@pnpm/exec.lifecycle 1100.1.7 → 1100.1.9

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @pnpm/lifecycle
 
+## 1100.1.9
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/bins.linker@1100.0.23
+  - @pnpm/core-loggers@1100.3.0
+  - @pnpm/fetching.directory-fetcher@1100.0.26
+  - @pnpm/pkg-manifest.reader@1100.0.13
+  - @pnpm/store.controller-types@1100.1.11
+  - @pnpm/types@1101.7.0
+
+## 1100.1.8
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/bins.linker@1100.0.22
+  - @pnpm/core-loggers@1100.2.5
+  - @pnpm/error@1100.1.0
+  - @pnpm/fetching.directory-fetcher@1100.0.25
+  - @pnpm/pkg-manifest.reader@1100.0.12
+  - @pnpm/store.cafs-types@1100.0.2
+  - @pnpm/store.controller-types@1100.1.10
+  - @pnpm/types@1101.6.0
+
 ## 1100.1.7
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1,11 @@
+import { runLifecycleHook, type RunLifecycleHookOptions } from './runLifecycleHook.js';
+import { runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions } from './runLifecycleHooksConcurrently.js';
+import { killTrackedProcessTrees, type TrackableChildProcess, trackChildProcess } from './trackChildProcess.js';
+export declare function makeNodeRequireOption(modulePath: string, env?: Record<string, string | undefined>): {
+    NODE_OPTIONS: string;
+};
+export declare function makeNodePackageMapOption(packageMapPath: string, env?: Record<string, string | undefined>): {
+    NODE_OPTIONS: string;
+};
+export { killTrackedProcessTrees, runLifecycleHook, type RunLifecycleHookOptions, runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions, type TrackableChildProcess, trackChildProcess, };
+export declare function runPostinstallHooks(opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/runLifecycleHook.d.ts

@@ -0,0 +1,19 @@
+import type { DependencyManifest, ProjectManifest } from '@pnpm/types';
+export interface RunLifecycleHookOptions {
+    args?: string[];
+    depPath: string;
+    extraBinPaths?: string[];
+    extraEnv?: Record<string, string>;
+    initCwd?: string;
+    optional?: boolean;
+    pkgRoot: string;
+    rootModulesDir: string;
+    scriptShell?: string;
+    silent?: boolean;
+    scriptsPrependNodePath?: boolean | 'warn-only';
+    shellEmulator?: boolean;
+    stdio?: string;
+    unsafePerm: boolean;
+    userAgent?: string;
+}
+export declare function runLifecycleHook(stage: string, manifest: ProjectManifest | DependencyManifest, opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/runLifecycleHook.js

