refactor(scripts): convert spawnSync to async spawn for consistency

Convert remaining spawnSync usage to async spawn from @socketsecurity/lib/spawn
for consistency across the codebase. Using async spawn provides better performance
and matches the pattern used throughout the project.

Files converted:
- scripts/build.mjs: Build router now uses async spawn with result.code
- scripts/publish.mjs: Publish router now uses async spawn with result.code
- packages/cli/scripts/utils/patches.mjs: Patch utilities now use async spawn

Changes:
- Import spawn from @socketsecurity/lib/spawn instead of spawnSync from node:child_process
- Wrap top-level code in async main() function
- Change result.status to result.code (spawn API returns {code, stdout?, stderr?})
- Add main().catch() error handler for async execution

Benefits:
- Consistent spawn usage across all scripts
- Better cross-platform compatibility with WIN32 shell handling
- Non-blocking execution where synchronous behavior isn't required

Author: jdalton

packages/cli/scripts/utils/patches.mjs

@@ -3,13 +3,14 @@
  * Provides helpers for transforming node_modules files and generating patch files.
  */
 
-import { spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 
 import { parse } from '@babel/core'
 import MagicString from 'magic-string'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { logger } from '@socketsecurity/lib/logger'
+import { spawn } from '@socketsecurity/lib/spawn'
 
 /**
  * Parse JavaScript/TypeScript code into a Babel AST.
@@ -91,14 +92,15 @@ export async function startPatch(packageSpec) {
   logger.log(`Starting patch for ${packageSpec}...`)
 
   // First, try to run pnpm patch to see if directory already exists.
-  let result = spawnSync('pnpm', ['patch', packageSpec], {
-    encoding: 'utf-8',
+  let result = await spawn('pnpm', ['patch', packageSpec], {
+    shell: WIN32,
     stdio: ['inherit', 'pipe', 'pipe'], // Capture stdout and stderr.
+    stdioString: true,
   })
 
   // Check if the error is about existing patch directory.
   // pnpm outputs errors to stdout, not stderr.
-  if (result.status !== 0 && result.stdout.includes('is not empty')) {
+  if (result.code !== 0 && result.stdout.includes('is not empty')) {
     const match = result.stdout.match(/directory (.+?) is not empty/)
     const existingPatchDir = match ? match[1] : null
 
@@ -118,14 +120,15 @@ export async function startPatch(packageSpec) {
       rmSync(existingPatchDir, { force: true, recursive: true })
 
       // Try pnpm patch again.
-      result = spawnSync('pnpm', ['patch', packageSpec], {
-        encoding: 'utf-8',
+      result = await spawn('pnpm', ['patch', packageSpec], {
+        shell: WIN32,
         stdio: ['inherit', 'pipe', 'inherit'],
+        stdioString: true,
       })
     }
   }
 
-  if (result.status !== 0) {
+  if (result.code !== 0) {
     throw new Error(`Failed to start patch for ${packageSpec}`)
   }
 
@@ -153,14 +156,14 @@ export async function startPatch(packageSpec) {
  * @param {string} patchPath - Path to temporary patch directory.
  * @param {string} packageName - Package name for logging.
  */
-export function commitPatch(patchPath, packageName) {
+export async function commitPatch(patchPath, packageName) {
   logger.log(`Committing patch for ${packageName}...`)
-  const result = spawnSync('pnpm', ['patch-commit', patchPath], {
-    encoding: 'utf-8',
+  const result = await spawn('pnpm', ['patch-commit', patchPath], {
+    shell: WIN32,
     stdio: 'inherit',
   })
 
-  if (result.status !== 0) {
+  if (result.code !== 0) {
     throw new Error(`Failed to commit patch for ${packageName}`)
   }
 
@@ -221,7 +224,7 @@ export async function createPatch(patchDef) {
     }
 
     // Commit the patch.
-    commitPatch(patchPath, packageName)
+    await commitPatch(patchPath, packageName)
   } catch (error) {
     logger.error(`Error creating patch for ${packageName}:`, error.message)
     // Cleanup temp directory on error.

scripts/build.mjs

@@ -5,10 +5,11 @@
  * Routes build commands to appropriate packages based on --target flag.
  */
 
-import { spawnSync } from 'node:child_process'
 import process from 'node:process'
+
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { logger } from '@socketsecurity/lib/logger'
-import colors from 'yoctocolors-cjs'
+import { spawn } from '@socketsecurity/lib/spawn'
 
 const TARGET_PACKAGES = {
   __proto__: null,
@@ -41,25 +42,31 @@ for (let i = 0; i < args.length; i++) {
   }
 }
 
