@socketsecurity/cli 0.14.94 → 0.14.96

package/dist/require/shadow-npm-paths.js

@@ -1,3 +1,456 @@
 'use strict'
 
-module.exports = require('../module-sync/shadow-npm-paths.js')
+const require$$0 = require('node:fs')
+const Module = require('node:module')
+const path = require('node:path')
+const process = require('node:process')
+const logger = require('@socketsecurity/registry/lib/logger')
+const path$1 = require('@socketsecurity/registry/lib/path')
+const constants = require('./constants.js')
+const vendor = require('./vendor.js')
+const debug = require('@socketsecurity/registry/lib/debug')
+const npm = require('@socketsecurity/registry/lib/npm')
+const words = require('@socketsecurity/registry/lib/words')
+
+const ignoredDirs = [
+  // Taken from ignore-by-default:
+  // https://github.com/novemberborn/ignore-by-default/blob/v2.1.0/index.js
+  '.git',
+  // Git repository files, see <https://git-scm.com/>
+  '.log',
+  // Log files emitted by tools such as `tsserver`, see <https://github.com/Microsoft/TypeScript/wiki/Standalone-Server-%28tsserver%29>
+  '.nyc_output',
+  // Temporary directory where nyc stores coverage data, see <https://github.com/bcoe/nyc>
+  '.sass-cache',
+  // Cache folder for node-sass, see <https://github.com/sass/node-sass>
+  '.yarn',
+  // Where node modules are installed when using Yarn, see <https://yarnpkg.com/>
+  'bower_components',
+  // Where Bower packages are installed, see <http://bower.io/>
+  'coverage',
+  // Standard output directory for code coverage reports, see <https://github.com/gotwarlost/istanbul>
+  'node_modules',
+  // Where Node modules are installed, see <https://nodejs.org/>
+  // Taken from globby:
+  // https://github.com/sindresorhus/globby/blob/v14.0.2/ignore.js#L11-L16
+  'flow-typed'
+]
+const ignoredDirPatterns = ignoredDirs.map(i => `**/${i}`)
+function directoryPatterns() {
+  return [...ignoredDirPatterns]
+}
+
+const { NODE_MODULES: NODE_MODULES$1, NPM: NPM$1, shadowBinPath } = constants
+async function filterGlobResultToSupportedFiles(entries, supportedFiles) {
+  const patterns = ['golang', NPM$1, 'maven', 'pypi', 'gem', 'nuget'].reduce(
+    (r, n) => {
+      const supported = supportedFiles[n]
+      r.push(
+        ...(supported
+          ? Object.values(supported).map(p => `**/${p.pattern}`)
+          : [])
+      )
+      return r
+    },
+    []
+  )
+  return entries.filter(p => vendor.micromatchExports.some(p, patterns))
+}
+async function globWithGitIgnore(patterns, options) {
+  const {
+    cwd = process.cwd(),
+    socketConfig,
+    ...additionalOptions
+  } = {
+    __proto__: null,
+    ...options
+  }
+  const projectIgnorePaths = socketConfig?.projectIgnorePaths
+  const ignoreFiles = await vendor.distExports.glob(['**/.gitignore'], {
+    absolute: true,
+    cwd,
+    expandDirectories: true
+  })
+  const ignores = [
+    ...directoryPatterns(),
+    ...(Array.isArray(projectIgnorePaths)
+      ? ignoreFileLinesToGlobPatterns(
+          projectIgnorePaths,
+          path.join(cwd, '.gitignore'),
+          cwd
+        )
+      : []),
+    ...(
+      await Promise.all(
+        ignoreFiles.map(async filepath =>
+          ignoreFileToGlobPatterns(
+            await require$$0.promises.readFile(filepath, 'utf8'),
+            filepath,
+            cwd
+          )
+        )
+      )
+    ).flat()
+  ]
+  const hasNegatedPattern = ignores.some(p => p.charCodeAt(0) === 33 /*'!'*/)
+  const globOptions = {
+    absolute: true,
+    cwd,
+    expandDirectories: false,
+    ignore: hasNegatedPattern ? [] : ignores,
+    ...additionalOptions
+  }
+  const result = await vendor.distExports.glob(patterns, globOptions)
+  if (!hasNegatedPattern) {
+    return result
+  }
+  const { absolute } = globOptions
+
+  // Note: the input files must be INSIDE the cwd. If you get strange looking
+  // relative path errors here, most likely your path is outside the given cwd.
+  const filtered = vendor
+    .ignoreExports()
+    .add(ignores)
+    .filter(absolute ? result.map(p => path.relative(cwd, p)) : result)
+  return absolute ? filtered.map(p => path.resolve(cwd, p)) : filtered
+}
+function ignoreFileLinesToGlobPatterns(lines, filepath, cwd) {
+  const base = path.relative(cwd, path.dirname(filepath)).replace(/\\/g, '/')
+  const patterns = []
+  for (let i = 0, { length } = lines; i < length; i += 1) {
+    const pattern = lines[i].trim()
+    if (pattern.length > 0 && pattern.charCodeAt(0) !== 35 /*'#'*/) {
+      patterns.push(
+        ignorePatternToMinimatch(
+          pattern.length && pattern.charCodeAt(0) === 33 /*'!'*/
+            ? `!${path.posix.join(base, pattern.slice(1))}`
+            : path.posix.join(base, pattern)
+        )
+      )
+    }
+  }
+  return patterns
+}
+function ignoreFileToGlobPatterns(content, filepath, cwd) {
+  return ignoreFileLinesToGlobPatterns(content.split(/\r?\n/), filepath, cwd)
+}
+
+// Based on `@eslint/compat` convertIgnorePatternToMinimatch.
