@socketsecurity/cli-with-sentry 1.1.99 → 1.1.101

package/dist/types/utils/dlx.d.mts

@@ -26,6 +26,12 @@ export type CoanaDlxOptions = DlxOptions & {
  *
  * If SOCKET_CLI_COANA_LOCAL_PATH environment variable is set, uses the local
  * Coana CLI at that path instead of downloading from npm.
+ *
+ * If the dlx path fails (e.g. broken `npx` on the host), falls back to
+ * `npm install`-ing @coana-tech/cli into a temp directory and invoking it
+ * directly via `node`. The fallback can be disabled with
+ * SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK or forced as the primary path with
+ * SOCKET_CLI_COANA_FORCE_NPM_INSTALL.
  */
 export declare function spawnCoanaDlx(args: string[] | readonly string[], orgSlug?: string, options?: CoanaDlxOptions | undefined, spawnExtra?: SpawnExtra | undefined): Promise<CResult<string>>;
 /**

package/dist/types/utils/dlx.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"dlx.d.mts","sourceRoot":"","sources":["../../../src/utils/dlx.mts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAMpE,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC3C,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAQD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,WAAW,EAAE,cAAc,EAC3B,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAwG1B;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,EACrC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAuH1B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAU1B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAU1B"}
+{"version":3,"file":"dlx.d.mts","sourceRoot":"","sources":["../../../src/utils/dlx.mts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAMpE,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC3C,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAQD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,WAAW,EAAE,cAAc,EAC3B,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAwG1B;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAkJD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,EACrC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAuI1B;AAsED;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAU1B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CAU1B"}

package/dist/utils.js

@@ -22,6 +22,7 @@ var promises$1 = require('node:stream/promises');
 var node_zlib = require('node:zlib');
 var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
 var require$$5 = require('node:module');
+var os = require('node:os');
 var require$$3 = require('node:https');
 var web = require('node:stream/web');
 var require$$13 = require('../external/@socketsecurity/registry/lib/url');
@@ -34,7 +35,6 @@ var streams = require('../external/@socketsecurity/registry/lib/streams');
 var promises = require('node:timers/promises');
 var require$$1 = require('node:util');
 var node_tls = require('node:tls');
-var os = require('node:os');
 var process$1 = require('node:process');
 var require$$0 = require('node:crypto');
 
