@socketsecurity/cli 1.1.101 → 1.1.151

package/dist/manifest-scripts/socket-facts.plugin.scala

@@ -0,0 +1,544 @@
+package socket
+
+import sbt._
+import sbt.Keys._
+
+import scala.collection.mutable
+import scala.reflect.ClassTag
+
+/**
+ * Emits a flat line-protocol RECORDS file at the build root (NOT the final
+ * `.socket.facts.json`, and NOT to stdout — sbt prints resolution noise to stdout
+ * with no way to silence it). The TS assembler (utils/src/manifest-scripts/assemble.ts)
+ * reads the records and owns all SBOM construction — graph merge, content-addressed
+ * ids, contentHash. This plugin only RESOLVES and emits raw facts. See records.ts for
+ * the record grammar.
+ *
+ * Must compile on Scala 2.10/sbt 0.13 and Scala 2.12/sbt 1.x (compiled by the sbt
+ * meta-build), hence string-named TaskKeys and reflection for version-specific
+ * ExclusionRule / ResolveException / ConfigRef shapes.
+ */
+object SocketFactsPlugin extends AutoPlugin {
+  override def trigger = allRequirements
+
+  object autoImport {
+    val socketFacts =
+      taskKey[Unit]("Emit Socket facts records for the whole build")
+  }
+  import autoImport._
+
+  override def projectSettings: Seq[Setting[_]] = Seq(
+    aggregate in socketFacts := false,
+    socketFacts := {
+      val st = state.value
+      val buildRoot = (baseDirectory in ThisBuild).value
+      val withFiles = boolProp("socket.withFiles")
+      val populateScope: Option[Set[String]] = readPopulateScope()
+
+      val extracted = Project.extract(st)
+      val allRefs = extracted.structure.allProjectRefs
+
+      // `-Dsocket.excludePaths` (scan-root-relative globs): a subproject whose dir is wholly excluded is
+      // never resolved and emits no project record. Source-file-level exclusion is left to the analysis.
+      val excludeMatchers = parseExcludeMatchers()
+      val rootCanonPath = buildRoot.getCanonicalFile.toPath
+      def relOf(f: File): String = {
+        val r = rootCanonPath.relativize(f.getCanonicalFile.toPath).toString.replace(java.io.File.separator, "/")
+        if (r.isEmpty) "." else r
+      }
+      def isExcludedRef(ref: ProjectRef): Boolean =
+        isExcludedPath(relOf(extracted.get(baseDirectory.in(ref))), excludeMatchers)
+
+      // Prefer `updateFull` (coursier `update` returns empty callers); fall back to `update` (sbt 0.13).
+      val hasUpdateFull =
+        extracted.structure.settings.map(_.key.key).exists(_.label == "updateFull")
+      val updateTaskName = if (hasUpdateFull) "updateFull" else "update"
+
+      // One tree per resolution root (project, config); the TS assembler merges them path-sensitively.
+      val perSub = mutable.LinkedHashMap.empty[String, RootTree]
+      val failures = mutable.LinkedHashSet.empty[Failure]
+      val scannedConfigs = mutable.LinkedHashSet.empty[String]
+      val matcher = buildConfigMatcher()
+
+      // Real artifact ext per build module, so an ext-less inter-project dep gets its true coordinate.
+      val moduleExts = buildModuleExts(allRefs, extracted)
+
+      allRefs.foreach { ref =>
+        if (!isExcludedRef(ref)) {
+          runUpdateResilient(updateTaskName, ref, extracted, st, failures).foreach { report =>
+            foldReport(report, ref, extracted, matcher, scannedConfigs, withFiles, populateScope, moduleExts).foreach {
+              case (rootKey, tree) => perSub(rootKey) = tree
+            }
+          }
+        }
+      }
+
+      val moduleDirs: Map[String, (Seq[String], Seq[String])] =
+        if (withFiles) buildModuleDirs(allRefs, extracted) else Map.empty
+
+      val sb = new StringBuilder
+      def rec(fields: String*): Unit = {
+        sb.append(fields.map(esc).mkString("\t")); sb.append('\n')
+      }
+
+      rec("meta", "sbt", extracted.getOpt(sbtVersion).getOrElse(""), sys.props.getOrElse("java.version", ""))
+
+      // One `project` record per build module (sources/targets only with --with-files). Excluded
+      // subprojects are omitted (they were also skipped during resolution above).
