feat(core): add sandbox target configuration for observed-IO opt-out - #36853
Open
AgentEnder wants to merge 2 commits into
Open
feat(core): add sandbox target configuration for observed-IO opt-out#36853AgentEnder wants to merge 2 commits into
AgentEnder wants to merge 2 commits into
Conversation
Adds a `sandbox` property to target configuration with `enabled`, `ignoredReads`, and `ignoredWrites`. The task orchestrator registers each task's sandbox configuration with the TaskIOService, which suppresses PID reporting for tasks whose target sets `sandbox.enabled: false`, so no IO tracing signal (and therefore no sandbox report) is produced for them. checkFilesAreInputs/checkFilesAreOutputs treat paths matching the ignored globs as reconciled so sandbox-violation validation skips them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YVrVQUAtU1aSQPuUxLkJsn
Review feedback: the target's sandbox configuration is copied onto each Task in createTaskGraph (Task['sandbox'] equals TargetConfiguration['sandbox']), so consumers read it off the task instead of resolving it through the project graph. The orchestrator registers it with the TaskIOService just-in-time in processTask, which both run paths await before spawning, replacing the upfront iteration over the task graph. The check-task-files sandbox matching is reverted: those functions answer whether a file is an input/output, and with ignored accesses excluded from reports at record time there is nothing left for them to reconcile. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YVrVQUAtU1aSQPuUxLkJsn
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Nx Cloud AI Fix could not be generatedView your CI Pipeline Execution ↗ for commit 56662c3
☁️ Nx Cloud last updated this comment at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
There is no way to opt a target out of observed-IO sandboxing or to declare reads/writes that should be excluded from sandboxing reports. Every task the runner tracks gets its PIDs reported through the
TaskIOService, so a sandbox report is produced regardless of whether the task can safely use one, and task instances carry no sandbox information for downstream consumers (the Nx Cloud runner and cloud api).Expected Behavior
Targets can declare a
sandboxconfiguration in project/target config (andtargetDefaults):{ "sandbox": { "enabled": false, "ignoredReads": ["tmp/cache/**"], "ignoredWrites": ["scratch/**"] } }TargetConfigurationgainssandbox(typed and in the JSON schemas), defined as the nativeTaskSandboxConfigurationsoTask['sandbox']andTargetConfiguration['sandbox']are the same type.createTaskGraphcopies the target'ssandboxconfig onto eachTaskinstance (likecache/parallelism), so consumers read it off the task itself instead of resolving it through the project graph.TaskIOServicejust-in-time inprocessTask(both run paths await it before spawning).notifyPidUpdatedrops PID updates for tasks withenabled: false, so no IO tracing signal — and therefore no sandbox report — is produced for opted-out tasks.ignoredReads/ignoredWritesare consumed by the Nx Cloud runner and io-trace daemon (nrwl/ocean), which exclude matching accesses from sandbox reports at record time; this PR only carries them on the task instances.Related Issue(s)
Part of the "Allow Nx plugins to declare tasks as non-snapshot-able" work (Linear). The
backpropagate/healingflag from that ticket is deliberately not included here.🤖 Generated with Claude Code
https://claude.ai/code/session_01YVrVQUAtU1aSQPuUxLkJsn
Generated by Claude Code