@@ -0,0 +1,168 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { lifecycleLogger } from '@pnpm/core-loggers';
+import { PnpmError } from '@pnpm/error';
+import { globalWarn } from '@pnpm/logger';
+import { lifecycle } from '@pnpm/npm-lifecycle';
+import chalk from 'chalk';
+import isWindows from 'is-windows';
+import { join as shellQuote } from 'shlex';
+function noop() { } // eslint-disable-line:no-empty
+export async function runLifecycleHook(stage, manifest, opts) {
+    const optional = opts.optional === true;
+    // To remediate CVE_2024_27980, Node.js does not allow .bat or .cmd files to
+    // be spawned without the "shell: true" option.
+    //
+    // https://nodejs.org/api/child_process.html#spawning-bat-and-cmd-files-on-windows
+    //
+    // Unfortunately, setting spawn's shell option also causes arguments to be
+    // evaluated before they're passed to the shell, resulting in a surprising
+    // behavior difference only with .bat/.cmd files.
+    //
+    // Instead of showing a "spawn EINVAL" error, let's throw a clearer error that
+    // this isn't supported.
+    //
+    // If this behavior needs to be supported in the future, the arguments would
+    // need to be escaped before they're passed to the .bat/.cmd file. For
+    // example, scripts such as "echo %PATH%" should be passed verbatim rather
+    // than expanded. This is difficult to do correctly. Other open source tools
+    // (e.g. Rust) attempted and introduced bugs. The Rust blog has a good
+    // high-level explanation of the same security vulnerability Node.js patched.
+    //
+    // https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html#overview
+    //
+    // Note that npm (as of version 10.5.0) doesn't support setting script-shell
+    // to a .bat or .cmd file either.
+    if (opts.scriptShell != null && typeof opts.scriptShell === 'string' && isWindowsBatchFile(opts.scriptShell)) {
+        throw new PnpmError('ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS', 'Cannot spawn .bat or .cmd as a script shell.', {
+            hint: `\
+The pnpm-workspace.yaml scriptShell option was configured to a .bat or .cmd file. These cannot be used as a script shell reliably.
+
+Please unset the scriptShell option, or configure it to a .exe instead.
+`,
+        });
+    }
+    const m = { _id: getId(manifest), ...manifest };
+    m.scripts = { ...m.scripts };
+    switch (stage) {
+        case 'start':
+            if (!m.scripts.start) {
+                if (!existsSync('server.js')) {
+                    throw new PnpmError('NO_SCRIPT_OR_SERVER', 'Missing script start or file server.js');
+                }
+                m.scripts.start = 'node server.js';
+            }
+            break;
+        case 'install':
+            if (!m.scripts.install && !m.scripts.preinstall) {
+                checkBindingGyp(opts.pkgRoot, m.scripts);
+            }
+            break;
+    }
+    if (opts.args?.length && m.scripts?.[stage]) {
+        // It is impossible to quote a command line argument that contains newline for Windows cmd.
+        const escapedArgs = isWindows()
+            ? opts.args.map((arg) => JSON.stringify(arg)).join(' ')
+            : shellQuote(opts.args);
+        m.scripts[stage] = `${m.scripts[stage]} ${escapedArgs}`;
+    }
+    // This script is used to prevent the usage of npm or Yarn.
+    // It does nothing, when pnpm is used, so we may skip its execution.