+      allRefs.foreach { ref =>
+        if (!isExcludedRef(ref)) {
+          val mid = rootIdOf(extracted, ref)
+          val ver = if (mid.revision == null) "" else mid.revision
+          rec("project", ref.project, mid.organization, mid.name, ver, relOf(extracted.get(baseDirectory.in(ref))))
+          if (withFiles) {
+            moduleDirs.get(mid.organization + ":" + mid.name + ":" + ver).foreach {
+              case (sources, targets) =>
+                sources.foreach(s => rec("projectSrc", ref.project, s))
+                targets.foreach(t => rec("projectTgt", ref.project, t))
+            }
+          }
+        }
+      }
+
+      // One resolution root per (subproject, configuration); the TS assembler content-addresses
+      // divergent subtrees.
+      var rootIdx = 0
+      perSub.foreach {
+        case (_, tree) =>
+          val rootId = rootIdx.toString
+          rootIdx += 1
+          rec("root", rootId, tree.projectKey, tree.config, if (tree.prod) "1" else "0")
+          tree.nodes.foreach {
+            case (coordId, node) =>
+              val c = node.coord
+              rec("node", rootId, coordId, c.org, c.name, c.version, c.ext, c.classifier, if (node.direct) "1" else "0")
+              node.children.foreach(ch => rec("edge", rootId, coordId, ch))
+              node.targets.foreach(p => rec("file", rootId, coordId, p))
+          }
+      }
+
+      // Scanned configs + raw failures (Coana owns the abort/warn policy and report rendering).
+      scannedConfigs.toList.sorted.foreach(c => rec("scanned", c))
+      failures.foreach(f => rec("failure", f.coord, f.detail, f.config))
+
+      val recordsFile = sys.props.get("socket.recordsFile").filter(_.nonEmpty) match {
+        case Some(p) => new File(p)
+        case None    => new File(buildRoot, ".socket.facts.records.tsv")
+      }
+      Option(recordsFile.getParentFile).foreach(_.mkdirs())
+      IO.write(recordsFile, sb.toString)
+      println("Socket facts records written to: " + recordsFile.getAbsolutePath)
+    }
+  )
+
+  // ---- resolution ---------------------------------------------------------
+
+  private def rootIdOf(extracted: Extracted, ref: ProjectRef): ModuleID = {
+    val sv = extracted.get(scalaVersion.in(ref))
+    val sbv = extracted.get(scalaBinaryVersion.in(ref))
+    CrossVersion.apply(sv, sbv)(extracted.get(projectID.in(ref)))
+  }
+
+  // GAV -> a build module's real artifact extension (jar for a normal project). coursier reports an
+  // inter-project dependency with no resolved artifact, so it would otherwise be ext-less and not
+  // match how depscan ingests it (ext=jar); stamping the real ext keeps a full, matching coordinate.
+  private def buildModuleExts(allRefs: Seq[ProjectRef], extracted: Extracted): Map[String, String] = {
+    allRefs.map { ref =>
+      val ext = extracted.getOpt(artifact.in(ref)).map(_.extension).filter(e => e != null && e.nonEmpty).getOrElse("jar")
+      gavKey(rootIdOf(extracted, ref)) -> ext
+    }.toMap
+  }
+
+  // Absolute source roots + compiled-output dirs per build module, keyed by GAV. --with-files only;
+  // absolute because reachability locates an internal module's code on THIS machine (no registry jar).
+  // ALL of the project's configurations are scanned (not just Compile/Test) so custom ones
+  // (IntegrationTest, ...) reach the analysis; source-file-level exclusion is coana's job.
+  private def buildModuleDirs(
+      allRefs: Seq[ProjectRef],
+      extracted: Extracted
+  ): Map[String, (Seq[String], Seq[String])] = {
+    allRefs.map { ref =>
+      val mid = rootIdOf(extracted, ref)
+      val ver = if (mid.revision == null) "" else mid.revision
+      val configs: Seq[Configuration] =
+        extracted.getOpt(thisProject.in(ref)).map(_.configurations).getOrElse(Seq(Compile, Test))
+      val sources = configs
+        .flatMap(c => extracted.getOpt(sourceDirectories.in(ref).in(c)).getOrElse(Nil))
+        .map(_.getAbsolutePath).distinct.sorted
+      val targets = configs
+        .flatMap(c => extracted.getOpt(classDirectory.in(ref).in(c)))
+        .map(_.getAbsolutePath).distinct.sorted
+      (mid.organization + ":" + mid.name + ":" + ver) -> ((sources, targets))
+    }.toMap
+  }
+
+  // On a hard resolve failure, record the failed modules and retry once with them excluded. Never throws.
