cypress 15.15.0 → 15.17.0

package/dist/bin/cypress

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 
-var cli = require('../cli-CQHngRhO.js');
-require('../xvfb-Csr_YzMk.js');
+var cli = require('../cli-CqSCkgQ7.js');
+require('../xvfb-CqCqXRC-.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -32,7 +32,7 @@ require('commander');
 require('cli-table3');
 require('dayjs');
 require('dayjs/plugin/relativeTime');
-require('../spawn-D9ARC26J.js');
+require('../spawn-Cnrq9zm4.js');
 require('child_process');
 require('listr2');
 require('readline');
@@ -45,7 +45,7 @@ require('@cypress/request');
 require('request-progress');
 require('proxy-from-env');
 require('yauzl');
-require('extract-zip');
+require('util');
 require('pretty-bytes');
 
 // declared here in order to avoid consumers who are looking for the binary to be available relative to the dist directory

package/dist/{cli-CQHngRhO.js → cli-CqSCkgQ7.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-CqCqXRC-.js');
 var _ = require('lodash');
 var commander = require('commander');
 var commonTags = require('common-tags');
@@ -13,18 +13,20 @@ var dayjs = require('dayjs');
 var relativeTime = require('dayjs/plugin/relativeTime');
 var chalk = require('chalk');
 var Bluebird = require('bluebird');
-var spawn = require('./spawn-D9ARC26J.js');
+var spawn = require('./spawn-Cnrq9zm4.js');
 var os = require('os');
 var listr2 = require('listr2');
 var timers = require('timers/promises');
-var promises = require('fs/promises');
+var fsp = require('fs/promises');
 var assert = require('assert');
 var request = require('@cypress/request');
 var requestProgress = require('request-progress');
 var proxyFromEnv = require('proxy-from-env');
 var cp = require('child_process');
 var yauzl = require('yauzl');
-var extract = require('extract-zip');
+var fs$1 = require('fs');
+var util = require('util');
+var require$$0 = require('stream');
 var readline = require('readline');
 var prettyBytes = require('pretty-bytes');
 
@@ -304,9 +306,154 @@ const downloadModule = {
     getCA,
 };
 