+// Apache v2.0 licensed
+// Copyright Nicholas C. Zakas
+// https://github.com/eslint/rewrite/blob/compat-v1.2.1/packages/compat/src/ignore-file.js#L28
+function ignorePatternToMinimatch(pattern) {
+  const isNegated = pattern.startsWith('!')
+  const negatedPrefix = isNegated ? '!' : ''
+  const patternToTest = (isNegated ? pattern.slice(1) : pattern).trimEnd()
+  // Special cases.
+  if (
+    patternToTest === '' ||
+    patternToTest === '**' ||
+    patternToTest === '/**' ||
+    patternToTest === '**'
+  ) {
+    return `${negatedPrefix}${patternToTest}`
+  }
+  const firstIndexOfSlash = patternToTest.indexOf('/')
+  const matchEverywherePrefix =
+    firstIndexOfSlash === -1 || firstIndexOfSlash === patternToTest.length - 1
+      ? '**/'
+      : ''
+  const patternWithoutLeadingSlash =
+    firstIndexOfSlash === 0 ? patternToTest.slice(1) : patternToTest
+  // Escape `{` and `(` because in gitignore patterns they are just
+  // literal characters without any specific syntactic meaning,
+  // while in minimatch patterns they can form brace expansion or extglob syntax.
+  //
+  // For example, gitignore pattern `src/{a,b}.js` ignores file `src/{a,b}.js`.
+  // But, the same minimatch pattern `src/{a,b}.js` ignores files `src/a.js` and `src/b.js`.
+  // Minimatch pattern `src/\{a,b}.js` is equivalent to gitignore pattern `src/{a,b}.js`.
+  const escapedPatternWithoutLeadingSlash =
+    patternWithoutLeadingSlash.replaceAll(
+      /(?=((?:\\.|[^{(])*))\1([{(])/guy,
+      '$1\\$2'
+    )
+  const matchInsideSuffix = patternToTest.endsWith('/**') ? '/*' : ''
+  return `${negatedPrefix}${matchEverywherePrefix}${escapedPatternWithoutLeadingSlash}${matchInsideSuffix}`
+}
+function pathsToPatterns(paths) {
+  // TODO: Does not support `~/` paths.
+  return paths.map(p => (p === '.' || p === './' ? '**/*' : p))
+}
+function findBinPathDetailsSync(binName) {
+  const binPaths =
+    vendor.libExports$1.sync(binName, {
+      all: true,
+      nothrow: true
+    }) ?? []
+  let shadowIndex = -1
+  let theBinPath
+  for (let i = 0, { length } = binPaths; i < length; i += 1) {
+    const binPath = binPaths[i]
+    // Skip our bin directory if it's in the front.
+    if (path.dirname(binPath) === shadowBinPath) {
+      shadowIndex = i
+    } else {
+      theBinPath = npm.resolveBinPath(binPath)
+      break
+    }
+  }
+  return {
+    name: binName,
+    path: theBinPath,
+    shadowed: shadowIndex !== -1
+  }
+}
+function findNpmPathSync(npmBinPath) {
+  // Lazily access constants.WIN32.
+  const { WIN32 } = constants
+  let thePath = npmBinPath
+  while (true) {
+    const libNmNpmPath = path.join(thePath, 'lib', NODE_MODULES$1, NPM$1)
+    // mise puts its npm bin in a path like:
+    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/bin/npm.
+    // HOWEVER, the location of the npm install is:
+    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/lib/node_modules/npm.
+    if (
+      // Use existsSync here because statsSync, even with { throwIfNoEntry: false },
+      // will throw an ENOTDIR error for paths like ./a-file-that-exists/a-directory-that-does-not.
+      // See https://github.com/nodejs/node/issues/56993.
+      require$$0.existsSync(libNmNpmPath) &&
+      require$$0
+        .statSync(libNmNpmPath, {
+          throwIfNoEntry: false
+        })
+        ?.isDirectory()
+    ) {
+      thePath = path.join(libNmNpmPath, NPM$1)
+    }
+    const nmPath = path.join(thePath, NODE_MODULES$1)
+    if (
+      // npm bin paths may look like:
+      //   /usr/local/share/npm/bin/npm
+      //   /Users/SomeUsername/.nvm/versions/node/vX.X.X/bin/npm
+      //   C:\Users\SomeUsername\AppData\Roaming\npm\bin\npm.cmd
+      // OR
+      //   C:\Program Files\nodejs\npm.cmd
+      //
+      // In practically all cases the npm path contains a node_modules folder:
+      //   /usr/local/share/npm/bin/npm/node_modules
+      //   C:\Program Files\nodejs\node_modules
+      require$$0.existsSync(nmPath) &&
+      require$$0
+        .statSync(nmPath, {
+          throwIfNoEntry: false
+        })
+        ?.isDirectory() &&
+      // Optimistically look for the default location.
+      (path.basename(thePath) === NPM$1 ||
+        // Chocolatey installs npm bins in the same directory as node bins.
+        (WIN32 && require$$0.existsSync(path.join(thePath, `${NPM$1}.cmd`))))
+    ) {
+      return thePath
+    }
+    const parent = path.dirname(thePath)
+    if (parent === thePath) {
+      return undefined
+    }
+    thePath = parent
+  }
+}
+async function getPackageFilesForScan(cwd, inputPaths, supportedFiles, config) {
+  debug.debugLog(
+    `getPackageFilesForScan: resolving ${inputPaths.length} paths:\n`,
+    inputPaths
+  )
+
+  // Lazily access constants.spinner.
