refactor: add IPC utility for shadow npm inject script

Adds src/utils/ipc.mts to centralize IPC data handling. The inject
script calls initializeIpc() at startup to wait for the handshake
and extract the extra field. The arborist then uses getIpcExtra()
to access shadow configuration (API token, bin name, etc.).

Author: jdalton

packages/cli/src/shadow/npm/arborist/lib/arborist/index.mts

@@ -10,7 +10,6 @@ import { NPX } from '../../../../../constants/agents.mts'
 import ENV from '../../../../../constants/env.mts'
 import { NODE_MODULES } from '../../../../../constants/packages.mts'
 import {
-  getInternals,
   SOCKET_CLI_ACCEPT_RISKS,
   SOCKET_CLI_SHADOW_ACCEPT_RISKS,
   SOCKET_CLI_SHADOW_API_TOKEN,
@@ -20,6 +19,7 @@ import {
   SOCKET_CLI_VIEW_ALL_RISKS,
 } from '../../../../../constants/shadow.mts'
 import { findUp } from '../../../../../utils/fs/find-up.mjs'
+import { getIpcExtra } from '../../../../../utils/ipc.mjs'
 import { logAlertsMap } from '../../../../../utils/socket/package-alert.mts'
 import {
   getAlertsMapFromArborist,
@@ -32,9 +32,6 @@ import type {
   NodeClass,
 } from '../../types.mts'
 
-const internals = getInternals()
-const getIpc = internals.getIpc
-
 export const SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {
   __proto__: null,
   audit: false,
@@ -106,7 +103,7 @@ export class SafeArborist extends Arborist {
       ...(args.length ? args[0] : undefined),
     } as ArboristReifyOptions
 
-    const ipc = getIpc ? await getIpc() : undefined
+    const ipc = getIpcExtra()
 
     const binName = ipc?.[SOCKET_CLI_SHADOW_BIN]
     if (!binName) {

packages/cli/src/shadow/npm/inject.mts

@@ -1,3 +1,7 @@
+import { initializeIpc } from '../../utils/ipc.mjs'
 import { installSafeArborist } from './arborist/index.mts'
 
+// Initialize IPC data handling.
+initializeIpc()
+
 installSafeArborist()

packages/cli/src/utils/ipc.mts

@@ -0,0 +1,37 @@
+/**
+ * IPC data handling for shadow npm processes.
+ *
+ * Provides access to IPC data passed via bootstrap handshake.
+ * The handshake includes shadow configuration like API tokens,
+ * bin names, and other settings needed by the arborist.
+ */
+
+import { waitForBootstrapHandshake } from './sea/boot.mjs'
+
+import type { IpcObject } from '../constants/shadow.mts'
+
+// Store for IPC extra data received via handshake.
+let ipcExtra: IpcObject | undefined
+
+/**
+ * Get IPC extra data from handshake.
+ * Returns the extra field from the bootstrap handshake.
+ */
+export function getIpcExtra(): IpcObject | undefined {
+  return ipcExtra
+}
+
+/**
+ * Initialize IPC data handling.
+ * Waits for the bootstrap handshake and extracts the extra field.
+ */
+export async function initializeIpc(): Promise<void> {
+  try {
+    const handshake = await waitForBootstrapHandshake(1000)
+    if (handshake?.['extra']) {
+      ipcExtra = handshake['extra'] as IpcObject
+    }
+  } catch {
+    // No handshake - running without IPC.
+  }
+}