@socketsecurity/cli-with-sentry 1.1.20 → 1.1.22

package/dist/shadow-npm-bin2.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-npm-bin2.js","sources":["../src/shadow/npm/link.mts","../src/shadow/stdio-ipc.mts","../src/shadow/npm-base.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getNpmBinPath,\n  getNpxBinPath,\n  isNpmBinPathShadowed,\n  isNpxBinPathShadowed,\n} from '../../utils/npm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'npm' | 'npx',\n): Promise<string> {\n  const isNpx = binName === 'npx'\n  // Find package manager being shadowed by this process.\n  const binPath = isNpx ? getNpxBinPath() : getNpmBinPath()\n  const { WIN32 } = constants\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n  const shadowed = isNpx ? isNpxBinPathShadowed() : isNpmBinPathShadowed()\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n  return binPath\n}\n","import type { StdioOptions } from 'node:child_process'\n\n/**\n * Ensures stdio configuration includes IPC channel for process communication.\n * Converts various stdio formats to include 'ipc' as the fourth element.\n */\nexport function ensureIpcInStdio(\n  stdio: StdioOptions | undefined,\n): StdioOptions {\n  if (typeof stdio === 'string') {\n    return [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      return stdio.concat('ipc')\n    }\n    return stdio\n  } else {\n    return ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n}\n","import {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/agent'\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { installLinks } from './npm/link.mts'\nimport { ensureIpcInStdio } from './stdio-ipc.mts'\nimport constants, { NODE_MODULES, NPM, NPX } from '../constants.mts'\nimport { cmdFlagsToString } from '../utils/cmd.mts'\nimport { findUp } from '../utils/fs.mts'\nimport { getPublicApiToken } from '../utils/sdk.mts'\n\nimport type { IpcObject } from '../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowNpmBase(\n  binName: typeof NPM | typeof NPX,\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n  const cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  const isShadowNpm = binName === NPM\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? ['--loglevel', 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp(NODE_MODULES, { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  const stdio = ensureIpcInStdio(getOwn(spawnOpts, 'stdio'))\n\n  const realBinPath = await installLinks(constants.shadowBinPath, binName)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n","import { NPM } from '../../constants.mts'\nimport shadowNpmBase from '../npm-base.mts'\n\nimport type { ShadowBinOptions, ShadowBinResult } from '../npm-base.mts'\nimport type { SpawnExtra } from '@socketsecurity/registry/lib/spawn'\n\nexport type { ShadowBinOptions, ShadowBinResult }\n\nexport default async function shadowNpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  return await shadowNpmBase(NPM, args, options, extra)\n}\n"],"names":["WIN32","env","__proto__","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;;AAYO;AAIL;AACA;;;AAEQA;AAAM;AACd;;AAEE;AACF;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AACA;AACF;;ACnCA;AACA;AACA;AACA;AACO;AAGL;;;AAGE;AACE;AACF;AACA;AACF;;AAEA;AACF;;ACae;;AAOXA;;;AAGF;AAAMC;;;AACN;AACA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGkDC;AAAsB;;;AAQxE;AAoBI;;AAEA;AACA;;AAMA;AACAF;;;;;AAKAG;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;AC/He;;AAMf;;;;","debugId":"2c1bb1bc-32c9-4dd7-8742-11961fead20c"}
+{"version":3,"file":"shadow-npm-bin2.js","sources":["../src/shadow/stdio-ipc.mts","../src/shadow/npm-base.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import type { StdioOptions } from 'node:child_process'\n\n/**\n * Ensures stdio configuration includes IPC channel for process communication.\n * Converts various stdio formats to include 'ipc' as the fourth element.\n */\nexport function ensureIpcInStdio(\n  stdio: StdioOptions | undefined,\n): StdioOptions {\n  if (typeof stdio === 'string') {\n    return [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      return stdio.concat('ipc')\n    }\n    return stdio\n  } else {\n    return ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n}\n","import { fileURLToPath } from 'node:url'\n\nimport {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/agent'\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { ensureIpcInStdio } from './stdio-ipc.mts'\nimport constants, {\n  FLAG_LOGLEVEL,\n  NODE_MODULES,\n  NPM,\n  NPX,\n} from '../constants.mts'\nimport { cmdFlagsToString } from '../utils/cmd.mts'\nimport { findUp } from '../utils/fs.mts'\nimport { getPublicApiToken } from '../utils/sdk.mts'\nimport { installNpmLinks, installNpxLinks } from '../utils/shadow-links.mts'\n\nimport type { IpcObject } from '../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowNpmBase(\n  binName: typeof NPM | typeof NPX,\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n\n  let cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const isShadowNpm = binName === NPM\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? [FLAG_LOGLEVEL, 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp(NODE_MODULES, { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  const stdio = ensureIpcInStdio(getOwn(spawnOpts, 'stdio'))\n\n  const realBinPath = isShadowNpm\n    ? await installNpmLinks(constants.shadowBinPath)\n    : await installNpxLinks(constants.shadowBinPath)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n","import { NPM } from '../../constants.mts'\nimport shadowNpmBase from '../npm-base.mts'\n\nimport type { ShadowBinOptions, ShadowBinResult } from '../npm-base.mts'\nimport type { SpawnExtra } from '@socketsecurity/registry/lib/spawn'\n\nexport type { ShadowBinOptions, ShadowBinResult }\n\nexport default async function shadowNpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  return await shadowNpmBase(NPM, args, options, extra)\n}\n"],"names":["env","__proto__","cwd","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;AAEA;AACA;AACA;AACA;AACO;AAGL;;;AAGE;AACE;AACF;AACA;AACF;;AAEA;AACF;;ACoBe;;AAOXA;;;AAGF;AAAMC;;;AAEN;;AAEEC;AACF;AAEA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGkDC;AAAsB;;AAMxE;AAIA;AAoBI;;AAEA;AACA;;AAMA;AACAH;;;;;AAKAI;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;AC7Ie;;AAMf;;;;","debugId":"6d18cbc8-e145-4f23-9c89-eb5694f263dd"}

