feat(bootstrap): add system node detection and forwarding control

Add which-based system Node.js detection with SOCKET_DISABLE_NODE_FORWARDING env var for e2e testing control.

- Add which dependency to catalog and bootstrap package
- Add detectSystemNode() using which to find system node
- Add shouldForwardToSystemNode() to check version requirements
- Add SOCKET_DISABLE_NODE_FORWARDING env var (1/true/yes to disable)
- Export helper functions for use in bootstrap entry points

Author: jdalton

packages/bootstrap/dist/bootstrap-npm.js

@@ -17,6 +17,7 @@
     "@socketsecurity/lib": "catalog:",
     "del-cli": "catalog:",
     "esbuild": "catalog:",
-    "semver": "catalog:"
+    "semver": "catalog:",
+    "which": "catalog:"
   }
 }

packages/bootstrap/dist/bootstrap-smol.js

@@ -11,9 +11,18 @@ import { dlxPackage } from '@socketsecurity/lib/dlx-package'
 import { logger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 import { gte } from 'semver'
+import which from 'which'
 
 export const SOCKET_DLX_DIR = path.join(homedir(), '.socket', '_dlx')
 
+/**
+ * Environment variable to disable node forwarding and use stub instead.
+ * Set to '1', 'true', or 'yes' to disable forwarding (useful for e2e testing).
+ */
+const SOCKET_DISABLE_NODE_FORWARDING = ['1', 'true', 'yes'].includes(
+  process.env.SOCKET_DISABLE_NODE_FORWARDING?.toLowerCase()
+)
+
 /**
  * Minimum Node.js version with SEA support.
  * This constant is injected at build time by esbuild from .config/node-version.mjs.
@@ -52,6 +61,42 @@ export function hasModernNode() {
   }
 }
 
+/**
+ * Detect if Node.js is available on the system.
+ */
+export async function detectSystemNode() {
+  try {
+    const nodePath = await which('node', { nothrow: true })
+    return nodePath || null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Check if we should forward to system Node.js.
+ * Returns false if SOCKET_DISABLE_NODE_FORWARDING is set (for e2e testing).
+ */
+export async function shouldForwardToSystemNode() {
+  if (SOCKET_DISABLE_NODE_FORWARDING) {
+    return false
+  }
+  const nodePath = await detectSystemNode()
+  if (!nodePath) {
+    return false
+  }
+  // Check if system node meets minimum version requirements.
+  try {
+    const result = await spawn(nodePath, ['--version'], {
+      stdio: 'pipe',
+    })
+    const version = result.stdout.trim()
+    return gte(version, MIN_NODE_VERSION)
+  } catch {
+    return false
+  }
+}
+
 /**
  * Execute the CLI with the given arguments.
  */

packages/bootstrap/package.json

@@ -11,3 +11,4 @@ catalog:
   esbuild: 0.24.0
   postject: 1.0.0-alpha.6
   semver: 7.6.3
+  which: 5.0.0