@socketsecurity/lib 6.0.3 → 6.0.5

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [6.0.5](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.5) - 2026-05-28
+
+### Fixed
+
+- **`/*@__PURE__*/` annotations in three modules** were positioned where rolldown (and any bundler honoring tree-shaking pure-call hints) ignored them, emitting `INVALID_ANNOTATION` warnings during downstream builds. The annotations are now adjacent to their `require()` call expressions in `globs/matcher` (`getMatchesGlob`'s `path.matchesGlob` probe) and `strings/width` (`getEastAsianWidth`'s lazy load). A stale `/*@__PURE__*/` on the `Logger` class declaration in `logger/node` was removed — class declarations are not call expressions and the annotation was being silently dropped.
+
+## [6.0.4](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.4) - 2026-05-28
+
+### Added
+
+- **`shell/quote` — `quote(argv)`.** Escape an argv array into a single POSIX-`sh`-safe command string for display, logging, or copy-pasteable reproductions. Wraps the vendored `shell-quote`. For spawning, prefer `child_process.spawn` with an argv array over quoting into a shell string.
+- **`shell/parse` — `parseShell(line)`.** Tokenize a command line into typed entries (bare strings, operators, comments, globs), preserving shell structure. Use when you need the operators / comments back; for plain argv extraction continue to use `argv/parse-args-string`.
+
+### Changed
+
+- **`argv/parse-args-string` now delegates to the vendored `shell-quote` parser** instead of the hand-rolled regex. Output narrows to bare-string tokens: inner quotes on mixed `key="value"` tokens are stripped (`--bar="x y"` → `--bar=x y`), `$VAR` collapses to empty, operators and comments are dropped. The function's own `@example` already documented the stripped form; only one unit test relied on the old shape.
+
+### Fixed
+
+- **`make-fetch-happen` fetcher is now lazily initialized.** `packages/operations.ts` was creating the fetcher at module load, which forced `make-fetch-happen` (and the npm-pack bundle behind it) to load for any consumer of the module — even ones that only used pure helpers. Initialization now defers to first use.
+- **`Global*` primordial aliases normalize embedded acronyms.** The generator was title-casing the first letter only, leaving embedded acronyms screaming (`encodeURIComponent` → `GlobalEncodeURIComponent`). DOM/URI/URL now lowercase past the first letter so aliases read as single TitleCase words. Concrete renames in `DEFAULT_ALIAS_MAP`: `GlobalDecodeURIComponent` → `GlobalDecodeUriComponent`, `GlobalEncodeURIComponent` → `GlobalEncodeUriComponent`.
+
 ## [6.0.3](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.3) - 2026-05-26
 
 ### Added

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,45 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) {
+		__defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	}
+	if (!no_symbols) {
+		__defProp(target, Symbol.toStringTag, { value: "Module" });
+	}
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+
+exports.__exportAll = __exportAll;
+exports.__toESM = __toESM;