+const pipelineAsync = util.promisify(require$$0.pipeline);
+// Unix file mode masks for entries stored in zip's externalFileAttributes
+// (the high 16 bits when the file was zipped on a Unix host).
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFLNK = 0o120000;
+// PATH_MAX on Linux/macOS is 4096; symlink targets larger than this are not
+// legal filesystem paths and almost certainly indicate a malformed or
+// malicious archive. The cap also prevents reading an arbitrarily large
+// "symlink" entry into memory.
+const MAX_SYMLINK_TARGET_BYTES = 4096;
+/**
+ * Extracts the contents of a zip archive into the given destination directory.
+ * Recreates directories, regular files, and symlinks while preserving Unix
+ * file modes encoded in each entry's external attributes. Calls `onEntry` once
+ * per archive entry processed. Refuses entries whose resolved path would
+ * escape the destination directory.
+ */
+const extractWithYauzl = (zipFilePath, destDir, onEntry) => xvfb.__awaiter(void 0, void 0, void 0, function* () {
+    const resolvedDest = path.resolve(destDir);
+    yield new Promise((resolve, reject) => {
+        // autoClose: false — `finish` below owns closing the zipfile, so we don't
+        // want yauzl's internal end-listener closing it first and tripping a
+        // double-close (EBADF) when we do.
+        yauzl.open(zipFilePath, { lazyEntries: true, autoClose: false }, (err, zipFile) => {
+            if (err) {
+                return reject(err);
+            }
+            // `settled` guards against an in-flight `handleEntry` calling
+            // `zipFile.readEntry()` on a now-closed handle when extraction has
+            // already failed (e.g. yauzl emitted 'error' while we were writing
+            // an entry to disk).
+            let settled = false;
+            const finish = _.once((err) => {
+                var _a, _b;
+                settled = true;
+                (_a = zipFile.removeAllListeners) === null || _a === void 0 ? void 0 : _a.call(zipFile);
+                (_b = zipFile.close) === null || _b === void 0 ? void 0 : _b.call(zipFile);
+                if (err) {
+                    return reject(err);
+                }
+                return resolve();
+            });
+            // Normalize any thrown / emitted value into a real Error so that a
+            // falsy rejection (e.g. `Promise.reject(undefined)`) doesn't get
+            // misread by `finish` as a successful completion.
+            const fail = (err) => {
+                finish(err instanceof Error ? err : new Error(typeof err === 'string' && err ? err : 'zip extraction failed'));
+            };
+            zipFile.on('error', fail);
+            zipFile.on('end', () => finish());
+            zipFile.on('entry', (entry) => {
+                handleEntry(zipFile, entry, resolvedDest)
+                    .then(() => {
+                    if (settled)
+                        return;
+                    onEntry();
+                    zipFile.readEntry();
+                })
+                    .catch(fail);
+            });
+            zipFile.readEntry();
+        });
+    });
+});
+const handleEntry = (zipFile, entry, resolvedDest) => xvfb.__awaiter(void 0, void 0, void 0, function* () {
+    const fileDest = path.resolve(resolvedDest, entry.fileName);
+    // refuse anything that would write outside the install dir
+    if (fileDest !== resolvedDest &&
+        !fileDest.startsWith(resolvedDest + path.sep)) {
+        throw new Error(`Refusing to extract entry outside of destination: ${entry.fileName}`);
+    }
+    const unixMode = (entry.externalFileAttributes >>> 16) & 0xffff;
+    // Some archivers mark directories by Unix mode bits instead of (or in
+    // addition to) a trailing slash; honor both so we don't extract a
+    // directory entry as a zero-byte file.
+    const isDir = /\/$/.test(entry.fileName) || (unixMode & S_IFMT) === S_IFDIR;
+    const isSymlink = (unixMode & S_IFMT) === S_IFLNK;
+    if (isDir) {
+        yield fsp.mkdir(fileDest, { recursive: true });
+        return;
+    }
+    yield fsp.mkdir(path.dirname(fileDest), { recursive: true });
+    if (isSymlink) {
+        if (entry.uncompressedSize > MAX_SYMLINK_TARGET_BYTES) {
+            throw new Error(`Refusing to extract symlink with target larger than ${MAX_SYMLINK_TARGET_BYTES} bytes: ${entry.fileName}`);
+        }
+        const linkTarget = yield readEntryAsString(zipFile, entry, MAX_SYMLINK_TARGET_BYTES);
+        const resolvedTarget = path.resolve(path.dirname(fileDest), linkTarget);
+        if (resolvedTarget !== resolvedDest &&
+            !resolvedTarget.startsWith(resolvedDest + path.sep)) {
+            throw new Error(`Refusing to extract symlink pointing outside of destination: ${entry.fileName} -> ${linkTarget}`);
+        }
+        yield fsp.rm(fileDest, { recursive: true, force: true });
+        yield fsp.symlink(linkTarget, fileDest);
+        return;
+    }
+    const readStream = yield new Promise((res, rej) => {
+        zipFile.openReadStream(entry, (err, rs) => {
+            if (err) {
