@socketsecurity/cli 1.1.154 → 1.1.156

package/dist/utils.js

@@ -15,6 +15,7 @@ var flags = require('./flags.js');
 var path = require('node:path');
 var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var prompts = require('../external/@socketsecurity/registry/lib/prompts');
+var env = require('../external/@socketsecurity/registry/lib/env');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var fs = require('node:fs');
 var fs$2 = require('node:fs/promises');
@@ -27,16 +28,17 @@ var url = require('../external/@socketsecurity/registry/lib/url');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
+var process$1 = require('node:process');
+var require$$7 = require('node:timers/promises');
+var promises = require('../external/@socketsecurity/registry/lib/promises');
 var require$$13 = require('node:https');
 var web = require('node:stream/web');
 var require$$0$1 = require('node:url');
 var globs = require('../external/@socketsecurity/registry/lib/globs');
 var streams = require('../external/@socketsecurity/registry/lib/streams');
-var require$$7 = require('node:timers/promises');
 var require$$10 = require('node:util');
 var require$$12 = require('node:http');
 var node_tls = require('node:tls');
-var process$1 = require('node:process');
 var require$$0 = require('node:crypto');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -4003,6 +4005,7 @@ function extractOwner(owner) {
  * Repository Information:
  * - detectDefaultBranch: Find default branch (main/master/develop/etc)
  * - getBaseBranch: Determine base branch (respects GitHub Actions env)
+ * - getCiBranch: Branch name a GitHub Actions run is on
  * - getRepoInfo: Extract owner/repo from git remote URL
  * - gitBranch: Get current branch or commit hash
  */
@@ -4048,6 +4051,29 @@ async function getBaseBranch(cwd = process.cwd()) {
   // https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#about-the-default-branch
   return 'main';
 }
+
+/**
+ * The branch a GitHub Actions workflow run is on, or undefined when the
+ * environment does not identify one. Read straight from process.env because
+ * GITHUB_HEAD_REF is not part of the constants.ENV snapshot.
+ */
+function getCiBranch() {
+  // The head branch of a pull request, only set for pull_request and
+  // pull_request_target events. Checked first because GITHUB_REF_NAME is
+  // '<pr_number>/merge' on those events, which is not a branch name.
+  // https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
+  const githubHeadRef = env.envAsString(process.env['GITHUB_HEAD_REF']);
+  if (githubHeadRef) {
+    return githubHeadRef;
+  }
+  // The pushed ref. GITHUB_REF_TYPE tells branches and tags apart, and a tag
+  // is not a branch name.
+  const githubRefName = env.envAsString(process.env['GITHUB_REF_NAME']);
+  if (env.envAsString(process.env['GITHUB_REF_TYPE']) === 'branch' && githubRefName) {
+    return githubRefName;
+  }
+  return undefined;
+}
 async function getRepoInfo(cwd = process.cwd()) {
   let info;
   try {
@@ -4094,6 +4120,14 @@ async function gitBranch(cwd = process.cwd()) {
       error: e
     });
   }
+  // Detached HEAD is the normal state in CI checkouts (actions/checkout),
+  // where the commit-SHA fallback below would mislabel the scan's branch — a
+  // SHA can never match the repo's default branch, so scans vanish from the
+  // Main/PR tabs. Prefer the branch the CI run says it is on.
+  const ciBranch = getCiBranch();
+  if (ciBranch) {
+    return ciBranch;
+  }
   // Fallback to using rev-parse to get the short commit hash in a
   // detached HEAD state.
   try {
@@ -4579,6 +4613,67 @@ function getSupportedFilePatterns(supportedFiles) {
   }
   return patterns;
 }
+// Whether `targetPath` is ignored by the gitignore matchers on its ancestor
+// directories, root to leaf, last match wins. Each matcher tests the path
+// relative to its own directory (how git stores patterns); `isDir` appends a
+// trailing slash so a directory-only rule like `build/` matches the directory.
+// `targetPath` is POSIX, relative to cwd.
+function pathIgnoredByChain(targetPath, isDir, matchersByDir) {
+  let ignored = false;
+  // Ancestor directories of targetPath: '', then each parent dir prefix.