package/dist/abort/signal.js

@@ -1,64 +1,58 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var signal_exports = {};
-__export(signal_exports, {
-  createCompositeAbortSignal: () => createCompositeAbortSignal,
-  createTimeoutSignal: () => createTimeoutSignal
-});
-module.exports = __toCommonJS(signal_exports);
-var import_error = require("../primordials/error");
-var import_math = require("../primordials/math");
-var import_number = require("../primordials/number");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_math = require('../primordials/math.js');
+const require_primordials_number = require('../primordials/number.js');
+
+//#region src/abort/signal.ts
+/**
+* @file Abort signal utilities — composite signal construction from multiple
+*   sources and timeout-driven signal creation.
+*/
+/**
+* Create a composite AbortSignal from multiple signals.
+*
+* @example
+*   ;```typescript
+*   const ac1 = new AbortController()
+*   const ac2 = new AbortController()
+*   const signal = createCompositeAbortSignal(ac1.signal, ac2.signal)
+*   ```
+*/
 function createCompositeAbortSignal(...signals) {
-  const validSignals = signals.filter((s) => s != null);
-  if (validSignals.length === 0) {
-    return new AbortController().signal;
-  }
-  if (validSignals.length === 1) {
-    return validSignals[0];
-  }
-  const controller = new AbortController();
-  for (const signal of validSignals) {
-    if (signal.aborted) {
-      controller.abort();
-      return controller.signal;
-    }
-    signal.addEventListener("abort", () => controller.abort(), { once: true });
-  }
-  return controller.signal;
+	const validSignals = signals.filter((s) => s != null);
+	if (validSignals.length === 0) return new AbortController().signal;
+	if (validSignals.length === 1) return validSignals[0];
+	const controller = new AbortController();
+	for (const signal of validSignals) {
+		if (signal.aborted) {
+			controller.abort();
+			return controller.signal;
+		}
+		signal.addEventListener("abort", () => controller.abort(), { once: true });
+	}
+	return controller.signal;
 }
+/**
+* Create an AbortSignal that triggers after a timeout.
+*
+* @example
+*   ;```typescript
+*   const signal = createTimeoutSignal(5000) // aborts after 5 seconds
+*   fetch('https://example.com', { signal })
+*   ```
+*
+* @throws {TypeError} If `ms` is not a number, is NaN, is not finite, or is not
+*   positive.
+*/
 function createTimeoutSignal(ms) {
-  if (typeof ms !== "number" || (0, import_number.NumberIsNaN)(ms)) {
-    throw new import_error.TypeErrorCtor("timeout must be a number");
-  }
-  if (!(0, import_number.NumberIsFinite)(ms)) {
-    throw new import_error.TypeErrorCtor("timeout must be a finite number");
-  }
-  if (ms <= 0) {
-    throw new import_error.TypeErrorCtor("timeout must be a positive number");
-  }
-  return AbortSignal.timeout((0, import_math.MathCeil)(ms));
+	if (typeof ms !== "number" || require_primordials_number.NumberIsNaN(ms)) throw new require_primordials_error.TypeErrorCtor("timeout must be a number");
+	if (!require_primordials_number.NumberIsFinite(ms)) throw new require_primordials_error.TypeErrorCtor("timeout must be a finite number");
+	if (ms <= 0) throw new require_primordials_error.TypeErrorCtor("timeout must be a positive number");
+	return AbortSignal.timeout(require_primordials_math.MathCeil(ms));
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createCompositeAbortSignal,
-  createTimeoutSignal
-});
+
+//#endregion
+exports.createCompositeAbortSignal = createCompositeAbortSignal;
+exports.createTimeoutSignal = createTimeoutSignal;