+  const { spinner } = constants
+  const patterns = pathsToPatterns(inputPaths)
+  spinner.start('Searching for local files to include in scan...')
+  const entries = await globWithGitIgnore(patterns, {
+    cwd,
+    socketConfig: config
+  })
+  if (debug.isDebug()) {
+    spinner.stop()
+    debug.debugLog(
+      `Resolved ${inputPaths.length} paths to ${entries.length} local paths:\n`,
+      entries
+    )
+    spinner.start('Searching for files now...')
+  } else {
+    spinner.start(
+      `Resolved ${inputPaths.length} paths to ${entries.length} local paths, searching for files now...`
+    )
+  }
+  const packageFiles = await filterGlobResultToSupportedFiles(
+    entries,
+    supportedFiles
+  )
+  spinner.successAndStop(
+    `Found ${packageFiles.length} local ${words.pluralize('file', packageFiles.length)}`
+  )
+  debug.debugLog('Absolute paths:\n', packageFiles)
+  return packageFiles
+}
+
+const { NODE_MODULES, NPM, NPX, SOCKET_CLI_ISSUES_URL } = constants
+function exitWithBinPathError(binName) {
+  logger.logger.fail(
+    `Socket unable to locate ${binName}; ensure it is available in the PATH environment variable`
+  )
+  // The exit code 127 indicates that the command or binary being executed
+  // could not be found.
+  // eslint-disable-next-line n/no-process-exit
+  process.exit(127)
+}
+let _npmBinPathDetails
+function getNpmBinPathDetails() {
+  if (_npmBinPathDetails === undefined) {
+    _npmBinPathDetails = findBinPathDetailsSync(NPM)
+  }
+  return _npmBinPathDetails
+}
+let _npxBinPathDetails
+function getNpxBinPathDetails() {
+  if (_npxBinPathDetails === undefined) {
+    _npxBinPathDetails = findBinPathDetailsSync(NPX)
+  }
+  return _npxBinPathDetails
+}
+let _npmBinPath
+function getNpmBinPath() {
+  if (_npmBinPath === undefined) {
+    _npmBinPath = getNpmBinPathDetails().path
+    if (!_npmBinPath) {
+      exitWithBinPathError(NPM)
+    }
+  }
+  return _npmBinPath
+}
+function isNpmBinPathShadowed() {
+  return getNpmBinPathDetails().shadowed
+}
+let _npxBinPath
+function getNpxBinPath() {
+  if (_npxBinPath === undefined) {
+    _npxBinPath = getNpxBinPathDetails().path
+    if (!_npxBinPath) {
+      exitWithBinPathError(NPX)
+    }
+  }
+  return _npxBinPath
+}
+function isNpxBinPathShadowed() {
+  return getNpxBinPathDetails().shadowed
+}
+let _npmPath
+function getNpmPath() {
+  if (_npmPath === undefined) {
+    const npmBinPath = getNpmBinPath()
+    _npmPath = npmBinPath ? findNpmPathSync(npmBinPath) : undefined
+    if (!_npmPath) {
+      let message = 'Unable to find npm CLI install directory.'
+      if (npmBinPath) {
+        message += `\nSearched parent directories of ${path.dirname(npmBinPath)}.`
+      }
+      message += `\n\nThis is may be a bug with socket-npm related to changes to the npm CLI.\nPlease report to ${SOCKET_CLI_ISSUES_URL}.`
+      logger.logger.fail(message)
+      // The exit code 127 indicates that the command or binary being executed
+      // could not be found.
+      // eslint-disable-next-line n/no-process-exit
+      process.exit(127)
+    }
+  }
+  return _npmPath
+}
+let _npmRequire
+function getNpmRequire() {
+  if (_npmRequire === undefined) {
+    const npmPath = getNpmPath()
+    const npmNmPath = path.join(npmPath, NODE_MODULES, NPM)
+    _npmRequire = Module.createRequire(
+      path.join(
+        require$$0.existsSync(npmNmPath) ? npmNmPath : npmPath,
+        '<dummy-basename>'
+      )
+    )
+  }
+  return _npmRequire
+}
+let _arboristPkgPath
+function getArboristPackagePath() {
+  if (_arboristPkgPath === undefined) {
+    const pkgName = '@npmcli/arborist'
+    const mainPathWithForwardSlashes = path$1.normalizePath(
+      getNpmRequire().resolve(pkgName)
+    )
+    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(
+      0,
+      mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length
+    )
+    // Lazily access constants.WIN32.