-const packageFilter = TARGET_PACKAGES[target]
-if (!packageFilter) {
-  logger.error(`Unknown build target: ${target}`)
-  logger.error(`Available targets: ${Object.keys(TARGET_PACKAGES).join(', ')}`)
-  process.exit(1)
-}
+async function main() {
+  const packageFilter = TARGET_PACKAGES[target]
+  if (!packageFilter) {
+    logger.error(`Unknown build target: ${target}`)
+    logger.error(`Available targets: ${Object.keys(TARGET_PACKAGES).join(', ')}`)
+    process.exit(1)
+  }
 
-const pnpmArgs = [
-  '--filter',
-  packageFilter,
-  'run',
-  'build',
-  ...buildArgs
-]
+  const pnpmArgs = [
+    '--filter',
+    packageFilter,
+    'run',
+    'build',
+    ...buildArgs
+  ]
 
-const result = spawnSync('pnpm', pnpmArgs, {
-  encoding: 'utf8',
-  shell: false,
-  stdio: 'inherit'
-})
+  const result = await spawn('pnpm', pnpmArgs, {
+    shell: WIN32,
+    stdio: 'inherit',
+  })
 
-process.exit(result.status ?? 1)
+  process.exit(result.code ?? 1)
+}
+
+main().catch(e => {
+  logger.error(e)
+  process.exit(1)
+})

scripts/publish.mjs

@@ -5,10 +5,11 @@
  * Routes publish commands to appropriate packages based on --target flag.
  */
 
-import { spawnSync } from 'node:child_process'
 import process from 'node:process'
+
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { logger } from '@socketsecurity/lib/logger'
-import colors from 'yoctocolors-cjs'
+import { spawn } from '@socketsecurity/lib/spawn'
 
 const TARGET_PACKAGES = {
   __proto__: null,
@@ -41,40 +42,46 @@ for (let i = 0; i < args.length; i++) {
   }
 }
 
-const packageFilter = TARGET_PACKAGES[target]
-if (!packageFilter) {
-  logger.error(`Unknown publish target: ${target}`)
-  logger.error(`Available targets: ${Object.keys(TARGET_PACKAGES).join(', ')}`)
-  process.exit(1)
-}
+async function main() {
+  const packageFilter = TARGET_PACKAGES[target]
+  if (!packageFilter) {
+    logger.error(`Unknown publish target: ${target}`)
+    logger.error(`Available targets: ${Object.keys(TARGET_PACKAGES).join(', ')}`)
+    process.exit(1)
+  }
 
-// Special handling for 'all' target.
-if (target === 'all') {
-  logger.log('Publishing all packages...')
-  logger.log('Note: Packages are published in dependency order by pnpm')
-}
+  // Special handling for 'all' target.
+  if (target === 'all') {
+    logger.log('Publishing all packages...')
+    logger.log('Note: Packages are published in dependency order by pnpm')
+  }
 
-const pnpmArgs = [
-  '--filter',
-  packageFilter,
-  'publish',
-  ...publishArgs
-]
+  const pnpmArgs = [
+    '--filter',
+    packageFilter,
+    'publish',
+    ...publishArgs
+  ]
 
-logger.log(`Publishing ${target}...`)
-logger.log(`Command: pnpm ${pnpmArgs.join(' ')}`)
-logger.log('')
+  logger.log(`Publishing ${target}...`)
+  logger.log(`Command: pnpm ${pnpmArgs.join(' ')}`)
+  logger.log('')
 
-const result = spawnSync('pnpm', pnpmArgs, {
-  encoding: 'utf8',
-  shell: false,
-  stdio: 'inherit'
-})
+  const result = await spawn('pnpm', pnpmArgs, {
+    shell: WIN32,
+    stdio: 'inherit',
+  })
+
+  if (result.code === 0) {
+    logger.log(`\n✓ Successfully published ${target}`)
+  } else {
+    logger.error(`\n✗ Failed to publish ${target}`)
+  }
 
-if (result.status === 0) {
-  logger.log(`\n✓ Successfully published ${target}`)
-} else {
-  logger.error(`\n✗ Failed to publish ${target}`)
+  process.exit(result.code ?? 1)
 }
 
-process.exit(result.status ?? 1)
+main().catch(e => {
+  logger.error(e)
+  process.exit(1)
+})