package/dist/ai/discover.js

@@ -1,128 +1,128 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var discover_exports = {};
-__export(discover_exports, {
-  cachePathFor: () => cachePathFor,
-  discoverAiAgents: () => discoverAiAgents,
-  discoverFresh: () => discoverFresh,
-  getDiscoveredAiAgents: () => getDiscoveredAiAgents,
-  readDiskCache: () => readDiskCache,
-  resetAiAgentDiscoveryCache: () => resetAiAgentDiscoveryCache,
-  writeDiskCache: () => writeDiskCache
-});
-module.exports = __toCommonJS(discover_exports);
-var import_node_fs = require("node:fs");
-var import_promises = require("node:fs/promises");
-var import_node_path = __toESM(require("node:path"), 1);
-var import_which = require("../bin/which");
-var import_message = require("../errors/message");
-var import_default = require("../logger/default");
-var import_json = require("../primordials/json");
-const logger = (0, import_default.getDefaultLogger)();
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_json = require('../primordials/json.js');
+const require_bin_which = require('../bin/which.js');
+const require_errors_message = require('../errors/message.js');
+const require_logger_default = require('../logger/default.js');
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+
+//#region src/ai/discover.mts
+/**
+* @file Detect which AI agent CLIs are installed on PATH. Strategy:
+*   which()-based lookup with a two-tier cache:
+*
+*   1. In-process Map — survives until the Node process exits.
+*   2. On-disk JSON at `<repo>/.cache/agent-discovery.json`, TTL 1h — survives
+*      across subprocess invocations (per-file ai-lint-fix batches) without
+*      re-running which(). Cache invalidation: stale on-disk cache is detected
+*      by mtime comparison; missing or expired → fresh which() pass + rewrite.
+*      Why two tiers: hooks and skills spawn dozens of short-lived Node
+*      processes per session. In-process alone misses the cross-process
+*      speedup; on-disk alone hits the filesystem on every call. The
+*      combination keeps repeated lookups under a millisecond after the
+*      cold-start cost.
+*/
+const logger = require_logger_default.getDefaultLogger();
 const KNOWN_AGENTS = [
-  "claude",
-  "codex",
-  "gemini",
-  "opencode"
+	"claude",
+	"codex",
+	"gemini",
+	"opencode"
 ];
-const CACHE_TTL_MS = 60 * 60 * 1e3;
+/**
+* Cache TTL in milliseconds (1 hour).
+*/
+const CACHE_TTL_MS = 3600 * 1e3;
 let inProcessCache;
 function cachePathFor(repoRoot) {
-  return import_node_path.default.join(repoRoot, ".cache", "agent-discovery.json");
+	return node_path.default.join(repoRoot, ".cache", "agent-discovery.json");
 }
+/**
+* Discover which AI agent CLIs are installed.
+*
+* @param options.repoRoot - Where to read/write the on-disk cache. Defaults to
+*   process.cwd(). Skill runners typically pass the target repo's root.
+* @param options.refresh - When true, bypass both caches and re-run which().
+*   Useful after `npm i -g <agent>` mid-session.
+*
+*   Returns a map of agent → absolute binary path. Agents that aren't installed
+*   are absent from the map (not present-with-undefined), so callers can use
+*   `'claude' in agents` for the existence check.
+*/
 async function discoverAiAgents(options = {}) {
-  const { refresh = false, repoRoot = process.cwd() } = options;
-  if (!refresh && inProcessCache) {
-    return inProcessCache;
-  }
-  const cachePath = cachePathFor(repoRoot);
-  if (!refresh) {
-    const fromDisk = readDiskCache(cachePath);
-    if (fromDisk) {
-      inProcessCache = fromDisk;
-      return fromDisk;
-    }
-  }
-  const fresh = discoverFresh();
-  inProcessCache = fresh;
-  await writeDiskCache(cachePath, fresh);
-  return fresh;
+	const { refresh = false, repoRoot = process.cwd() } = options;
+	if (!refresh && inProcessCache) return inProcessCache;
+	const cachePath = cachePathFor(repoRoot);
+	if (!refresh) {
+		const fromDisk = readDiskCache(cachePath);
+		if (fromDisk) {
+			inProcessCache = fromDisk;
+			return fromDisk;
+		}
+	}
+	const fresh = discoverFresh();
+	inProcessCache = fresh;
+	await writeDiskCache(cachePath, fresh);
+	return fresh;
 }
 function discoverFresh() {
-  const out = {};
-  for (const name of KNOWN_AGENTS) {
-    const found = (0, import_which.whichSync)(name);
-    if (typeof found === "string" && found) {
-      out[name] = found;
-    }
-  }
-  return out;
+	const out = {};
+	for (const name of KNOWN_AGENTS) {
+		const found = require_bin_which.whichSync(name);
+		if (typeof found === "string" && found) out[name] = found;
+	}
+	return out;
 }
+/**
+* Synchronous in-process lookup. Skips disk cache + which(). Returns undefined
+* if discoverAiAgents() hasn't been called yet in this process, OR returns the
+* most recent discovery result.
+*
+* Useful in fast paths where the caller has already populated the cache and
+* just wants to read it back.
+*/
 function getDiscoveredAiAgents() {
-  return inProcessCache;
+	return inProcessCache;
 }
 function readDiskCache(cachePath) {
-  if (!(0, import_node_fs.existsSync)(cachePath)) {
-    return void 0;
-  }
-  try {
-    const raw = (0, import_node_fs.readFileSync)(cachePath, "utf8");
-    const parsed = (0, import_json.JSONParse)(raw);
-    if (typeof parsed !== "object" || parsed === null || typeof parsed.writtenAt !== "number" || Date.now() - parsed.writtenAt > CACHE_TTL_MS) {
-      return void 0;
-    }
-    return parsed.agents;
-  } catch {
-    return void 0;
-  }
+	if (!(0, node_fs.existsSync)(cachePath)) return;
+	try {
+		const parsed = require_primordials_json.JSONParse((0, node_fs.readFileSync)(cachePath, "utf8"));
+		if (typeof parsed !== "object" || parsed === null || typeof parsed.writtenAt !== "number" || Date.now() - parsed.writtenAt > CACHE_TTL_MS) return;
+		return parsed.agents;
+	} catch {
+		return;
+	}
 }
+/**
+* Reset the in-process cache. Tests use this; production callers shouldn't need
+* it (use `refresh: true` on discoverAiAgents()).
+*/
 function resetAiAgentDiscoveryCache() {
-  inProcessCache = void 0;
+	inProcessCache = void 0;
 }
 async function writeDiskCache(cachePath, agents) {
-  try {
-    await (0, import_promises.mkdir)(import_node_path.default.dirname(cachePath), { recursive: true });
-    const payload = { agents, writtenAt: Date.now() };
-    (0, import_node_fs.writeFileSync)(cachePath, (0, import_json.JSONStringify)(payload, void 0, 2) + "\n");
-  } catch (e) {
-    logger.error(`discoverAiAgents: cache write failed (${(0, import_message.errorMessage)(e)})`);
-  }
+	try {
+		await (0, node_fs_promises.mkdir)(node_path.default.dirname(cachePath), { recursive: true });
+		(0, node_fs.writeFileSync)(cachePath, require_primordials_json.JSONStringify({
+			agents,
+			writtenAt: Date.now()
+		}, void 0, 2) + "\n");
+	} catch (e) {
+		logger.error(`discoverAiAgents: cache write failed (${require_errors_message.errorMessage(e)})`);
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cachePathFor,
-  discoverAiAgents,
-  discoverFresh,
-  getDiscoveredAiAgents,
-  readDiskCache,
-  resetAiAgentDiscoveryCache,
-  writeDiskCache
-});
+
+//#endregion
+exports.cachePathFor = cachePathFor;
+exports.discoverAiAgents = discoverAiAgents;
+exports.discoverFresh = discoverFresh;
+exports.getDiscoveredAiAgents = getDiscoveredAiAgents;
+exports.readDiskCache = readDiskCache;
+exports.resetAiAgentDiscoveryCache = resetAiAgentDiscoveryCache;
+exports.writeDiskCache = writeDiskCache;