+    if (m.scripts[stage] === 'npx only-allow pnpm' || !m.scripts[stage])
+        return false;
+    if (opts.stdio !== 'inherit') {
+        lifecycleLogger.debug({
+            depPath: opts.depPath,
+            optional,
+            script: m.scripts[stage],
+            stage,
+            wd: opts.pkgRoot,
+        });
+    }
+    else if (!opts.silent) {
+        process.stderr.write(chalk.dim(`$ ${m.scripts[stage]}`) + '\n');
+    }
+    const logLevel = (opts.stdio !== 'inherit' || opts.silent)
+        ? 'silent'
+        : undefined;
+    await lifecycle(m, stage, opts.pkgRoot, {
+        config: {},
+        dir: opts.rootModulesDir,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: {
+            ...opts.extraEnv,
+            INIT_CWD: opts.initCwd ?? process.cwd(),
+            PNPM_SCRIPT_SRC_DIR: opts.pkgRoot,
+            ...(opts.userAgent ? { npm_config_user_agent: opts.userAgent } : {}),
+        },
+        log: {
+            clearProgress: noop,
+            info: noop,
+            level: logLevel,
+            pause: noop,
+            resume: noop,
+            showProgress: noop,
+            silly: npmLog,
+            verbose: npmLog,
+            warn: (...msg) => {
+                globalWarn(msg.join(' '));
+            },
+        },
+        runConcurrently: true,
+        scriptsPrependNodePath: opts.scriptsPrependNodePath,
+        scriptShell: opts.scriptShell,
+        shellEmulator: opts.shellEmulator,
+        stdio: opts.stdio ?? 'pipe',
+        unsafePerm: opts.unsafePerm,
+    });
+    return true;
+    function npmLog(prefix, logId, stdtype, line) {
+        switch (stdtype) {
+            case 'stdout':
+            case 'stderr':
+                lifecycleLogger.debug({
+                    depPath: opts.depPath,
+                    line: (line ?? 0).toString(),
+                    stage,
+                    stdio: stdtype,
+                    wd: opts.pkgRoot,
+                });
+                return;
+            case 'Returned: code:': {
+                if (opts.stdio === 'inherit') {
+                    // Preventing the pnpm reporter from overriding the project's script output
+                    return;
+                }
+                const code = line ?? 1;
+                lifecycleLogger.debug({
+                    depPath: opts.depPath,
+                    exitCode: code,
+                    optional,
+                    stage,
+                    wd: opts.pkgRoot,
+                });
+            }
+        }
+    }
+}
+/**
+ * Run node-gyp when binding.gyp is available. Only do this when there are no
+ * `install` and `preinstall` scripts (see `npm help scripts`).
+ */
+function checkBindingGyp(root, scripts) {
+    if (existsSync(path.join(root, 'binding.gyp'))) {
+        scripts.install = 'node-gyp rebuild';
+    }
+}
+function getId(manifest) {
+    return `${manifest.name ?? ''}@${manifest.version ?? ''}`;
+}
+function isWindowsBatchFile(scriptShell) {
+    // Node.js performs a similar check to determine whether it should throw
+    // EINVAL when spawning a .cmd/.bat file.
+    //
+    // https://github.com/nodejs/node/commit/6627222409#diff-1e725bfa950eda4d4b5c0c00a2bb6be3e5b83d819872a1adf2ef87c658273903
+    const scriptShellLower = scriptShell.toLowerCase();
+    return isWindows() && (scriptShellLower.endsWith('.cmd') || scriptShellLower.endsWith('.bat'));
+}
+//# sourceMappingURL=runLifecycleHook.js.map