+                return rej(err);
+            }
+            return res(rs);
+        });
+    });
+    // Preserve the Unix mode bits when present; otherwise fall back to a sane default.
+    const fileMode = (unixMode & 0o7777) || 0o644;
+    const writeStream = fs$1.createWriteStream(fileDest, { mode: fileMode });
+    yield pipelineAsync(readStream, writeStream);
+});
+const readEntryAsString = (zipFile, entry, maxBytes) => {
+    return new Promise((resolve, reject) => {
+        zipFile.openReadStream(entry, (err, rs) => {
+            if (err) {
+                return reject(err);
+            }
+            const chunks = [];
+            let received = 0;
+            let bailed = false;
+            const bail = (err) => {
+                var _a;
+                if (bailed)
+                    return;
+                bailed = true;
+                (_a = rs.destroy) === null || _a === void 0 ? void 0 : _a.call(rs, err);
+                reject(err);
+            };
+            rs.on('data', (chunk) => {
+                received += chunk.length;
+                if (received > maxBytes) {
+                    bail(new Error(`Refusing to read entry body larger than ${maxBytes} bytes: ${entry.fileName}`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            rs.on('end', () => {
+                if (bailed)
+                    return;
+                resolve(Buffer.concat(chunks).toString('utf8'));
+            });
+            rs.on('error', bail);
+        });
+    });
+};
+
 const debug$5 = Debug('cypress:cli:unzip');
 const unzipTools = {
-    extract,
+    extractWithYauzl,
 };
 // expose this function for simple testing
 const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFilePath, installDir, progress }) {
@@ -319,7 +466,10 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
     let yauzlDoneTime = 0;
     yield fs.ensureDir(installDir);
     yield new Promise((resolve, reject) => {
-        return yauzl.open(zipFilePath, (err, zipFile) => {
+        // Open with lazyEntries so yauzl doesn't auto-emit entries (which would
+        // require the fd to stay open for the duration of the OS-tool extraction).
+        // We only need the entryCount here for the progress calculation.
+        return yauzl.open(zipFilePath, { lazyEntries: true }, (err, zipFile) => {
             yauzlDoneTime = Date.now();
             if (err) {
                 debug$5('error using yauzl %s', err.message);
@@ -327,6 +477,8 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
             }
             const total = zipFile.entryCount;
             debug$5('zipFile entries count', total);
+            // Close the count-only handle — the Node fallback re-opens the zip for extraction.
+            zipFile.close();
             const started = new Date();
             let percent = 0;
             let count = 0;
@@ -343,13 +495,8 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
             };
             const unzipWithNode = () => xvfb.__awaiter(void 0, void 0, void 0, function* () {
                 debug$5('unzipping with node.js (slow)');
-                const opts = {
-                    dir: installDir,
-                    onEntry: tick,
-                };
-                debug$5('calling Node extract tool %s %o', zipFilePath, opts);
                 try {
-                    yield unzipTools.extract(zipFilePath, opts);
+                    yield unzipTools.extractWithYauzl(zipFilePath, installDir, tick);
                     debug$5('node unzip finished');
                     return resolve();
                 }
@@ -569,7 +716,7 @@ const start$1 = (...args_1) => xvfb.__awaiter(void 0, [...args_1], void 0, funct
     if (!pkgPath) {
         return xvfb.throwFormErrorText('Could not find package.json for Cypress package to determine build information')();
     }
-    const { buildInfo, version } = JSON.parse(yield promises.readFile(pkgPath, 'utf8'));
+    const { buildInfo, version } = JSON.parse(yield fsp.readFile(pkgPath, 'utf8'));
     _.defaults(options, {
         force: false,
         buildInfo,
@@ -673,9 +820,10 @@ const start$1 = (...args_1) => xvfb.__awaiter(void 0, [...args_1], void 0, funct
     // let the user know what version of cypress we're downloading!
     xvfb.loggerModule.log(`Installing Cypress ${chalk.gray(`(version: ${versionToInstall})`)}`);
     xvfb.loggerModule.log();
-    const taskRunner = new listr2.Listr(tasks, {
-        silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent',
-    });
+    const taskRunner = new listr2.Listr(tasks, Object.assign(Object.assign({ 
+        // In CI we want timestamped, line-per-event output. Locally,
+        // the default in-place spinner is the better experience.
+        renderer: xvfb.util.isCi() ? 'verbose' : 'default' }, (xvfb.util.isCi() && { rendererOptions: { timestamp: listr2.PRESET_TIMESTAMP } })), { silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent' }));
     yield taskRunner.run();
     // delay 1 sec for UX, unless we are testing
     yield timers.setTimeout(1000);
@@ -1083,6 +1231,8 @@ function getSize(path$1) {
 }
 