package/dist/shadow-pnpm-bin2.js

@@ -8,23 +8,23 @@ var logger = require('../external/@socketsecurity/registry/lib/logger');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var constants = require('./constants.js');
 var utils = require('./utils.js');
+var packages = require('../external/@socketsecurity/registry/lib/packages');
 var shadowNpmBin = require('./shadow-npm-bin2.js');
-var vendor = require('./vendor.js');
 
 /**
- * Extract package PURLs from add/dlx command arguments.
+ * Extract package PURLs from command arguments for add/dlx commands where
+ * packages are specified as arguments.
+ * Used by: pnpm, yarn.
  */
-function extractPackagePurlsFromArgs(command, rawArgs, dlxCommands) {
+function extractPackagePurlsFromCommandArgs(rawArgs) {
   const packagePurls = [];
-  const isDlxCommand = dlxCommands?.has(command);
-  if (command === 'add' || isDlxCommand) {
-    // For 'add package1 package2@version' or 'dlx package', get packages from args.
-    const packageArgs = rawArgs.slice(1).filter(arg => !arg.startsWith('-') && arg !== '--');
-    for (const pkgSpec of packageArgs) {
-      const purl = utils.safeNpmSpecToPurl(pkgSpec);
-      if (purl) {
-        packagePurls.push(purl);
-      }
+
+  // For 'add package1 package2@version' or 'dlx package', get packages from args.
+  const packageArgs = rawArgs.slice(1).filter(a => !a.startsWith('-') && a !== '--');
+  for (const pkgSpec of packageArgs) {
+    const purl = utils.safeNpmSpecToPurl(pkgSpec);
+    if (purl) {
+      packagePurls.push(purl);
     }
   }
   return packagePurls;
@@ -32,19 +32,22 @@ function extractPackagePurlsFromArgs(command, rawArgs, dlxCommands) {
 