+    _arboristPkgPath = constants.WIN32
+      ? path.normalize(arboristPkgPathWithForwardSlashes)
+      : arboristPkgPathWithForwardSlashes
+  }
+  return _arboristPkgPath
+}
+let _arboristClassPath
+function getArboristClassPath() {
+  if (_arboristClassPath === undefined) {
+    _arboristClassPath = path.join(
+      getArboristPackagePath(),
+      'lib/arborist/index.js'
+    )
+  }
+  return _arboristClassPath
+}
+let _arboristDepValidPath
+function getArboristDepValidPath() {
+  if (_arboristDepValidPath === undefined) {
+    _arboristDepValidPath = path.join(
+      getArboristPackagePath(),
+      'lib/dep-valid.js'
+    )
+  }
+  return _arboristDepValidPath
+}
+let _arboristEdgeClassPath
+function getArboristEdgeClassPath() {
+  if (_arboristEdgeClassPath === undefined) {
+    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js')
+  }
+  return _arboristEdgeClassPath
+}
+let _arboristNodeClassPath
+function getArboristNodeClassPath() {
+  if (_arboristNodeClassPath === undefined) {
+    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js')
+  }
+  return _arboristNodeClassPath
+}
+let _arboristOverrideSetClassPath
+function getArboristOverrideSetClassPath() {
+  if (_arboristOverrideSetClassPath === undefined) {
+    _arboristOverrideSetClassPath = path.join(
+      getArboristPackagePath(),
+      'lib/override-set.js'
+    )
+  }
+  return _arboristOverrideSetClassPath
+}
+
+exports.getArboristClassPath = getArboristClassPath
+exports.getArboristDepValidPath = getArboristDepValidPath
+exports.getArboristEdgeClassPath = getArboristEdgeClassPath
+exports.getArboristNodeClassPath = getArboristNodeClassPath
+exports.getArboristOverrideSetClassPath = getArboristOverrideSetClassPath
+exports.getNpmBinPath = getNpmBinPath
+exports.getNpmRequire = getNpmRequire
+exports.getNpxBinPath = getNpxBinPath
+exports.getPackageFilesForScan = getPackageFilesForScan
+exports.isNpmBinPathShadowed = isNpmBinPathShadowed
+exports.isNpxBinPathShadowed = isNpxBinPathShadowed
+//# debugId=94de2f72-f785-4ee7-85de-932aaba92a8e
+//# sourceMappingURL=shadow-npm-paths.js.map

package/dist/require/shadow-npm-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-npm-paths.js","sources":["../../src/utils/ignore-by-default.ts","../../src/utils/path-resolve.ts","../../src/shadow/npm/paths.ts"],"sourcesContent":["const ignoredDirs = [\n  // Taken from ignore-by-default:\n  // https://github.com/novemberborn/ignore-by-default/blob/v2.1.0/index.js\n  '.git', // Git repository files, see <https://git-scm.com/>\n  '.log', // Log files emitted by tools such as `tsserver`, see <https://github.com/Microsoft/TypeScript/wiki/Standalone-Server-%28tsserver%29>\n  '.nyc_output', // Temporary directory where nyc stores coverage data, see <https://github.com/bcoe/nyc>\n  '.sass-cache', // Cache folder for node-sass, see <https://github.com/sass/node-sass>\n  '.yarn', // Where node modules are installed when using Yarn, see <https://yarnpkg.com/>\n  'bower_components', // Where Bower packages are installed, see <http://bower.io/>\n  'coverage', // Standard output directory for code coverage reports, see <https://github.com/gotwarlost/istanbul>\n  'node_modules', // Where Node modules are installed, see <https://nodejs.org/>\n  // Taken from globby:\n  // https://github.com/sindresorhus/globby/blob/v14.0.2/ignore.js#L11-L16\n  'flow-typed'\n] as const\n\nconst ignoredDirPatterns = ignoredDirs.map(i => `**/${i}`)\n\nexport function directoryPatterns() {\n  return [...ignoredDirPatterns]\n}\n","import { existsSync, promises as fs, statSync } from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport ignore from 'ignore'\nimport micromatch from 'micromatch'\nimport { glob as tinyGlob } from 'tinyglobby'\nimport which from 'which'\n\nimport { debugLog, isDebug } from '@socketsecurity/registry/lib/debug'\nimport { resolveBinPath } from '@socketsecurity/registry/lib/npm'\nimport { pluralize } from '@socketsecurity/registry/lib/words'\n\nimport { directoryPatterns } from './ignore-by-default'\nimport constants from '../constants'\n\nimport type { SocketYml } from '@socketsecurity/config'\nimport type { SocketSdkReturnType } from '@socketsecurity/sdk'\nimport type { GlobOptions } from 'tinyglobby'\n\ntype GlobWithGitIgnoreOptions = GlobOptions & {\n  socketConfig?: SocketYml | undefined\n}\n\nconst { NODE_MODULES, NPM, shadowBinPath } = constants\n\nasync function filterGlobResultToSupportedFiles(\n  entries: string[],\n  supportedFiles: SocketSdkReturnType<'getReportSupportedFiles'>['data']\n): Promise<string[]> {\n  const patterns = ['golang', NPM, 'maven', 'pypi', 'gem', 'nuget'].reduce(\n    (r: string[], n: string) => {\n      const supported = supportedFiles[n]\n      r.push(\n        ...