From 459903fb419778cc47d94b7a41ce59cb44fedf87 Mon Sep 17 00:00:00 2001 From: Oskar Haarklou Veileborg Date: Mon, 19 Oct 2026 11:25:34 +0200 Subject: [PATCH] refactor(dlx): drop the force option and range detection Coana was the only caller of spawnDlx that passed `force: true`, and the only one with a version range. cdxgen and synp are pinned and launched with `silent: true`, so neither code path runs any more. --- src/utils/dlx.mts | 42 ++++++++---------------------------------- src/utils/dlx.test.mts | 41 ++--------------------------------------- 2 files changed, 10 insertions(+), 73 deletions(-) diff --git a/src/utils/dlx.mts b/src/utils/dlx.mts index d8f4909ea..2c84b34f2 100644 --- a/src/utils/dlx.mts +++ b/src/utils/dlx.mts @@ -9,7 +9,7 @@ * * Package Manager Detection: * - Auto-detects npm, pnpm, or yarn based on lockfiles - * - Supports force-refresh and silent execution modes + * - Supports silent execution mode * * Integration: * - Works with shadow binaries for security scanning @@ -39,7 +39,6 @@ const require = createRequire(import.meta.url) const { PACKAGE_LOCK_JSON, PNPM_LOCK_YAML, YARN_LOCK } = constants export type DlxOptions = ShadowBinOptions & { - force?: boolean | undefined agent?: 'npm' | 'pnpm' | 'yarn' | undefined silent?: boolean | undefined } @@ -49,16 +48,9 @@ export type DlxPackageSpec = { version: string } -/** - * Regex to check if a version string contains range operators. - * Matches any version with range operators: ~, ^, >, <, =, x, X, *, spaces, or ||. - */ -const rangeOperatorsRegExp = /[~^><=xX* ]|\|\|/ - /** * Spawns a package using dlx-style execution (npx/pnpm dlx/yarn dlx). * Automatically detects the appropriate package manager if not specified. - * Uses force/update flags to ensure the latest version within the range is fetched. */ export async function spawnDlx( packageSpec: DlxPackageSpec, @@ -66,15 +58,7 @@ export async function spawnDlx( options?: DlxOptions | undefined, spawnExtra?: SpawnExtra | undefined, ): Promise { - // If version is not pinned exactly, default to force and silent for better UX. - const isNotPinned = rangeOperatorsRegExp.test(packageSpec.version) - - const { - agent, - force = false, - silent = isNotPinned, - ...shadowOptions - } = options ?? {} + const { agent, silent = false, ...shadowOptions } = options ?? {} let finalShadowOptions = shadowOptions @@ -123,18 +107,12 @@ export async function spawnDlx( // store, so the project's install hooks are irrelevant to it. pnpm honors // this only as a config setting, not as a `dlx` CLI flag, so it must be set // via the npm_config_ env var. See: https://pnpm.io/npmrc#settings - const pnpmEnv: Record = { - ...getOwn(finalShadowOptions, 'env'), - npm_config_ignore_pnpmfile: 'true', - } - if (force) { - // Set dlx-cache-max-age to 0 minutes to bypass cache and force a fresh - // download. This ensures we always get the latest version within the range. - pnpmEnv['npm_config_dlx_cache_max_age'] = '0' - } finalShadowOptions = { ...finalShadowOptions, - env: pnpmEnv, + env: { + ...getOwn(finalShadowOptions, 'env'), + npm_config_ignore_pnpmfile: 'true', + }, } spawnArgs.push(packageString, ...args) @@ -164,10 +142,6 @@ export async function spawnDlx( // Use npm exec/npx. // For consistency, we'll use npx which is more commonly used for one-off execution. spawnArgs = ['--yes'] - if (force) { - // Use --force to bypass cache and get latest within range. - spawnArgs.push('--force') - } if (silent) { spawnArgs.push(FLAG_SILENT) } @@ -192,7 +166,7 @@ export async function spawnCdxgenDlx( version: constants.ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION, }, args, - { force: false, silent: true, ...options }, + { silent: true, ...options }, spawnExtra, ) } @@ -211,7 +185,7 @@ export async function spawnSynpDlx( version: `${constants.ENV.INLINED_SOCKET_CLI_SYNP_VERSION}`, }, args, - { force: false, silent: true, ...options }, + { silent: true, ...options }, spawnExtra, ) } diff --git a/src/utils/dlx.test.mts b/src/utils/dlx.test.mts index 568b26fa5..34a221fe6 100644 --- a/src/utils/dlx.test.mts +++ b/src/utils/dlx.test.mts @@ -106,22 +106,6 @@ describe('utils/dlx', () => { expect(spawnArgs[3]).toBe('/some/path') }) - it('should default silent to true for pnpm when version is not pinned', async () => { - const packageSpec: DlxPackageSpec = { - name: '@coana-tech/cli', - version: '~1.0.0', - } - - await spawnDlx(packageSpec, ['run', '/some/path'], { agent: 'pnpm' }) - - expect(mockShadowPnpmBin).toHaveBeenCalledTimes(1) - const [spawnArgs] = mockShadowPnpmBin.mock.calls[0] - - // Verify that --silent is automatically added for unpinned versions. - expect(spawnArgs[0]).toBe('--silent') - expect(spawnArgs[1]).toBe('dlx') - }) - it('should place --silent after --yes for npm', async () => { const packageSpec: DlxPackageSpec = { name: '@coana-tech/cli', @@ -144,32 +128,12 @@ describe('utils/dlx', () => { expect(spawnArgs[4]).toBe('/some/path') }) - it('should set npm_config_dlx_cache_max_age env var for pnpm when force is true', async () => { - const packageSpec: DlxPackageSpec = { - name: '@coana-tech/cli', - version: '1.0.0', - } - - await spawnDlx(packageSpec, ['run', '/some/path'], { - agent: 'pnpm', - force: true, - }) - - expect(mockShadowPnpmBin).toHaveBeenCalledTimes(1) - const [, options] = mockShadowPnpmBin.mock.calls[0] - - // Verify that the env var is set to force cache bypass. - expect(options.env).toBeDefined() - expect(options.env.npm_config_dlx_cache_max_age).toBe('0') - }) - - it('should set npm_config_ignore_pnpmfile env var for pnpm regardless of force', async () => { + it('should set npm_config_ignore_pnpmfile env var for pnpm', async () => { const packageSpec: DlxPackageSpec = { name: '@coana-tech/cli', version: '1.0.0', } - // force defaults to false here, exercising the non-force path. await spawnDlx(packageSpec, ['run', '/some/path'], { agent: 'pnpm' }) expect(mockShadowPnpmBin).toHaveBeenCalledTimes(1) @@ -182,7 +146,7 @@ describe('utils/dlx', () => { expect(options.env.npm_config_ignore_pnpmfile).toBe('true') }) - it('should handle pinned version without silent flag by default', async () => { + it('should not add --silent by default', async () => { const packageSpec: DlxPackageSpec = { name: '@coana-tech/cli', version: '1.0.0', @@ -193,7 +157,6 @@ describe('utils/dlx', () => { expect(mockShadowPnpmBin).toHaveBeenCalledTimes(1) const [spawnArgs] = mockShadowPnpmBin.mock.calls[0] - // For pinned versions, silent defaults to false. expect(spawnArgs[0]).toBe('dlx') expect(spawnArgs[1]).toBe('@coana-tech/cli@1.0.0') })