 /**
  * Extract package PURLs from package.json for install/update commands.
+ * Used by: pnpm, yarn.
  */
-async function extractPackagePurlsFromPackageJson(cwd) {
+async function extractPackagePurlsFromPackageJson(cwd = process.cwd()) {
   const packagePurls = [];
   try {
-    const packageJsonContent = await fs.promises.readFile(`${cwd}/package.json`, 'utf8');
-    const packageJson = JSON.parse(packageJsonContent);
+    const pkgJson = await packages.readPackageJson(cwd);
     const allDeps = {
-      ...packageJson.dependencies,
-      ...packageJson.devDependencies,
-      ...packageJson.optionalDependencies,
-      ...packageJson.peerDependencies
+      ...pkgJson.dependencies,
+      ...pkgJson.devDependencies,
+      ...pkgJson.optionalDependencies,
+      ...pkgJson.peerDependencies
     };
-    for (const [name, version] of Object.entries(allDeps)) {
+    for (const {
+      0: name,
+      1: version
+    } of Object.entries(allDeps)) {
       const purl = utils.safeNpmSpecToPurl(typeof version === 'string' ? `${name}@${version}` : name);
       if (purl) {
         packagePurls.push(purl);
@@ -52,7 +55,7 @@ async function extractPackagePurlsFromPackageJson(cwd) {
     }
     utils.debugScan('start', packagePurls.length);
   } catch (e) {
-    require$$9.debugFn('warn', 'Package.json not found or invalid during dependency scanning');
+    require$$9.debugFn('warn', `${constants.PACKAGE_JSON} not found or invalid during dependency scanning`);
     require$$9.debugDir('error', e);
   }
   return packagePurls;
@@ -91,8 +94,8 @@ async function scanPackagesAndLogAlerts(options) {
 
   // Extract package names from command arguments before any downloads.
   let packagePurls = [];
-  if (command === 'add' || isDlxCommand) {
-    packagePurls = extractPackagePurlsFromArgs(command, rawArgs, dlxCommands);
+  if (isDlxCommand || utils.isAddCommand(command)) {
+    packagePurls = extractPackagePurlsFromCommandArgs(rawArgs);
   } else if (isInstallCommand) {
     // For install/update, scan dependencies from package.json.
     // Note: This scans direct dependencies only.
@@ -150,32 +153,6 @@ async function scanPackagesAndLogAlerts(options) {
   };
 }
 
-async function installLinks(shadowBinPath, _binName) {
-  // Find pnpm being shadowed by this process.
-  const binPath = utils.getPnpmBinPath();
-  const {
-    WIN32
-  } = constants.default;
-
-  // TODO: Is this early exit needed?
-  if (WIN32 && binPath) {
-    return binPath;
-  }
-  const shadowed = utils.isPnpmBinPathShadowed();
-
-  // Move our bin directory to front of PATH so its found first.
-  if (!shadowed) {
-    if (WIN32) {
-      await vendor.libExports(path.join(constants.default.distPath, 'pnpm-cli.js'), path.join(shadowBinPath, 'pnpm'));
-    }
-    const {
-      env
-    } = process;
-    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`;
-  }
-  return binPath;
-}
-
 const DLX_COMMANDS = new Set(['dlx']);
 const INSTALL_COMMANDS = new Set(['add', 'i', 'install', 'install-test', 'it', 'update', 'up']);
 async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
@@ -188,11 +165,6 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
     ipc,
     ...spawnOpts
   } = opts;
-  const {
-    spinner
-  } = opts;
-  const wasSpinning = !!spinner?.isSpinning;
-  spinner?.start();
   let {
     cwd = process.cwd()
   } = opts;
@@ -201,26 +173,30 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
   }
   const terminatorPos = args.indexOf('--');
   const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
-  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
+  const {
+    spinner
+  } = opts;
+  const wasSpinning = !!spinner?.isSpinning;
 
   // Check if this is a command that needs security scanning.
   const command = rawPnpmArgs[0];
   const isDlxCommand = command && DLX_COMMANDS.has(command);
   const isInstallCommand = command && INSTALL_COMMANDS.has(command);
   const needsScanning = isDlxCommand || isInstallCommand;
+  spinner?.start();
   if (needsScanning && !rawPnpmArgs.includes(constants.FLAG_DRY_RUN)) {
     const acceptRisks = !!constants.default.ENV.SOCKET_CLI_ACCEPT_RISKS;
     const viewAllRisks = !!constants.default.ENV.SOCKET_CLI_VIEW_ALL_RISKS;
 