@@ -5246,6 +5246,102 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
     return await shadowNpxBin(spawnArgs, finalShadowOptions, spawnExtra);
   }
 }
+/**
+ * Cache of resolved Coana CLI script paths from the npm-install fallback,
+ * keyed by version string. Lives for the lifetime of the Socket CLI process so
+ * repeated invocations (e.g. socket fix --pr looping per GHSA) only install
+ * once.
+ */
+const installedCoanaScriptPathsByVersion = new Map();
+
+/**
+ * Spawn an installed Coana entry point via `node` (or directly, if it's a
+ * native binary). Shared by the SOCKET_CLI_COANA_LOCAL_PATH branch and the
+ * npm-install fallback.
+ */
+async function spawnCoanaScriptViaNode(scriptPath, args, finalEnv, options, spawnExtra) {
+  const isBinary = !scriptPath.endsWith('.js') && !scriptPath.endsWith('.mjs');
+  const spawnArgs = isBinary ? args : [scriptPath, ...args];
+  const spawnResult = await spawn.spawn(isBinary ? scriptPath : 'node', spawnArgs, {
+    cwd: options.cwd,
+    env: finalEnv,
+    stdio: spawnExtra?.['stdio'] || 'inherit'
+  });
+  return {
+    ok: true,
+    data: spawnResult.stdout
+  };
+}
+
+/**
+ * Resolve the executable JS file inside an installed @coana-tech/cli package
+ * by reading its package.json `bin` field. Returns an absolute path suitable
+ * for passing to `node`.
+ */
+async function resolveCoanaBinFromInstallDir(installDir) {
+  const packageJsonPath = path.join(installDir, 'node_modules', '@coana-tech', 'cli', 'package.json');
+  const pkg = JSON.parse(await fs.promises.readFile(packageJsonPath, 'utf8'));
+  const {
+    bin
+  } = pkg;
+  let relativeBin;
+  if (typeof bin === 'string') {
+    relativeBin = bin;
+  } else if (bin && typeof bin === 'object') {
+    // Prefer an entry named "coana" if present; otherwise take the first.
+    relativeBin = bin['coana'] ?? Object.values(bin)[0];
+  }
+  if (!relativeBin) {
+    throw new Error(`@coana-tech/cli package.json at ${packageJsonPath} is missing a usable bin entry`);
+  }
+  return path.resolve(path.dirname(packageJsonPath), relativeBin);
+}
+
+/**
+ * Install @coana-tech/cli into a fresh temp directory via `npm install` and
+ * return its executable JS path. Caches the result per version for the
+ * lifetime of the process.
+ */
+async function installCoanaToTmpdir(version, finalEnv) {
+  const cached = installedCoanaScriptPathsByVersion.get(version);
+  if (cached) {
+    return cached;
+  }
+  const installDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'socket-coana-'));
+  await spawn.spawn('npm', ['install', '--no-save', '--no-package-lock', '--no-audit', '--no-fund', '--prefix', installDir, `@coana-tech/cli@${version}`], {
+    env: finalEnv,
+    stdio: 'inherit'
+  });
+  const scriptPath = await resolveCoanaBinFromInstallDir(installDir);
+  installedCoanaScriptPathsByVersion.set(version, scriptPath);
+  return scriptPath;
+}
+
+/**
+ * Fallback path used when the dlx (npx / pnpm dlx / yarn dlx) invocation
+ * fails. Installs @coana-tech/cli into a temp directory via `npm install`
+ * and spawns it directly via `node`.
+ */
+async function spawnCoanaViaNpmInstall(args, version, finalEnv, options, spawnExtra) {
+  let scriptPath;
+  try {
+    scriptPath = await installCoanaToTmpdir(version, finalEnv);
+  } catch (e) {
+    const stderr = e?.stderr;
+    const cause = getErrorCause(e);
+    return {
+      ok: false,
+      data: e,
+      message: `npm install fallback failed: ${stderr || cause}`
+    };
+  }
+  try {
+    return await spawnCoanaScriptViaNode(scriptPath, args, finalEnv, options, spawnExtra);
+  } catch (e) {
+    return buildDlxErrorResult(e);
+  }
+}
+
 /**
  * Helper to spawn coana with dlx.
  * Automatically uses force and silent when version is not pinned exactly.
@@ -5253,6 +5349,12 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
  *
  * If SOCKET_CLI_COANA_LOCAL_PATH environment variable is set, uses the local
  * Coana CLI at that path instead of downloading from npm.
+ *
+ * If the dlx path fails (e.g. broken `npx` on the host), falls back to
+ * `npm install`-ing @coana-tech/cli into a temp directory and invoking it
+ * directly via `node`. The fallback can be disabled with
+ * SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK or forced as the primary path with
+ * SOCKET_CLI_COANA_FORCE_NPM_INSTALL.
  */
 async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
   const {
@@ -5287,43 +5389,42 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
   if (proxyUrl) {
     mixinsEnv['SOCKET_CLI_API_PROXY'] = proxyUrl;
   }
-  try {
-    const localCoanaPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
-    // Use local Coana CLI if path is provided.
-    if (localCoanaPath) {
-      const isBinary = !localCoanaPath.endsWith('.js') && !localCoanaPath.endsWith('.mjs');
-      const finalEnv = {
-        ...process.env,
-        ...constants.default.processEnv,
-        ...mixinsEnv,
-        ...spawnEnv
-      };
-      const spawnArgs = isBinary ? args : [localCoanaPath, ...args];
-      const spawnResult = await spawn.spawn(isBinary ? localCoanaPath : 'node', spawnArgs, {
-        cwd: dlxOptions.cwd,
-        env: finalEnv,
-        stdio: spawnExtra?.['stdio'] || 'inherit'
-      });
-      return {
-        ok: true,
-        data: spawnResult.stdout
-      };
+  const finalEnv = {
+    ...process.env,
+    ...constants.default.processEnv,
+    ...mixinsEnv,
+    ...spawnEnv
+  };
+  const resolvedVersion = coanaVersion || constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION;
+  const localCoanaPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
+  // Use local Coana CLI if path is provided.
+  if (localCoanaPath) {
+    try {
+      return await spawnCoanaScriptViaNode(localCoanaPath, args, finalEnv, {
+        cwd: dlxOptions.cwd
+      }, spawnExtra);
+    } catch (e) {
+      return buildDlxErrorResult(e);
     }
+  }
 