+  private def runUpdateResilient(
+      taskName: String,
+      ref: ProjectRef,
+      extracted: Extracted,
+      state: State,
+      failures: mutable.LinkedHashSet[Failure]
+  ): Option[UpdateReport] = {
+    val key = TaskKey[UpdateReport](taskName)
+
+    def runOn(st: State): Either[Seq[ModuleID], UpdateReport] =
+      Project.runTask(key.in(ref).scopedKey, st) match {
+        case Some((_, sbt.Value(rep))) => Right(rep)
+        case Some((_, sbt.Inc(inc)))   => Left(extractFailedModules(inc))
+        case _                         => Left(Nil)
+      }
+
+    runOn(state) match {
+      case Right(rep) => Some(rep)
+      case Left(failed) =>
+        failed.foreach { m =>
+          failures += Failure(coordOf(m), "unresolved dependency", taskName)
+        }
+        if (failed.isEmpty) None
+        else
+          runOn(extracted.append(exclusionSettings(extracted, failed), state)) match {
+            case Right(rep) => Some(rep)
+            case Left(_)    => None
+          }
+    }
+  }
+
+  // Reflection: ResolveException's package and the `failed` accessor differ between sbt 0.13 and 1.x.
+  private def extractFailedModules(inc: sbt.Incomplete): Seq[ModuleID] = {
+    val out = mutable.ListBuffer.empty[ModuleID]
+    def walk(i: sbt.Incomplete): Unit = {
+      i.directCause.foreach { ex =>
+        val cn = ex.getClass.getName
+        if (cn == "sbt.ResolveException" || cn == "sbt.librarymanagement.ResolveException") {
+          try {
+            val m = ex.getClass.getMethod("failed")
+            out ++= m.invoke(ex).asInstanceOf[Seq[ModuleID]]
+          } catch { case _: Throwable => }
+        }
+      }
+      i.causes.foreach(walk)
+    }
+    walk(inc)
+    out.toList.distinct
+  }
+
+  // ExclusionRule constructor shape differs between sbt 0.13 (`sbt.ExclusionRule`) and 1.x (`sbt.SbtExclusionRule`).
+  private def exclusionSettings(extracted: Extracted, failed: Seq[ModuleID]): Seq[Setting[_]] = {
+    val cls: Class[_] =
+      try Class.forName("sbt.SbtExclusionRule")
+      catch { case _: ClassNotFoundException => classOf[sbt.ExclusionRule] }
+
+    def rule(m: ModuleID): Any =
+      if (cls.getName.contains("SbtExclusionRule")) {
+        cls.getConstructors.find(_.getParameterCount == 5) match {
+          case Some(ctor) =>
+            ctor.newInstance(m.organization, m.name, "*", Seq(), sbt.CrossVersion.Disabled)
+          case None =>
+            throw new IllegalStateException("No suitable SbtExclusionRule constructor")
+        }
+      } else ExclusionRule(organization = m.organization, name = m.name)
+
+    def castSeq[T](xs: Seq[Any])(implicit ct: ClassTag[T]): Seq[T] = xs.map(_.asInstanceOf[T])
+
+    extracted.structure.allProjectRefs.map { ref =>
+      excludeDependencies.in(ref) := {
+        val original = excludeDependencies.in(ref).value
+        castSeq(original ++ failed.map(rule))(ClassTag(cls))
+      }
+    }
+  }
+
+  // Fold one project's UpdateReport into one tree per configuration (rootKey -> tree), keyed by coordinate.
