@pnpm/exec.lifecycle 1100.1.2 → 1100.1.4

package/lib/index.js

@@ -1,6 +1,7 @@
 import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { runLifecycleHook } from './runLifecycleHook.js';
 import { runLifecycleHooksConcurrently } from './runLifecycleHooksConcurrently.js';
+import { killTrackedProcessTrees, trackChildProcess } from './trackChildProcess.js';
 export function makeNodeRequireOption(modulePath, env) {
     let { NODE_OPTIONS } = env ?? process.env;
     NODE_OPTIONS = `${NODE_OPTIONS ?? process.env.NODE_OPTIONS ?? ''} --require=${quotePathIfNeeded(modulePath)}`.trim();
@@ -30,7 +31,7 @@ function removeNodePackageMapOption(nodeOptions) {
         .replace(/(?:^|\s)--experimental-package-map\s+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\S+)/g, '')
         .trim();
 }
-export { runLifecycleHook, runLifecycleHooksConcurrently, };
+export { killTrackedProcessTrees, runLifecycleHook, runLifecycleHooksConcurrently, trackChildProcess, };
 export async function runPostinstallHooks(opts) {
     const pkg = await safeReadPackageJsonFromDir(opts.pkgRoot);
     if (pkg == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.lifecycle",
-  "version": "1100.1.2",
+  "version": "1100.1.4",
   "description": "Package lifecycle hook runner",
   "keywords": [
     "pnpm",
@@ -29,34 +29,34 @@
     "!*.map"
   ],
   "dependencies": {
+    "@pnpm/bins.linker": "1100.0.18",
+    "@pnpm/core-loggers": "1100.2.3",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/fetching.directory-fetcher": "1100.0.21",
     "@pnpm/npm-lifecycle": "^1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/store.cafs-types": "1100.0.1",
+    "@pnpm/store.controller-types": "1100.1.8",
+    "@pnpm/types": "1101.4.0",
     "chalk": "^5.6.2",
     "is-windows": "^1.0.2",
     "path-exists": "^5.0.0",
     "run-groups": "^5.0.0",
-    "shlex": "^3.0.0",
-    "@pnpm/bins.linker": "1100.0.16",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.directory-fetcher": "1100.0.19",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/store.cafs-types": "1100.0.1",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/types": "1101.3.2"
+    "shlex": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@types/is-windows": "^1.0.2",
-    "@zkochan/rimraf": "^4.0.0",
-    "load-json-file": "^7.0.1",
-    "@pnpm/exec.lifecycle": "1100.1.2",
+    "@pnpm/exec.lifecycle": "1100.1.4",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/prepare": "1100.0.20",
+    "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@types/is-windows": "^1.0.2",
+    "@zkochan/rimraf": "^4.0.0",
+    "load-json-file": "^7.0.1"
   },
   "engines": {
     "node": ">=22.13"

package/lib/index.d.ts

@@ -1,10 +0,0 @@
-import { runLifecycleHook, type RunLifecycleHookOptions } from './runLifecycleHook.js';
-import { runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions } from './runLifecycleHooksConcurrently.js';
-export declare function makeNodeRequireOption(modulePath: string, env?: Record<string, string | undefined>): {
-    NODE_OPTIONS: string;
-};
-export declare function makeNodePackageMapOption(packageMapPath: string, env?: Record<string, string | undefined>): {
-    NODE_OPTIONS: string;
-};
-export { runLifecycleHook, type RunLifecycleHookOptions, runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions, };
-export declare function runPostinstallHooks(opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/runLifecycleHook.d.ts

@@ -1,19 +0,0 @@
-import type { DependencyManifest, ProjectManifest } from '@pnpm/types';
-export interface RunLifecycleHookOptions {
-    args?: string[];
-    depPath: string;
-    extraBinPaths?: string[];
-    extraEnv?: Record<string, string>;
-    initCwd?: string;
-    optional?: boolean;
-    pkgRoot: string;
-    rootModulesDir: string;
-    scriptShell?: string;
-    silent?: boolean;
-    scriptsPrependNodePath?: boolean | 'warn-only';
-    shellEmulator?: boolean;
-    stdio?: string;
-    unsafePerm: boolean;
-    userAgent?: string;
-}
-export declare function runLifecycleHook(stage: string, manifest: ProjectManifest | DependencyManifest, opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/runLifecycleHook.js

