?: string;
}): Promise<TaskFileResolver>;

Exported from packages/nx/src/devkit-internals.ts.

isInput() accepts a path as an input if any of the following hold:

Path is in HashInputs.files (resolved self-inputs).
Path is in HashInputs.depOutputs (materialized — only populated after
upstream tasks have run).
Path matches a dependentTasksOutputFiles glob declared on the task AND
lies inside the declared outputs of an upstream task in the task graph
(honors transitive: true|false). This is the static check that lets
sandbox-report verification work without first running the dependency.

Files

File	Change
`packages/nx/src/hasher/task-file-resolver.ts`	added — primitive impl
`packages/nx/src/hasher/task-file-resolver.spec.ts`	added — unit tests
`packages/nx/src/hasher/verify-sandbox-violations.ts`	deleted
`packages/nx/src/hasher/verify-sandbox-violations.spec.ts`	deleted
`packages/nx/src/devkit-internals.ts`	exposes `createTaskFileResolver`
`packages/nx/src/devkit-exports.ts`	removes `verifySandboxViolations` exports
`packages/nx/src/command-line/show/show-target/inputs.ts`	refactored — uses resolver
`packages/nx/src/command-line/show/show-target/outputs.ts`	refactored — uses resolver

Test plan

Unit tests for the resolver primitive (23 tests passing locally — including
6 new tests covering dependentTasksOutputFiles static validation).
Unit tests for show target inputs|outputs (25 tests passing locally).
CI build / lint / full jest suite.

Linked PR

Consumed by nrwl/ocean#11134, which owns the SandboxReport schema and
iterates the report calling resolver.isInput / resolver.isOutput per file.

netlify · 2026-05-05T21:47:31Z

✅ Deploy Preview for nx-docs ready!

Name	Link
🔨 Latest commit	`9307800`
🔍 Latest deploy log	https://app.netlify.com/projects/nx-docs/deploys/6a03f7c78232c100085095f1
😎 Deploy Preview	https://deploy-preview-35583--nx-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-05-05T21:47:34Z

✅ Deploy Preview for nx-dev ready!

Name	Link
🔨 Latest commit	`9307800`
🔍 Latest deploy log	https://app.netlify.com/projects/nx-dev/deploys/6a03f7c71478de0008713ada
😎 Deploy Preview	https://deploy-preview-35583--nx-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

nx-cloud · 2026-05-05T21:48:00Z

View your CI Pipeline Execution ↗ for commit 71a4d46

Command	Status	Duration	Result
`nx affected --targets=lint,test,build,e2e,e2e-c...`	✅ Succeeded	15m 30s	View ↗
`nx run-many -t check-imports check-lock-files c...`	✅ Succeeded	3s	View ↗
`nx-cloud record -- pnpm nx-cloud conformance:check`	✅ Succeeded	16s	View ↗
`nx build workspace-plugin`	✅ Succeeded	<1s	View ↗
`nx-cloud record -- nx sync:check`	✅ Succeeded	22s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	6s	View ↗

☁️ Nx Cloud last updated this comment at 2026-05-13 04:21:35 UTC

AgentEnder · 2026-05-11T19:51:01Z

+  const taskId = t.configuration
+    ? `${t.projectName}:${t.targetName}:${t.configuration}`
+    : `${t.projectName}:${t.targetName}`;


We have utils to create the task id already, don't do it ad-hoc like this

AgentEnder · 2026-05-11T19:55:17Z

+  function parseTaskId(taskId: string): {
+    project: string;
+    target: string;
+    configuration?: string;
+  } {
+    const [project, target, configuration] = splitByColons(taskId);
+    if (!project || !target) {
+      throw new Error(
+        `Invalid taskId "${taskId}" — expected "project:target[:configuration]"`
+      );
+    }
+    return { project, target, configuration };
+  }


Nope, we have dedicated utils for this stuff

AgentEnder · 2026-05-11T19:55:48Z

+    // The result key is usually the same as taskId but may include a
+    // defaultConfiguration suffix when none was explicitly given.
+    let inputs: HashInputs | undefined = planResult[taskId];
+    if (!inputs) {
+      const prefix = `${project}:${target}`;
+      for (const [key, val] of Object.entries(planResult)) {
+        if (key === prefix || key.startsWith(prefix + ':')) {
+          inputs = val;
+          break;
+        }
+      }
+    }


We can read the target's default configuration instead of guessing here

AgentEnder · 2026-05-11T19:59:20Z

+  function findCanonicalTaskId(taskId: string, tg: TaskGraph): string | null {
+    if (tg.tasks[taskId]) return taskId;
+    const { project, target } = parseTaskId(taskId);
+    const prefix = `${project}:${target}`;
+    for (const id of Object.keys(tg.tasks)) {
+      if (id === prefix || id.startsWith(prefix + ':')) return id;
+    }
+    return null;
+  }


This is kinda crazy, we've got better utils for this. Don't duplicate.