 dayjs.extend(relativeTime);
+// Subdirs under the cache root that are not binary version dirs.
+const EXTERNAL_CACHE_ENTRIES = new Set(['bundles']);
 // output colors for the table
 const colors = {
     titles: chalk.white,
@@ -1104,6 +1254,8 @@ const prune = () => xvfb.__awaiter(void 0, void 0, void 0, function* () {
     try {
         const versions = yield fs.readdir(cacheDir);
         for (const version of versions) {
+            if (EXTERNAL_CACHE_ENTRIES.has(version))
+                continue;
             if (version !== checkedInBinaryVersion) {
                 deletedBinary = true;
                 const versionDir = path.join(cacheDir, version);
@@ -1423,6 +1575,8 @@ const descriptions = {
     group: 'a named group for recorded runs in Cypress Cloud',
     headed: 'displays the browser instead of running headlessly',
     headless: 'hide the browser instead of running headed (default for cypress run)',
+    inspect: 'enable the Node.js inspector to debug the Cypress development process. only available when used with --dev',
+    inspectBrk: 'enable the Node.js inspector and break before the Cypress development process starts. only available when used with --dev',
     key: 'your secret Record Key. you can omit this if you set a CYPRESS_RECORD_KEY environment variable.',
     parallel: 'enables concurrent runs and automatic load balancing of specs across multiple machines or processes',
     passWithNoTests: 'pass when no tests are found',
@@ -1551,8 +1705,7 @@ const addCypressRunCommand = (program) => {
         .option('--no-runner-ui', text('noRunnerUi'))
         .option('-o, --reporter-options <reporter-options>', text('reporterOptions'))
         .option('-s, --spec <spec>', text('spec'))
-        .option('-t, --tag <tag>', text('tag'))
-        .option('--dev', text('dev'), coerceFalse);
+        .option('-t, --tag <tag>', text('tag'));
 };
 const addCypressOpenCommand = (program) => {
     return program
@@ -1569,14 +1722,24 @@ const addCypressOpenCommand = (program) => {
         .option('-x, --expose <expose>', text('expose'))
         .option('--global', text('global'))
         .option('-p, --port <port>', text('port'))
-        .option('-P, --project <project-path>', text('project'))
-        .option('--dev', text('dev'), coerceFalse);
+        .option('-P, --project <project-path>', text('project'));
+};
+// `--dev`, `--inspect` and `--inspect-brk` are internal flags used when
+// developing Cypress itself. They are intentionally hidden from the public
+// `--help` output and only registered when `--dev` is actually passed, so that
+// released versions don't advertise flags that error for end users.
+// See https://github.com/cypress-io/cypress/issues/21320
+const maybeAddDevFlag = (program, args) => {
+    if (args.includes('--dev')) {
+        return program.option('--dev', text('dev'), coerceFalse);
+    }
+    return program;
 };
-const maybeAddInspectFlags = (program) => {
-    if (process.argv.includes('--dev')) {
+const maybeAddInspectFlags = (program, args) => {
+    if (args.includes('--dev')) {
         return program
-            .option('--inspect', 'Node option')
-            .option('--inspect-brk', 'Node option');
+            .option('--inspect', text('inspect'))
+            .option('--inspect-brk', text('inspectBrk'));
     }
     return program;
 };
@@ -1617,7 +1780,7 @@ const cliModule = {
             cliArgs.unshift(null, null);
             debug('creating program parser');
             const program = createProgram();
-            maybeAddInspectFlags(addCypressRunCommand(program))
+            maybeAddInspectFlags(maybeAddDevFlag(addCypressRunCommand(program), cliArgs), cliArgs)
                 .action((...fnArgs) => {
                 debug('parsed Cypress run %o', fnArgs);
                 const options = parseVariableOpts(fnArgs, cliArgs);
@@ -1649,7 +1812,7 @@ const cliModule = {
             cliArgs.unshift(null, null);
             debug('creating program parser');
             const program = createProgram();
-            maybeAddInspectFlags(addCypressOpenCommand(program))
+            maybeAddInspectFlags(maybeAddDevFlag(addCypressOpenCommand(program), cliArgs), cliArgs)
                 .action((...fnArgs) => {
                 debug('parsed Cypress open %o', fnArgs);
                 const options = parseVariableOpts(fnArgs, cliArgs);
@@ -1719,7 +1882,7 @@ const cliModule = {
                 .option('-v, --version', text('version'))
                 .command('version')
                 .description(text('version')));
-            maybeAddInspectFlags(addCypressOpenCommand(program))
+            maybeAddInspectFlags(maybeAddDevFlag(addCypressOpenCommand(program), args), args)
                 .action((opts) => xvfb.__awaiter(this, void 0, void 0, function* () {
                 debug('opening Cypress');
                 try {
@@ -1730,7 +1893,7 @@ const cliModule = {
                     xvfb.util.logErrorExit1(e);
                 }
             }));
-            maybeAddInspectFlags(addCypressRunCommand(program))
+            maybeAddInspectFlags(maybeAddDevFlag(addCypressRunCommand(program), args), args)
                 .action((...fnArgs) => xvfb.__awaiter(this, void 0, void 0, function* () {
                 debug('running Cypress with args %o', fnArgs);
                 try {
@@ -1754,11 +1917,10 @@ const cliModule = {
                     xvfb.util.logErrorExit1(e);
                 }
             }));
-            program
+            maybeAddDevFlag(program
                 .command('verify')
                 .usage('[options]')
-                .description('Verifies that Cypress is installed correctly and executable')
-                .option('--dev', text('dev'), coerceFalse)
+                .description('Verifies that Cypress is installed correctly and executable'), args)
                 .action((opts) => xvfb.__awaiter(this, void 0, void 0, function* () {
                 const defaultOpts = { force: true, welcomeMessage: false };
                 const parsedOpts = xvfb.util.parseOpts(opts);
@@ -1809,11 +1971,10 @@ const cliModule = {
                     cacheModule[command]();
                 });
             });
-            program
+            maybeAddDevFlag(program
                 .command('info')
                 .usage('[command]')
-                .description('Prints Cypress and system information')
-                .option('--dev', text('dev'), coerceFalse)
+                .description('Prints Cypress and system information'), args)
                 .action((opts) => xvfb.__awaiter(this, void 0, void 0, function* () {
                 try {
                     const code = yield methods.start(opts);