@@ -1,168 +0,0 @@
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-import { lifecycleLogger } from '@pnpm/core-loggers';
-import { PnpmError } from '@pnpm/error';
-import { globalWarn } from '@pnpm/logger';
-import { lifecycle } from '@pnpm/npm-lifecycle';
-import chalk from 'chalk';
-import isWindows from 'is-windows';
-import { join as shellQuote } from 'shlex';
-function noop() { } // eslint-disable-line:no-empty
-export async function runLifecycleHook(stage, manifest, opts) {
-    const optional = opts.optional === true;
-    // To remediate CVE_2024_27980, Node.js does not allow .bat or .cmd files to
-    // be spawned without the "shell: true" option.
-    //
-    // https://nodejs.org/api/child_process.html#spawning-bat-and-cmd-files-on-windows
-    //
-    // Unfortunately, setting spawn's shell option also causes arguments to be
-    // evaluated before they're passed to the shell, resulting in a surprising
-    // behavior difference only with .bat/.cmd files.
-    //
-    // Instead of showing a "spawn EINVAL" error, let's throw a clearer error that
-    // this isn't supported.
-    //
-    // If this behavior needs to be supported in the future, the arguments would
-    // need to be escaped before they're passed to the .bat/.cmd file. For
-    // example, scripts such as "echo %PATH%" should be passed verbatim rather
-    // than expanded. This is difficult to do correctly. Other open source tools
-    // (e.g. Rust) attempted and introduced bugs. The Rust blog has a good
-    // high-level explanation of the same security vulnerability Node.js patched.
-    //
-    // https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html#overview
-    //
-    // Note that npm (as of version 10.5.0) doesn't support setting script-shell
-    // to a .bat or .cmd file either.
-    if (opts.scriptShell != null && typeof opts.scriptShell === 'string' && isWindowsBatchFile(opts.scriptShell)) {
-        throw new PnpmError('ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS', 'Cannot spawn .bat or .cmd as a script shell.', {
-            hint: `\
-The pnpm-workspace.yaml scriptShell option was configured to a .bat or .cmd file. These cannot be used as a script shell reliably.
-
-Please unset the scriptShell option, or configure it to a .exe instead.
-`,
-        });
-    }
-    const m = { _id: getId(manifest), ...manifest };
-    m.scripts = { ...m.scripts };
-    switch (stage) {
-        case 'start':
-            if (!m.scripts.start) {
-                if (!existsSync('server.js')) {
-                    throw new PnpmError('NO_SCRIPT_OR_SERVER', 'Missing script start or file server.js');
-                }
-                m.scripts.start = 'node server.js';
-            }
-            break;
-        case 'install':
-            if (!m.scripts.install && !m.scripts.preinstall) {
-                checkBindingGyp(opts.pkgRoot, m.scripts);
-            }
-            break;
-    }
-    if (opts.args?.length && m.scripts?.[stage]) {
-        // It is impossible to quote a command line argument that contains newline for Windows cmd.
-        const escapedArgs = isWindows()
-            ? opts.args.map((arg) => JSON.stringify(arg)).join(' ')
-            : shellQuote(opts.args);
-        m.scripts[stage] = `${m.scripts[stage]} ${escapedArgs}`;
-    }
-    // This script is used to prevent the usage of npm or Yarn.
-    // It does nothing, when pnpm is used, so we may skip its execution.