(supported\n          ? Object.values(supported).map(p => `**/${p.pattern}`)\n          : [])\n      )\n      return r\n    },\n    []\n  )\n  return entries.filter(p => micromatch.some(p, patterns))\n}\n\nasync function globWithGitIgnore(\n  patterns: string[],\n  options: GlobWithGitIgnoreOptions\n) {\n  const {\n    cwd = process.cwd(),\n    socketConfig,\n    ...additionalOptions\n  } = { __proto__: null, ...options } as GlobWithGitIgnoreOptions\n  const projectIgnorePaths = socketConfig?.projectIgnorePaths\n  const ignoreFiles = await tinyGlob(['**/.gitignore'], {\n    absolute: true,\n    cwd,\n    expandDirectories: true\n  })\n  const ignores = [\n    ...directoryPatterns(),\n    ...(Array.isArray(projectIgnorePaths)\n      ? ignoreFileLinesToGlobPatterns(\n          projectIgnorePaths,\n          path.join(cwd, '.gitignore'),\n          cwd\n        )\n      : []),\n    ...(\n      await Promise.all(\n        ignoreFiles.map(async filepath =>\n          ignoreFileToGlobPatterns(\n            await fs.readFile(filepath, 'utf8'),\n            filepath,\n            cwd\n          )\n        )\n      )\n    ).flat()\n  ]\n  const hasNegatedPattern = ignores.some(p => p.charCodeAt(0) === 33 /*'!'*/)\n  const globOptions = {\n    absolute: true,\n    cwd,\n    expandDirectories: false,\n    ignore: hasNegatedPattern ? [] : ignores,\n    ...additionalOptions\n  }\n  const result = await tinyGlob(patterns, globOptions)\n  if (!hasNegatedPattern) {\n    return result\n  }\n  const { absolute } = globOptions\n\n  // Note: the input files must be INSIDE the cwd. If you get strange looking\n  // relative path errors here, most likely your path is outside the given cwd.\n  const filtered = ignore()\n    .add(ignores)\n    .filter(absolute ? result.map(p => path.relative(cwd, p)) : result)\n  return absolute ? filtered.map(p => path.resolve(cwd, p)) : filtered\n}\n\nfunction ignoreFileLinesToGlobPatterns(\n  lines: string[],\n  filepath: string,\n  cwd: string\n): string[] {\n  const base = path.relative(cwd, path.dirname(filepath)).replace(/\\\\/g, '/')\n  const patterns = []\n  for (let i = 0, { length } = lines; i < length; i += 1) {\n    const pattern = lines[i]!.trim()\n    if (pattern.length > 0 && pattern.charCodeAt(0) !== 35 /*'#'*/) {\n      patterns.push(\n        ignorePatternToMinimatch(\n          pattern.length && pattern.charCodeAt(0) === 33 /*'!'*/\n            ? `!${path.posix.join(base, pattern.slice(1))}`\n            : path.posix.join(base, pattern)\n        )\n      )\n    }\n  }\n  return patterns\n}\n\nfunction ignoreFileToGlobPatterns(\n  content: string,\n  filepath: string,\n  cwd: string\n): string[] {\n  return ignoreFileLinesToGlobPatterns(content.split(/\\r?\\n/), filepath, cwd)\n}\n\n// Based on `@eslint/compat` convertIgnorePatternToMinimatch.\n// Apache v2.0 licensed\n// Copyright Nicholas C. Zakas\n// https://github.com/eslint/rewrite/blob/compat-v1.2.1/packages/compat/src/ignore-file.js#L28\nfunction ignorePatternToMinimatch(pattern: string): string {\n  const isNegated = pattern.startsWith('!')\n  const negatedPrefix = isNegated ? '!' : ''\n  const patternToTest = (isNegated ? pattern.slice(1) : pattern).trimEnd()\n  // Special cases.\n  if (\n    patternToTest === '' ||\n    patternToTest === '**' ||\n    patternToTest === '/**' ||\n    patternToTest === '**'\n  ) {\n    return `${negatedPrefix}${patternToTest}`\n  }\n  const firstIndexOfSlash = patternToTest.indexOf('/')\n  const matchEverywherePrefix =\n    firstIndexOfSlash === -1 || firstIndexOfSlash === patternToTest.length - 1\n      ? '**/'\n      : ''\n  const patternWithoutLeadingSlash =\n    firstIndexOfSlash === 0 ? patternToTest.slice(1) : patternToTest\n  // Escape `{` and `(` because in gitignore patterns they are just\n  // literal characters without any specific syntactic meaning,\n  // while in minimatch patterns they can form brace expansion or extglob syntax.\n  //\n  // For example, gitignore pattern `src/{a,b}.js` ignores file `src/{a,b}.js`.\n  // But, the same minimatch pattern `src/{a,b}.js` ignores files `src/a.js` and `src/b.js`.\n  // Minimatch pattern `src/\\{a,b}.js` is equivalent to gitignore pattern `src/{a,b}.js`.\n  const escapedPatternWithoutLeadingSlash =\n    patternWithoutLeadingSlash.replaceAll(\n      /(?=((?:\\\\.|[^{(])*))\\1([{(])/guy,\n      '$1\\\\$2'\n    )\n  const matchInsideSuffix = patternToTest.endsWith('/**') ? '/*' : ''\n  return `${negatedPrefix}${matchEverywherePrefix}${escapedPatternWithoutLeadingSlash}${matchInsideSuffix}`\n}\n\nfunction pathsToPatterns(paths: string[] | readonly string[]): string[] {\n  // TODO: Does not support `~/` paths.