AgentEnder · 2026-05-11T19:59:31Z

+  function getDepsOutputs(taskId: string): ExpandedDepsOutput[] {
+    if (depsOutputsCache.has(taskId)) return depsOutputsCache.get(taskId)!;
+
+    const tg = getTaskGraphFor(taskId);
+    if (!tg) {
+      depsOutputsCache.set(taskId, []);
+      return [];
+    }
+    const canonical = findCanonicalTaskId(taskId, tg);
+    if (!canonical) {
+      depsOutputsCache.set(taskId, []);
+      return [];
+    }
+    const task = tg.tasks[canonical] as Task;
+    let result: ExpandedDepsOutput[] = [];
+    try {
+      result =
+        getInputs(task, options.projectGraph, getNxJson()).depsOutputs ?? [];
+    } catch {
+      result = [];
+    }
+    depsOutputsCache.set(taskId, result);
+    return result;
+  }


AgentEnder · 2026-05-11T19:59:44Z

+  function getUpstreamTaskIds(taskId: string, transitive: boolean): string[] {
+    const tg = getTaskGraphFor(taskId);
+    if (!tg) return [];
+    const canonical = findCanonicalTaskId(taskId, tg);
+    if (!canonical) return [];
+    const direct = tg.dependencies[canonical] ?? [];
+    if (!transitive) return [...direct];
+    const visited = new Set<string>();
+    const queue = [...direct];
+    while (queue.length) {
+      const id = queue.shift()!;
+      if (visited.has(id)) continue;
+      visited.add(id);
+      queue.push(...(tg.dependencies[id] ?? []));
+    }
+    return [...visited];
+  }


We almost certainly have a better util

AgentEnder · 2026-05-11T19:59:55Z

+  function pathMatchesOutputPattern(
+    normalizedPath: string,
+    pattern: string
+  ): boolean {
+    const np = pattern.replace(/\\/g, '/');
+    return (
+      normalizedPath === np ||
+      normalizedPath.startsWith(np + '/') ||
+      minimatch(normalizedPath, np, { dot: true })
+    );
+  }


Existing utils?

AgentEnder · 2026-05-11T20:00:35Z

+  function isOutputImpl(taskId: string, path: string): boolean {
+    const normalized = path.replace(/\\/g, '/');
+    return getOutputs(taskId).some((p) =>
+      pathMatchesOutputPattern(normalized, p)
+    );
+  }


Why these weird Impl suffixes? Also, why are we even doing the filtering like this? This sucks. Getting bespoke listts of outputs per path instead of some bulk query

AgentEnder · 2026-05-11T20:00:48Z

+    const depsOutputs = getDepsOutputs(taskId);
+    if (depsOutputs.length === 0) return false;
+    for (const { dependentTasksOutputFiles, transitive } of depsOutputs) {
+      if (!minimatch(normalized, dependentTasksOutputFiles, { dot: true })) {


We almost certainly have a util

…cking Adds a programmatic API that lets external consumers verify whether sandbox-violation file paths from a prior task run would be considered legitimate inputs/outputs in the current workspace configuration. The API mirrors the logic that powers nx show target --check: inputs are reconciled via HashPlanInspector.inspectTaskInputs, outputs via getOutputsForTargetAndConfiguration with glob matching. HashPlanInspector and the new verifier are now exported from devkit-exports for use by the nx-cloud light client.

…evkit-internals Replaces the sandbox-report-aware verifySandboxViolations export with a generic primitive. createTaskFileResolver returns a handle exposing getInputs / getOutputs / isInput / isOutput per task — the cloud light client owns the SandboxReport shape and the iteration loop. Exposed via devkit-internals (not the public devkit-exports surface). A follow-up commit will refactor nx show target --check to consume this same resolver.