+  const segments = targetPath.split('/');
+  segments.pop();
+  const dirs = [''];
+  let prefix = '';
+  for (let i = 0, {
+      length
+    } = segments; i < length; i += 1) {
+    prefix = prefix ? `${prefix}/${segments[i]}` : segments[i];
+    dirs.push(prefix);
+  }
+  for (let i = 0, {
+      length
+    } = dirs; i < length; i += 1) {
+    const dir = dirs[i];
+    const matchers = matchersByDir.get(dir);
+    if (!matchers) {
+      continue;
+    }
+    const relToDir = dir === '' ? targetPath : targetPath.slice(dir.length + 1);
+    const probe = isDir ? `${relToDir}/` : relToDir;
+    for (let j = 0, len = matchers.length; j < len; j += 1) {
+      const result = matchers[j].test(probe);
+      if (result.ignored) {
+        ignored = true;
+      } else if (result.unignored) {
+        ignored = false;
+      }
+    }
+  }
+  return ignored;
+}
+
+// Whether `relPath` is ignored, honoring git's rule that an excluded directory
+// is never descended into: a file is ignored if any ancestor directory is, and a
+// deeper `!` cannot re-include a file under an excluded parent. Walks ancestors
+// top-down, short-circuiting on the first excluded one. POSIX, relative to cwd.
+function isIgnoredAlongChain(relPath, matchersByDir) {
+  // Outside cwd (a `..` prefix) or empty: outside every gitignore's domain, and
+  // the `ignore` package throws on such input, so report not-ignored.
+  if (!relPath || relPath === '..' || relPath.startsWith('../')) {
+    return false;
+  }
+  const segments = relPath.split('/');
+  const last = segments.length - 1;
+  let prefix = '';
+  for (let i = 0; i <= last; i += 1) {
+    prefix = prefix ? `${prefix}/${segments[i]}` : segments[i];
+    if (pathIgnoredByChain(prefix, i < last, matchersByDir)) {
+      return true;
+    }
+  }
+  return false;
+}
 async function globWithGitIgnore(patterns, options) {
   const {
     additionalIgnores,
@@ -4590,33 +4685,36 @@ async function globWithGitIgnore(patterns, options) {
     __proto__: null,
     ...options
   };
+
+  // Anchored minimatch patterns for fast-glob: built-in ignored dirs, venv
+  // markers, projectIgnorePaths, and every discovered `.gitignore`, translated
+  // and anchored from cwd. When no pattern is negated, fast-glob does the whole
+  // gitignore match from this set.
   const ignores = new Set(IGNORED_DIR_PATTERNS);
 
-  // CLI-supplied `additionalIgnores` are already anchored minimatch — they
-  // must not pass through the `ignore` package (whose gitignore "match
-  // anywhere" semantics would re-interpret a bare `tests` to match
-  // `subdir/tests/foo.json`). Keep them in fast-glob's ignore list across
-  // both paths; only gitignore-translated entries go into the `ig` matcher.
+  // CLI-supplied `additionalIgnores` are already anchored minimatch from cwd, so
+  // they go straight to fast-glob and never enter the gitignore matchers (whose
+  // "match anywhere" semantics would re-interpret a bare `tests` as `**/tests`).
   const cliMinimatchIgnores = additionalIgnores ?? [];
   const projectIgnorePaths = socketConfig?.projectIgnorePaths;
-  const projectIgnoreGlobs = Array.isArray(projectIgnorePaths) ? ignoreFileLinesToGlobPatterns(projectIgnorePaths, path.join(cwd, '.gitignore'), cwd) : [];
+  const projectIgnoreLines = Array.isArray(projectIgnorePaths) ? projectIgnorePaths : [];
+  const projectIgnoreGlobs = projectIgnoreLines.length ? ignoreFileLinesToGlobPatterns(projectIgnoreLines, path.join(cwd, '.gitignore'), cwd) : [];
   for (const pattern of projectIgnoreGlobs) {
     ignores.add(pattern);
   }
 
-  // The discovery walk (`.gitignore` files plus `pyvenv.cfg` venv markers) has
-  // to honor the same directory exclusions as the package walk below. Otherwise
-  // an unreadable subtree (e.g. a postgres `pgdata` dir owned by another uid, or
-  // a Docker volume mount) makes fast-glob throw `EACCES: permission denied,
-  // scandir` *here* — before --exclude-paths (`cliMinimatchIgnores`) or
-  // projectIgnorePaths are ever applied to the main walk, which is why excluding
-  // the path did not help. `suppressErrors` is the backstop: a directory the
-  // user simply cannot read cannot contain manifests they could scan anyway, so
-  // skip it instead of aborting the whole `socket fix` / `socket scan` run.