\n  return paths.map(p => (p === '.' || p === './' ? '**/*' : p))\n}\n\nexport function findBinPathDetailsSync(binName: string): {\n  name: string\n  path: string | undefined\n  shadowed: boolean\n} {\n  const binPaths =\n    which.sync(binName, {\n      all: true,\n      nothrow: true\n    }) ?? []\n  let shadowIndex = -1\n  let theBinPath: string | undefined\n  for (let i = 0, { length } = binPaths; i < length; i += 1) {\n    const binPath = binPaths[i]!\n    // Skip our bin directory if it's in the front.\n    if (path.dirname(binPath) === shadowBinPath) {\n      shadowIndex = i\n    } else {\n      theBinPath = resolveBinPath(binPath)\n      break\n    }\n  }\n  return { name: binName, path: theBinPath, shadowed: shadowIndex !== -1 }\n}\n\nexport function findNpmPathSync(npmBinPath: string): string | undefined {\n  // Lazily access constants.WIN32.\n  const { WIN32 } = constants\n  let thePath = npmBinPath\n  while (true) {\n    const libNmNpmPath = path.join(thePath, 'lib', NODE_MODULES, NPM)\n    // mise puts its npm bin in a path like:\n    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/bin/npm.\n    // HOWEVER, the location of the npm install is:\n    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/lib/node_modules/npm.\n    if (\n      // Use existsSync here because statsSync, even with { throwIfNoEntry: false },\n      // will throw an ENOTDIR error for paths like ./a-file-that-exists/a-directory-that-does-not.\n      // See https://github.com/nodejs/node/issues/56993.\n      existsSync(libNmNpmPath) &&\n      statSync(libNmNpmPath, { throwIfNoEntry: false })?.isDirectory()\n    ) {\n      thePath = path.join(libNmNpmPath, NPM)\n    }\n    const nmPath = path.join(thePath, NODE_MODULES)\n    if (\n      // npm bin paths may look like:\n      //   /usr/local/share/npm/bin/npm\n      //   /Users/SomeUsername/.nvm/versions/node/vX.X.X/bin/npm\n      //   C:\\Users\\SomeUsername\\AppData\\Roaming\\npm\\bin\\npm.cmd\n      // OR\n      //   C:\\Program Files\\nodejs\\npm.cmd\n      //\n      // In practically all cases the npm path contains a node_modules folder:\n      //   /usr/local/share/npm/bin/npm/node_modules\n      //   C:\\Program Files\\nodejs\\node_modules\n      existsSync(nmPath) &&\n      statSync(nmPath, { throwIfNoEntry: false })?.isDirectory() &&\n      // Optimistically look for the default location.\n      (path.basename(thePath) === NPM ||\n        // Chocolatey installs npm bins in the same directory as node bins.\n        (WIN32 && existsSync(path.join(thePath, `${NPM}.cmd`))))\n    ) {\n      return thePath\n    }\n    const parent = path.dirname(thePath)\n    if (parent === thePath) {\n      return undefined\n    }\n    thePath = parent\n  }\n}\n\nexport async function getPackageFilesForScan(\n  cwd: string,\n  inputPaths: string[],\n  supportedFiles: SocketSdkReturnType<'getReportSupportedFiles'>['data'],\n  config?: SocketYml | undefined\n): Promise<string[]> {\n  debugLog(\n    `getPackageFilesForScan: resolving ${inputPaths.length} paths:\\n`,\n    inputPaths\n  )\n\n  // Lazily access constants.spinner.\n  const { spinner } = constants\n\n  const patterns = pathsToPatterns(inputPaths)\n\n  spinner.start('Searching for local files to include in scan...')\n\n  const entries = await globWithGitIgnore(patterns, {\n    cwd,\n    socketConfig: config\n  })\n\n  if (isDebug()) {\n    spinner.stop()\n    debugLog(\n      `Resolved ${inputPaths.length} paths to ${entries.length} local paths:\\n`,\n      entries\n    )\n    spinner.start('Searching for files now...')\n  } else {\n    spinner.start(\n      `Resolved ${inputPaths.length} paths to ${entries.length} local paths, searching for files now...`\n    )\n  }\n\n  const packageFiles = await filterGlobResultToSupportedFiles(\n    entries,\n    supportedFiles\n  )\n\n  spinner.successAndStop(\n    `Found ${packageFiles.length} local ${pluralize('file', packageFiles.length)}`\n  )\n  debugLog('Absolute paths:\\n', packageFiles)\n\n  return packageFiles\n}\n","import { existsSync } from 'node:fs'\nimport Module from 'node:module'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { normalizePath } from '@socketsecurity/registry/lib/path'\n\nimport constants from '../../constants'\nimport {\n  findBinPathDetailsSync,\n  findNpmPathSync\n} from '../../utils/path-resolve'\n\nconst { NODE_MODULES, NPM, NPX, SOCKET_CLI_ISSUES_URL } = constants\n\nfunction exitWithBinPathError(binName: string): never {\n  logger.fail(\n    `Socket unable to locate ${binName}; ensure it is available in the PATH environment variable`\n  )\n  // The exit code 127 indicates that the command or binary being executed\n  // could not be found.