…ally Previously isInput() only matched against the materialized HashInputs.files list — when an upstream task hadn't run yet, depOutputs was empty and any file declared via { dependentTasksOutputFiles: '...', transitive?: bool } was reported as not-an-input even when the path obviously matched both the glob and a declared upstream output. The new logic walks the task graph from the inspected task, pulls each upstream's declared output globs, and reports the path as an input when it matches the dependentTasksOutputFiles glob AND lies inside one of those upstream outputs. Honors transitive: true/false. The check is exposed separately as resolver.matchesDependentTaskOutputs so consumers (e.g. the nx-cloud check-sandbox-report command) can reason about why a path was considered an input. Adds 6 unit tests covering: materialized depOutputs, static glob+output match, glob-without-output mismatch, output-without-glob mismatch, transitive=true walk, transitive=false short-walk, and the standalone matchesDependentTaskOutputs accessor.

…uts public functions Surfaces are simpler (no factory pattern): callers pass files directly and receive { matched, unmatched } without constructing or threading a resolver object. Functions are public (devkit-exports) not internal: Cloud can import them directly without going through requireNx / devkit-internals. Module-level graph caching keeps it fast: createProjectGraphAsync and HashPlanInspector.init are called at most once per process — the same efficiency as the old resolver but without the explicit pass-through. Breaking: TaskFileResolver interface and createTaskFileResolver factory are removed from devkit-internals. Cloud should import checkFilesAreInputs / checkFilesAreOutputs from @nx/devkit instead.

…uts public functions [Self-Healing CI Rerun]

Replaces splitByColons (low-level lexer) with the project-graph-aware splitTarget helper so taskIds whose project name contains colons (e.g. some:scoped:project:build) parse correctly.

… [Self-Healing CI Rerun]

nx-cloud

Nx Cloud has identified a flaky task in your failed CI:

🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.

View detailed reasoning in Nx Cloud ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}

polygraph-snapshot-app Bot added the polygraph label May 5, 2026

This comment was marked as outdated.

Sign in to view

AgentEnder force-pushed the feat/check-sandbox-report branch from 9ec92af to 8378d0e Compare May 6, 2026 20:51

AgentEnder changed the title ~~feat(core): expose verifySandboxViolations API for sandbox-report checking~~ feat(core): add TaskFileResolver primitive; refactor show target --check to use it May 6, 2026

This comment was marked as outdated.

Sign in to view

AgentEnder self-assigned this May 11, 2026

AgentEnder requested changes May 11, 2026

View reviewed changes

AgentEnder added 5 commits May 11, 2026 17:12

fix(core): address task-file-resolver review feedback

187b53e

chore(core): prettier format fix for task-file-resolver

adae585

AgentEnder force-pushed the feat/check-sandbox-report branch from 31a7d28 to adae585 Compare May 11, 2026 21:13

chore(misc): reeview feedback

e58ff2f

This comment was marked as outdated.

Sign in to view

AgentEnder and others added 2 commits May 12, 2026 13:38

chore(repo): retrigger ci

52e5a35

chore(repo): retrigger ci [Self-Healing CI Rerun]

ac58359

This comment was marked as outdated.

Sign in to view

AgentEnder and others added 2 commits May 12, 2026 18:13

cleanup(core): replace TaskFileResolver with checkFilesAreInputs/Outp…

5ed91fe

…uts public functions [Self-Healing CI Rerun]

This comment was marked as outdated.

Sign in to view

AgentEnder and others added 2 commits May 12, 2026 23:16

cleanup(core): use splitTarget for taskId parsing in check-task-files

71a4d46

Replaces splitByColons (low-level lexer) with the project-graph-aware splitTarget helper so taskIds whose project name contains colons (e.g. some:scoped:project:build) parse correctly.

cleanup(core): use splitTarget for taskId parsing in check-task-files…

9307800

… [Self-Healing CI Rerun]

nx-cloud Bot reviewed May 13, 2026

View reviewed changes

Conversation

polygraph-snapshot-app Bot commented May 5, 2026 • edited by AgentEnder Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

API

Files

Test plan

Linked PR

Uh oh!

netlify Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-docs ready!

Uh oh!

netlify Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-dev ready!

Uh oh!

nx-cloud Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

nx-cloud Bot left a comment

Choose a reason for hiding this comment

Nx Cloud has identified a flaky task in your failed CI:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

polygraph-snapshot-app Bot commented May 5, 2026 •

edited by AgentEnder

Loading

netlify Bot commented May 5, 2026 •

edited

Loading

netlify Bot commented May 5, 2026 •

edited

Loading

nx-cloud Bot commented May 5, 2026 •

edited

Loading