package/lib/runLifecycleHooksConcurrently.d.ts

@@ -0,0 +1,18 @@
+import type { StoreController } from '@pnpm/store.controller-types';
+import type { ProjectManifest, ProjectRootDir } from '@pnpm/types';
+import { type RunLifecycleHookOptions } from './runLifecycleHook.js';
+export type RunLifecycleHooksConcurrentlyOptions = Omit<RunLifecycleHookOptions, 'depPath' | 'pkgRoot' | 'rootModulesDir'> & {
+    resolveSymlinksInInjectedDirs?: boolean;
+    storeController: StoreController;
+    extraNodePaths?: string[];
+    preferSymlinkedExecutables?: boolean;
+};
+export interface Importer {
+    buildIndex: number;
+    manifest: ProjectManifest;
+    rootDir: ProjectRootDir;
+    modulesDir: string;
+    stages?: string[];
+    targetDirs?: string[];
+}
+export declare function runLifecycleHooksConcurrently(stages: string[], importers: Importer[], childConcurrency: number, opts: RunLifecycleHooksConcurrentlyOptions): Promise<void>;

package/lib/runLifecycleHooksConcurrently.js

@@ -0,0 +1,67 @@
+import path from 'node:path';
+import { linkBins } from '@pnpm/bins.linker';
+import { fetchFromDir } from '@pnpm/fetching.directory-fetcher';
+import { logger } from '@pnpm/logger';
+import { runGroups } from 'run-groups';
+import { runLifecycleHook } from './runLifecycleHook.js';
+export async function runLifecycleHooksConcurrently(stages, importers, childConcurrency, opts) {
+    const importersByBuildIndex = new Map();
+    for (const importer of importers) {
+        if (!importersByBuildIndex.has(importer.buildIndex)) {
+            importersByBuildIndex.set(importer.buildIndex, [importer]);
+        }
+        else {
+            importersByBuildIndex.get(importer.buildIndex).push(importer);
+        }
+    }
+    const sortedBuildIndexes = Array.from(importersByBuildIndex.keys()).sort((a, b) => a - b);
+    const groups = sortedBuildIndexes.map((buildIndex) => {
+        const importers = importersByBuildIndex.get(buildIndex);
+        return importers.map(({ manifest, modulesDir, rootDir, stages: importerStages, targetDirs }) => async () => {
+            // We are linking the bin files, in case they were created by lifecycle scripts of other workspace packages.
+            await linkBins(modulesDir, path.join(modulesDir, '.bin'), {
+                extraNodePaths: opts.extraNodePaths,
+                allowExoticManifests: true,
+                preferSymlinkedExecutables: opts.preferSymlinkedExecutables,
+                projectManifest: manifest,
+                warn: (message) => {
+                    logger.warn({ message, prefix: rootDir });
+                },
+            });
+            const runLifecycleHookOpts = {
+                ...opts,
+                depPath: rootDir,
+                pkgRoot: rootDir,
+                rootModulesDir: modulesDir,
+            };
+            let isBuilt = false;
+            for (const stage of (importerStages ?? stages)) {
+                if (await runLifecycleHook(stage, manifest, runLifecycleHookOpts)) { // eslint-disable-line no-await-in-loop
+                    isBuilt = true;
+                }
+            }
+            if (targetDirs == null || targetDirs.length === 0 || !isBuilt)
+                return;
+            // Re-import only the freshly-built source — fetchFromDir already
+            // excludes the source's node_modules/. `keepModulesDir: true` makes
+            // importIndexedDir skip the destructive makeEmptyDir fast path
+            // (#11088) and preserve the target's existing node_modules (bin
+            // symlinks + transitive deps from the initial install) via its
+            // staging/move path. Replaces the old scanDir-into-filesMap
+            // workaround (#4299) that the fast path then wiped, causing ENOENT
+            // on .bin/<tool>. Stays on storeController.importPackage so source
+            // files keep their hardlinks (no copy-loop).
+            const filesResponse = await fetchFromDir(rootDir, { resolveSymlinks: opts.resolveSymlinksInInjectedDirs });
+            await Promise.all(targetDirs.map(async (targetDir) => opts.storeController.importPackage(targetDir, {
+                filesResponse: {
+                    resolvedFrom: 'local-dir',
+                    ...filesResponse,
+                },
+                force: false,
+                keepModulesDir: true,
+            })));
+        });
+    });
+    await runGroups(childConcurrency, groups);
+}
+//# sourceMappingURL=runLifecycleHooksConcurrently.js.map

package/lib/trackChildProcess.d.ts

@@ -0,0 +1,23 @@
+export interface TrackableChildProcess {
+    pid?: number;
+    once: (event: 'close' | 'error', listener: () => void) => unknown;
+}
+/**
+ * Registers a child process spawned for a user command so that
+ * killTrackedProcessTrees() can terminate its process tree if pnpm exits
+ * while the command is still running.
+ */
+export declare function trackChildProcess(child: TrackableChildProcess): void;
+/**
+ * Kills the process trees of the still-running child processes registered
+ * with trackChildProcess(). Best-effort: children that exited concurrently
+ * are skipped silently.
+ *
+ * On Windows the tree is killed with `taskkill /T`, which terminates every
+ * descendant of a known PID without enumerating the system process list (an
+ * enumeration needs `wmic` or PowerShell there and can take tens of seconds).
+ * On POSIX only the tracked child itself is signalled; descendants are
+ * expected to be handled by the caller (the error handler enumerates them
+ * cheaply with one `ps` call).
+ */
+export declare function killTrackedProcessTrees(): Promise<void>;

