refactor: use execFile exclusively in installPackages

All pnpm commands (i, remove, run postinstall) now use execFile
instead of exec, eliminating shell interpretation entirely. No
command in installPackages needs shell features.

Author: fernandomg

source/__tests__/operations/installPackages.test.ts

@@ -6,7 +6,7 @@ vi.mock('../../operations/exec.js', () => ({
   execFile: vi.fn().mockResolvedValue(''),
 }))
 
-const { exec, execFile } = await import('../../operations/exec.js')
+const { execFile } = await import('../../operations/exec.js')
 const { installPackages } = await import('../../operations/installPackages.js')
 
 describe('installPackages', () => {
@@ -15,23 +15,23 @@ describe('installPackages', () => {
   })
 
   describe('full mode', () => {
-    it('runs pnpm i', async () => {
+    it('runs pnpm i via execFile', async () => {
       await installPackages('/project/my_app', 'full')
 
-      expect(exec).toHaveBeenCalledWith('pnpm i', { cwd: '/project/my_app' })
+      expect(execFile).toHaveBeenCalledWith('pnpm', ['i'], { cwd: '/project/my_app' })
     })
 
     it('runs only one command', async () => {
       await installPackages('/project/my_app', 'full')
 
-      expect(exec).toHaveBeenCalledTimes(1)
+      expect(execFile).toHaveBeenCalledTimes(1)
     })
 
     it('ignores features argument', async () => {
       await installPackages('/project/my_app', 'full', ['demo', 'subgraph'])
 
-      expect(exec).toHaveBeenCalledTimes(1)
-      expect(exec).toHaveBeenCalledWith('pnpm i', { cwd: '/project/my_app' })
+      expect(execFile).toHaveBeenCalledTimes(1)
+      expect(execFile).toHaveBeenCalledWith('pnpm', ['i'], { cwd: '/project/my_app' })
     })
   })
 
@@ -40,8 +40,8 @@ describe('installPackages', () => {
       const allFeatures = Object.keys(featureDefinitions) as Array<keyof typeof featureDefinitions>
       await installPackages('/project/my_app', 'custom', allFeatures)
 
-      expect(exec).toHaveBeenCalledTimes(1)
-      expect(exec).toHaveBeenCalledWith('pnpm i', { cwd: '/project/my_app' })
+      expect(execFile).toHaveBeenCalledTimes(1)
+      expect(execFile).toHaveBeenCalledWith('pnpm', ['i'], { cwd: '/project/my_app' })
     })
   })
 
@@ -69,10 +69,7 @@ describe('installPackages', () => {
         if (args[0] === 'remove') {
           callOrder.push('remove')
         }
-        return ''
-      })
-      vi.mocked(exec).mockImplementation(async (cmd) => {
-        if (typeof cmd === 'string' && cmd.includes('postinstall')) {
+        if (args[0] === 'run' && args[1] === 'postinstall') {
           callOrder.push('postinstall')
         }
         return ''
@@ -119,5 +116,21 @@ describe('installPackages', () => {
         expect(removeArgs).toContain(pkg)
       }
     })
+
+    it('runs postinstall via execFile', async () => {
+      await installPackages('/project/my_app', 'custom', ['demo'])
+
+      expect(execFile).toHaveBeenCalledWith('pnpm', ['run', 'postinstall'], {
+        cwd: '/project/my_app',
+      })
+    })
+  })
+
+  it('never uses exec (shell) for any command', async () => {
+    const { exec } = await import('../../operations/exec.js')
+
+    await installPackages('/project/my_app', 'custom', ['demo'])
+
+    expect(exec).not.toHaveBeenCalled()
   })
 })

source/operations/installPackages.ts

@@ -1,25 +1,25 @@
 import type { FeatureName } from '../constants/config.js'
 import type { InstallationType } from '../types/types.js'
 import { getPackagesToRemove } from '../utils/utils.js'
-import { exec, execFile } from './exec.js'
+import { execFile } from './exec.js'
 
 export async function installPackages(
   projectFolder: string,
   mode: InstallationType,
   features: FeatureName[] = [],
 ): Promise<void> {
   if (mode === 'full') {
-    await exec('pnpm i', { cwd: projectFolder })
+    await execFile('pnpm', ['i'], { cwd: projectFolder })
     return
   }
 
   const packagesToRemove = getPackagesToRemove(features)
 
   if (packagesToRemove.length === 0) {
-    await exec('pnpm i', { cwd: projectFolder })
+    await execFile('pnpm', ['i'], { cwd: projectFolder })
     return
   }
 
   await execFile('pnpm', ['remove', ...packagesToRemove], { cwd: projectFolder })
-  await exec('pnpm run postinstall', { cwd: projectFolder })
+  await execFile('pnpm', ['run', 'postinstall'], { cwd: projectFolder })
 }