-  // Negated patterns are dropped — for a discovery walk they could only
-  // re-include a subtree (never prevent a crash), and fast-glob treats `!`
-  // ignore entries inconsistently. Folding pyvenv.cfg discovery into this same
-  // walk avoids a second full-tree traversal.
+  // Raw per-directory `.gitignore` contents from discovery. Matchers are built
+  // from these only when a pattern is negated (see below).
+  const gitignoreFiles = [];
+  // Directory excludes from discovered pyvenv.cfg markers, so virtualenvs with
+  // non-conventional names are pruned. Fed to fast-glob's ignore on every path.
+  const venvGlobs = [];
+
+  // Discover `.gitignore` files and `pyvenv.cfg` venv markers in one walk,
+  // honoring the same dir exclusions as the package walk so an unreadable subtree
+  // (EACCES, foreign-uid pgdata, Docker mount) can't abort it. `suppressErrors`
+  // skips dirs the user cannot read; negated patterns are dropped here because
+  // fast-glob treats `!` ignore entries inconsistently.
   const discoveryStream = vendor.outExports.globStream(['**/.gitignore', `**/${PYVENV_CFG}`], {
     absolute: true,
     cwd,
@@ -4624,21 +4722,40 @@ async function globWithGitIgnore(patterns, options) {
     ignore: [...DEFAULT_IGNORE_FOR_GIT_IGNORE, ...projectIgnoreGlobs, ...cliMinimatchIgnores].filter(p => p.charCodeAt(0) !== 33 /*'!'*/).map(stripTrailingSlash),
     suppressErrors: true
   });
-  for await (const ignorePatterns of streams.transform(discoveryStream, async filepath => {
+  for await (const found of streams.transform(discoveryStream, async filepath => {
+    const dirRel = path$1.normalizePath(path.relative(cwd, path.dirname(filepath)));
     if (path.basename(filepath) === PYVENV_CFG) {
-      // A pyvenv.cfg sits at the venv root, so exclude the whole directory.
-      const relDir = path.relative(cwd, path.dirname(filepath)).replace(/\\/g, '/');
-      // An empty relDir means the scan target itself is a venv root; don't
-      // emit `/**`, which would exclude everything the user explicitly targeted.
-      return relDir ? [`${relDir}/**`] : [];
+      // A pyvenv.cfg sits at the venv root, so exclude the whole directory. An
+      // empty dirRel means the scan target itself is a venv root; don't emit
+      // `/**`, which would exclude everything the user explicitly targeted.
+      return {
+        content: '',
+        dir: dirRel,
+        patterns: dirRel ? [`${dirRel}/**`] : [],
+        venv: true
+      };
     }
-    return ignoreFileToGlobPatterns((await fs$1.safeReadFile(filepath)) ?? '', filepath, cwd);
+    const content = (await fs$1.safeReadFile(filepath)) ?? '';
+    return {
+      content,
+      dir: dirRel,
+      patterns: ignoreFileToGlobPatterns(content, filepath, cwd),
+      venv: false
+    };
   }, {
     concurrency: 8
   })) {
-    for (const p of ignorePatterns) {
+    for (const p of found.patterns) {
       ignores.add(p);
     }
+    if (found.venv) {
+      venvGlobs.push(...found.patterns);
+    } else if (found.content) {
+      gitignoreFiles.push({
+        content: found.content,
+        dir: found.dir
+      });
+    }
   }
   let hasNegatedPattern = false;
   for (const p of ignores) {
@@ -4652,41 +4769,72 @@ async function globWithGitIgnore(patterns, options) {
     absolute: true,
     cwd,
     dot: true,
-    ignore: hasNegatedPattern ? [...globs.defaultIgnore, ...cliMinimatchIgnores] : [...ignores, ...cliMinimatchIgnores].map(stripTrailingSlash),
+    // With a negation, the per-dir matcher chain (below) covers only gitignore
+    // and projectIgnore patterns, so fast-glob still prunes the built-in ignored
+    // dirs and discovered venvs. Without one, the full anchored set goes to
+    // fast-glob, which does the whole match.