package/lib/trackChildProcess.js

@@ -0,0 +1,72 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+const trackedChildPids = new Set();
+/**
+ * Registers a child process spawned for a user command so that
+ * killTrackedProcessTrees() can terminate its process tree if pnpm exits
+ * while the command is still running.
+ */
+export function trackChildProcess(child) {
+    const pid = child.pid;
+    if (pid == null)
+        return;
+    trackedChildPids.add(pid);
+    const untrack = () => {
+        trackedChildPids.delete(pid);
+    };
+    child.once('close', untrack);
+    child.once('error', untrack);
+}
+/**
+ * Kills the process trees of the still-running child processes registered
+ * with trackChildProcess(). Best-effort: children that exited concurrently
+ * are skipped silently.
+ *
+ * On Windows the tree is killed with `taskkill /T`, which terminates every
+ * descendant of a known PID without enumerating the system process list (an
+ * enumeration needs `wmic` or PowerShell there and can take tens of seconds).
+ * On POSIX only the tracked child itself is signalled; descendants are
+ * expected to be handled by the caller (the error handler enumerates them
+ * cheaply with one `ps` call).
+ */
+export async function killTrackedProcessTrees() {
+    await Promise.all(Array.from(trackedChildPids, killProcessTree));
+}
+async function killProcessTree(pid) {
+    if (process.platform === 'win32') {
+        // Resolve taskkill to its absolute System32 location so a taskkill.exe
+        // planted in the current directory or on PATH can't be run in its place
+        // during error cleanup. `process.env` is case-insensitive on Windows, so
+        // `SystemRoot` also matches the SYSTEMROOT/systemroot spellings.
+        const taskkillPath = path.join(process.env.SystemRoot ?? process.env.windir ?? 'C:\\Windows', 'System32', 'taskkill.exe');
+        await new Promise((resolve) => {
+            const taskkill = spawn(taskkillPath, ['/pid', pid.toString(), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+            // pnpm is on its error-exit path and must not hang, so the wait is
+            // bounded by a timer that resolves even if taskkill never emits 'exit'
+            // or 'error' (and reaps a stuck taskkill). The kill is best-effort
+            // either way. The timer is unref'd so it can't keep the process alive.
+            const timer = setTimeout(() => {
+                taskkill.kill();
+                resolve();
+            }, 10_000);
+            timer.unref();
+            const done = () => {
+                clearTimeout(timer);
+                resolve();
+            };
+            // A non-zero exit code (128 when the process is already gone, 1 when
+            // access is denied) is deliberately ignored.
+            taskkill.once('error', done);
+            taskkill.once('exit', done);
+        });
+    }
+    else {
+        try {
+            process.kill(pid);
+        }
+        catch {
+            // the process exited before it could be signalled
+        }
+    }
+}
+//# sourceMappingURL=trackChildProcess.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.lifecycle",
-  "version": "1100.1.7",
+  "version": "1100.1.9",
   "description": "Package lifecycle hook runner",
   "keywords": [
     "pnpm",
@@ -29,16 +29,16 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/bins.linker": "1100.0.21",
-    "@pnpm/core-loggers": "1100.2.4",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.directory-fetcher": "1100.0.24",
+    "@pnpm/bins.linker": "1100.0.23",
+    "@pnpm/core-loggers": "1100.3.0",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/fetching.directory-fetcher": "1100.0.26",
     "@pnpm/npm-lifecycle": "^1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.11",
-    "@pnpm/store.cafs-types": "1100.0.1",
-    "@pnpm/store.controller-types": "1100.1.9",
-    "@pnpm/types": "1101.5.0",
-    "chalk": "^5.6.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.13",
+    "@pnpm/store.cafs-types": "1100.0.2",
+    "@pnpm/store.controller-types": "1100.1.11",
+    "@pnpm/types": "1101.7.0",
+    "chalk": "^6.0.0",
     "is-windows": "^1.0.2",
     "path-exists": "^5.0.0",
     "run-groups": "^5.0.0",
@@ -49,10 +49,10 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/exec.lifecycle": "1100.1.7",
+    "@pnpm/exec.lifecycle": "1100.1.9",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.21",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/prepare": "1100.0.23",
+    "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/test-ipc-server": "1100.0.0",
     "@types/is-windows": "^1.0.2",
     "@zkochan/rimraf": "^4.0.0",