     // Handle add and dlx commands with shared utility.
-    if (command === 'add' || isDlxCommand) {
+    if (isDlxCommand || utils.isAddCommand(command)) {
       const scanResult = await scanPackagesAndLogAlerts({
         acceptRisks,
         command,
         cwd,
         dlxCommands: DLX_COMMANDS,
         installCommands: INSTALL_COMMANDS,
-        managerName: 'pnpm',
+        managerName: constants.PNPM,
         rawArgs: rawPnpmArgs,
         spinner,
         viewAllRisks
@@ -231,7 +207,7 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
         // This line is never reached in production, but helps tests.
         throw new Error('process.exit called');
       }
-    } else if (['install', 'i', 'update', 'up'].includes(command)) {
+    } else if (utils.isPnpmLockfileScanCommand(command)) {
       // For install/update, scan all dependencies from pnpm-lock.yaml
       const pnpmLockPath = path.join(cwd, constants.PNPM_LOCK_YAML);
       if (fs.existsSync(pnpmLockPath)) {
@@ -258,7 +234,7 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
                   hideAt: viewAllRisks ? 'none' : 'middle',
                   output: process.stderr
                 });
-                const errorMessage = `Socket pnpm exiting due to risks.${viewAllRisks ? '' : `\nView all risks - Rerun with environment variable ${constants.default.SOCKET_CLI_VIEW_ALL_RISKS}=1.`}${acceptRisks ? '' : `\nAccept risks - Rerun with environment variable ${constants.default.SOCKET_CLI_ACCEPT_RISKS}=1.`}`.trim();
+                const errorMessage = `Socket ${constants.PNPM} exiting due to risks.${viewAllRisks ? '' : `\nView all risks - Rerun with environment variable ${constants.default.SOCKET_CLI_VIEW_ALL_RISKS}=1.`}${acceptRisks ? '' : `\nAccept risks - Rerun with environment variable ${constants.default.SOCKET_CLI_ACCEPT_RISKS}=1.`}`.trim();
                 logger.logger.error(errorMessage);
                 // eslint-disable-next-line n/no-process-exit
                 process.exit(1);
@@ -271,17 +247,17 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
             }
           }
         } catch (e) {
-          require$$9.debugFn('error', 'PNPM lockfile scanning failed');
+          require$$9.debugFn('error', `${constants.PNPM} lockfile scanning failed`);
           require$$9.debugDir('error', e);
         }
       } else {
-        require$$9.debugFn('notice', 'skip: no pnpm-lock.yaml found, skipping bulk install scanning');
+        require$$9.debugFn('notice', `skip: no ${constants.PNPM_LOCK_YAML} found, skipping bulk install scanning`);
       }
     }
     require$$9.debugFn('notice', 'complete: scanning, proceeding with install');
   }
-  const realPnpmPath = await installLinks(constants.default.shadowBinPath);
-  spinner?.stop();
+  const realPnpmPath = await utils.installPnpmLinks(constants.default.shadowBinPath);
+  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
   const suffixArgs = [...rawPnpmArgs, ...otherArgs];
   require$$9.debugFn('notice', `spawn: ${constants.PNPM} shadow bin ${realPnpmPath} ${utils.cmdFlagsToString(suffixArgs)}`);
   if (wasSpinning) {
@@ -292,6 +268,7 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
   const stdio = shadowNpmBin.ensureIpcInStdio(spawnOpts.stdio);
   const spawnPromise = spawn.spawn(realPnpmPath, suffixArgs, {
     ...spawnOpts,
+    cwd,
     env: {
       ...process.env,
       ...spawnEnv
@@ -319,5 +296,5 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
 
 exports.scanPackagesAndLogAlerts = scanPackagesAndLogAlerts;
 exports.shadowPnpmBin = shadowPnpmBin;
-//# debugId=cdf92b11-1bc1-407a-8db7-38adcb6998cc
+//# debugId=b4cf863e-3d5c-4dcc-ad18-e70648911b2
 //# sourceMappingURL=shadow-pnpm-bin2.js.map