+  private def foldReport(
+      report: UpdateReport,
+      ref: ProjectRef,
+      extracted: Extracted,
+      matcher: String => Boolean,
+      scannedConfigs: mutable.LinkedHashSet[String],
+      withFiles: Boolean,
+      populateScope: Option[Set[String]],
+      moduleExts: Map[String, String]
+  ): mutable.LinkedHashMap[String, RootTree] = {
+    val perRoot = mutable.LinkedHashMap.empty[String, RootTree]
+    val rootGav = gavKey(rootIdOf(extracted, ref))
+
+    def emittable(m: ModuleReport): Boolean = !m.evicted
+
+    def inScope(m: ModuleID): Boolean = populateScope match {
+      case None       => true
+      case Some(gavs) => gavs.contains(gavKey(m))
+    }
+
+    report.configurations.foreach { cr =>
+      val cfg = confName(cr)
+      if (matcher(cfg)) {
+        scannedConfigs += cfg
+        val prod = isProdConf(cfg) && !isTestConf(cfg)
+        val nodes = mutable.LinkedHashMap.empty[String, Node]
+        // module GAV -> component ids (caller edges are module-level).
+        val midToIds = mutable.HashMap.empty[String, mutable.LinkedHashSet[String]]
+
+        cr.modules.foreach { m =>
+          if (emittable(m)) {
+            val ids = midToIds.getOrElseUpdate(gavKey(m.module), mutable.LinkedHashSet.empty[String])
+            variantsOf(m, moduleExts).foreach { case (coord, fileOpt) =>
+              val node = nodes.getOrElseUpdate(coord.id, new Node(coord))
+              ids += coord.id
+              if (withFiles && inScope(m.module)) fileOpt.foreach(f => node.targets += f.getAbsolutePath)
+            }
+          }
+        }
+
+        // Caller edges within this config: a root caller marks the child direct, any other becomes its parent.
+        cr.modules.foreach { m =>
+          if (emittable(m)) {
+            midToIds.get(gavKey(m.module)).foreach { childIds =>
+              m.callers.foreach { c =>
+                val callerKey = gavKey(c.caller)
+                if (callerKey == rootGav) childIds.foreach(cid => nodes(cid).direct = true)
+                else
+                  midToIds.get(callerKey).foreach { parentIds =>
+                    // Drop self-edges (test → main resolving to the same coordinate), matching gradle.
+                    parentIds.foreach(pid => childIds.foreach(cid => if (pid != cid) nodes(pid).children += cid))
+                  }
+              }
+            }
+          }
+        }
+
+        if (nodes.nonEmpty) perRoot(ref.project + "::" + cfg) = new RootTree(ref.project, cfg, prod, nodes)
+      }
+    }
+    perRoot
+  }
+
+  private def variantsOf(m: ModuleReport, moduleExts: Map[String, String]): Seq[(Coord, Option[File])] = {
+    val mid = m.module
+    // `mid.revision` is normally set for a resolved module, but normalize null (Coord.id calls
+    // `.nonEmpty`, which NPEs on null) to match the other call sites (gavKey, module records).
+    val ver = if (mid.revision == null) "" else mid.revision
+    val arts = m.artifacts
+    if (arts == null || arts.isEmpty)
+      // No resolved artifact (e.g. an inter-project dep): stamp the module's real ext if it's a build
+      // module (matches depscan's ext=jar), else leave ext-less.
+      Seq((Coord(mid.organization, mid.name, ver, moduleExts.getOrElse(gavKey(mid), ""), ""), None))
+    else
+      arts.toList.map {
+        case (art, file) =>
+          (Coord(mid.organization, mid.name, ver, extOf(art), classifierOf(art)), Option(file))
+      }
+  }
+
+  // ---- config selection ---------------------------------------------------
+
+  // With no includes the default is ALL configurations (captures build/tooling deps).
+  private def buildConfigMatcher(): String => Boolean = {
+    def parse(prop: String): List[java.util.regex.Pattern] =
+      sys.props.get(prop) match {
+        case Some(s) if s.trim.nonEmpty =>
+          s.split(",").map(_.trim).filter(_.nonEmpty).toList.map(globToRegex)
+        case _ => Nil
+      }
+    val includes = parse("socket.includeConfigs")
+    val excludes = parse("socket.excludeConfigs")
+    (name: String) => {
+      val included =
+        if (includes.isEmpty) true
+        else includes.exists(_.matcher(name).matches())
+      included && !excludes.exists(_.matcher(name).matches())
+    }
+  }
+
+  // Case-SENSITIVE (matching is documented as case-sensitive). Supports `*`, `?`, and `[...]`
+  // character classes: enumerations (`[cC]`), ranges (`[a-z]`), and `[!..]`/`[^..]` negation. A
+  // malformed glob falls back to a literal match, never throws.
