Adopt Nub fast command paths

.github/workflows/ci.yml

@@ -37,13 +37,13 @@ jobs:
           cache: 'pnpm'
 
       - run: pnpm install --frozen-lockfile
-      - uses: nrwl/nx-set-shas@v4
+      - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
       - name: Determine affected projects
         id: determine_affected
         run: |
           base="${NX_BASE:-origin/master}"
           head="${NX_HEAD:-HEAD}"
-          projects_json="$(pnpm exec nx show projects --affected --json --base="$base" --head="$head")"
+          projects_json="$(./node_modules/.bin/nubx --node nx show projects --affected --json --base="$base" --head="$head")"
           projects="$(printf '%s' "$projects_json" | node -e 'let input = ""; process.stdin.on("data", chunk => input += chunk); process.stdin.on("end", () => { const projects = input.trim() ? JSON.parse(input) : []; if (!Array.isArray(projects)) { throw new Error("Expected an array from nx show projects --json"); } process.stdout.write(projects.join(",")); });')"
           echo "projects=${projects}" >> "$GITHUB_OUTPUT"
           echo "projects_csv=,${projects}," >> "$GITHUB_OUTPUT"
@@ -57,6 +57,6 @@ jobs:
       - name: Lint Nx module boundaries
         run: pnpm lint:nx
       - name: Test new-engine-ctl CI wiring
-        run: pnpm exec nx run new-engine-ctl:test
+        run: ./node_modules/.bin/nubx --node nx run new-engine-ctl:test
       # Nx Affected runs only tasks affected by the changes in this PR/commit. Learn more: https://nx.dev/ci/features/affected
-      - run: pnpm exec nx affected -t lint test
+      - run: ./node_modules/.bin/nubx --node nx affected -t lint test

.github/workflows/ui-release.yml

@@ -43,7 +43,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Set Nx SHAs
-        uses: nrwl/nx-set-shas@v4
+        uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
         with:
           main-branch-name: master
 
@@ -58,7 +58,7 @@ jobs:
             exit 0
           fi
 
-          AFFECTED=$(pnpm exec nx show projects --affected --base="$NX_BASE" --head="$NX_HEAD")
+          AFFECTED=$(./node_modules/.bin/nubx --node nx show projects --affected --base="$NX_BASE" --head="$NX_HEAD")
           echo "$AFFECTED"
           if echo "$AFFECTED" | grep -q "^ui-kit$"; then
             echo "is_affected=true" >> "$GITHUB_OUTPUT"

.github/workflows/zaneops-main-after-ci.yml

@@ -47,7 +47,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build new-engine-ctl
-        run: pnpm exec nx run new-engine-ctl:build
+        run: ./node_modules/.bin/nubx --node nx run new-engine-ctl:build
 
       - name: Resolve base SHA
         id: base

.github/workflows/zaneops-preview-after-ci.yml

@@ -52,7 +52,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build new-engine-ctl
-        run: pnpm exec nx run new-engine-ctl:build
+        run: ./node_modules/.bin/nubx --node nx run new-engine-ctl:build
 
       - name: Resolve PR number
         id: pr

.github/workflows/zaneops-preview-teardown.yml

@@ -28,7 +28,9 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build new-engine-ctl
-        run: NX_ISOLATE_PLUGINS=false pnpm exec nx run new-engine-ctl:build
+        # Teardown only needs the checked-out CLI build artifact; keep Nx plugin
+        # execution in-process here to avoid worker-startup issues in cleanup runs.
+        run: NX_ISOLATE_PLUGINS=false ./node_modules/.bin/nubx --node nx run new-engine-ctl:build
 
       - name: Upload new-engine-ctl artifact
         uses: actions/upload-artifact@v4

apps/new-engine-ctl/package.json

@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "node ./scripts/build.mjs",
-    "dev": "tsx src/cli.ts",
+    "dev": "nub src/cli.ts",
     "lint": "biome check src scripts",
     "format": "biome format --write src scripts",
     "test": "vitest run",
@@ -23,7 +23,6 @@
     "@biomejs/biome": "^2.3.7",
     "@types/node": "^24.12.4",
     "esbuild": "^0.27.3",
-    "tsx": "^4.19.4",
     "vitest": "^4.0.18"
   }
 }

