@socketsecurity/cli-with-sentry 1.8.4 → 1.9.1

package/dist/shadow-pnpm-bin2.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { readPackageJson } from '@socketsecurity/registry/lib/packages'\n\nimport constants, { FLAG_DRY_RUN, PACKAGE_JSON } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { isAddCommand } from '../utils/cmd.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\nfunction extractPackagePurlsFromCommandArgs(\n  rawArgs: string[] | readonly string[],\n): string[] {\n  const packagePurls: string[] = []\n\n  const packageArgs = rawArgs\n    .slice(1)\n    .filter(a => !a.startsWith('-') && a !== '--')\n\n  for (const pkgSpec of packageArgs) {\n    const purl = safeNpmSpecToPurl(pkgSpec)\n    if (purl) {\n      packagePurls.push(purl)\n    }\n  }\n\n  return packagePurls\n}\n\nexport type DlxFlags = {\n  // Options whose value names a package to download.\n  package: ReadonlySet<string>\n  // Other options that take the next argument as their value.\n  withValue: ReadonlySet<string>\n}\n\n/**\n * Package option values, or else the first positional, name packages. Later\n * positionals are arguments for the launched binary.\n */\nfunction extractPackagePurlsFromDlxArgs(\n  rawArgs: string[] | readonly string[],\n  dlxFlags: DlxFlags,\n): string[] {\n  const pkgSpecs: string[] = []\n  const args = rawArgs.slice(1)\n  for (let i = 0, { length } = args; i < length; i += 1) {\n    const arg = args[i]!\n    if (arg === '--') {\n      break\n    }\n    if (arg.startsWith('-')) {\n      const eqIndex = arg.indexOf('=')\n      const name = eqIndex === -1 ? arg : arg.slice(0, eqIndex)\n      const isPackageFlag = dlxFlags.package.has(name)\n      if (eqIndex !== -1) {\n        if (isPackageFlag) {\n          pkgSpecs.push(arg.slice(eqIndex + 1))\n        }\n        continue\n      }\n      const value = args[i + 1]\n      if (\n        (isPackageFlag || dlxFlags.withValue.has(name)) &&\n        value !== undefined &&\n        !value.startsWith('-')\n      ) {\n        if (isPackageFlag) {\n          pkgSpecs.push(value)\n        }\n        i += 1\n      }\n      continue\n    }\n    if (!pkgSpecs.length) {\n      pkgSpecs.push(arg)\n    }\n    break\n  }\n\n  const packagePurls: string[] = []\n  for (const pkgSpec of pkgSpecs) {\n    const purl = safeNpmSpecToPurl(pkgSpec)\n    if (purl) {\n      packagePurls.push(purl)\n    }\n  }\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n * Used by: pnpm, yarn.\n */\nasync function extractPackagePurlsFromPackageJson(\n  cwd = process.cwd(),\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const pkgJson = await readPackageJson(cwd)\n\n    const allDeps = {\n      ...pkgJson.dependencies,\n      ...pkgJson.devDependencies,\n      ...pkgJson.optionalDependencies,\n      ...pkgJson.peerDependencies,\n    }\n\n    for (const { 0: name, 1: version } of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      `${PACKAGE_JSON} not found or invalid during dependency scanning`,\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  apiToken?: string | undefined\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  dlxFlags?: DlxFlags | undefined\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    apiToken,\n    command,\n    dlxCommands,\n    dlxFlags = { package: new Set(), withValue: new Set() },\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (isDlxCommand) {\n    packagePurls = extractPackagePurlsFromDlxArgs(rawArgs, dlxFlags)\n  } else if (isAddCommand(command)) {\n    packagePurls = extractPackagePurlsFromCommandArgs(rawArgs)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      apiToken,\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport {\n  cmdFlagsToString,\n  isAddCommand,\n  isPnpmLockfileScanCommand,\n} from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { installPnpmLinks } from '../../utils/shadow-links.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type { DlxFlags } from '../common.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\n// pnpm 10's dlx and global options that take a value. pnpm stops parsing\n// options at the first positional after `dlx`.\nconst DLX_FLAGS: DlxFlags = {\n  package: new Set(['--package']),\n  withValue: new Set([\n    '--allow-build',\n    '--changed-files-ignore-pattern',\n    '--cpu',\n    '--dir',\n    '--filter',\n    '--filter-prod',\n    '--libc',\n    '--loglevel',\n    '--os',\n    '--prefix',\n    '--reporter',\n    '--test-pattern',\n    '--use-node-version',\n    '--workspace-packages',\n    '-C',\n    '-F',\n  ]),\n}\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n\n  const { spinner } = opts\n  const wasSpinning = !!spinner?.isSpinning\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  spinner?.start()\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks =\n      !!ipc?.[constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS] ||\n      !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const apiToken = ipc?.