fix: bypass SFW shim for test installs (SFW strips registry time metadata)

Author: jdalton

scripts/npm/install-npm-packages.mjs

@@ -104,6 +104,7 @@ import {
 import { filterPackagesByChanges } from '../utils/git.mjs'
 import {
   copySocketOverride,
+  PNPM_REAL_BIN,
   PNPM_HOISTED_INSTALL_FLAGS,
   PNPM_INSTALL_ENV,
 } from '../utils/package.mjs'
@@ -524,7 +525,7 @@ async function installPackage(packageInfo) {
         // If Socket override has different dependencies, install them.
         // Always use pnpm for installation to avoid npm override conflicts.
         if (overridePkgJson.dependencies) {
-          await runCommandQuietStrict('pnpm', ['install'], {
+          await runCommandQuietStrict(PNPM_REAL_BIN, ['install'], {
             cwd: installedPath,
             env: {
               ...process.env,
@@ -539,7 +540,7 @@ async function installPackage(packageInfo) {
         // The hoisted install at parent level makes test runners available to nested package.
         // Always use pnpm for installation to avoid npm override conflicts.
         await runCommandQuietStrict(
-          'pnpm',
+          PNPM_REAL_BIN,
           ['install', ...PNPM_HOISTED_INSTALL_FLAGS],
           {
             cwd: packageTempDir,
@@ -778,7 +779,7 @@ async function installPackage(packageInfo) {
     await pRetry(
       async () => {
         await runCommandQuietStrict(
-          'pnpm',
+          PNPM_REAL_BIN,
           ['install', ...PNPM_HOISTED_INSTALL_FLAGS],
           {
             cwd: packageTempDir,
@@ -816,7 +817,7 @@ async function installPackage(packageInfo) {
       // Always use pnpm for installation to avoid npm override conflicts.
       writeProgress('👷')
       await runCommandQuietStrict(
-        'pnpm',
+        PNPM_REAL_BIN,
         ['install', ...PNPM_HOISTED_INSTALL_FLAGS],
         {
           cwd: packageTempDir,
@@ -940,7 +941,7 @@ async function installPackage(packageInfo) {
     // If Socket override has different dependencies, install them.
     // Always use pnpm for installation to avoid npm override conflicts.
     if (overridePkgJson.dependencies) {
-      await runCommandQuietStrict('pnpm', ['install'], {
+      await runCommandQuietStrict(PNPM_REAL_BIN, ['install'], {
         cwd: installedPath,
         env: {
           ...process.env,
@@ -955,7 +956,7 @@ async function installPackage(packageInfo) {
     // The hoisted install at parent level makes test runners available to nested package.
     // Always use pnpm for installation to avoid npm override conflicts.
     await runCommandQuietStrict(
-      'pnpm',
+      PNPM_REAL_BIN,
       ['install', ...PNPM_HOISTED_INSTALL_FLAGS],
       {
         cwd: packageTempDir,

scripts/utils/package.mjs

@@ -14,13 +14,37 @@ import { readPackageJson } from '@socketsecurity/lib/packages/operations'
 import { pEach } from '@socketsecurity/lib/promises'
 import { withSpinner } from '@socketsecurity/lib/spinner'
 
+import { whichSync } from '@socketsecurity/lib/bin'
+
 import { cleanTestScript } from '../../test/utils/script-cleaning.mjs'
 import { testRunners } from '../../test/utils/test-runners.mjs'
 import { DEFAULT_CONCURRENCY } from '../constants/core.mjs'
 import { ROOT_PATH } from '../constants/paths.mjs'
 import { spawn } from './spawn.mjs'
 import process from 'node:process'
 
+// Resolve real pnpm binary, bypassing SFW shim.
+// SFW shims intercept pnpm and proxy registry requests, stripping metadata
+// fields (e.g. "time") which causes pnpm v11 ERR_PNPM_MISSING_TIME failures.
+// Strip the SFW shim dir from PATH to find the real binary.
+function getRealPnpmBin() {
+  const sfwShimDir = process.env['SFW_SHIM_DIR']
+  if (sfwShimDir) {
+    const cleanPath = (process.env['PATH'] ?? '')
+      .split(path.delimiter)
+      .filter(p => p !== sfwShimDir)
+      .join(path.delimiter)
+    const real = whichSync('pnpm', { nothrow: true, path: cleanPath })
+    if (real && typeof real === 'string') {
+      return real
+    }
+  }
+  return 'pnpm'
+}
+
+/** Real pnpm binary path (bypasses SFW shim if present). */
+export const PNPM_REAL_BIN = getRealPnpmBin()
+
 // Shared pnpm flags to make it behave like npm with hoisting.
 const PNPM_NPM_LIKE_FLAGS = [
   '--config.shamefully-hoist=true',