+    ignore: hasNegatedPattern ? [...globs.defaultIgnore, ...IGNORED_DIR_PATTERNS, ...venvGlobs, ...cliMinimatchIgnores] : [...ignores, ...cliMinimatchIgnores].map(stripTrailingSlash),
     ...additionalOptions,
-    // Skip directories the running user cannot read rather than aborting the
-    // whole walk on the first `EACCES` (see the .gitignore discovery walk
-    // above for the full rationale). Pinned after `...additionalOptions` so a
-    // caller's options bag cannot accidentally flip it back to `false` and
-    // re-introduce the crash — `suppressErrors` is a safety invariant here, not
-    // a tunable.
+    // Skip dirs the running user cannot read instead of aborting on the first
+    // `EACCES`. Pinned after `...additionalOptions` so a caller's options bag
+    // cannot flip it off; it is a safety invariant, not a tunable.
     suppressErrors: true
   };
 
-  // When no filter is provided and no negated patterns exist, use the fast path.
+  // No negation and no filter: fast-glob's anchored ignore set is authoritative.
   if (!hasNegatedPattern && !filter) {
     return await vendor.outExports.glob(patterns, globOptions);
   }
-  // Add support for negated "ignore" patterns which many globbing libraries,
-  // including 'fast-glob', 'globby', and 'tinyglobby', lack support for.
-  // Use streaming to avoid unbounded memory accumulation.
-  // This is critical for large monorepos with 100k+ files.
+
+  // When a pattern is negated, match each candidate against the gitignore
+  // ancestor chain. One matcher per `.gitignore` is built from its raw lines and
+  // deduped by content via `igByContent`, keeping compiled-regex memory bounded
+  // by the number of DISTINCT `.gitignore` contents, not by file count (a single
+  // matcher over every anchored pattern can exhaust V8 code space on big repos).
+  let matchersByDir;
+  if (hasNegatedPattern) {
+    const byDir = new Map();
+    const igByContent = new Map();
+    const addMatcher = (dirRel, content) => {
+      let ig = igByContent.get(content);
+      if (!ig) {
+        ig = vendor.ignoreExports().add(content.split(/\r?\n/));
+        igByContent.set(content, ig);
+      }
+      const existing = byDir.get(dirRel);
+      if (existing) {
+        existing.push(ig);
+      } else {
+        byDir.set(dirRel, [ig]);
+      }
+    };
+    // projectIgnorePaths act as a root-level gitignore.
+    if (projectIgnoreLines.length) {
+      addMatcher('', projectIgnoreLines.join('\n'));
+    }
+    for (let i = 0, {
+        length
+      } = gitignoreFiles; i < length; i += 1) {
+      addMatcher(gitignoreFiles[i].dir, gitignoreFiles[i].content);
+    }
+    matchersByDir = byDir;
+  }
+
+  // Stream so memory stays bounded on large monorepos with 100k+ files: the
+  // optional caller filter drops non-matches before they accumulate. On the slow
+  // path each surviving entry is also re-checked against its gitignore ancestor
+  // chain, which carries the full negation support fast-glob lacks.
   const results = [];
-  const ig = hasNegatedPattern ? vendor.ignoreExports().add([...ignores]) : null;
   const stream = vendor.outExports.globStream(patterns, globOptions);
   for await (const p of stream) {
-    // Check gitignore patterns with negation support.
-    if (ig) {
-      // Note: the input files must be INSIDE the cwd. If you get strange looking
-      // relative path errors here, most likely your path is outside the given cwd.
-      const relPath = globOptions.absolute ? path.relative(cwd, p) : p;
-      if (ig.ignores(relPath)) {
+    if (matchersByDir) {
+      // Patterns are forward-slash anchored and tested relative to each
+      // gitignore's directory; normalize so a Windows backslash path matches.
+      const relPath = path$1.normalizePath(globOptions.absolute ? path.relative(cwd, p) : p);
+      if (isIgnoredAlongChain(relPath, matchersByDir)) {
         continue;
       }
     }
-    // Apply the optional filter to reduce memory usage.
-    // When scanning large monorepos, this filters early (e.g., to manifest files only)
-    // instead of accumulating all 100k+ files and filtering later.
     if (filter && !filter(p)) {
       continue;
     }
@@ -5087,6 +5235,17 @@ async function withTmpDir(prefix, fn) {
   }
 }
 
+// Symlink-resolved absolute path when the target exists (e.g. macOS symlinks
+// /tmp -> /private/tmp); falls back to a plain resolve so a not-yet-existing
+// path still gets a usable absolute value instead of throwing.