package/dist/cli.js

@@ -2,14 +2,14 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-require('./xvfb-Csr_YzMk.js');
+require('./xvfb-CqCqXRC-.js');
 require('lodash');
 require('commander');
 require('common-tags');
 require('log-symbols');
 require('debug');
-var cli = require('./cli-CQHngRhO.js');
-require('./spawn-D9ARC26J.js');
+var cli = require('./cli-CqSCkgQ7.js');
+require('./spawn-Cnrq9zm4.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -42,10 +42,10 @@ require('request-progress');
 require('proxy-from-env');
 require('child_process');
 require('yauzl');
-require('extract-zip');
+require('util');
+require('stream');
 require('readline');
 require('pretty-bytes');
-require('stream');
 require('string_decoder');
 require('node:string_decoder');
 

package/dist/{cypress-BMOTlyGc.js → cypress-BZS7OvER.js}

@@ -1,9 +1,9 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-CqCqXRC-.js');
 var tmp = require('tmp');
 var fs = require('fs-extra');
-var cli$1 = require('./cli-CQHngRhO.js');
+var cli$1 = require('./cli-CqSCkgQ7.js');
 
 /**
  * Opens Cypress GUI

package/dist/cypress.js

@@ -1,10 +1,10 @@
 'use strict';
 
-require('./xvfb-Csr_YzMk.js');
+require('./xvfb-CqCqXRC-.js');
 require('tmp');
 require('fs-extra');
-require('./cli-CQHngRhO.js');
-var cypress = require('./cypress-BMOTlyGc.js');
+require('./cli-CqSCkgQ7.js');
+var cypress = require('./cypress-BZS7OvER.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -33,7 +33,7 @@ require('commander');
 require('cli-table3');
 require('dayjs');
 require('dayjs/plugin/relativeTime');
-require('./spawn-D9ARC26J.js');
+require('./spawn-Cnrq9zm4.js');
 require('child_process');
 require('listr2');
 require('readline');
@@ -46,7 +46,7 @@ require('@cypress/request');
 require('request-progress');
 require('proxy-from-env');
 require('yauzl');
-require('extract-zip');
+require('util');
 require('pretty-bytes');
 
 

package/dist/exec/spawn.js

@@ -1,12 +1,12 @@
 'use strict';
 
-require('../xvfb-Csr_YzMk.js');
+require('../xvfb-CqCqXRC-.js');
 require('lodash');
 require('os');
 require('child_process');
 require('path');
 require('debug');
-var spawn = require('../spawn-D9ARC26J.js');
+var spawn = require('../spawn-Cnrq9zm4.js');
 require('readline');
 require('process');
 require('stream');

package/dist/exec/xvfb.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var xvfb = require('../xvfb-Csr_YzMk.js');
+var xvfb = require('../xvfb-CqCqXRC-.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');

package/dist/index.js

@@ -2,12 +2,12 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-CqCqXRC-.js');
 var minimist = require('minimist');
 var Debug = require('debug');
-var cli$1 = require('./cli-CQHngRhO.js');
-var spawn = require('./spawn-D9ARC26J.js');
-var cypress = require('./cypress-BMOTlyGc.js');
+var cli$1 = require('./cli-CqSCkgQ7.js');
+var spawn = require('./spawn-Cnrq9zm4.js');
+var cypress = require('./cypress-BZS7OvER.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -44,10 +44,10 @@ require('request-progress');
 require('proxy-from-env');
 require('child_process');
 require('yauzl');
-require('extract-zip');
+require('util');
+require('stream');
 require('readline');
 require('pretty-bytes');
-require('stream');
 require('string_decoder');
 require('node:string_decoder');
 require('tmp');