package/dist/ai/profiles.js

@@ -1,68 +1,97 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var profiles_exports = {};
-__export(profiles_exports, {
-  AI_PROFILE: () => AI_PROFILE
-});
-module.exports = __toCommonJS(profiles_exports);
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/ai/profiles.mts
+/**
+* Capability ladder of lockdown profiles, ordered least → most capable. Key
+* order documents the ladder; each tier is a strict superset of the previous
+* tier's tool surface.
+*/
 const AI_PROFILE = {
-  read: {
-    allow: [],
-    disallow: ["Agent", "Bash", "Edit", "MultiEdit", "Write"],
-    permissionMode: "dontAsk",
-    tools: ["Glob", "Grep", "Read", "WebFetch", "WebSearch"]
-  },
-  // No Write / MultiEdit: edits land in existing files, never create new ones.
-  edit: {
-    allow: [],
-    disallow: ["Agent", "Bash", "MultiEdit", "WebFetch", "WebSearch", "Write"],
-    permissionMode: "acceptEdits",
-    tools: ["Edit", "Glob", "Grep", "Read"]
-  },
-  // MultiEdit + Write added: may create files. Bash still denied.
-  create: {
-    allow: [],
-    disallow: ["Agent", "Bash", "WebFetch", "WebSearch"],
-    permissionMode: "acceptEdits",
-    tools: ["Edit", "Glob", "Grep", "MultiEdit", "Read", "Write"]
-  },
-  // Bash allowlisted to git / pnpm / node only; anything else is denied.
-  full: {
-    allow: [
-      "Bash(git status:*)",
-      "Bash(git diff:*)",
-      "Bash(git log:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(node:*)",
-      "Bash(pnpm exec:*)",
-      "Bash(pnpm run:*)",
-      "Bash(pnpm test:*)"
-    ],
-    disallow: ["Agent", "WebFetch", "WebSearch"],
-    permissionMode: "acceptEdits",
-    tools: ["Bash", "Edit", "Glob", "Grep", "MultiEdit", "Read", "Write"]
-  }
+	read: {
+		allow: [],
+		disallow: [
+			"Agent",
+			"Bash",
+			"Edit",
+			"MultiEdit",
+			"Write"
+		],
+		permissionMode: "dontAsk",
+		tools: [
+			"Glob",
+			"Grep",
+			"Read",
+			"WebFetch",
+			"WebSearch"
+		]
+	},
+	edit: {
+		allow: [],
+		disallow: [
+			"Agent",
+			"Bash",
+			"MultiEdit",
+			"WebFetch",
+			"WebSearch",
+			"Write"
+		],
+		permissionMode: "acceptEdits",
+		tools: [
+			"Edit",
+			"Glob",
+			"Grep",
+			"Read"
+		]
+	},
+	create: {
+		allow: [],
+		disallow: [
+			"Agent",
+			"Bash",
+			"WebFetch",
+			"WebSearch"
+		],
+		permissionMode: "acceptEdits",
+		tools: [
+			"Edit",
+			"Glob",
+			"Grep",
+			"MultiEdit",
+			"Read",
+			"Write"
+		]
+	},
+	full: {
+		allow: [
+			"Bash(git status:*)",
+			"Bash(git diff:*)",
+			"Bash(git log:*)",
+			"Bash(git add:*)",
+			"Bash(git commit:*)",
+			"Bash(node:*)",
+			"Bash(pnpm exec:*)",
+			"Bash(pnpm run:*)",
+			"Bash(pnpm test:*)"
+		],
+		disallow: [
+			"Agent",
+			"WebFetch",
+			"WebSearch"
+		],
+		permissionMode: "acceptEdits",
+		tools: [
+			"Bash",
+			"Edit",
+			"Glob",
+			"Grep",
+			"MultiEdit",
+			"Read",
+			"Write"
+		]
+	}
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  AI_PROFILE
-});
+
+//#endregion
+exports.AI_PROFILE = AI_PROFILE;