fix: show warning when path contains delimiter (#6606)

.github/workflows/ci-release.yml

@@ -85,7 +85,7 @@ jobs:
             os: macos-latest
             shell: bash
           - name: macOS
-            os: macos-13
+            os: macos-15-intel
             shell: bash
           - name: Windows
             os: windows-latest
@@ -96,13 +96,13 @@ jobs:
           - 22.9.0
           - 22.x
         exclude:
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.17.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.x
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.9.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.x
     runs-on: ${{ matrix.platform.os }}
     defaults:

.github/workflows/ci.yml

@@ -61,7 +61,7 @@ jobs:
             os: macos-latest
             shell: bash
           - name: macOS
-            os: macos-13
+            os: macos-15-intel
             shell: bash
           - name: Windows
             os: windows-latest
@@ -72,13 +72,13 @@ jobs:
           - 22.9.0
           - 22.x
         exclude:
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.17.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.x
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.9.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.x
     runs-on: ${{ matrix.platform.os }}
     defaults:

lib/set-path.js

@@ -1,3 +1,4 @@
+const { log } = require('proc-log')
 const { resolve, dirname, delimiter } = require('path')
 // the path here is relative, even though it does not need to be
 // in order to make the posix tests pass in windows
@@ -14,6 +15,13 @@ const setPATH = (projectPath, binPaths, env) => {
 
   const pathArr = []
   if (binPaths) {
+    for (const bin of binPaths) {
+      if (bin.includes(delimiter)) {
+        const event = env.npm_lifecycle_event
+        const context = event ? `"${event}" script` : 'script execution'
+        log.warn('run-script', `Path contains delimiter ("${delimiter}"), ${context} may not behave as expected.`)
+      }
+    }
     pathArr.push(...binPaths)
   }
   // unshift the ./node_modules/.bin from every folder

test/make-spawn-args.js

@@ -1,5 +1,7 @@
 const t = require('tap')
 const spawk = require('spawk')
+const { delimiter } = require('node:path')
+const setPATH = require('../lib/set-path.js')
 const runScript = require('..')
 
 const pkg = {
@@ -141,4 +143,40 @@ t.test('spawn args', async t => {
     }))
     t.ok(spawk.done())
   })
+
+  await t.test('binPaths containing delimiter logs warning', async t => {
+    const warnings = []
+    const onWarn = (...args) => warnings.push(args)
+    process.on('log', onWarn)
+    t.teardown(() => process.off('log', onWarn))
+
+    spawk.spawn(
+      /.*/,
+      false,
+      e => (e.env.PATH || e.env.Path).includes(`/path/with${delimiter}delimiter`)
+    )
+    await t.resolves(() => runScript({
+      pkg,
+      binPaths: [`/path/with${delimiter}delimiter`],
+      path: testdir,
+      event: 'test',
+    }))
+    const warning = warnings.find(w => w[0] === 'warn' && w[1] === 'run-script' && w[2].includes('delimiter'))
+    t.ok(warning, 'warning should be logged when binPath contains delimiter')
+    t.match(warning[2], '"test" script')
+    t.ok(spawk.done())
+  })
+
+  await t.test('binPaths containing delimiter uses generic message without event', async t => {
+    const warnings = []
+    const onWarn = (...args) => warnings.push(args)
+    process.on('log', onWarn)
+    t.teardown(() => process.off('log', onWarn))
+
+    setPATH(testdir, [`/path/with${delimiter}delimiter`], {})
+
+    const warning = warnings.find(w => w[0] === 'warn' && w[1] === 'run-script' && w[2].includes('delimiter'))
+    t.ok(warning, 'warning should be logged with generic message when no event')
+    t.match(warning[2], 'script execution')
+  })
 })