package/dist/{spawn-D9ARC26J.js → spawn-Cnrq9zm4.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-CqCqXRC-.js');
 var _ = require('lodash');
 var os = require('os');
 var cp = require('child_process');
@@ -171,9 +171,10 @@ function verifyBinary(installedVersion, binaryDir, options) {
                     yield xvfb.stateModule.writeBinaryVerifiedAsync(true, binaryDir);
                     task.title = xvfb.util.titleize(chalk.green('Verified Cypress!'), chalk.gray(binaryDir));
                 }),
-            }], {
-            silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent',
-        });
+            }], Object.assign(Object.assign({ 
+            // In CI we want timestamped, line-per-event output. Locally,
+            // the default in-place spinner is the better experience.
+            renderer: xvfb.util.isCi() ? 'verbose' : 'default' }, (xvfb.util.isCi() && { rendererOptions: { timestamp: listr2.PRESET_TIMESTAMP } })), { silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent' }));
         yield verifyTaskRunner.run();
         if (options.welcomeMessage) {
             xvfb.loggerModule.log();
@@ -1059,6 +1060,8 @@ var distExports = requireDist();
 const debug = Debug('cypress:cli');
 const debugElectron = Debug('cypress:electron');
 const debugStderr = Debug('cypress:internal-stderr');
+// Must match CYPRESS_OPEN_READY_MESSAGE in packages/server/lib/modes/interactive.ts
+const CYPRESS_OPEN_READY_MESSAGE = 'Cypress is ready';
 function isPlatform(platform) {
     return os.platform() === platform;
 }
@@ -1127,8 +1130,15 @@ function createSpawnFunction(executable, args, options) {
             }
             if (xvfb.util.isPossibleLinuxWithIncorrectDisplay()) {
                 // make sure we use the latest DISPLAY variable if any
-                debug('passing DISPLAY', process.env.DISPLAY);
-                stdioOptions.env.DISPLAY = process.env.DISPLAY;
+                debug('passing DISPLAY', process$1.env.DISPLAY);
+                stdioOptions.env.DISPLAY = process$1.env.DISPLAY;
+            }
+            if (stdioOptions.detached) {
+                // Ask interactive mode to print a ready sentinel on stdout; pipe stdio during
+                // startup so errors are visible and we can detect it. Streams are destroyed
+                // once it arrives so they don't keep the parent event loop alive.
+                args.push('--emit-when-ready');
+                stdioOptions.stdio = ['ignore', 'pipe', 'pipe'];
             }
             if (stdioOptions.env.ELECTRON_RUN_AS_NODE) {
                 // Since we are running electron as node, we need to add an entry point file.
@@ -1144,8 +1154,8 @@ function createSpawnFunction(executable, args, options) {
             if (startScriptPath) {
                 args.unshift(startScriptPath);
             }
-            if (process.env.CYPRESS_INTERNAL_DEV_DEBUG) {
-                args.unshift(process.env.CYPRESS_INTERNAL_DEV_DEBUG);
+            if (process$1.env.CYPRESS_INTERNAL_DEV_DEBUG) {
+                args.unshift(process$1.env.CYPRESS_INTERNAL_DEV_DEBUG);
             }
             debug('spawn args %o %o', args, _.omit(stdioOptions, 'env'));
             debug('spawning Cypress with executable: %s', executable);
@@ -1156,14 +1166,16 @@ function createSpawnFunction(executable, args, options) {
             function resolveOn(event) {
                 return function (code, signal) {
                     debug('child event fired %o', { event, code, signal });
-                    if (code === null) {
-                        const errorObject = xvfb.errors.childProcessKilled(event, signal);
-                        errorObject.platform = platform;
-                        const err = xvfb.getErrorSync(errorObject, platform);
-                        reject(err);
+                    if (signal) {
+                        if (signal === 'SIGINT') {
+                            resolve(0);
+                        }
+                        else {
+                            resolve(128 + os.constants.signals[signal]);
+                        }
                         return;
                     }
-                    resolve(code);
+                    resolve(code !== null && code !== void 0 ? code : 1);
                 };
             }
             const child = cp.spawn(executable, args, stdioOptions);
@@ -1184,6 +1196,44 @@ function createSpawnFunction(executable, args, options) {
                     });
                 });
             }
+            else {
+                // Adding listeners here prevents immediate process.exit() for these signals.
+                // Exiting when the child process exits instead will allow the child process
+                // to log during the exit process.
+                // Unlike in windows, we do not need to propagate these signals to the child process
+                // tree.
+                for (const signal of ['SIGINT', 'SIGTERM']) {
+                    debug('adding message for signal listener for %s', signal);
+                    process$1.once(signal, function () {
+                        return xvfb.__awaiter(this, void 0, void 0, function* () {
+                            console.log(`\n\n${signal} received; Attempting to exit gracefully. Force exit with ^C again if needed.\n\n`);
+                            if (process$1.stdin.isTTY) {
+                                process$1.stdin.setRawMode(false);
+                            }
+                        });
+                    });
+                }
+            }
+            if (stdioOptions.detached) {
+                child.stdout.on('data', (data) => {
+                    const str = data.toString();
+                    const readyMessageIndex = str.indexOf(CYPRESS_OPEN_READY_MESSAGE);
+                    const isReady = readyMessageIndex !== -1;
+                    if (isReady) {
+                        const outputBeforeReady = str.slice(0, readyMessageIndex);
+                        if (outputBeforeReady)
+                            process$1.stdout.write(outputBeforeReady);
+                        child.stdout.destroy();
+                        child.stderr.destroy();
+                        child.unref();
+                        resolve(0);
+                        return;
+                    }
+                    process$1.stdout.write(data);
+                });
+                child.stderr.pipe(process$1.stderr, { end: false });
+                return;
+            }
             // if stdio options is set to 'pipe', then
             //   we should set up pipes:
             //  process STDIN (read stream) => child STDIN (writeable)
@@ -1214,9 +1264,9 @@ function createSpawnFunction(executable, args, options) {
                         sourceStream.write(data);
                     }
                 });
-                if (((_a = process.env.ELECTRON_ENABLE_LOGGING) !== null && _a !== void 0 ? _a : '') === '1' ||
+                if (((_a = process$1.env.ELECTRON_ENABLE_LOGGING) !== null && _a !== void 0 ? _a : '') === '1' ||
                     debugElectron.enabled ||
-                    ((_b = process.env.CYPRESS_INTERNAL_ENV) !== null && _b !== void 0 ? _b : '') === 'development') {
+                    ((_b = process$1.env.CYPRESS_INTERNAL_ENV) !== null && _b !== void 0 ? _b : '') === 'development') {
                     sourceStream.pipe(process$1.stderr, { end: false });
                 }
                 else {
@@ -1231,14 +1281,12 @@ function createSpawnFunction(executable, args, options) {
             // to have any effect. so we're just catching the
             // error here and not doing anything.
             process$1.stdin.on('error', (err) => {
+                debug('error on stdin', err);
                 if (['EPIPE', 'ENOTCONN'].includes(err.code)) {
                     return;
                 }
                 reject(err);
             });
-            if (stdioOptions.detached) {
-                child.unref();
-            }
         }));
     };
 }
@@ -1304,16 +1352,16 @@ function start(args_1) {
         // binary that it was invoked through the NPM module
         const baseArgs = args ? (typeof args === 'string' ? [args] : args) : [];
         const decoratedArgs = baseArgs.concat([
-            '--cwd', process.cwd(),
-            '--userNodePath', process.execPath,
-            '--userNodeVersion', process.versions.node,
+            '--cwd', process$1.cwd(),
+            '--userNodePath', process$1.execPath,
+            '--userNodeVersion', process$1.versions.node,
         ]);
         const needsXvfb = xvfb.xvfb.isNeeded();
         debug('needs to start own Xvfb?', needsXvfb);
         const stdio = (_a = options.stdio) !== null && _a !== void 0 ? _a : getStdioStrategy(needsXvfb);
         const dev = (_b = options.dev) !== null && _b !== void 0 ? _b : false;
         const detached = (_c = options.detached) !== null && _c !== void 0 ? _c : false;
-        const env = (_d = options.env) !== null && _d !== void 0 ? _d : process.env;
+        const env = (_d = options.env) !== null && _d !== void 0 ? _d : process$1.env;
         const spawn = createSpawnFunction(executable, decoratedArgs, { stdio, dev, detached, env });
         if (needsXvfb) {
             debug('starting xvfb');