package/dist/shadow-pnpm-bin2.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/link.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { promises as fs } from 'node:fs'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants, { FLAG_DRY_RUN } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\n/**\n * Extract package PURLs from add/dlx command arguments.\n */\nexport function extractPackagePurlsFromArgs(\n  command: string,\n  rawArgs: string[] | readonly string[],\n  dlxCommands?: Set<string>,\n): string[] {\n  const packagePurls: string[] = []\n  const isDlxCommand = dlxCommands?.has(command)\n\n  if (command === 'add' || isDlxCommand) {\n    // For 'add package1 package2@version' or 'dlx package', get packages from args.\n    const packageArgs = rawArgs\n      .slice(1)\n      .filter(arg => !arg.startsWith('-') && arg !== '--')\n\n    for (const pkgSpec of packageArgs) {\n      const purl = safeNpmSpecToPurl(pkgSpec)\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n  }\n\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n */\nexport async function extractPackagePurlsFromPackageJson(\n  cwd: string,\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const packageJsonContent = await fs.readFile(`${cwd}/package.json`, 'utf8')\n    const packageJson = JSON.parse(packageJsonContent)\n\n    const allDeps = {\n      ...packageJson.dependencies,\n      ...packageJson.devDependencies,\n      ...packageJson.optionalDependencies,\n      ...packageJson.peerDependencies,\n    }\n\n    for (const [name, version] of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      'Package.json not found or invalid during dependency scanning',\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    command,\n    dlxCommands,\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (command === 'add' || isDlxCommand) {\n    packagePurls = extractPackagePurlsFromArgs(command, rawArgs, dlxCommands)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getPnpmBinPath,\n  isPnpmBinPathShadowed,\n} from '../../utils/pnpm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  _binName: 'pnpm',\n): Promise<string> {\n  // Find pnpm being shadowed by this process.\n  const binPath = getPnpmBinPath()\n  const { WIN32 } = constants\n\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isPnpmBinPathShadowed()\n\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, 'pnpm-cli.js'),\n        path.join(shadowBinPath, 'pnpm'),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks = !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (command === 'add' || isDlxCommand) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: 'pnpm',\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (['install', 'i', 'update', 'up'].includes(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket pnpm exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', 'PNPM lockfile scanning failed')\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          'skip: no pnpm-lock.yaml found, skipping bulk install scanning',\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installLinks(constants.shadowBinPath, PNPM)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, pnpm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","debugScan","debugFn","debugDir","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","WIN32","env","__proto__","dlxCommands","installCommands","managerName","rawArgs","process","spawnPromise"],"mappings":";;;;;;;;;;;;;AAeA;AACA;AACA;AACO;;AAML;AAEA;AACE;;AAKA;AACE;AACA;AACEA;AACF;AACF;AACF;AAEA;AACF;;AAEA;AACA;AACA;AACO;;;AAMH;AACA;AAEA;;;;AAIE;;AAGF;AACE;AAGA;AACEA;AACF;AACF;AAEAC;;AAEAC;AAIAC;AACF;AAEA;AACF;AAoBA;AACA;AACA;AACO;;;;;;;AASHC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;;;AAGE;AACA;AACAP;AACF;AAEA;;AACWO;;AACX;AAEAN;;AACsBD;AAAa;;AAGjC;;;AAE4BQ;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAN;AACA;AACF;AAEAA;;AACsBY;AAAuB;;AAEpCN;;AACX;;ACzLO;AAIL;AACA;;AACQO;AAAM;;AAEd;;AAEE;AACF;AAEA;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACDA;AAEA;AAUe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCL;AAAQ;AAEhB;;;AAIMJ;AAAoB;;AAExBA;AACF;AAEA;AACA;AACA;;AAEA;AACA;;;AAGA;;;;;AAME;AACA;AACE;;;;AAIEW;AACAC;AACAC;AACAC;;AAEAf;AACF;;AAGE;AACAgB;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACAnB;AAKA;AACEE;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;;AAYAC;AACA;AACAS;AACA;AACA;AACF;;AAEA;AACAnB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;;;AAQAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAa;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAO;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"cdf92b11-1bc1-407a-8db7-38adcb6998cc"}
