fix(sea): preserve native reentry and windows shim execution

Author: jdalton

src/command/ask/handle-ask.mts

@@ -1,3 +1,4 @@
+import sea from 'node:sea'
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
@@ -130,6 +131,9 @@ const ENVIRONMENT_KEYWORDS = {
 export function getCliReentryArgv(
   command: string[] | readonly string[],
 ): string[] | undefined {
+  if (sea.isSea()) {
+    return [...command]
+  }
   const entryPath = process.argv[1]
   return entryPath ? [entryPath, ...command] : undefined
 }

src/util/ecosystem/environment-agent.mts

@@ -19,7 +19,8 @@ import semver from 'semver'
 
 import { getNpmExecPath, getPnpmExecPath } from '../../constants/agents.mts'
 import { FLAG_VERSION } from '../../constants/cli.mts'
-import { execPath, nodeNoWarningsFlags } from '../../constants/paths.mts'
+import { nodeNoWarningsFlags } from '../../constants/paths.mts'
+import { resolveNodeRuntime } from '../spawn/node-runtime.mts'
 import { preferWindowsCmdShim, resolveBinPathSync } from './windows-shims.mts'
 
 import type { Agent } from './supported-agents.mts'
@@ -117,10 +118,11 @@ export async function getAgentVersion(
     }
 
     if (shouldRunWithNode) {
+      const runtime = await resolveNodeRuntime({ cwd })
       const spawnResult = await spawn(
-        execPath,
+        runtime.executable,
         [...nodeNoWarningsFlags, shouldRunWithNode, FLAG_VERSION],
-        { cwd },
+        { cwd, env: runtime.environment },
       )
 
       if (!spawnResult) {

test/unit/command/ask/handle-ask.test.mts

@@ -1,3 +1,4 @@
+import sea from 'node:sea'
 import {
   extractWords,
   normalizeQuery,
@@ -97,6 +98,15 @@ describe('handleAsk', () => {
     )
   })
 
+  it('reenters a SEA executable with command arguments only', () => {
+    const probe = vi.spyOn(sea, 'isSea').mockReturnValue(true)
+    try {
+      expect(getCliReentryArgv(['scan', '--json'])).toEqual(['scan', '--json'])
+    } finally {
+      probe.mockRestore()
+    }
+  })
+
   it('reports an unknown entry script instead of guessing one', () => {
     const originalArgv1 = process.argv[1]
     process.argv[1] = ''

test/unit/util/ecosystem/environment.test.mts

@@ -23,6 +23,19 @@ import {
   resolveBinPathSync,
 } from '../../../../src/util/ecosystem/environment.mts'
 
+const mockIsWin32 = vi.hoisted(() => vi.fn(() => false))
+const mockNodeRuntime = vi.hoisted(() => vi.fn())
+vi.mock(
+  import('@socketsecurity/lib-stable/constants/platform'),
+  async importOriginal => ({
+    ...(await importOriginal()),
+    isWin32: mockIsWin32,
+  }),
+)
+vi.mock(import('../../../../src/util/spawn/node-runtime.mts'), () => ({
+  resolveNodeRuntime: mockNodeRuntime,
+}))
+
 // Mock the dependencies.
 const mockExistsSync = vi.hoisted(() => vi.fn())
 const mockReadFileSync = vi.hoisted(() => vi.fn())
@@ -70,6 +83,7 @@ vi.mock(import('semver'), () => ({
 describe('package-environment', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsWin32.mockReturnValue(false)
     // Default mock behavior for spawn to get package manager version.
     mockSpawn.mockResolvedValue({ stdout: '10.0.0', stderr: '', code: 0 })
   })
@@ -201,6 +215,21 @@ describe('package-environment', () => {
   })
 
   describe('getAgentVersion', () => {
+    it('runs Windows JavaScript shims with the trusted Node runtime', async () => {
+      mockIsWin32.mockReturnValue(true)
+      mockExistsSync.mockReturnValue(true)
+      mockReadFileSync.mockReturnValue('node "/tools/npm-cli.js" "$@"')
+      mockNodeRuntime.mockResolvedValue({
+        executable: '/trusted/node',
+        environment: { PATH: '/trusted' },
+      })
+      await getAgentVersion('npm', '/tools/npm', '/project')
+      expect(mockSpawn).toHaveBeenCalledWith(
+        '/trusted/node',
+        expect.arrayContaining(['/tools/npm-cli.js', '--version']),
+        { cwd: '/project', env: { PATH: '/trusted' } },
+      )
+    })
     it('returns coerced semver version on successful spawn', async () => {
       mockSpawn.mockResolvedValue({
         stdout: '10.8.2',