@vltpkg/run 1.0.10 → 1.1.1

package/dist/index.d.ts

@@ -4,7 +4,7 @@ import type { Manifest } from '@vltpkg/types';
 export * from './node-gyp.ts';
 /**
  * The user agent string set as `npm_config_user_agent` in lifecycle script
- * environments. Follows the conventional format used by package managers.
+ * environments. Matches the `user-agent` header sent with registry requests.
  */
 export declare const npmConfigUserAgent: string;
 /** options shared by run() and exec() */
@@ -53,7 +53,7 @@ export type RunOptions = SharedOptions & {
     /**
      * Pass in a manifest to avoid having to read it at all
      */
-    manifest?: Pick<Manifest, 'scripts' | 'gypfile'>;
+    manifest?: Pick<Manifest, 'scripts' | 'gypfile' | 'hasInstallScript'>;
     /**
      * if the script is not defined in package.json#scripts, just ignore it and
      * treat as success. Otherwise, treat as an error. Default false.

package/dist/index.js

@@ -1,4 +1,5 @@
 import { error } from '@vltpkg/error-cause';
+import { userAgent } from '@vltpkg/user-agent';
 import { PackageJson } from '@vltpkg/package-json';
 import { promiseSpawn } from '@vltpkg/promise-spawn';
 import { foregroundChild } from 'foreground-child';
@@ -11,9 +12,9 @@ import { getNodeGypShimDir, hasNodeGypReference, hasNodeGypBinding, } from "./no
 export * from "./node-gyp.js";
 /**
  * The user agent string set as `npm_config_user_agent` in lifecycle script
- * environments. Follows the conventional format used by package managers.
+ * environments. Matches the `user-agent` header sent with registry requests.
  */
-export const npmConfigUserAgent = `vlt/${process.version.slice(1)} node/${process.version} ${process.platform} ${process.arch}`;
+export const npmConfigUserAgent = userAgent;
 /** map of which node_modules/.bin folders exist */
 const dotBins = new Map();
 /** Check if a directory exists, and cache result */
@@ -102,10 +103,13 @@ const runImpl = async (options, execImpl, empty) => {
     // npm adds a `"install": "node-gyp rebuild"` if a binding.gyp
     // is present at the time of publish, EVEN IF it's not included
     // in the package. So, we need to read the actual package.json
-    // in those cases.
-    const untrustworthy = !!(manifest?.gypfile &&
-        arg0 === 'install' &&
-        manifest.scripts?.install === 'node-gyp rebuild');
+    // in those cases. Likewise an abbreviated registry manifest only
+    // says `hasInstallScript`, and the scripts live on disk.
+    const untrustworthy = !!manifest &&
+        ((manifest.gypfile === true &&
+            arg0 === 'install' &&
+            manifest.scripts?.install === 'node-gyp rebuild') ||
+            (manifest.hasInstallScript === true && !manifest.scripts));
     const pj = (untrustworthy ? undefined : manifest) ??
         packageJson.read(options.cwd);
     const { scripts } = pj;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/run",
   "description": "Run package.json scripts and execute commands",
-  "version": "1.0.10",
+  "version": "1.1.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,11 +13,12 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.10",
-    "@vltpkg/package-json": "1.0.10",
-    "@vltpkg/promise-spawn": "1.0.10",
-    "@vltpkg/types": "1.0.10",
-    "@vltpkg/xdg": "1.0.10",
+    "@vltpkg/error-cause": "1.1.1",
+    "@vltpkg/package-json": "1.1.1",
+    "@vltpkg/promise-spawn": "1.1.1",
+    "@vltpkg/types": "1.1.1",
+    "@vltpkg/user-agent": "1.1.1",
+    "@vltpkg/xdg": "1.1.1",
     "foreground-child": "^3.3.1",
     "walk-up-path": "^4.0.0"
   },