+  private def globToRegex(glob: String): java.util.regex.Pattern = {
+    val sb = new StringBuilder
+    var i = 0
+    val n = glob.length
+    while (i < n) {
+      val c = glob.charAt(i)
+      if (c == '*') { sb.append(".*"); i += 1 }
+      else if (c == '?') { sb.append('.'); i += 1 }
+      else if (c == '[') {
+        val j = glob.indexOf(']', i + 1)
+        // Treat as a class only with a non-empty body; else a literal `[`.
+        if (j <= i + 1) { sb.append("\\["); i += 1 }
+        else {
+          var body = glob.substring(i + 1, j)
+          val neg = body.startsWith("!")
+          if (neg) body = body.substring(1)
+          // Only literal chars and `-` ranges are meaningful; neutralize regex-class tricks.
+          body = body.replace("\\", "\\\\").replace("[", "\\[").replace("&", "\\&")
+          sb.append('[').append(if (neg) "^" else "").append(body).append(']')
+          i = j + 1
+        }
+      } else if ("\\.^$|+(){}]".indexOf(c.toInt) >= 0) {
+        sb.append('\\').append(c); i += 1
+      } else { sb.append(c); i += 1 }
+    }
+    try java.util.regex.Pattern.compile(sb.toString)
+    catch {
+      case _: java.util.regex.PatternSyntaxException =>
+        java.util.regex.Pattern.compile(java.util.regex.Pattern.quote(glob))
+    }
+  }
+
+  // ConfigurationReport.configuration is a String on sbt 0.13, a ConfigRef on 1.x: read `.name` reflectively.
+  private def confName(cr: ConfigurationReport): String = {
+    val c: Any = cr.configuration
+    try c.getClass.getMethod("name").invoke(c).toString
+    catch { case _: Throwable => c.toString }
+  }
+
+  // `-Dsocket.excludePaths` → glob PathMatchers, used only to skip whole excluded subprojects. Each
+  // entry variant yields the entry itself and `entry/**` so it matches the dir and its subtree (same expansion
+  // as the SCA ignore path). A trailing `/**` is stripped first, so a user-written `dir/**` still excludes the
+  // `dir` directory itself, not only its contents. Standard glob semantics (anchored to the scan root, matching
+  // the CLI flag): `x` is root-level, `**/x` matches at any depth. Mirrors the gradle/maven producers.
+  private def parseExcludeMatchers(): Seq[java.nio.file.PathMatcher] = {
+    sys.props.get("socket.excludePaths").map(_.trim).filter(_.nonEmpty) match {
+      case None => Nil
+      case Some(raw) =>
+        val fs = java.nio.file.FileSystems.getDefault
+        raw.split(",").toSeq.flatMap { r =>
+          var g = r.trim.replace("\\", "/")
+          while (g.startsWith("/")) g = g.substring(1)
+          while (g.endsWith("/")) g = g.substring(0, g.length - 1)
+          while (g.endsWith("/**")) {
+            g = g.substring(0, g.length - 3)
+            while (g.endsWith("/")) g = g.substring(0, g.length - 1)
+          }
+          if (g.isEmpty) Nil
+          else zeroDepthVariants(g).flatMap { v =>
+            Seq(fs.getPathMatcher("glob:" + v), fs.getPathMatcher("glob:" + v + "/**"))
+          }
+        }
+    }
+  }
+
+  // NIO glob requires a slash-adjacent `**` to consume at least one path segment, but the CLI's
+  // micromatch lets it match zero (`**/x` matches root-level `x`). Emit every variant with `**/`
+  // occurrences dropped so both semantics hold.