+  // Allow forcing the npm-install path for debugging or for environments
+  // where dlx is known-broken.
+  if (process.env['SOCKET_CLI_COANA_FORCE_NPM_INSTALL']) {
+    return await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
+      cwd: dlxOptions.cwd
+    }, spawnExtra);
+  }
+  try {
     // Use npm/dlx version.
     const result = await spawnDlx({
       name: '@coana-tech/cli',
-      version: coanaVersion || constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION
+      version: resolvedVersion
     }, args, {
       force: true,
       silent: true,
       ...dlxOptions,
-      env: {
-        ...process.env,
-        ...constants.default.processEnv,
-        ...mixinsEnv,
-        ...spawnEnv
-      },
+      env: finalEnv,
       ipc: {
         [constants.default.SOCKET_CLI_SHADOW_ACCEPT_RISKS]: true,
         [constants.default.SOCKET_CLI_SHADOW_API_TOKEN]: constants.default.SOCKET_PUBLIC_API_TOKEN,
@@ -5337,28 +5438,99 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
       data: output.stdout
     };
   } catch (e) {
-    const stderr = e?.stderr;
-    const exitCode = e?.code;
-    const signal = e?.signal;
-    const cause = getErrorCause(e);
-    // Build a descriptive error message with exit code and signal details.
-    const details = [];
-    if (typeof exitCode === 'number') {
-      details.push(`exit code ${exitCode}`);
+    const dlxError = buildDlxErrorResult(e);
+    if (process.env['SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK']) {
+      return dlxError;
     }
-    if (signal) {
-      details.push(`signal ${signal}`);
+
+    // Only retry via `npm install` when the failure looks like the launcher
+    // never got Coana running. A real Coana process that booted and exited
+    // with an error would just hit the same failure on retry.
+    if (!shouldFallbackOnDlxError(e)) {
+      return dlxError;
+    }
+    logger.logger.warn('Coana dlx invocation failed before Coana started; falling back to `npm install` + `node`.');
+    const fallbackResult = await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
+      cwd: dlxOptions.cwd
+    }, spawnExtra);
+    if (fallbackResult.ok) {
+      return fallbackResult;
     }
-    const detailSuffix = details.length ? ` (${details.join(', ')})` : '';
-    const message = stderr ? `Coana command failed${detailSuffix}: ${stderr}` : `Coana command failed${detailSuffix}: ${cause}`;
+    // Surface both errors so support has full context.
     return {
       ok: false,
       data: e,
-      message
+      message: `${dlxError.message}. npm-install fallback also failed: ${fallbackResult.message}`
     };
   }
 }
 
+/**
+ * Decide whether a thrown dlx error should trigger the npm-install fallback.
+ *
+ * The goal is to retry only when the dlx launcher (npx / pnpm dlx / yarn dlx)
+ * failed before Coana itself ran. If Coana actually booted, any subsequent
+ * non-zero exit is a real Coana failure and retrying would hit the same one.
+ *
+ * Signals we use, in priority order:
+ * 1. Captured stderr containing Coana's startup banner — definitive proof
+ *    Coana ran, so do NOT retry. Only available when the caller passed
+ *    `stdio: 'pipe'` (or the spawn defaulted to it).
+ * 2. Spawn-level errors (`e.code` is a string like 'ENOENT'): the binary
+ *    wasn't found / couldn't start — retry.
+ * 3. Signal kills (`e.signal` set, or numeric `e.code >= 128`): conventionally
+ *    not a clean exit; the customer-observed exit code 249 falls here. Retry.
+ * 4. Small integer exit codes with no banner in captured stderr: ambiguous,
+ *    but Coana's own exit codes are small integers, so default to NOT retrying
+ *    rather than blindly re-running Coana.
+ */
+function shouldFallbackOnDlxError(e) {
+  const capturedStderr = String(e?.stderr ?? '');
+  if (capturedStderr && /Coana CLI version/i.test(capturedStderr)) {
+    return false;
+  }
+  const code = e?.code;
+  // Spawn-level failure (e.g. ENOENT when npx is missing from PATH).
+  if (typeof code === 'string') {
+    return true;
+  }
+  // Killed by signal — almost never a clean Coana exit.
+  if (e?.signal) {
+    return true;
+  }
+  // Exit codes >= 128 are conventionally signal-derived, and the observed
+  // npx-launcher failures in the wild fall into this range (e.g. 249, 254).
+  if (typeof code === 'number' && code >= 128) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Build a CResult error from a thrown spawn error, preserving exit code,
+ * signal, and stderr context.
+ */
+function buildDlxErrorResult(e) {
+  const stderr = e?.stderr;
+  const exitCode = e?.code;
+  const signal = e?.signal;
+  const cause = getErrorCause(e);
+  const details = [];
+  if (typeof exitCode === 'number') {
+    details.push(`exit code ${exitCode}`);
+  }
+  if (signal) {
+    details.push(`signal ${signal}`);
+  }
+  const detailSuffix = details.length ? ` (${details.join(', ')})` : '';
+  const message = stderr ? `Coana command failed${detailSuffix}: ${stderr}` : `Coana command failed${detailSuffix}: ${cause}`;
+  return {
+    ok: false,
+    data: e,
+    message
+  };
+}
+
 /**
  * Helper to spawn cdxgen with dlx.
  */
@@ -8053,5 +8225,5 @@ exports.updateConfigValue = updateConfigValue;
 exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=66ed990f-e796-4032-b20c-833678da51f2
+//# debugId=3d2a7b08-ceff-43f9-8aea-9e31467b851b
 //# sourceMappingURL=utils.js.map