Function resolveCommandCandidate

packages/cli-exec/src/lookup.ts:346–382

* Global candidates can be returned directly. Local bins must resolve through * the installed `vercel` package so a spoofed shim cannot be invoked.

(
  command: string,
  candidate: string,
  localBinSearch: LocalBinSearch,
  diagnostics: ResolutionDiagnostics
)

 * the installed `vercel` package so a spoofed shim cannot be invoked.
 */
async function resolveCommandCandidate(
  command: string,
  candidate: string,
  localBinSearch: LocalBinSearch,
  diagnostics: ResolutionDiagnostics
): Promise<ResolvedCommand | null> {
  if (!(await stat(candidate)).isFile()) {
    return null;
  }

  const realPath = await realpath(candidate);
  const localBinCandidate = await classifyPathLocalBinCandidate(
    candidate,
    localBinSearch.directories
  );

  if (!localBinCandidate) {
    return { realPath, source: 'path' };
  }

  if ('reason' in localBinCandidate) {
    recordSkippedLocalBin(diagnostics, candidate, localBinCandidate.reason);
    return null;
  }

  const localPackageBinResult = await getLocalVercelPackageBin(
    command,
    localBinCandidate.directory
  );

  if ('reason' in localPackageBinResult) {
    recordSkippedLocalBin(diagnostics, candidate, localPackageBinResult.reason);
    return null;
  }

  return { realPath: localPackageBinResult.binPath, source: 'local-bin' };
}

/**
 * Adds a rejected local bin candidate to lookup diagnostics.