+async function realpathOrResolved(target) {
+  try {
+    return await fs.promises.realpath(target);
+  } catch {
+    return path.resolve(target);
+  }
+}
+
 function findBinPathDetailsSync(binName) {
   const rawBinPaths = bin.whichBinSync(binName, {
     all: true,
@@ -6725,6 +6884,35 @@ function findBinNextToNode(binName) {
   }
   return undefined;
 }
+const JS_ENTRY_EXTENSIONS = new Set(['.cjs', '.js', '.mjs']);
+
+/**
+ * Resolve a package manager bin path to a JavaScript entry `node` can run.
+ *
+ * Some version managers ship `npm` as a shell script instead of the usual shim
+ * that points at npm's JavaScript entry. mise writes a bash wrapper so it can
+ * run `mise reshim` after a global install. resolveBinPathSync only recognizes
+ * npm's own shim, by the `NPM_CLI_JS=` assignment inside it, and passes anything
+ * else through untouched, so the wrapper reaches us unchanged. We then hand it
+ * to `node` as the main module and the shell syntax throws a SyntaxError before
+ * npm ever starts (issue #946).
+ *
+ * When the resolved path is not JavaScript, fall back to the CLI entry inside
+ * npm's install directory, which findNpmDirPathSync already knows how to locate
+ * for this layout. A path we cannot map keeps its current value, so an
+ * unrecognized layout behaves exactly as it does today.
+ */
+function resolveBinPathToJsEntry(binPath, cliEntryName) {
+  if (JS_ENTRY_EXTENSIONS.has(path.extname(binPath).toLowerCase())) {
+    return binPath;
+  }
+  const npmDirPath = findNpmDirPathSync(binPath);
+  if (!npmDirPath) {
+    return binPath;
+  }
+  const jsEntryPath = path.join(npmDirPath, 'bin', cliEntryName);
+  return fs.existsSync(jsEntryPath) ? jsEntryPath : binPath;
+}
 let _npmBinPath;
 function getNpmBinPath() {
   if (_npmBinPath === undefined) {
@@ -6741,15 +6929,15 @@ function getNpmBinPathDetails() {
     // First try to find npm next to the node binary to avoid picking up
     // a project-local npm from node_modules/.bin on PATH.
     const npmNextToNode = findBinNextToNode(constants.NPM);
-    if (npmNextToNode) {
-      _npmBinPathDetails = {
-        name: constants.NPM,
-        path: npmNextToNode,
-        shadowed: false
-      };
-    } else {
-      _npmBinPathDetails = findBinPathDetailsSync(constants.NPM);
-    }
+    const details = npmNextToNode ? {
+      name: constants.NPM,
+      path: npmNextToNode,
+      shadowed: false
+    } : findBinPathDetailsSync(constants.NPM);
+    _npmBinPathDetails = details.path ? {
+      ...details,
+      path: resolveBinPathToJsEntry(details.path, 'npm-cli.js')
+    } : details;
   }
   return _npmBinPathDetails;
 }
@@ -6806,15 +6994,15 @@ function getNpxBinPathDetails() {
     // standalone npx package which bundles npm@5.1.0, incompatible
     // with Node 22+).
     const npxNextToNode = findBinNextToNode('npx');
-    if (npxNextToNode) {
-      _npxBinPathDetails = {
-        name: 'npx',
-        path: npxNextToNode,
-        shadowed: false
-      };
-    } else {
-      _npxBinPathDetails = findBinPathDetailsSync('npx');
-    }
+    const details = npxNextToNode ? {
+      name: 'npx',
+      path: npxNextToNode,
+      shadowed: false
+    } : findBinPathDetailsSync('npx');
+    _npxBinPathDetails = details.path ? {
+      ...details,
+      path: resolveBinPathToJsEntry(details.path, 'npx-cli.js')
+    } : details;
   }
   return _npxBinPathDetails;
 }
@@ -7420,20 +7608,20 @@ async function detectAndValidatePackageEnvironment(cwd, options) {
  * - Classifying a GitHub response as a blocking error (rate limit / abuse
  *   detection / auth) with a clear, actionable message.
  * - A bounded-retry request wrapper that respects `Retry-After` /
- *   `x-ratelimit-reset` for short reset windows and retries transient 5xx /
- *   network failures with capped exponential backoff.
+ *   `x-ratelimit-reset` for short reset windows and hands transient 5xx /
+ *   network failures to the fleet's shared `pRetry` for backoff.
