Function execNpmInteractive

cli/src/npm-client.ts:180–320

* PTY-based npm execution for interactive commands (uses node-pty). * * - Web OTP - either open URL in browser if openUrls is true or passes the URL to frontend. If no auth happened within AUTH_URL_TIMEOUT_MS kills the process to unlock the connector. * * - CLI OTP - if we get a classic OTP prom

(
  args: string[],
  options: ExecNpmOptions = {},
)

 * - CLI OTP - if we get a classic OTP prompt will either return OTP request to the frontend or will pass sent OTP if its provided
 */
async function execNpmInteractive(
  args: string[],
  options: ExecNpmOptions = {},
): Promise<NpmExecResult> {
  const openUrls = options.openUrls === true
  const { promise, resolve } = Promise.withResolvers<NpmExecResult>()

  // Lazy-load node-pty so the native addon is only required when interactive mode is actually used.
  const pty = await import('@lydell/node-pty')

  const npmArgs = options.otp ? [...args, '--otp', options.otp] : args

  if (!options.silent) {
    const displayCmd = options.otp
      ? ['npm', ...args, '--otp', '******'].join(' ')
      : ['npm', ...args].join(' ')
    logCommand(`${displayCmd} (interactive/pty)`)
  }

  let output = ''
  let resolved = false
  let otpPromptSeen = false
  let authUrlSeen = false
  let enterSent = false
  let authUrlTimeout: ReturnType<typeof setTimeout> | null = null
  let authUrlTimedOut = false

  const env = createNpmEnv()

  // When openUrls is false, tell npm not to open the browser.
  // npm still prints the auth URL and polls doneUrl
  if (!openUrls) {
    env.npm_config_browser = 'false'
  }

  const child = pty.spawn('npm', npmArgs, {
    name: 'xterm-256color',
    cols: 120,
    rows: 30,
    cwd: options.cwd,
    env,
  })

  // General timeout: 5 minutes (covers non-auth interactive commands)
  const timeout = setTimeout(() => {
    if (resolved) return
    logDebug('Interactive command timed out', { output })
    child.kill()
  }, 300000)

  child.onData((data: string) => {
    output += data
    const clean = stripAnsi(data)
    logDebug('pty data:', { text: clean.trim() })

    const cleanAll = stripAnsi(output)

    // Detect auth URL in output and notify the caller.