[constants.SOCKET_CLI_SHADOW_API_TOKEN]\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (isDlxCommand || isAddCommand(command)) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        apiToken,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        dlxFlags: DLX_FLAGS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: PNPM,\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (isPnpmLockfileScanCommand(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                apiToken,\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket ${PNPM} exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', `${PNPM} lockfile scanning failed`)\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          `skip: no ${PNPM_LOCK_YAML} found, skipping bulk install scanning`,\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installPnpmLinks(constants.shadowBinPath)\n\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      cwd,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, pnpm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","length","pkgSpecs","i","debugScan","debugFn","debugDir","dlxFlags","package","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","withValue","__proto__","env","dlxCommands","installCommands","managerName","rawArgs","process","spawnPromise"],"mappings":";;;;;;;;;;;;;AAgBA;;;AASE;AACE;AACA;AACEA;AACF;AACF;AAEA;AACF;AASA;AACA;AACA;AACA;AACA;;AAKE;AACA;AAAkBC;;AAChB;;AAEE;AACF;AACA;AACE;AACA;;AAEA;AACE;;AAEA;AACA;AACF;AACA;;AAME;AACEC;AACF;AACAC;AACF;AACA;AACF;AACA;AACED;AACF;AACA;AACF;;AAGA;AACE;AACA;AACEF;AACF;AACF;AACA;AACF;;AAEA;AACA;AACA;AACA;AACA;;;AAMI;AAEA;;;;AAIE;;AAGF;AAAa;AAAS;AAAW;AAC/B;AAGA;AACEA;AACF;AACF;AAEAI;;AAEAC;AAIAC;AACF;AAEA;AACF;AAsBA;AACA;AACA;AACO;;;;;;AAQHC;AAAaC;;;;;AAGbC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;AACEZ;AACF;AACEA;;AAEA;AACA;AACAA;AACF;AAEA;;AACWY;;AACX;AAEAR;;AACsBJ;AAAa;;AAGjC;;;;AAG4Ba;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAR;AACA;AACF;AAEAA;;AACsBc;AAAuB;;AAEpCN;;AACX;;ACrNA;;AAEA;AACA;AACA;AACEJ;AACAW;AAkBF;AAEA;AAUe;AAKb;AAAeC;;;;AACPC;;;AAAiC;;AAEnCV;AAAoB;;AAExBA;AACF;AAEA;AACA;;AAEQI;AAAQ;AAChB;;AAEA;AACA;;;AAGA;;;AAKE;AAGA;;;AAGA;AACA;AACE;;;;;AAKEO;AACAf;AACAgB;AACAC;AACAC;;AAEAf;AACF;;AAGE;AACAgB;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACArB;AAKA;;AAEEI;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;AAEA;AAUAC;AACA;AACAS;AACA;AACA;AACF;;AAEA;AACArB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;AAIA;;AAGAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;;AAEAgB;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAM;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"d93e81dd-bb41-4577-831d-44c9d5852804"}
+{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { readPackageJson } from '@socketsecurity/registry/lib/packages'\n\nimport constants, { FLAG_DRY_RUN, PACKAGE_JSON } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { isAddCommand } from '../utils/cmd.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\nfunction extractPackagePurlsFromCommandArgs(\n  rawArgs: string[] | readonly string[],\n): string[] {\n  const packagePurls: string[] = []\n\n  const packageArgs = rawArgs\n    .slice(1)\n    .filter(a => !a.startsWith('-') && a !== '--')\n\n  for (const pkgSpec of packageArgs) {\n    const purl = safeNpmSpecToPurl(pkgSpec)\n    if (purl) {\n      packagePurls.push(purl)\n    }\n  }\n\n  return packagePurls\n}\n\nexport type DlxFlags = {\n  // Options whose value names a package to download.\n  package: ReadonlySet<string>\n  // Other options that take the next argument as their value.\n  withValue: ReadonlySet<string>\n}\n\n/**\n * Package option values, or else the first positional, name packages. Later\n * positionals are arguments for the launched binary.\n */\nfunction extractPackagePurlsFromDlxArgs(\n  rawArgs: string[] | readonly string[],\n  dlxFlags: DlxFlags,\n): string[] {\n  const pkgSpecs: string[] = []\n  const args = rawArgs.slice(1)\n  for (let i = 0, { length } = args; i < length; i += 1) {\n    const arg = args[i]!\n    if (arg === '--') {\n      break\n    }\n    if (arg.startsWith('-')) {\n      const eqIndex = arg.indexOf('=')\n      const name = eqIndex === -1 ? arg : arg.slice(0, eqIndex)\n      const isPackageFlag = dlxFlags.package.has(name)\n      if (eqIndex !== -1) {\n        if (isPackageFlag) {\n          pkgSpecs.push(arg.slice(eqIndex + 1))\n        }\n        continue\n      }\n      const value = args[i + 1]\n      if (\n        (isPackageFlag || dlxFlags.withValue.has(name)) &&\n        value !== undefined &&\n        !value.startsWith('-')\n      ) {\n        if (isPackageFlag) {\n          pkgSpecs.push(value)\n        }\n        i += 1\n      }\n      continue\n    }\n    if (!pkgSpecs.length) {\n      pkgSpecs.push(arg)\n    }\n    break\n  }\n\n  const packagePurls: string[] = []\n  for (const pkgSpec of pkgSpecs) {\n    const purl = safeNpmSpecToPurl(pkgSpec)\n    if (purl) {\n      packagePurls.push(purl)\n    }\n  }\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n * Used by: pnpm, yarn.