+  private def zeroDepthVariants(glob: String): Seq[String] = {
+    val out = mutable.LinkedHashSet[String]()
+    val work = mutable.Queue(glob)
+    while (work.nonEmpty) {
+      val cur = work.dequeue()
+      if (out.add(cur)) {
+        var idx = cur.indexOf("**/")
+        while (idx >= 0) {
+          if (idx == 0 || cur.charAt(idx - 1) == '/') {
+            val collapsed = cur.substring(0, idx) + cur.substring(idx + 3)
+            if (collapsed.nonEmpty) work.enqueue(collapsed)
+          }
+          idx = cur.indexOf("**/", idx + 1)
+        }
+      }
+    }
+    out.toSeq
+  }
+
+  private def isExcludedPath(rel: String, matchers: Seq[java.nio.file.PathMatcher]): Boolean = {
+    if (matchers.isEmpty) false
+    else {
+      var c = (if (rel == null) "" else rel).replace("\\", "/")
+      while (c.startsWith("./")) c = c.substring(2)
+      while (c.startsWith("/")) c = c.substring(1)
+      while (c.endsWith("/")) c = c.substring(0, c.length - 1)
+      if (c.isEmpty) false
+      else {
+        val p = java.nio.file.Paths.get(c)
+        matchers.exists(_.matches(p))
+      }
+    }
+  }
+
+  private def isTestConf(name: String): Boolean = name.toLowerCase.contains("test")
+
+  // Only feeds the informational `dev` flag, never gates analysis.
+  private def isProdConf(name: String): Boolean = {
+    val n = name.toLowerCase
+    n == "compile" || n == "runtime"
+  }
+
+  // ---- misc helpers --------------------------------------------------------
+
+  private def boolProp(name: String): Boolean =
+    java.lang.Boolean.parseBoolean(sys.props.getOrElse(name, "false"))
+
+  private def readPopulateScope(): Option[Set[String]] = {
+    sys.props.get("socket.populateFilesFor").map(_.trim).filter(_.nonEmpty) match {
+      case None => None
+      case Some(path) =>
+        val f = new java.io.File(path)
+        if (!f.exists) {
+          println("[socket-facts] WARN populateFilesFor file not found; recording files for all resolved artifacts")
+          None
+        } else {
+          val src = scala.io.Source.fromFile(f, "UTF-8")
+          try {
+            val set = src.getLines().map(_.trim).filter(_.nonEmpty).toSet
+            if (set.isEmpty) {
+              println("[socket-facts] WARN populateFilesFor file empty; recording files for all resolved artifacts")
+              None
+            } else {
+              println("[socket-facts] --with-files scoped to " + set.size + " SBOM artifact(s)")
+              Some(set)
+            }
+          } finally src.close()
+        }
+    }
+  }
+
+  private def gavKey(m: ModuleID): String = {
+    def s(v: String): String = if (v == null) "" else v
+    s(m.organization) + ":" + s(m.name) + ":" + s(m.revision)
+  }
+
+  private def coordOf(m: ModuleID): String = {
+    val rev = m.revision
+    m.organization + ":" + m.name + (if (rev != null && rev.nonEmpty) ":" + rev else "")
+  }
+
+  private def extOf(a: Artifact): String = {
+    val e = a.extension
+    if (e == null || e.isEmpty) "jar" else e
+  }
+
+  private def classifierOf(a: Artifact): String =
+    a.classifier.getOrElse("")
+
+  // Backslash-escape so a value can never break line/field framing (see records.ts unescape).
+  private def esc(v: String): String = {
+    if (v == null) ""
+    else v.replace("\\", "\\\\").replace("\t", "\\t").replace("\n", "\\n").replace("\r", "\\r")
+  }
+
+  private final case class Failure(coord: String, detail: String, config: String)
+
+  private final case class Coord(
+      org: String,
+      name: String,
+      version: String,
+      ext: String,
+      classifier: String
+  ) {
+    val id: String = Seq(org, name, ext, classifier, version).filter(_.nonEmpty).mkString(":")
+  }
+
+  private final class Node(val coord: Coord) {
+    val children = mutable.TreeSet.empty[String]
+    var direct = false
+    // External artifact's resolved jar(s); --with-files only.
+    val targets = mutable.TreeSet.empty[String]
+  }
+
+  private final class RootTree(
+      val projectKey: String,
+      val config: String,
+      val prod: Boolean,
+      val nodes: mutable.LinkedHashMap[String, Node]
+  )
+}

package/dist/shadow-npm-bin2.js

@@ -3,8 +3,8 @@
 var constants = require('./constants.js');
 var require$$0 = require('node:url');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
+var debug = require('../external/@socketsecurity/registry/lib/debug');
+var objects = require('../external/@socketsecurity/registry/lib/objects');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var utils = require('./utils.js');
 
@@ -34,7 +34,7 @@ async function shadowNpmBase(binName, args = process.argv.slice(2), options, ext
     __proto__: null,
     ...options
   };
-  let cwd = require$$11.getOwn(spawnOpts, 'cwd') ?? process.cwd();
+  let cwd = objects.getOwn(spawnOpts, 'cwd') ?? process.cwd();
   if (cwd instanceof URL) {
     cwd = require$$0.fileURLToPath(cwd);
   }
@@ -51,7 +51,7 @@ async function shadowNpmBase(binName, args = process.argv.slice(2), options, ext
   // and package.json files.