\n  // eslint-disable-next-line n/no-process-exit\n  process.exit(127)\n}\n\nlet _npmBinPathDetails: ReturnType<typeof findBinPathDetailsSync> | undefined\nfunction getNpmBinPathDetails(): ReturnType<typeof findBinPathDetailsSync> {\n  if (_npmBinPathDetails === undefined) {\n    _npmBinPathDetails = findBinPathDetailsSync(NPM)\n  }\n  return _npmBinPathDetails\n}\n\nlet _npxBinPathDetails: ReturnType<typeof findBinPathDetailsSync> | undefined\nfunction getNpxBinPathDetails(): ReturnType<typeof findBinPathDetailsSync> {\n  if (_npxBinPathDetails === undefined) {\n    _npxBinPathDetails = findBinPathDetailsSync(NPX)\n  }\n  return _npxBinPathDetails\n}\n\nlet _npmBinPath: string | undefined\nexport function getNpmBinPath(): string {\n  if (_npmBinPath === undefined) {\n    _npmBinPath = getNpmBinPathDetails().path\n    if (!_npmBinPath) {\n      exitWithBinPathError(NPM)\n    }\n  }\n  return _npmBinPath\n}\n\nexport function isNpmBinPathShadowed() {\n  return getNpmBinPathDetails().shadowed\n}\n\nlet _npxBinPath: string | undefined\nexport function getNpxBinPath(): string {\n  if (_npxBinPath === undefined) {\n    _npxBinPath = getNpxBinPathDetails().path\n    if (!_npxBinPath) {\n      exitWithBinPathError(NPX)\n    }\n  }\n  return _npxBinPath\n}\n\nexport function isNpxBinPathShadowed() {\n  return getNpxBinPathDetails().shadowed\n}\n\nlet _npmPath: string | undefined\nexport function getNpmPath() {\n  if (_npmPath === undefined) {\n    const npmBinPath = getNpmBinPath()\n    _npmPath = npmBinPath ? findNpmPathSync(npmBinPath) : undefined\n    if (!_npmPath) {\n      let message = 'Unable to find npm CLI install directory.'\n      if (npmBinPath) {\n        message += `\\nSearched parent directories of ${path.dirname(npmBinPath)}.`\n      }\n      message += `\\n\\nThis is may be a bug with socket-npm related to changes to the npm CLI.\\nPlease report to ${SOCKET_CLI_ISSUES_URL}.`\n      logger.fail(message)\n      // The exit code 127 indicates that the command or binary being executed\n      // could not be found.\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(127)\n    }\n  }\n  return _npmPath\n}\n\nlet _npmRequire: NodeJS.Require | undefined\nexport function getNpmRequire(): NodeJS.Require {\n  if (_npmRequire === undefined) {\n    const npmPath = getNpmPath()\n    const npmNmPath = path.join(npmPath, NODE_MODULES, NPM)\n    _npmRequire = Module.createRequire(\n      path.join(existsSync(npmNmPath) ? npmNmPath : npmPath, '<dummy-basename>')\n    )\n  }\n  return _npmRequire\n}\n\nlet _arboristPkgPath: string | undefined\nexport function getArboristPackagePath() {\n  if (_arboristPkgPath === undefined) {\n    const pkgName = '@npmcli/arborist'\n    const mainPathWithForwardSlashes = normalizePath(\n      getNpmRequire().resolve(pkgName)\n    )\n    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(\n      0,\n      mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length\n    )\n    // Lazily access constants.WIN32.\n    _arboristPkgPath = constants.WIN32\n      ? path.normalize(arboristPkgPathWithForwardSlashes)\n      : arboristPkgPathWithForwardSlashes\n  }\n  return _arboristPkgPath\n}\n\nlet _arboristClassPath: string | undefined\nexport function getArboristClassPath() {\n  if (_arboristClassPath === undefined) {\n    _arboristClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/arborist/index.js'\n    )\n  }\n  return _arboristClassPath\n}\n\nlet _arboristDepValidPath: string | undefined\nexport function getArboristDepValidPath() {\n  if (_arboristDepValidPath === undefined) {\n    _arboristDepValidPath = path.join(\n      getArboristPackagePath(),\n      'lib/dep-valid.js'\n    )\n  }\n  return _arboristDepValidPath\n}\n\nlet _arboristEdgeClassPath: string | undefined\nexport function getArboristEdgeClassPath() {\n  if (_arboristEdgeClassPath === undefined) {\n    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js')\n  }\n  return _arboristEdgeClassPath\n}\n\nlet _arboristNodeClassPath: string | undefined\nexport function getArboristNodeClassPath() {\n  if (_arboristNodeClassPath === undefined) {\n    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js')\n  }\n  return _arboristNodeClassPath\n}\n\nlet _arboristOverrideSetClassPath: string | undefined\nexport function getArboristOverrideSetClassPath() {\n  if (_arboristOverrideSetClassPath === undefined) {\n    _arboristOverrideSetClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/override-set.js'\n    )\n  }\n  return _arboristOverrideSetClassPath\n}\n"],"names":["shadowBinPath","cwd","__proto__","absolute","expandDirectories","ignore","length","all","nothrow","shadowIndex","theBinPath","name","path","WIN32","existsSync","throwIfNoEntry","thePath","spinner","socketConfig","debugLog","SOCKET_CLI_ISSUES_URL","logger","process","_npmBinPathDetails","_npxBinPathDetails","_npmBinPath","_npxBinPath","_arboristPkgPath"],"mappings":";;;;;;;;;;;;;;AAAA;AACE;AACA;AACA;AAAQ;AACR;AAAQ;AACR;AAAe;AACf;AAAe;AACf;AAAS;AACT;AAAoB;AACpB;AAAY;AACZ;AAAgB;AAChB;AACA;AACA;AAGF;AAEO;;AAEP;;ACIA;;;AAA2BA;AAAc;AAEzC;;AAMM;;AAMA;;AAIJ;AACF;AAEA;;AAKIC;;;AAGF;AAAMC;;;AACN;;AAEEC;;AAEAC;AACF;AACA;AAqBA;AACA;AACED;;AAEAC;AACAC;;;;;AAKA;AACF;;AACQF;AAAS;;AAEjB;AACA;AACA;AAGA;AACF;AAEA;;;AAOE;AAAkBG;;;AAEhB;;AAQA;AACF;AACA;AACF;AAEA;AAKE;AACF;;AAEA;AACA;AACA;AACA;AACA;AACE;AACA;AACA;AACA;AACA;AAME;AACF;AACA;AACA;AAIA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;;;AAQF;AAEA;AACE;AACA;AACF;AAEO;AAKL;AAEIC;AACAC;;;AAGJ;AACA;AAAkBF;;AAChB;AACA;;AAEEG;AACF;AACEC;AACA;AACF;AACF;;AACSC;AAAeC;;;AAC1B;AAEO;AACL;;AACQC;AAAM;;AAEd;AACE;AACA;AACA;AACA;AACA;AACA;AACE;AACA;AACA;AACAC;AACyBC;AAAsB;;AAGjD;;AAEA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACAD;AACmBC;AAAsB;AACzC;AACCH;AACC;AACCC;AAEH;AACF;AACA;;AAEE;AACF;AACAG;AACF;AACF;AAEO;;;AAWL;;AACQC;AAAQ;AAEhB;AAEAA;AAEA;;AAEEC;AACF;;;AAIEC;AAIAF;AACF;AACEA;AAGF;;AAOAA;AAGAE;AAEA;AACF;;AC5RA;;;;AAAgCC;AAAsB;AAEtD;AACEC;AAGA;AACA;AACA;AACAC;AACF;AAEA;AACA;;AAEIC;AACF;AACA;AACF;AAEA;AACA;;AAEIC;AACF;AACA;AACF;AAEA;AACO;;AAEHC;;;AAGA;AACF;AACA;AACF;AAEO;AACL;AACF;AAEA;AACO;;AAEHC;;;AAGA;AACF;AACA;AACF;AAEO;AACL;AACF;AAEA;AACO;;AAEH;;;;AAIE;;AAEA;;AAEAL;AACA;AACA;AACA;AACAC;AACF;AACF;AACA;AACF;AAEA;AACO;;AAEH;;;AAKF;AACA;AACF;AAEA;AACO;;;AAGH;AAGA;AAIA;AACAK;AAGF;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;;;;;;;;;;;;","debugId":"94de2f72-f785-4ee7-85de-932aaba92a8e"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "0.14.94",
+  "version": "0.14.96",
   "description": "CLI tool for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT",
@@ -77,42 +77,16 @@
     "update:deps": "npx --yes npm-check-updates"
   },
   "dependencies": {
-    "@apideck/better-ajv-errors": "0.3.6",
-    "@octokit/rest": "^21.1.1",
-    "@pnpm/lockfile.detect-dep-types": "^1001.0.7",
-    "@pnpm/lockfile.fs": "^1001.1.9",
-    "@pnpm/logger": "^1000.0.0",
     "@socketregistry/hyrious__bun.lockb": "1.0.17",
     "@socketregistry/indent-string": "1.0.12",
     "@socketregistry/is-interactive": "1.0.5",
     "@socketregistry/packageurl-js": "1.0.5",
-    "@socketsecurity/config": "2.1.3",
     "@socketsecurity/registry": "1.0.143",
     "@socketsecurity/sdk": "1.4.28",
-    "blessed": "0.1.81",
-    "blessed-contrib": "4.11.0",
-    "browserslist": "4.24.4",
-    "chalk-table": "1.0.2",
-    "cmd-shim": "7.0.0",
-    "common-tags": "1.8.2",
-    "fast-content-type-parse": "^2.0.0",
-    "hpagent": "1.2.0",
-    "ignore": "7.0.3",
-    "meow": "13.2.0",
-    "micromatch": "4.0.8",
-    "npm-package-arg": "12.0.2",
-    "open": "10.1.0",
-    "pony-cause": "2.1.11",
-    "semver": "7.7.1",
-    "terminal-link": "2.1.1",
-    "tiny-updater": "3.5.3",
-    "tinyglobby": "0.2.12",
-    "which": "5.0.0",
-    "yaml": "2.7.1",
-    "yargs-parser": "21.1.1",
-    "yoctocolors-cjs": "2.1.2"
+    "blessed": "0.1.81"
   },
   "devDependencies": {
+    "@apideck/better-ajv-errors": "0.3.6",
     "@babel/core": "^7.26.10",
     "@babel/plugin-proposal-export-default-from": "^7.25.9",
     "@babel/plugin-syntax-dynamic-import": "^7.8.3",
@@ -126,12 +100,17 @@
     "@eslint/compat": "^1.2.8",
     "@eslint/js": "^9.24.0",
     "@octokit/openapi-types": "^25.0.0",
+    "@octokit/rest": "^21.1.1",
     "@octokit/types": "^14.0.0",
+    "@pnpm/lockfile.detect-dep-types": "^1001.0.7",
+    "@pnpm/lockfile.fs": "^1001.1.9",
+    "@pnpm/logger": "^1000.0.0",
     "@rollup/plugin-commonjs": "28.0.3",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-replace": "^6.0.2",
     "@rollup/pluginutils": "^5.1.4",
+    "@socketsecurity/config": "2.1.3",
     "@types/blessed": "0.1.25",
     "@types/cmd-shim": "^5.0.2",
     "@types/common-tags": "^1.8.4",
@@ -169,6 +148,27 @@
     "rollup-plugin-ts": "^3.4.5",
     "synp": "^1.9.14",
     "type-coverage": "^2.29.7",
+    "blessed-contrib": "4.11.0",
+    "browserslist": "4.24.4",
+    "chalk-table": "1.0.2",
+    "cmd-shim": "7.0.0",
+    "common-tags": "1.8.2",
+    "fast-content-type-parse": "^2.0.0",
+    "hpagent": "1.2.0",
+    "ignore": "7.0.3",
+    "meow": "13.2.0",
+    "micromatch": "4.0.8",
+    "npm-package-arg": "12.0.2",
+    "open": "10.1.0",
+    "pony-cause": "2.1.11",
+    "semver": "7.7.1",
+    "terminal-link": "2.1.1",
+    "tiny-updater": "3.5.3",
+    "tinyglobby": "0.2.12",
+    "which": "5.0.0",
+    "yaml": "2.7.1",
+    "yargs-parser": "21.1.1",
+    "yoctocolors-cjs": "2.1.2",
     "typescript": "5.4.5",
     "typescript-eslint": "^8.29.1",
     "unplugin-purge-polyfills": "^0.0.7",