fix(scan): ignore project .pnpmfile.cjs when launching tools via pnpm dlx (1.1.130)#1383
Merged
Martin Torp (mtorp) merged 1 commit intoJun 29, 2026
v1.xSocketDev/socket-cli:v1.xfrom
martin/debug-palantir-errorSocketDev/socket-cli:martin/debug-palantir-errorCopy head branch name to clipboard
Merged
fix(scan): ignore project .pnpmfile.cjs when launching tools via pnpm dlx (1.1.130)#1383Martin Torp (mtorp) merged 1 commit intov1.xSocketDev/socket-cli:v1.xfrom martin/debug-palantir-errorSocketDev/socket-cli:martin/debug-palantir-errorCopy head branch name to clipboard
Martin Torp (mtorp) merged 1 commit into
v1.xSocketDev/socket-cli:v1.xfrom
martin/debug-palantir-errorSocketDev/socket-cli:martin/debug-palantir-errorCopy head branch name to clipboard
Conversation
… dlx (1.1.130) Reachability scans launch Coana (and cdxgen/synp) via `pnpm dlx` with the target repo as cwd. In a pnpm workspace root, `pnpm dlx` evaluates that repo's root `.pnpmfile.cjs`, so a broken or environment-specific hook there (e.g. a `require()` of a file that is still an unresolved Git LFS pointer) crashes the launcher with a bare exit code before the tool ever starts. Set `npm_config_ignore_pnpmfile=true` on the pnpm dlx launch env so the project's pnpm hooks never run. The dlx tool installs into an isolated store, so those hooks are irrelevant to it. The `--ignore-pnpmfile` CLI flag is rejected by `pnpm dlx`; only the env/config form works.
Oskar Haarklou Veileborg (BarrensZeppelin)
approved these changes
Jun 29, 2026
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Member
There was a problem hiding this comment.
LGTM 🎉
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Reachability scans (
socket scan create --reach) can fail to start with a confusing error when run inside a pnpm workspace whose root defines a.pnpmfile.cjs:Root cause
Socket CLI launches its bundled analysis tools (Coana, and similarly cdxgen/synp) via
pnpm dlx <pkg>with the target repo as the working directory (src/utils/dlx.mts→spawnDlx).When that working directory is a pnpm workspace root,
pnpm dlxevaluates the repo's root.pnpmfile.cjsbefore doing anything else. If a hook in that file throws at load time — for example a top-levelrequire()of a file that is still an unresolved Git LFS pointer (so its contents are the LFS spec text, not JavaScript) — pnpm crashes with a bare exit code before the analysis tool ever boots. The CLI then surfaces only the generic "Coana failed to run via the package manager (exit code 1)".Notes confirmed while debugging:
pnpm dlxloads the cwd's.pnpmfile.cjsonly when the cwd is a workspace root; a standalone project dir is unaffected. This is why it only reproduces in monorepos.Fix
In the pnpm branch of
spawnDlx, always setnpm_config_ignore_pnpmfile=trueon the launch environment, sopnpm dlxnever runs the target project's pnpm hooks. The dlx tool is installed into an isolated store, so the project's install hooks are irrelevant to it. This covers the Coana, cdxgen, and synp dlx launches.The
--ignore-pnpmfileCLI flag is rejected bypnpm dlx("Unknown option"); only thenpm_config_ignore_pnpmfileenv/config form is honored — verified against pnpm 10.28.0/10.33.0.Testing
pnpm dlxlaunch in a workspace root succeed.npm_config_ignore_pnpmfile=trueregardless of theforceflag.pnpm test:unit src/utils/dlx.test.mts— 29 pass.pnpm check:tscclean; eslint clean.Note
Low Risk
Small, targeted change to pnpm dlx spawn env in dlx.mts; skips project hooks only for isolated dlx installs, with unit test coverage.
Overview
Fixes reachability and other scans that launch bundled tools (Coana, cdxgen, synp) with
pnpm dlxfrom a pnpm workspace root, wherepnpm dlxwas loading the repo’s.pnpmfile.cjsand could exit before the tool started (e.g. hooks thatrequireGit LFS pointer files).spawnDlxnow always setsnpm_config_ignore_pnpmfile=trueon the pnpm launch environment so project install hooks are skipped; the existingforcepath still setsnpm_config_dlx_cache_max_age=0in the same env block. Release 1.1.130 with changelog; unit test asserts the env var is set regardless offorce.Reviewed by Cursor Bugbot for commit 0d7ed41. Configure here.