package/dist/{xvfb-Csr_YzMk.js → xvfb-CqCqXRC-.js}

@@ -593,8 +593,12 @@ const isInstallingFromPostinstallHook = () => {
 };
 const getCacheDir = () => {
     let cache_directory = util.getCacheDir();
-    if (util.getEnv('CYPRESS_CACHE_FOLDER')) {
-        const envVarCacheDir = untildify(util.getEnv('CYPRESS_CACHE_FOLDER'));
+    // Pass trim=true so we strip surrounding double quotes and whitespace.
+    // Windows CMD's `set CYPRESS_CACHE_FOLDER="C:\path"` embeds literal quotes
+    // into the env value; without dequoting, the resolved cache directory ends
+    // up with quote chars in its name (see cypress-io/cypress#4506).
+    if (util.getEnv('CYPRESS_CACHE_FOLDER', true)) {
+        const envVarCacheDir = untildify(util.getEnv('CYPRESS_CACHE_FOLDER', true));
         debug$1('using environment variable CYPRESS_CACHE_FOLDER %s', envVarCacheDir);
         if (!path.isAbsolute(envVarCacheDir) && isInstallingFromPostinstallHook()) {
             const packageRootFolder = path.join('..', '..', envVarCacheDir);
@@ -903,19 +907,6 @@ const invalidConfigFile = {
     description: '`--config-file` cannot be false.',
     solution: 'Either pass a relative path to a valid Cypress config file or remove this option.',
 };
-/**
- * This error happens when CLI detects that the child Test Runner process
- * was killed with a signal, like SIGBUS
- * @see https://github.com/cypress-io/cypress/issues/5808
- * @param {'close'|'event'} eventName Child close event name
- * @param {string} signal Signal that closed the child process, like "SIGBUS"
-*/
-const childProcessKilled = (eventName, signal) => {
-    return {
-        description: `The Test Runner unexpectedly exited via a ${chalk.cyan(eventName)} event with signal ${chalk.cyan(signal)}`,
-        solution: solutionUnknown,
-    };
-};
 const CYPRESS_RUN_BINARY = {
     notValid: (value) => {
         const properFormat = `**/${stateModule.getPlatformExecutable()}`;
@@ -925,12 +916,6 @@ const CYPRESS_RUN_BINARY = {
         };
     },
 };
-function getErrorSync(errorObject, platform) {
-    const errorMessage = syncFormErrorText(Object.assign(Object.assign({}, errorObject), { platform }));
-    const err = new Error(errorMessage);
-    err.known = true;
-    return err;
-}
 function formErrorText(info, msg, prevMessage) {
     return __awaiter(this, void 0, void 0, function* () {
         const platform = yield util.getPlatformInfo();
@@ -1035,7 +1020,6 @@ const errors = {
     invalidCacheDirectory,
     CYPRESS_RUN_BINARY,
     smokeTestFailure,
-    childProcessKilled,
     incompatibleHeadlessFlags,
     invalidRunProjectPath,
     invalidTestingType,
@@ -1154,7 +1138,6 @@ exports._xvfb = _xvfb;
 exports._xvfbOptions = _xvfbOptions;
 exports.errors = errors;
 exports.exitWithError = exitWithError;
-exports.getErrorSync = getErrorSync;
 exports.isNeeded = isNeeded;
 exports.loggerModule = loggerModule;
 exports.relativeToRepoRoot = relativeToRepoRoot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cypress",
-  "version": "15.15.0",
+  "version": "15.17.0",
   "main": "dist/index.js",
   "scripts": {
     "postinstall": "node dist/index.js --exec install",
@@ -27,7 +27,6 @@
     "eventemitter2": "6.4.7",
     "execa": "4.1.0",
     "executable": "^4.1.1",
-    "extract-zip": "2.0.1",
     "fs-extra": "^9.1.0",
     "hasha": "5.2.2",
     "is-installed-globally": "~0.4.0",
@@ -46,7 +45,7 @@
     "tslib": "1.14.1",
     "tree-kill": "1.2.2",
     "untildify": "^4.0.0",
-    "yauzl": "^2.10.0"
+    "yauzl": "^3.3.1"
   },
   "files": [
     "bin",
@@ -139,8 +138,8 @@
   },
   "buildInfo": {
     "commitBranch": "develop",
-    "commitSha": "914ad901d9d50e2c744769a445643702ceca774b",
-    "commitDate": "2026-05-12T03:59:53.000Z",
+    "commitSha": "b22780a9bb118b86730e22243aba16e25e7a5bed",
+    "commitDate": "2026-06-09T13:13:52.000Z",
     "stable": true
   },
   "description": "Cypress is a next generation front end testing tool built for the modern web",

