refactor(cli)!: remove shadow bins for pnpm and yarn #889
+61
−566
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 5 commits
November 6, 2025 09:19
Create dedicated module for NODE_SEA_FUSE constant and use static import instead of lazy require(). This improves bundling and eliminates dynamic require() calls. Changes: - Create src/utils/sea/constants/NODE_SEA_FUSE.mts with fuse constant - Update src/utils/sea/build.mts to use static import - Replace 3 require() calls with direct constant usage
Remove shadow bin wrappers for pnpm and yarn, using direct spawn instead. Shadow bins are only needed for npm/npx security scanning. For pnpm/yarn, we use direct spawn with WIN32 shell option for cross-platform compatibility. BREAKING CHANGE: socket-pnpm and socket-yarn binaries no longer use shadow wrappers. Commands now spawn package managers directly. Changes: - Remove src/shadow/pnpm/ and src/shadow/yarn/ directories - Remove src/pnpm-cli.mts and src/yarn-cli.mts entry points - Update cmd-pnpm.mts to use direct spawn() with WIN32 shell - Update cmd-yarn.mts to use direct spawn() with WIN32 shell - Replace lazy require() with static imports from @socketsecurity/lib
…commands Convert npm and npx commands from lazy require() to static ES module imports for shadow bins. This improves bundling and eliminates dynamic loading. Changes: - Remove createRequire usage from cmd-npm.mts and cmd-npx.mts - Add static imports for shadowNpmBin and shadowNpxBin - Add type cast (as any) for spawnPromise.process to fix TypeScript error - Maintain same functionality with cleaner static imports
…patch Update cli-dispatch to use static imports and direct command calls instead of dynamic imports and subprocess spawning. This improves performance, reduces overhead, and enables better tree-shaking. Changes: - Add static imports for cmdNpm, cmdNpx, cmdPnpm, cmdYarn - Replace dynamic import() calls with direct command.run() calls - Remove subprocess spawning for package manager commands - All commands now call handlers directly in same process - Update comments to reflect direct command execution Benefits: - Faster execution (no subprocess overhead) - Better bundling (static imports) - Cleaner code flow (direct function calls)
…runner Simplify shadow runner to only support npm/npx since pnpm/yarn now use direct spawning. Replace lazy require() with static imports for shadow bins. Changes: - Remove createRequire and lazy require() usage - Add static imports for shadowNpmBin and shadowNpxBin - Remove agent parameter from ShadowRunnerOptions - Remove detectPackageManager() function (no longer needed) - Remove pnpm/yarn logic from runShadowCommand() - Update docs to clarify npm/npx-only support - Simplify runShadowCommand to always use shadowNpxBin Note: pnpm/yarn commands now use direct spawn in their respective command files instead of shadow wrappers.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes shadow bin wrappers for pnpm and yarn, using direct spawning instead. Shadow bins are only needed for npm/npx security scanning. This change also converts all lazy
require()calls to static ES module imports throughout the refactored code paths.Changes
spawn()with WIN32 shell optioncreateRequire()and lazyrequire()with ES module importsBreaking Change
This is unlikely to affect users in practice since the functionality remains the same, but the internal mechanism has changed fundamentally.
Benefits
Test Plan
socket pnpmcommandssocket yarncommandsRelated
Part of broader effort to eliminate dynamic require() usage and simplify package manager command architecture.