\n */\nasync function extractPackagePurlsFromPackageJson(\n  cwd = process.cwd(),\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const pkgJson = await readPackageJson(cwd)\n\n    const allDeps = {\n      ...pkgJson.dependencies,\n      ...pkgJson.devDependencies,\n      ...pkgJson.optionalDependencies,\n      ...pkgJson.peerDependencies,\n    }\n\n    for (const { 0: name, 1: version } of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      `${PACKAGE_JSON} not found or invalid during dependency scanning`,\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  apiToken?: string | undefined\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  dlxFlags?: DlxFlags | undefined\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    apiToken,\n    command,\n    dlxCommands,\n    dlxFlags = { package: new Set(), withValue: new Set() },\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (isDlxCommand) {\n    packagePurls = extractPackagePurlsFromDlxArgs(rawArgs, dlxFlags)\n  } else if (isAddCommand(command)) {\n    packagePurls = extractPackagePurlsFromCommandArgs(rawArgs)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      apiToken,\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport {\n  cmdFlagsToString,\n  isAddCommand,\n  isPnpmLockfileScanCommand,\n} from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { installPnpmLinks } from '../../utils/shadow-links.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type { DlxFlags } from '../common.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\n// pnpm 10's dlx and global options that take a value. pnpm stops parsing\n// options at the first positional after `dlx`.\nconst DLX_FLAGS: DlxFlags = {\n  package: new Set(['--package']),\n  withValue: new Set([\n    '--allow-build',\n    '--changed-files-ignore-pattern',\n    '--cpu',\n    '--dir',\n    '--filter',\n    '--filter-prod',\n    '--libc',\n    '--loglevel',\n    '--os',\n    '--prefix',\n    '--reporter',\n    '--test-pattern',\n    '--use-node-version',\n    '--workspace-packages',\n    '-C',\n    '-F',\n  ]),\n}\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n\n  const { spinner } = opts\n  const wasSpinning = !!spinner?.isSpinning\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  spinner?.start()\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks =\n      !!ipc?.[constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS] ||\n      !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const apiToken = ipc?.[constants.SOCKET_CLI_SHADOW_API_TOKEN]\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (isDlxCommand || isAddCommand(command)) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        apiToken,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        dlxFlags: DLX_FLAGS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: PNPM,\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (isPnpmLockfileScanCommand(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                apiToken,\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket ${PNPM} exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', `${PNPM} lockfile scanning failed`)\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          `skip: no ${PNPM_LOCK_YAML} found, skipping bulk install scanning`,\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installPnpmLinks(constants.shadowBinPath)\n\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      cwd,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, pnpm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","length","pkgSpecs","i","debugScan","debugFn","debugDir","dlxFlags","package","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","withValue","__proto__","env","dlxCommands","installCommands","managerName","rawArgs","process","spawnPromise"],"mappings":";;;;;;;;;;;;;AAgBA;;;AASE;AACE;AACA;AACEA;AACF;AACF;AAEA;AACF;AASA;AACA;AACA;AACA;AACA;;AAKE;AACA;AAAkBC;;AAChB;;AAEE;AACF;AACA;AACE;AACA;;AAEA;AACE;;AAEA;AACA;AACF;AACA;;AAME;AACEC;AACF;AACAC;AACF;AACA;AACF;AACA;AACED;AACF;AACA;AACF;;AAGA;AACE;AACA;AACEF;AACF;AACF;AACA;AACF;;AAEA;AACA;AACA;AACA;AACA;;;AAMI;AAEA;;;;AAIE;;AAGF;AAAa;AAAS;AAAW;AAC/B;AAGA;AACEA;AACF;AACF;AAEAI;;AAEAC;AAIAC;AACF;AAEA;AACF;AAsBA;AACA;AACA;AACO;;;;;;AAQHC;AAAaC;;;;;AAGbC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;AACEZ;AACF;AACEA;;AAEA;AACA;AACAA;AACF;AAEA;;AACWY;;AACX;AAEAR;;AACsBJ;AAAa;;AAGjC;;;;AAG4Ba;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAR;AACA;AACF;AAEAA;;AACsBc;AAAuB;;AAEpCN;;AACX;;ACrNA;;AAEA;AACA;AACA;AACEJ;AACAW;AAkBF;AAEA;AAUe;AAKb;AAAeC;;;;AACPC;;;AAAiC;;AAEnCV;AAAoB;;AAExBA;AACF;AAEA;AACA;;AAEQI;AAAQ;AAChB;;AAEA;AACA;;;AAGA;;;AAKE;AAGA;;;AAGA;AACA;AACE;;;;;AAKEO;AACAf;AACAgB;AACAC;AACAC;;AAEAf;AACF;;AAGE;AACAgB;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACArB;AAKA;;AAEEI;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;AAEA;AAUAC;AACA;AACAS;AACA;AACA;AACF;;AAEA;AACArB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;AAIA;;AAGAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;;AAEAgB;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAM;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"1ed6f0e5-aa1d-4c99-b3d4-5329879f4ddb"}