package/types/cypress.d.ts

@@ -1486,6 +1486,22 @@ declare namespace Cypress {
      *    cy.get('button').should('be.visible')
      */
     get<K extends keyof HTMLElementTagNameMap>(selector: K, options?: Partial<Loggable & Timeoutable & Withinable & Shadow>): Chainable<JQuery<HTMLElementTagNameMap[K]>>
+    /**
+     * Get aliased DOM elements, intercepts, spies, stubs, or wrapped values via `@` prefix.
+     * Use the `S` type parameter to specify the type of the aliased subject.
+     * @see https://on.cypress.io/get#Alias
+     * @example
+     *    // Get the aliased 'todos' elements
+     *    cy.get('ul#todos').as('todos')
+     *    cy.get<JQuery<HTMLLIElement>>('@todos')
+     *
+     *    // Alias a wrapped value and retrieve it with proper typing
+     *    cy.wrap({ name: 'Jane' }).as('user')
+     *    cy.get<{ name: string }>('@user').then((user) => {
+     *      // user is typed as { name: string }
+     *    })
+     */
+    get<S = any>(alias: `@${string}`, options?: Partial<Loggable & Timeoutable & Withinable & Shadow>): Chainable<S>
     /**
      * Get one or more DOM elements by selector.
      * The querying behavior of this command matches exactly how $(…) works in jQuery.
@@ -1496,17 +1512,6 @@ declare namespace Cypress {
      *    cy.get('.dropdown-menu').click()
      */
     get<E extends Node = HTMLElement>(selector: string, options?: Partial<Loggable & Timeoutable & Withinable & Shadow>): Chainable<JQuery<E>>
-    /**
-     * Get one or more DOM elements by alias.
-     * @see https://on.cypress.io/get#Alias
-     * @example
-     *    // Get the aliased 'todos' elements
-     *    cy.get('ul#todos').as('todos')
-     *    //...hack hack hack...
-     *    //later retrieve the todos
-     *    cy.get('@todos')
-     */
-    get<S = any>(alias: string, options?: Partial<Loggable & Timeoutable & Withinable & Shadow>): Chainable<S>
 
     /**
      * Get a browser cookie by its name.
@@ -3442,6 +3447,7 @@ declare namespace Cypress {
   >, Partial<Pick<ResolvedConfigOptions, 'baseUrl' | 'testIsolation'>> {
     browser?: IsBrowserMatcher | IsBrowserMatcher[]
     keystrokeDelay?: number
+    expose?: Record<string, any>
   }
 
   interface TestConfigOverrides extends Partial<
@@ -3449,6 +3455,7 @@ declare namespace Cypress {
   >, Partial<Pick<ResolvedConfigOptions, 'baseUrl'>> {
     browser?: IsBrowserMatcher | IsBrowserMatcher[]
     keystrokeDelay?: number
+    expose?: Record<string, any>
   }
 
   /**

package/types/net-stubbing.d.ts

@@ -548,7 +548,7 @@ declare global {
       })
       ```
       */
-      wait<TRequest = any, TResponse = any>(alias: string, options?: Partial<WaitOptions>): Chainable<Interception<TRequest, TResponse>>
+      wait<TRequest = any, TResponse = any>(alias: `@${string}`, options?: Partial<WaitOptions>): Chainable<Interception<TRequest, TResponse>>
       /**
        * Wait for list of requests to complete.
        *
@@ -568,7 +568,7 @@ declare global {
         })
       ```
       */
-      wait(aliases: string[], options?: Partial<WaitOptions>): Chainable<Interception[]>
+      wait(aliases: `@${string}`[], options?: Partial<WaitOptions>): Chainable<Interception[]>
     }
   }
 }

package/types/sinon/index.d.ts

@@ -12,7 +12,9 @@
 //                 Roey Berman <https://github.com/bergundy>
 // Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped
 
-import * as FakeTimers from '@sinonjs/fake-timers';
+// Import via the @types name so TS resolves to the bundled
+// @types/sinonjs__fake-timers (cypress-io/cypress#33829).
+import * as FakeTimers from 'sinonjs__fake-timers';
 
 // sinon uses DOM dependencies which are absent in browser-less environment like node.js
 // to avoid compiler errors this monkey patch is used