   '--allow-fs-read=*', `--allow-fs-write=${cwd}/*`, `--allow-fs-write=${constants.default.npmGlobalPrefix}/*`, `--allow-fs-write=${constants.default.npmCachePath}/*`] : [];
   const useAudit = rawBinArgs.includes('--audit');
-  const useDebug = require$$9.isDebug('stdio');
+  const useDebug = debug.isDebug('stdio');
   const useNodeOptions = nodeOptionsArg || permArgs.length;
   const binArgs = rawBinArgs.filter(a => !agent.isNpmAuditFlag(a) && !agent.isNpmProgressFlag(a));
   const isSilent = !useDebug && !binArgs.some(agent.isNpmLoglevelFlag);
@@ -62,7 +62,7 @@ async function shadowNpmBase(binName, args = process.argv.slice(2), options, ext
     cwd,
     onlyDirectories: true
   })) ? [] : ['--no-audit'];
-  const stdio = ensureIpcInStdio(require$$11.getOwn(spawnOpts, 'stdio'));
+  const stdio = ensureIpcInStdio(objects.getOwn(spawnOpts, 'stdio'));
   const realBinPath = isShadowNpm ? await utils.installNpmLinks(constants.default.shadowBinPath) : await utils.installNpxLinks(constants.default.shadowBinPath);
   const spawnPromise = spawn.spawn(constants.default.execPath, [...constants.default.nodeNoWarningsFlags, ...constants.default.nodeDebugFlags, ...constants.default.nodeHardenFlags, ...constants.default.nodeMemoryFlags, ...(constants.default.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.default.instrumentWithSentryPath] : []), '--require', constants.default.shadowNpmInjectPath, realBinPath, ...noAuditArgs, ...(useNodeOptions ? [`--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}'`] : []), '--no-fund',
   // Add '--no-progress' to fix input being swallowed by the npm spinner.
@@ -98,5 +98,5 @@ async function shadowNpmBin(args = process.argv.slice(2), options, extra) {
 exports.ensureIpcInStdio = ensureIpcInStdio;
 exports.shadowNpmBase = shadowNpmBase;
 exports.shadowNpmBin = shadowNpmBin;
-//# debugId=6d18cbc8-e145-4f23-9c89-eb5694f263dd
+//# debugId=b8a12df1-9dde-45ca-ba67-92fe3a3c3e08
 //# sourceMappingURL=shadow-npm-bin2.js.map

package/dist/shadow-npm-bin2.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-npm-bin2.js","sources":["../src/shadow/stdio-ipc.mts","../src/shadow/npm-base.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import type { StdioOptions } from 'node:child_process'\n\n/**\n * Ensures stdio configuration includes IPC channel for process communication.\n * Converts various stdio formats to include 'ipc' as the fourth element.\n */\nexport function ensureIpcInStdio(\n  stdio: StdioOptions | undefined,\n): StdioOptions {\n  if (typeof stdio === 'string') {\n    return [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      return stdio.concat('ipc')\n    }\n    return stdio\n  } else {\n    return ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n}\n","import { fileURLToPath } from 'node:url'\n\nimport {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/agent'\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { ensureIpcInStdio } from './stdio-ipc.mts'\nimport constants, {\n  FLAG_LOGLEVEL,\n  NODE_MODULES,\n  NPM,\n  NPX,\n} from '../constants.mts'\nimport { cmdFlagsToString } from '../utils/cmd.mts'\nimport { findUp } from '../utils/fs.mts'\nimport { getPublicApiToken } from '../utils/sdk.mts'\nimport { installNpmLinks, installNpxLinks } from '../utils/shadow-links.mts'\n\nimport type { IpcObject } from '../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowNpmBase(\n  binName: typeof NPM | typeof NPX,\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n\n  let cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const isShadowNpm = binName === NPM\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? [FLAG_LOGLEVEL, 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp(NODE_MODULES, { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  const stdio = ensureIpcInStdio(getOwn(spawnOpts, 'stdio'))\n\n  const realBinPath = isShadowNpm\n    ? await