  */
 
 // GitHub returns 429 for some secondary rate limits; there is no shared
 // constant for it in constants.mts, so define it locally.
 const HTTP_STATUS_TOO_MANY_REQUESTS = 429;
 
-// Retry at most this many times for transient (5xx / network) failures,
-// counting the initial attempt.
-const MAX_TRANSIENT_ATTEMPTS = 3;
-
-// Cap for exponential backoff between transient retries.
-const MAX_BACKOFF_MS = 10_000;
+// Base delay before the first transient retry. Mirrors the default in
+// @socketsecurity/lib's releases/github-retry-config, including the env var
+// name, so both socket-cli lines back off against the GitHub API on the same
+// schedule. Read live rather than captured at import so a test or a CI job can
+// set it to 0 and skip the real wallclock wait.
+const DEFAULT_RETRY_BASE_DELAY_MS = 5000;
 
 // Only wait-and-retry a rate-limited response when the reset window is at
 // most this many seconds. The usual primary-limit reset is up to an hour
@@ -7525,13 +7713,34 @@ function classifyGitHubResponse(status, headers, bodyText, context) {
   }
   return undefined;
 }
-function backoffMs(attempt) {
-  return Math.min(1000 * 2 ** (attempt - 1), MAX_BACKOFF_MS);
+
+/**
+ * Retry policy for transient GitHub failures. Same values as the shared
+ * GITHUB_RETRY_CONFIG in @socketsecurity/lib: two retries on top of the initial
+ * attempt, delay doubling each time, capped at 10 seconds. Built per call
+ * rather than at import so the env override is read live.
+ */
+function githubRetryOptions() {
+  return {
+    backoffFactor: 2,
+    baseDelayMs: env.envAsNumber(process$1.env['SOCKET_GITHUB_RETRY_BASE_DELAY_MS'], DEFAULT_RETRY_BASE_DELAY_MS),
+    maxDelayMs: 10_000,
+    retries: 2
+  };
 }
-function sleep(ms) {
-  return new Promise(resolve => {
-    setTimeout(resolve, ms);
-  });
+
+/**
+ * Thrown by one request attempt to tell `pRetry` what happened. `retryable`
+ * false means another attempt cannot help, so the retry loop stops early
+ * instead of burning its budget. The CResult is what the caller sees.
+ */
+class GitHubRequestFailure extends Error {
+  constructor(result, retryable) {
+    super(result.message);
+    this.name = 'GitHubRequestFailure';
+    this.result = result;
+    this.retryable = retryable;
+  }
 }
 
 /**
@@ -7549,7 +7758,8 @@ function sleep(ms) {
  *   short (<= CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS); otherwise surface the error
  *   immediately. Long primary-limit resets are not worth blocking on.
  * - Auth: never retried.
- * - 5xx / network: capped exponential backoff, MAX_TRANSIENT_ATTEMPTS total.
+ * - 5xx / network: handed to the fleet's shared `pRetry` for exponential
+ *   backoff, on the policy in `githubRetryOptions`.
  */
 async function githubApiRequest(url, init, context,
 // Injectable request implementation. Defaults to the real `apiFetch`;
@@ -7558,72 +7768,89 @@ async function githubApiRequest(url, init, context,
 fetchImpl = apiFetch) {
   const method = init.method || 'GET';
   let rateLimitWaitUsed = false;
-  for (let attempt = 1;; attempt += 1) {
+  // pRetry rethrows whichever error it stored first. Track the newest one
+  // ourselves so the caller always sees the failure that actually ended the
+  // run, not an earlier one it had already recovered past.
+  let lastFailure;
+  const fail = (result, retryable) => {
+    const failure = new GitHubRequestFailure(result, retryable);
+    lastFailure = failure;
+    return failure;
+  };
+  const attempt = async () => {
     debugApiRequest(method, url);
     let response;
     try {
-      // eslint-disable-next-line no-await-in-loop
       response = await fetchImpl(url, init);
       debugApiResponse(method, url, response.status);
     } catch (e) {
       debugApiResponse(method, url, undefined, e);
-      // Network-level failure (DNS, connection reset, timeout). Retry a few
-      // times with bounded backoff before giving up.
-      if (attempt < MAX_TRANSIENT_ATTEMPTS) {
-        debug$2.debugFn('notice', `retry: network error while ${context}`, attempt);
-        // eslint-disable-next-line no-await-in-loop
-        await sleep(backoffMs(attempt));
-        continue;
-      }
-      return {
+      // Network-level failure (DNS, connection reset, timeout).
