fix(vscode): block lifecycle scripts in all dlx commands

[MaxKless]

Summary

• Several npx/yarn dlx/pnpm dlx invocations either had no --ignore-scripts protection or placed the flag after the package name, where it gets passed to nx instead of npx. This is the primary supply chain attack vector — lifecycle scripts from transitive dependencies run during package fetch.
• Created a shared buildSafeDlxCommand helper (libs/shared/npm/src/lib/safe-dlx-command.ts) that returns the correct flag or env var for each package manager: --ignore-scripts for npx, YARN_ENABLE_SCRIPTS=false for yarn berry, npm_config_ignore_scripts=true for pnpm, and a no-op for bun.
• Fixed all four call sites: nx-init.ts, periodic-ai-check.ts, get-cloud-onboarding-url.ts, and init-nx-cloud-view.ts.
• Changed the periodic AI agent check from a 3-minute delay + 3-hour repeating interval to a single randomized startup delay (1–5 minutes).

Key decisions

• The helper returns env vars instead of inlining VAR=value command syntax because that doesn't work on Windows.
• Yarn berry removed --ignore-scripts from dlx, and pnpm dlx doesn't support it either — both need env vars instead.
• nx-init.ts was hardcoded to npx regardless of the user's package manager. Now it detects the PM and uses the helper.
• The periodic check doesn't need to repeat every 3 hours — a one-time startup check is sufficient.

[nx-cloud-snapshot]

View your CI Pipeline Execution ↗ for commit f90602e

Command	Status	Duration	Result
nx affected --targets=lint,test,build,e2e-ci,ty...	✅ Succeeded	11m 55s	View ↗
nx-cloud record -- yarn nx sync:check	✅ Succeeded	8s	View ↗
nx-cloud record -- yarn nx run-many -t ktfmtFormat	✅ Succeeded	3m 15s	View ↗
nx run-many -t ktfmtFormat	✅ Succeeded	3m 11s	View ↗
nx-cloud record -- yarn nx format:check --verbose	✅ Succeeded	4s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-04-07 11:10:52 UTC

[nx-cloud-snapshot]

✅ The fix from Nx Cloud was applied automatically

We ran nx format:write on the two files modified by the PR (apps/vscode/src/nx-init.ts and libs/vscode/mcp/src/lib/periodic-ai-check.ts) to resolve the format:check failure. The PR's code changes were not formatted according to the workspace's Prettier configuration, causing the CI format check to fail. These formatting fixes will allow the format:check task to pass without altering any logic.

Tip

✅ We verified this fix by re-running nx-cloud record -- yarn nx format:check --verbose.

Suggested Fix changes

diff --git a/apps/vscode/src/nx-init.ts b/apps/vscode/src/nx-init.ts
index fda15cca..755b0545 100644
--- a/apps/vscode/src/nx-init.ts
+++ b/apps/vscode/src/nx-init.ts
@@ -41,9 +41,7 @@ export function initNxInit(context: ExtensionContext) {
         const packageManagerCommand = await getPackageManagerCommand(
           workspacePath ?? '',
         );
-        const { prefix, env } = buildSafeDlxCommand(
-          packageManagerCommand.dlx,
-        );
+        const { prefix, env } = buildSafeDlxCommand(packageManagerCommand.dlx);
         const command = `${prefix} nx@latest init`;
         const task = new Task(
           { type: 'nx' },
diff --git a/libs/vscode/mcp/src/lib/periodic-ai-check.ts b/libs/vscode/mcp/src/lib/periodic-ai-check.ts
index 5e4f450b..06d14140 100644
--- a/libs/vscode/mcp/src/lib/periodic-ai-check.ts
+++ b/libs/vscode/mcp/src/lib/periodic-ai-check.ts
@@ -141,8 +141,7 @@ async function constructCommand(
     : buildSafeDlxCommand(packageManagerCommands.dlx, { npxCacheDir });
 
   return {
-    command:
-      `${prefix} nx@latest configure-ai-agents ${flags}`.trim(),
+    command: `${prefix} nx@latest configure-ai-agents ${flags}`.trim(),
     env,
   };
 }
@@ -677,8 +676,7 @@ async function runAiAgentCheckLegacy() {
           source: 'notification',
         });
 
-        const { command: setupCmd, env: setupEnv } =
-          await constructCommand('');
+        const { command: setupCmd, env: setupEnv } = await constructCommand('');
         const task = new Task(
           { type: 'nx' },
           TaskScope.Workspace,

  

View interactive diff ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}