+{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { readPackageJson } from '@socketsecurity/registry/lib/packages'\n\nimport constants, { FLAG_DRY_RUN, PACKAGE_JSON } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { isAddCommand } from '../utils/cmd.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\n/**\n * Extract package PURLs from command arguments for add/dlx commands where\n * packages are specified as arguments.\n * Used by: pnpm, yarn.\n */\nfunction extractPackagePurlsFromCommandArgs(\n  rawArgs: string[] | readonly string[],\n): string[] {\n  const packagePurls: string[] = []\n\n  // For 'add package1 package2@version' or 'dlx package', get packages from args.\n  const packageArgs = rawArgs\n    .slice(1)\n    .filter(a => !a.startsWith('-') && a !== '--')\n\n  for (const pkgSpec of packageArgs) {\n    const purl = safeNpmSpecToPurl(pkgSpec)\n    if (purl) {\n      packagePurls.push(purl)\n    }\n  }\n\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n * Used by: pnpm, yarn.\n */\nasync function extractPackagePurlsFromPackageJson(\n  cwd = process.cwd(),\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const pkgJson = await readPackageJson(cwd)\n\n    const allDeps = {\n      ...pkgJson.dependencies,\n      ...pkgJson.devDependencies,\n      ...pkgJson.optionalDependencies,\n      ...pkgJson.peerDependencies,\n    }\n\n    for (const { 0: name, 1: version } of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      `${PACKAGE_JSON} not found or invalid during dependency scanning`,\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    command,\n    dlxCommands,\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (isDlxCommand || isAddCommand(command)) {\n    packagePurls = extractPackagePurlsFromCommandArgs(rawArgs)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport {\n  cmdFlagsToString,\n  isAddCommand,\n  isPnpmLockfileScanCommand,\n} from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { installPnpmLinks } from '../../utils/shadow-links.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n\n  const { spinner } = opts\n  const wasSpinning = !!spinner?.isSpinning\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  spinner?.start()\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks = !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (isDlxCommand || isAddCommand(command)) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: PNPM,\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (isPnpmLockfileScanCommand(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket ${PNPM} exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', `${PNPM} lockfile scanning failed`)\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          `skip: no ${PNPM_LOCK_YAML} found, skipping bulk install scanning`,\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installPnpmLinks(constants.shadowBinPath)\n\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      cwd,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, pnpm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","debugScan","debugFn","debugDir","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","__proto__","env","dlxCommands","installCommands","managerName","rawArgs","process","spawnPromise"],"mappings":";;;;;;;;;;;;;AAgBA;AACA;AACA;AACA;AACA;AACA;;;AAKE;;AAKA;AACE;AACA;AACEA;AACF;AACF;AAEA;AACF;;AAEA;AACA;AACA;AACA;AACA;;;AAMI;AAEA;;;;AAIE;;AAGF;AAAa;AAAS;AAAW;AAC/B;AAGA;AACEA;AACF;AACF;AAEAC;;AAEAC;AAIAC;AACF;AAEA;AACF;AAoBA;AACA;AACA;AACO;;;;;;;AASHC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;AACEP;;AAEA;AACA;AACAA;AACF;AAEA;;AACWO;;AACX;AAEAN;;AACsBD;AAAa;;AAGjC;;;AAE4BQ;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAN;AACA;AACF;AAEAA;;AACsBY;AAAuB;;AAEpCN;;AACX;;ACxJA;AAEA;AAUe;AAKb;AAAeO;;;;AACPC;;;AAAiC;;AAEnCT;AAAoB;;AAExBA;AACF;AAEA;AACA;;AAEQI;AAAQ;AAChB;;AAEA;AACA;;;AAGA;;;;;;AAQE;AACA;AACE;;;;AAIEM;AACAC;AACAC;AACAC;;AAEAd;AACF;;AAGE;AACAe;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACAlB;AAKA;AACEE;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;AAEA;AAUAC;AACA;AACAQ;AACA;AACA;AACF;;AAEA;AACAlB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;AAIA;;AAGAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;;AAEAa;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAM;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"b4cf863e-3d5c-4dcc-ad18-e70648911b2"}