apps/new-engine-ctl/src/__tests__/ci-workflows.test.ts

@@ -21,7 +21,7 @@ const previewBaselineCompleteEnvPattern = /PREVIEW_BASELINE_COMPLETE:/
 const previewBaselineCompleteFlagPattern =
   /--preview-baseline-complete "\$PREVIEW_BASELINE_COMPLETE"/
 const node24Pattern = /node-version: 24/
-const ciCtlTestPattern = /pnpm exec nx run new-engine-ctl:test/
+const ciCtlTestPattern = /nubx --node nx run new-engine-ctl:test/
 const mainVerifyEnvironmentFallbackPattern =
   /ENVIRONMENT_NAME:\s*\$\{\{\s*needs\.deploy\.outputs\.environment_name\s*\|\|\s*secrets\.ZANEOPS_ZANE_PRODUCTION_ENVIRONMENT_NAME\s*\}\}/
 const mainVerifySummaryEnvironmentFallbackPattern =

apps/new-engine-ctl/src/__tests__/scope-preview.test.ts

@@ -1,9 +1,9 @@
-import { dirname, join, resolve } from "node:path"
+import { delimiter, dirname, join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
 
 import { expect, test } from "vitest"
 import { executePlan } from "../orchestration/plan.js"
-import { executeScope } from "../orchestration/scope.js"
+import { executeScope, withWorkspaceBinPath } from "../orchestration/scope.js"
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../../..")
 const stackManifestPath = join(
@@ -17,6 +17,30 @@ const stackInputsPath = join(
 const explicitPreviewRejectPattern =
   /Explicit services are not deployable on lane preview: medusa-db/
 const cloneToPreviewRejectPattern = /clone_to_preview is false/
+const workspaceBinPath = join(process.cwd(), "node_modules", ".bin")
+
+test("scope preserves existing Path casing when prefixing workspace bin", () => {
+  const env = withWorkspaceBinPath({
+    Path: "C:\\Windows\\System32",
+    OTHER_VALUE: "kept",
+  })
+
+  expect(env.Path).toBe(
+    [workspaceBinPath, "C:\\Windows\\System32"].join(delimiter)
+  )
+  expect(Object.hasOwn(env, "PATH")).toBe(false)
+  expect(env.OTHER_VALUE).toBe("kept")
+})
+
+test("scope removes duplicate path casing when prefixing workspace bin", () => {
+  const env = withWorkspaceBinPath({
+    PATH: "/usr/bin",
+    Path: "C:\\Windows\\System32",
+  })
+
+  expect(env.PATH).toBe([workspaceBinPath, "/usr/bin"].join(delimiter))
+  expect(Object.hasOwn(env, "Path")).toBe(false)
+})
 
 test("preview scope prepares DB credentials for first baseline replay", async () => {
   const result = await executeScope({

apps/new-engine-ctl/src/orchestration/scope.ts

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process"
 import { mkdir, writeFile } from "node:fs/promises"
-import { dirname, matchesGlob } from "node:path"
+import { delimiter, dirname, join, matchesGlob } from "node:path"
 import { promisify } from "node:util"
 
 import type { ScopeCommandInput, ScopeResponse } from "../contracts/scope.js"
@@ -26,6 +26,29 @@ type ExecResult = {
   stderr: string
 }
 
+export function withWorkspaceBinPath(
+  env: NodeJS.ProcessEnv
+): NodeJS.ProcessEnv {
+  const pathKey =
+    Object.keys(env).find((key) => key === "PATH") ??
+    Object.keys(env).find((key) => key.toUpperCase() === "PATH") ??
+    "PATH"
+  const nextEnv = { ...env }
+
+  for (const key of Object.keys(nextEnv)) {
+    if (key !== pathKey && key.toUpperCase() === "PATH") {
+      delete nextEnv[key]
+    }
+  }
+
+  return {
+    ...nextEnv,
+    [pathKey]: [join(process.cwd(), "node_modules", ".bin"), env[pathKey]]
+      .filter(Boolean)
+      .join(delimiter),
+  }
+}
+
 function toCsv(values: string[]): string {
   return normalizeCsvToArray(values.join(",")).join(",")
 }
@@ -111,9 +134,9 @@ async function resolveNxAffectedProjects(input: {
 }> {
   try {
     const result = await runCommand(
-      "pnpm",
+      "nubx",
       [
-        "exec",
+        "--node",
         "nx",
         "show",
         "projects",
@@ -124,7 +147,7 @@ async function resolveNxAffectedProjects(input: {
       ],
       {
         env: {
-          ...process.env,
+          ...withWorkspaceBinPath(process.env),
           NX_DAEMON: "false",
           NX_ISOLATE_PLUGINS: String(input.nxIsolatePlugins),
         },
@@ -141,7 +164,16 @@ async function resolveNxAffectedProjects(input: {
         (value): value is string => typeof value === "string"
       ),
     }
-  } catch {
+  } catch (error) {
+    if (
+      error &&
+      typeof error === "object" &&
+      "code" in error &&
+      error.code === "ENOENT"
+    ) {
+      throw new Error("Required command not found: nubx")
+    }
+
     return {
       nxStatus: "fallback",
       projects: [],