+      throw fail({
         ok: false,
         message: 'Network error connecting to GitHub',
         cause: formatErrorWithDetail(`Network error while ${context}`, e)
-      };
+      }, true);
     }
-
-    // eslint-disable-next-line no-await-in-loop
     const bodyText = await response.text();
     const blocking = classifyGitHubResponse(response.status, response.headers, bodyText, context);
     if (blocking) {
       // Auth failures never succeed on retry.
       if (blocking.message === GITHUB_ERR_AUTH_FAILED) {
-        return blocking;
+        throw fail(blocking, false);
       }
-      // Rate limit / abuse: retry once, but only when the reset window is
-      // short enough to be worth waiting on.
+      // Rate limit / abuse: wait once, but only when the reset window is short
+      // enough to be worth waiting on.
       const waitSeconds = getRateLimitWaitSeconds(response.headers);
       if (!rateLimitWaitUsed && waitSeconds !== undefined && waitSeconds <= CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS) {
         rateLimitWaitUsed = true;
         logger.logger.info(`GitHub rate limit hit while ${context}; waiting ${waitSeconds}s before one retry...`);
-        // Add a second of slack so we retry just past the reset boundary.
-        // eslint-disable-next-line no-await-in-loop
-        await sleep((waitSeconds + 1) * 1000);
-        continue;
+        // GitHub told us exactly when the quota comes back, so this wait is
+        // honoring a server instruction rather than backing off. Backoff is
+        // pRetry's job and its delay is capped well below a reset window.
+        // A second of slack lands the retry just past the reset boundary.
+        await require$$7.setTimeout((waitSeconds + 1) * 1000);
+        throw fail(blocking, true);
       }
-      return blocking;
+      throw fail(blocking, false);
     }
 
-    // Transient server errors: retry with bounded backoff, then surface.
+    // Transient server errors.
     if (response.status >= constants.HTTP_STATUS_INTERNAL_SERVER_ERROR) {
-      if (attempt < MAX_TRANSIENT_ATTEMPTS) {
-        debug$2.debugFn('notice', `retry: GitHub ${response.status} while ${context}`, attempt);
-        // eslint-disable-next-line no-await-in-loop
-        await sleep(backoffMs(attempt));
-        continue;
-      }
-      return {
+      throw fail({
         ok: false,
         message: 'GitHub server error',
         cause: `GitHub server error (${response.status}) while ${context}. ` + 'GitHub may be experiencing issues; try again shortly.'
-      };
+      }, true);
     }
+    return {
+      response,
+      bodyText
+    };
+  };
+  try {
+    const data = await promises.pRetry(attempt, {
+      ...githubRetryOptions(),
+      onRetry(attemptNumber, e) {
+        if (e instanceof GitHubRequestFailure && !e.retryable) {
+          // Stop now; another attempt cannot change the answer.
+          return false;
+        }
+        debug$2.debugFn('notice', `retry: ${e instanceof Error ? e.message : 'failure'} while ${context}`, attemptNumber);
+        return undefined;
+      },
+      onRetryCancelOnFalse: true
+    });
     return {
       ok: true,
-      data: {
-        response,
-        bodyText
-      }
+      data
+    };
+  } catch {
+    /* c8 ignore next - `lastFailure` is set on every throw out of `attempt`. */
+    return lastFailure?.result ?? {
+      ok: false,
+      message: 'GitHub request failed',
+      cause: `GitHub request failed while ${context}.`
     };
   }
 }
@@ -8831,6 +9058,7 @@ exports.readOrDefaultSocketJsonUp = readOrDefaultSocketJsonUp;
 exports.readPnpmLockfile = readPnpmLockfile;
 exports.readSocketJsonCascade = readSocketJsonCascade;
 exports.readSocketJsonSync = readSocketJsonSync;
+exports.realpathOrResolved = realpathOrResolved;
 exports.runAgentInstall = runAgentInstall;
 exports.runSelfUpdateCheck = runSelfUpdateCheck;
 exports.safeNpa = safeNpa$1;
@@ -8860,5 +9088,5 @@ exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=588541a6-eef9-410e-a3c6-6f594e50db6b
+//# debugId=e72c7655-2d5e-4e48-bfdb-c488b68167b6
 //# sourceMappingURL=utils.js.map