-    if (m.scripts[stage] === 'npx only-allow pnpm' || !m.scripts[stage])
-        return false;
-    if (opts.stdio !== 'inherit') {
-        lifecycleLogger.debug({
-            depPath: opts.depPath,
-            optional,
-            script: m.scripts[stage],
-            stage,
-            wd: opts.pkgRoot,
-        });
-    }
-    else if (!opts.silent) {
-        process.stderr.write(chalk.dim(`$ ${m.scripts[stage]}`) + '\n');
-    }
-    const logLevel = (opts.stdio !== 'inherit' || opts.silent)
-        ? 'silent'
-        : undefined;
-    await lifecycle(m, stage, opts.pkgRoot, {
-        config: {},
-        dir: opts.rootModulesDir,
-        extraBinPaths: opts.extraBinPaths,
-        extraEnv: {
-            ...opts.extraEnv,
-            INIT_CWD: opts.initCwd ?? process.cwd(),
-            PNPM_SCRIPT_SRC_DIR: opts.pkgRoot,
-            ...(opts.userAgent ? { npm_config_user_agent: opts.userAgent } : {}),
-        },
-        log: {
-            clearProgress: noop,
-            info: noop,
-            level: logLevel,
-            pause: noop,
-            resume: noop,
-            showProgress: noop,
-            silly: npmLog,
-            verbose: npmLog,
-            warn: (...msg) => {
-                globalWarn(msg.join(' '));
-            },
-        },
-        runConcurrently: true,
-        scriptsPrependNodePath: opts.scriptsPrependNodePath,
-        scriptShell: opts.scriptShell,
-        shellEmulator: opts.shellEmulator,
-        stdio: opts.stdio ?? 'pipe',
-        unsafePerm: opts.unsafePerm,
-    });
-    return true;
-    function npmLog(prefix, logId, stdtype, line) {
-        switch (stdtype) {
-            case 'stdout':
-            case 'stderr':
-                lifecycleLogger.debug({
-                    depPath: opts.depPath,
-                    line: (line ?? 0).toString(),
-                    stage,
-                    stdio: stdtype,
-                    wd: opts.pkgRoot,
-                });
-                return;
-            case 'Returned: code:': {
-                if (opts.stdio === 'inherit') {
-                    // Preventing the pnpm reporter from overriding the project's script output
-                    return;
-                }
-                const code = line ?? 1;
-                lifecycleLogger.debug({
-                    depPath: opts.depPath,
-                    exitCode: code,
-                    optional,
-                    stage,
-                    wd: opts.pkgRoot,
-                });
-            }
-        }
-    }
-}
-/**
- * Run node-gyp when binding.gyp is available. Only do this when there are no
- * `install` and `preinstall` scripts (see `npm help scripts`).
- */
-function checkBindingGyp(root, scripts) {
-    if (existsSync(path.join(root, 'binding.gyp'))) {
-        scripts.install = 'node-gyp rebuild';
-    }
-}
-function getId(manifest) {
-    return `${manifest.name ?? ''}@${manifest.version ?? ''}`;
-}
-function isWindowsBatchFile(scriptShell) {
-    // Node.js performs a similar check to determine whether it should throw
-    // EINVAL when spawning a .cmd/.bat file.
-    //
-    // https://github.com/nodejs/node/commit/6627222409#diff-1e725bfa950eda4d4b5c0c00a2bb6be3e5b83d819872a1adf2ef87c658273903
-    const scriptShellLower = scriptShell.toLowerCase();
-    return isWindows() && (scriptShellLower.endsWith('.cmd') || scriptShellLower.endsWith('.bat'));
-}
-//# sourceMappingURL=runLifecycleHook.js.map

