@socketsecurity/cli-with-sentry 1.1.126 → 1.1.128

package/dist/types/utils/glob.d.mts

@@ -2,7 +2,7 @@ import type { Agent } from './package-environment.mts';
 import type { SocketYml } from '@socketsecurity/config';
 import type { SocketSdkSuccessResult } from '@socketsecurity/sdk';
 import type { Options as GlobOptions } from 'fast-glob';
-export declare const IGNORED_DIRS: readonly [".git", ".log", ".nyc_output", ".sass-cache", ".yarn", "bower_components", "coverage", "node_modules", "flow-typed"];
+export declare const IGNORED_DIRS: readonly [".git", ".log", ".nyc_output", ".sass-cache", ".yarn", "bower_components", "coverage", "node_modules", "flow-typed", ".venv"];
 // fast-glob silently discards `ignore` entries that end in `/` (it
 // treats them as literal directory paths, not glob patterns). The
 // gitignore convention of writing directory entries as `dist/` lands

package/dist/types/utils/glob.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.mts","sourceRoot":"","sources":["../../../src/utils/glob.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAMvD,eAAO,MAAM,YAAY,gIAcf,CAAA;AAmGV,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,uEAAqE;AACrE,4CAA4C;AAC5C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAuBD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACvC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CAKV;AAED,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAI/B;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CASV;AAED,KAAK,wBAAwB,GAAG,WAAW,GAAG;IAC5C,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IACjD,sDAAsD;IACtD,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;IACpD,YAAY,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACrC,CAAA;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAgInB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,SAAgB,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAUnB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,WAI1E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,EAAE,CAgBV"}
+{"version":3,"file":"glob.d.mts","sourceRoot":"","sources":["../../../src/utils/glob.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAMvD,eAAO,MAAM,YAAY,yIAiBf,CAAA;AAwGV,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,uEAAqE;AACrE,4CAA4C;AAC5C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAuBD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACvC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CAKV;AAED,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAI/B;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CASV;AAED,KAAK,wBAAwB,GAAG,WAAW,GAAG;IAC5C,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IACjD,sDAAsD;IACtD,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;IACpD,YAAY,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACrC,CAAA;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CA+InB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,SAAgB,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAUnB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,WAI1E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,EAAE,CAgBV"}

package/dist/utils.js

@@ -4385,8 +4385,16 @@ constants.NODE_MODULES,
 // Where Node modules are installed, see <https://nodejs.org/>
 // Taken from globby:
 // https://github.com/sindresorhus/globby/blob/v14.0.2/ignore.js#L11-L16
-'flow-typed'];
+'flow-typed',
+// Conventional Python virtual environment dir. Arbitrarily-named venvs are
+// detected via their pyvenv.cfg marker during the discovery walk below.
+'.venv'];
 const IGNORED_DIR_PATTERNS = IGNORED_DIRS.map(i => `**/${i}`);
+
+// Marker file at the root of every Python virtual environment (stdlib `venv`
+// per PEP 405, and virtualenv >= 20). Lets us detect venvs that don't use a
+// conventional directory name.
+const PYVENV_CFG = 'pyvenv.cfg';
 async function getWorkspaceGlobs(agent, cwd = process.cwd()) {
   let workspacePatterns;
   if (agent === constants.PNPM) {
@@ -4520,25 +4528,36 @@ async function globWithGitIgnore(patterns, options) {
     ignores.add(pattern);
   }
 
-  // The .gitignore discovery walk has to honor the same directory exclusions
-  // as the package walk below. Otherwise an unreadable subtree (e.g. a
-  // postgres `pgdata` dir owned by another uid, or a Docker volume mount) makes
-  // fast-glob throw `EACCES: permission denied, scandir` *here* — before
-  // --exclude-paths (`cliMinimatchIgnores`) or projectIgnorePaths are ever
-  // applied to the main walk, which is why excluding the path did not help.
-  // `suppressErrors` is the backstop: a directory the user simply cannot read
-  // cannot contain manifests they could scan anyway, so skip it instead of
-  // aborting the whole `socket fix` / `socket scan` run. Negated patterns are
-  // dropped — for a discovery walk they could only re-include a subtree (never
-  // prevent a crash), and fast-glob treats `!` ignore entries inconsistently.
-  const gitIgnoreStream = vendor.outExports.globStream(['**/.gitignore'], {
+  // The discovery walk (`.gitignore` files plus `pyvenv.cfg` venv markers) has
+  // to honor the same directory exclusions as the package walk below. Otherwise
+  // an unreadable subtree (e.g. a postgres `pgdata` dir owned by another uid, or
+  // a Docker volume mount) makes fast-glob throw `EACCES: permission denied,
+  // scandir` *here* — before --exclude-paths (`cliMinimatchIgnores`) or
+  // projectIgnorePaths are ever applied to the main walk, which is why excluding
+  // the path did not help. `suppressErrors` is the backstop: a directory the
+  // user simply cannot read cannot contain manifests they could scan anyway, so
+  // skip it instead of aborting the whole `socket fix` / `socket scan` run.
+  // Negated patterns are dropped — for a discovery walk they could only
+  // re-include a subtree (never prevent a crash), and fast-glob treats `!`
+  // ignore entries inconsistently. Folding pyvenv.cfg discovery into this same
+  // walk avoids a second full-tree traversal.
+  const discoveryStream = vendor.outExports.globStream(['**/.gitignore', `**/${PYVENV_CFG}`], {
     absolute: true,
     cwd,
     dot: true,
     ignore: [...DEFAULT_IGNORE_FOR_GIT_IGNORE, ...projectIgnoreGlobs, ...cliMinimatchIgnores].filter(p => p.charCodeAt(0) !== 33 /*'!'*/).map(stripTrailingSlash),
     suppressErrors: true
   });
-  for await (const ignorePatterns of streams.transform(gitIgnoreStream, async filepath => ignoreFileToGlobPatterns((await fs$1.safeReadFile(filepath)) ?? '', filepath, cwd), {
+  for await (const ignorePatterns of streams.transform(discoveryStream, async filepath => {
+    if (path.basename(filepath) === PYVENV_CFG) {
+      // A pyvenv.cfg sits at the venv root, so exclude the whole directory.
+      const relDir = path.relative(cwd, path.dirname(filepath)).replace(/\\/g, '/');
+      // An empty relDir means the scan target itself is a venv root; don't
+      // emit `/**`, which would exclude everything the user explicitly targeted.
+      return relDir ? [`${relDir}/**`] : [];
+    }
+    return ignoreFileToGlobPatterns((await fs$1.safeReadFile(filepath)) ?? '', filepath, cwd);
+  }, {
     concurrency: 8
   })) {
     for (const p of ignorePatterns) {
@@ -8478,5 +8497,5 @@ exports.updateConfigValue = updateConfigValue;
 exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=ca641f10-e836-48a4-ba4b-d7184d048e3f
+//# debugId=6a2346d1-e6a5-427e-9fec-7790860159e2
 //# sourceMappingURL=utils.js.map