package/dist/shadow-yarn-bin.js

@@ -1,34 +1,12 @@
 'use strict';
 
+var require$$0 = require('node:url');
 var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
-var shadowPnpmBin = require('./shadow-pnpm-bin2.js');
-var shadowNpmBin = require('./shadow-npm-bin2.js');
-var path = require('node:path');
-var vendor = require('./vendor.js');
 var constants = require('./constants.js');
 var utils = require('./utils.js');
-
-async function installLinks(shadowBinPath, binName) {
-  const binPath = utils.getYarnBinPath();
-  const {
-    WIN32
-  } = constants.default;
-  if (WIN32 && binPath) {
-    return binPath;
-  }
-  const shadowed = utils.isYarnBinPathShadowed();
-  if (!shadowed) {
-    if (WIN32) {
-      await vendor.libExports(path.join(constants.default.distPath, `${binName}-cli.js`), path.join(shadowBinPath, binName));
-    }
-    const {
-      env
-    } = process;
-    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`;
-  }
-  return binPath;
-}
+var shadowPnpmBin = require('./shadow-pnpm-bin2.js');
+var shadowNpmBin = require('./shadow-npm-bin2.js');
 
 const DLX_COMMANDS = new Set(['dlx']);
 const INSTALL_COMMANDS = new Set(['add', 'install', 'up', 'upgrade', 'upgrade-interactive']);
@@ -42,24 +20,29 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
     ipc,
     ...spawnOpts
   } = opts;
+  let {
+    cwd = process.cwd()
+  } = opts;
+  if (cwd instanceof URL) {
+    cwd = require$$0.fileURLToPath(cwd);
+  }
+  const terminatorPos = args.indexOf('--');
+  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
   const {
     spinner
   } = opts;
   const wasSpinning = !!spinner?.isSpinning;
   spinner?.start();
-  const terminatorPos = args.indexOf('--');
-  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
-  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
 
   // Check for package scanning.
   const command = rawYarnArgs[0];
   const scanResult = await shadowPnpmBin.scanPackagesAndLogAlerts({
     acceptRisks: !!constants.default.ENV.SOCKET_CLI_ACCEPT_RISKS,
     command,
-    cwd: process.cwd(),
+    cwd,
     dlxCommands: DLX_COMMANDS,
     installCommands: INSTALL_COMMANDS,
-    managerName: 'yarn',
+    managerName: constants.YARN,
     rawArgs: rawYarnArgs,
     spinner,
     viewAllRisks: !!constants.default.ENV.SOCKET_CLI_VIEW_ALL_RISKS
@@ -70,8 +53,8 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
     // This line is never reached in production, but helps tests.
     throw new Error('process.exit called');
   }
-  const realYarnPath = await installLinks(constants.default.shadowBinPath, constants.YARN);
-  spinner?.stop();
+  const realYarnPath = await utils.installYarnLinks(constants.default.shadowBinPath);
+  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
   const suffixArgs = [...rawYarnArgs, ...otherArgs];
   require$$9.debugFn('notice', `spawn: ${constants.YARN} shadow bin ${realYarnPath} ${utils.cmdFlagsToString(suffixArgs)}`);
   if (wasSpinning) {
@@ -82,6 +65,7 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
   const stdio = shadowNpmBin.ensureIpcInStdio(spawnOpts.stdio);
   const spawnPromise = spawn.spawn(realYarnPath, suffixArgs, {
     ...spawnOpts,
+    cwd,
     env: {
       ...process.env,
       ...spawnEnv
@@ -108,5 +92,5 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
 }
 
 module.exports = shadowYarnBin;
-//# debugId=1cf735f7-d72e-4a95-9a5f-bc6822d5a468
+//# debugId=673b7dc1-02c4-46a2-b70b-e0f78c541d47
 //# sourceMappingURL=shadow-yarn-bin.js.map