package.json

@@ -6,19 +6,19 @@
     "node": "24.x"
   },
   "scripts": {
-    "test-all": "cross-env TEST_ALL_ESHOPS=true nx e2e e2e",
-    "test": "nx e2e e2e",
+    "test-all": "cross-env TEST_ALL_ESHOPS=true nubx --node nx e2e e2e",
+    "test": "nubx --node nx e2e e2e",
     "test:e2e:medusa-be:admin": "pnpm --dir apps/medusa-be test:e2e:admin",
     "test:e2e:medusa-be:http": "bash ./scripts/e2e/medusa-be-http.sh run",
     "test:e2e:medusa-be:http:debug": "MEDUSA_E2E_KEEP_STACK=1 bash ./scripts/e2e/medusa-be-http.sh run",
-    "dev:all:nx": "nx run-many --target=dev --projects=medusa-*",
+    "dev:all:nx": "nubx --node nx run-many --target=dev --projects=medusa-*",
     "start:fe-demo": "cd apps/frontend-demo && npm run start",
     "start:be": "cd apps/medusa-be && npm run start",
-    "start:all:nx": "nx run-many --target=start --projects=medusa-*",
+    "start:all:nx": "nubx --node nx run-many --target=start --projects=medusa-*",
     "build:be": "cd apps/medusa-be && npm run build",
-    "build:all:nx": "nx run-many --target=build --projects=medusa-*",
-    "lint:nx": "NX_DAEMON=false pnpm exec nx show projects > /dev/null && eslint --config eslint.nx.config.cjs \"apps/**/*.{ts,tsx,js,jsx}\" \"libs/**/*.{ts,tsx,js,jsx}\"",
-    "nx:affected": "NX_DAEMON=false pnpm exec nx affected -t lint test",
+    "build:all:nx": "nubx --node nx run-many --target=build --projects=medusa-*",
+    "lint:nx": "NX_DAEMON=false nubx --node nx show projects > /dev/null && eslint --config eslint.nx.config.cjs \"apps/**/*.{ts,tsx,js,jsx}\" \"libs/**/*.{ts,tsx,js,jsx}\"",
+    "nx:affected": "NX_DAEMON=false nubx --node nx affected -t lint test",
     "knip": "knip",
     "knip:report": "knip --reporter markdown > reports/knip-report.md",
     "knip:fix": "knip --fix",
@@ -30,6 +30,7 @@
     "@biomejs/biome": "^2.3.7",
     "@medusajs/deps": "2.16.0",
     "@medusajs/eslint-plugin": "2.16.0",
+    "@nubjs/nub": "0.1.14",
     "@nx/esbuild": "22.4.2",
     "@nx/eslint-plugin": "22.4.2",
     "@nx/js": "22.4.2",

pnpm-workspace.yaml

@@ -97,6 +97,7 @@ syncInjectedDepsAfterScripts:
   - build
 
 allowBuilds:
+  '@nubjs/nub': true
   '@biomejs/biome': true
   '@medusajs/telemetry': false
   '@parcel/watcher': true

scripts/dev/run-zane-main-lane.sh

@@ -141,7 +141,9 @@ require_tools() {
   common::require_command git
   common::require_command jq
   common::ensure_pnpm "$ROOT_DIR"
+  export PATH="${ROOT_DIR}/node_modules/.bin:${PATH}"
   common::require_command node
+  common::require_command nubx
 }
 
 ensure_ctl_built() {

scripts/dev/run-zane-preview-lane.sh

@@ -135,7 +135,9 @@ require_tools() {
   common::require_command git
   common::require_command jq
   common::ensure_pnpm "$ROOT_DIR"
+  export PATH="${ROOT_DIR}/node_modules/.bin:${PATH}"
   common::require_command node
+  common::require_command nubx
   common::require_command sed
 }