installNpmLinks(constants.shadowBinPath)\n    : await installNpxLinks(constants.shadowBinPath)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n","import { NPM } from '../../constants.mts'\nimport shadowNpmBase from '../npm-base.mts'\n\nimport type { ShadowBinOptions, ShadowBinResult } from '../npm-base.mts'\nimport type { SpawnExtra } from '@socketsecurity/registry/lib/spawn'\n\nexport type { ShadowBinOptions, ShadowBinResult }\n\nexport default async function shadowNpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  return await shadowNpmBase(NPM, args, options, extra)\n}\n"],"names":["env","__proto__","cwd","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;AAEA;AACA;AACA;AACA;AACO;AAGL;;;AAGE;AACE;AACF;AACA;AACF;;AAEA;AACF;;ACoBe;;AAOXA;;;AAGF;AAAMC;;;AAEN;;AAEEC;AACF;AAEA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGkDC;AAAsB;;AAMxE;AAIA;AAoBI;;AAEA;AACA;;AAMA;AACAH;;;;;AAKAI;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;AC7Ie;;AAMf;;;;","debugId":"6d18cbc8-e145-4f23-9c89-eb5694f263dd"}
+{"version":3,"file":"shadow-npm-bin2.js","sources":["../src/shadow/stdio-ipc.mts","../src/shadow/npm-base.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import type { StdioOptions } from 'node:child_process'\n\n/**\n * Ensures stdio configuration includes IPC channel for process communication.\n * Converts various stdio formats to include 'ipc' as the fourth element.\n */\nexport function ensureIpcInStdio(\n  stdio: StdioOptions | undefined,\n): StdioOptions {\n  if (typeof stdio === 'string') {\n    return [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      return stdio.concat('ipc')\n    }\n    return stdio\n  } else {\n    return ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n}\n","import { fileURLToPath } from 'node:url'\n\nimport {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/agent'\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { ensureIpcInStdio } from './stdio-ipc.mts'\nimport constants, {\n  FLAG_LOGLEVEL,\n  NODE_MODULES,\n  NPM,\n  NPX,\n} from '../constants.mts'\nimport { cmdFlagsToString } from '../utils/cmd.mts'\nimport { findUp } from '../utils/fs.mts'\nimport { getPublicApiToken } from '../utils/sdk.mts'\nimport { installNpmLinks, installNpxLinks } from '../utils/shadow-links.mts'\n\nimport type { IpcObject } from '../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowNpmBase(\n  binName: typeof NPM | typeof NPX,\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n\n  let cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const isShadowNpm = binName === NPM\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? [FLAG_LOGLEVEL, 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp(NODE_MODULES, { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  const stdio = ensureIpcInStdio(getOwn(spawnOpts, 'stdio'))\n\n  const realBinPath = isShadowNpm\n    ? await installNpmLinks(constants.shadowBinPath)\n    : await installNpxLinks(constants.shadowBinPath)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n","import { NPM } from '../../constants.mts'\nimport shadowNpmBase from '../npm-base.mts'\n\nimport type { ShadowBinOptions, ShadowBinResult } from '../npm-base.mts'\nimport type { SpawnExtra } from '@socketsecurity/registry/lib/spawn'\n\nexport type { ShadowBinOptions, ShadowBinResult }\n\nexport default async function shadowNpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  return await shadowNpmBase(NPM, args, options, extra)\n}\n"],"names":["env","__proto__","cwd","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;AAEA;AACA;AACA;AACA;AACO;AAGL;;;AAGE;AACE;AACF;AACA;AACF;;AAEA;AACF;;ACoBe;;AAOXA;;;AAGF;AAAMC;;;AAEN;;AAEEC;AACF;AAEA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGkDC;AAAsB;;AAMxE;AAIA;AAoBI;;AAEA;AACA;;AAMA;AACAH;;;;;AAKAI;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;AC7Ie;;AAMf;;;;","debugId":"b8a12df1-9dde-45ca-ba67-92fe3a3c3e08"}