package/dist/shadow-yarn-bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-yarn-bin.js","sources":["../src/shadow/yarn/link.mts","../src/shadow/yarn/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getYarnBinPath,\n  isYarnBinPathShadowed,\n} from '../../utils/yarn-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'yarn',\n): Promise<string> {\n  const binPath = getYarnBinPath()\n  const { WIN32 } = constants\n\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isYarnBinPathShadowed()\n\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { debugFn } from '@socketsecurity/registry/lib/debug'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, { YARN } from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowYarnOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowYarnResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'install',\n  'up',\n  'upgrade',\n  'upgrade-interactive',\n])\n\nexport default async function shadowYarnBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowYarnOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowYarnResult> {\n  const opts = { __proto__: null, ...options } as ShadowYarnOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  const terminatorPos = args.indexOf('--')\n  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check for package scanning.\n  const command = rawYarnArgs[0]\n  const scanResult = await scanPackagesAndLogAlerts({\n    acceptRisks: !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS,\n    command,\n    cwd: process.cwd(),\n    dlxCommands: DLX_COMMANDS,\n    installCommands: INSTALL_COMMANDS,\n    managerName: 'yarn',\n    rawArgs: rawYarnArgs,\n    spinner,\n    viewAllRisks: !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS,\n  })\n\n  if (scanResult.shouldExit) {\n    // eslint-disable-next-line n/no-process-exit\n    process.exit(1)\n    // This line is never reached in production, but helps tests.\n    throw new Error('process.exit called')\n  }\n\n  const realYarnPath = await installLinks(constants.shadowBinPath, YARN)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawYarnArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${YARN} shadow bin ${realYarnPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realYarnPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, yarn is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: YARN,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["WIN32","env","__proto__","spinner","acceptRisks","cwd","dlxCommands","installCommands","managerName","rawArgs","viewAllRisks","process","debugFn","spawnPromise"],"mappings":";;;;;;;;;;;AAUO;AAIL;;AACQA;AAAM;;AAGZ;AACF;AAEA;;AAGE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACVA;AAEA;AAQe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCE;AAAQ;AAEhB;;AAIA;AACA;AACA;;AAEA;AACA;AACA;AACEC;;AAEAC;AACAC;AACAC;AACAC;AACAC;;AAEAC;AACF;;AAGE;AACAC;AACA;AACA;AACF;;;;AAQAC;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAX;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAY;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"1cf735f7-d72e-4a95-9a5f-bc6822d5a468"}
+{"version":3,"file":"shadow-yarn-bin.js","sources":["../src/shadow/yarn/bin.mts"],"sourcesContent":["import { fileURLToPath } from 'node:url'\n\nimport { debugFn } from '@socketsecurity/registry/lib/debug'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport constants, { YARN } from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { installYarnLinks } from '../../utils/shadow-links.mts'\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowYarnOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowYarnResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'install',\n  'up',\n  'upgrade',\n  'upgrade-interactive',\n])\n\nexport default async function shadowYarnBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowYarnOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowYarnResult> {\n  const opts = { __proto__: null, ...options } as ShadowYarnOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n\n  const { spinner } = opts\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  // Check for package scanning.\n  const command = rawYarnArgs[0]\n  const scanResult = await scanPackagesAndLogAlerts({\n    acceptRisks: !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS,\n    command,\n    cwd,\n    dlxCommands: DLX_COMMANDS,\n    installCommands: INSTALL_COMMANDS,\n    managerName: YARN,\n    rawArgs: rawYarnArgs,\n    spinner,\n    viewAllRisks: !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS,\n  })\n\n  if (scanResult.shouldExit) {\n    // eslint-disable-next-line n/no-process-exit\n    process.exit(1)\n    // This line is never reached in production, but helps tests.\n    throw new Error('process.exit called')\n  }\n\n  const realYarnPath = await installYarnLinks(constants.shadowBinPath)\n\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const suffixArgs = [...rawYarnArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${YARN} shadow bin ${realYarnPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realYarnPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      cwd,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, yarn is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: YARN,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["__proto__","env","cwd","spinner","acceptRisks","dlxCommands","installCommands","managerName","rawArgs","viewAllRisks","process","debugFn","spawnPromise"],"mappings":";;;;;;;;;;AA2BA;AAEA;AAQe;AAKb;AAAeA;;;;AACPC;;;AAAiC;;AAEnCC;AAAoB;;AAExBA;AACF;AAEA;AACA;;AAEQC;AAAQ;AAChB;;;AAIA;AACA;AACA;AACEC;;;AAGAC;AACAC;AACAC;AACAC;;AAEAC;AACF;;AAGE;AACAC;AACA;AACA;AACF;;AAIA;;AAGAC;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;;AAEAV;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAW;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"673b7dc1-02c4-46a2-b70b-e0f78c541d47"}