package/lib/runLifecycleHooksConcurrently.d.ts

@@ -1,18 +0,0 @@
-import type { StoreController } from '@pnpm/store.controller-types';
-import type { ProjectManifest, ProjectRootDir } from '@pnpm/types';
-import { type RunLifecycleHookOptions } from './runLifecycleHook.js';
-export type RunLifecycleHooksConcurrentlyOptions = Omit<RunLifecycleHookOptions, 'depPath' | 'pkgRoot' | 'rootModulesDir'> & {
-    resolveSymlinksInInjectedDirs?: boolean;
-    storeController: StoreController;
-    extraNodePaths?: string[];
-    preferSymlinkedExecutables?: boolean;
-};
-export interface Importer {
-    buildIndex: number;
-    manifest: ProjectManifest;
-    rootDir: ProjectRootDir;
-    modulesDir: string;
-    stages?: string[];
-    targetDirs?: string[];
-}
-export declare function runLifecycleHooksConcurrently(stages: string[], importers: Importer[], childConcurrency: number, opts: RunLifecycleHooksConcurrentlyOptions): Promise<void>;

package/lib/runLifecycleHooksConcurrently.js

@@ -1,67 +0,0 @@
-import path from 'node:path';
-import { linkBins } from '@pnpm/bins.linker';
-import { fetchFromDir } from '@pnpm/fetching.directory-fetcher';
-import { logger } from '@pnpm/logger';
-import { runGroups } from 'run-groups';
-import { runLifecycleHook } from './runLifecycleHook.js';
-export async function runLifecycleHooksConcurrently(stages, importers, childConcurrency, opts) {
-    const importersByBuildIndex = new Map();
-    for (const importer of importers) {
-        if (!importersByBuildIndex.has(importer.buildIndex)) {
-            importersByBuildIndex.set(importer.buildIndex, [importer]);
-        }
-        else {
-            importersByBuildIndex.get(importer.buildIndex).push(importer);
-        }
-    }
-    const sortedBuildIndexes = Array.from(importersByBuildIndex.keys()).sort((a, b) => a - b);
-    const groups = sortedBuildIndexes.map((buildIndex) => {
-        const importers = importersByBuildIndex.get(buildIndex);
-        return importers.map(({ manifest, modulesDir, rootDir, stages: importerStages, targetDirs }) => async () => {
-            // We are linking the bin files, in case they were created by lifecycle scripts of other workspace packages.
-            await linkBins(modulesDir, path.join(modulesDir, '.bin'), {
-                extraNodePaths: opts.extraNodePaths,
-                allowExoticManifests: true,
-                preferSymlinkedExecutables: opts.preferSymlinkedExecutables,
-                projectManifest: manifest,
-                warn: (message) => {
-                    logger.warn({ message, prefix: rootDir });
-                },
-            });
-            const runLifecycleHookOpts = {
-                ...opts,
-                depPath: rootDir,
-                pkgRoot: rootDir,
-                rootModulesDir: modulesDir,
-            };
-            let isBuilt = false;
-            for (const stage of (importerStages ?? stages)) {
-                if (await runLifecycleHook(stage, manifest, runLifecycleHookOpts)) { // eslint-disable-line no-await-in-loop
-                    isBuilt = true;
-                }
-            }
-            if (targetDirs == null || targetDirs.length === 0 || !isBuilt)
-                return;
-            // Re-import only the freshly-built source — fetchFromDir already
-            // excludes the source's node_modules/. `keepModulesDir: true` makes
-            // importIndexedDir skip the destructive makeEmptyDir fast path
-            // (#11088) and preserve the target's existing node_modules (bin
-            // symlinks + transitive deps from the initial install) via its
-            // staging/move path. Replaces the old scanDir-into-filesMap
-            // workaround (#4299) that the fast path then wiped, causing ENOENT
-            // on .bin/<tool>. Stays on storeController.importPackage so source
-            // files keep their hardlinks (no copy-loop).
-            const filesResponse = await fetchFromDir(rootDir, { resolveSymlinks: opts.resolveSymlinksInInjectedDirs });
-            await Promise.all(targetDirs.map(async (targetDir) => opts.storeController.importPackage(targetDir, {
-                filesResponse: {
-                    resolvedFrom: 'local-dir',
-                    ...filesResponse,
-                },
-                force: false,
-                keepModulesDir: true,
-            })));
-        });
-    });
-    await runGroups(childConcurrency, groups);
-}
-//# sourceMappingURL=runLifecycleHooksConcurrently.js.map