fix: handle pnpm frozen-lockfile in CI for optimize command

In CI environments, pnpm automatically runs with --frozen-lockfile which prevents
lockfile updates. When the optimize command tries to add overrides and update
the lockfile, it fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.

Added explicit --no-frozen-lockfile flag when running pnpm install in CI mode
to allow the lockfile to be updated with Socket.dev overrides.

Author: jdalton

src/utils/agent.mts

@@ -38,7 +38,13 @@ export function runAgentInstall(
     ...spawnOpts
   } = { __proto__: null, ...options } as AgentInstallOptions
   const skipNodeHardenFlags = isPnpm && pkgEnvDetails.agentVersion.major < 11
-  return spawn(agentExecPath, ['install', ...args], {
+  // In CI mode, pnpm uses --frozen-lockfile by default, which prevents lockfile updates.
+  // We need to explicitly disable it when updating the lockfile with overrides.
+  const installArgs = isPnpm && constants.ENV.CI
+    ? ['install', '--no-frozen-lockfile', ...args]
+    : ['install', ...args]
+
+  return spawn(agentExecPath, installArgs, {
     cwd: pkgPath,
     shell: constants.WIN32,
     spinner,

src/utils/package-environment.mts

@@ -213,7 +213,14 @@ async function getAgentExecPath(agent: Agent): Promise<string> {
     if (existsSync(npmPath)) {
       return npmPath
     }
-    // If npmExecPath doesn't exist, fall back to whichBin.
+    // If npmExecPath doesn't exist, try common locations.
+    // Check npm in the same directory as node.
+    const nodeDir = path.dirname(process.execPath)
+    const npmInNodeDir = path.join(nodeDir, 'npm')
+    if (existsSync(npmInNodeDir)) {
+      return npmInNodeDir
+    }
+    // Fall back to whichBin.
     return (await whichBin(binName, { nothrow: true })) ?? binName
   }
   return (await whichBin(binName, { nothrow: true })) ?? binName