@socketsecurity/lib 6.0.4 → 6.0.6

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [6.0.6](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.6) - 2026-06-01
+
+### Added
+
+- **`http-request` now negotiates and decompresses `gzip` / `br` response bodies.** Buffered requests advertise `Accept-Encoding: gzip, br` and transparently decompress responses by `Content-Encoding`. Node's HTTP client does neither, so a compressed Socket API response previously reached callers as raw deflated bytes. Streamed requests (`stream: true`, e.g. `httpDownload`) intentionally skip the `Accept-Encoding` header so piped-to-disk payloads stay raw and checksum cleanly. Callers can override (e.g. `'identity'`).
+- **`http-request/headers` — `basicAuthHeader(token)`.** Builds the Socket API Basic-auth shape (token-as-username, empty password) so call sites stop hand-rolling `Basic ${base64(token + ':')}`.
+- **`http-request` retry instrumentation.** Adds `Retry-Attempt`, `Retry-Max`, and `Retry-After` request headers on retried attempts so server-side logs can correlate a retry chain.
+- **`prim` CLI bin.** `prim` is now published as a `bin` entry (`dist/bin/prim.cjs`); installs from `@socketsecurity/lib` make `npx prim` work. Also new in this release: `prim --diff` for unified line-diffs in dry-run mode, multi-hop cycle detection in `validateRewrites`, and a two-phase apply with cross-batch validation.
+- **`sanitizeHeaders` shape-based redaction.** `isSensitiveHeaderName` regex (`auth | cookie | credential | key | password | secret | token`) covers custom token headers (`x-amz-security-token`, `api-key`, …) without an explicit allowlist. Same reasoning as "a denylist is itself a leak."
+- **`packages/provenance` — staged-publish detection.** `getTrustStatus` now reads `_npmUser.approver` and surfaces `stagedPublish: true` when a registry version was promoted out of staging via the 2FA-gated approve step (pnpm/pnpm#12056). Adds a new top tier to the trust ladder: `stagedPublish` ranks above `trustedPublisher` and `provenance`. The `TRUST_LEVELS` tuple (`'none' | 'provenance' | 'trustedPublisher' | 'stagedPublish'`), `getTrustLevel`, `getTrustLevelName`, `compareTrust`, and `didTrustDecrease` all extend to level 3.
+- **`words/pluralize` — `Intl.PluralRules` dictionary mode.** New `options.forms` accepts a `{ singular?, plural, zero?, two?, few?, many? }` dictionary keyed by CLDR plural category for locale-aware pluralization of irregulars and non-English counts. `singular` and `plural` map to CLDR's `one` and `other`; the remaining four are optional and fall back to `plural`. New `options.locale` (BCP 47, default `'en-US'`) and `options.type` (`'cardinal' | 'ordinal'`, default `'cardinal'`) configure the underlying `Intl.PluralRules`. Defaults are unchanged — `pluralize('file', { count: n })` still uses the simple `+s` rule with zero `Intl` cost. Cache reuses one `Intl.PluralRules` instance per `<locale>:<type>` pair.
+- **`external-tools/from-pip-venv` — generic Python-package install helper.** Two functions: `createPipVenv({ cacheDir, entryPoint, installSpec })` creates a venv (`python -m venv --clear`) + runs `pip install <spec>` inside it, returning the entry-point binary path. Idempotent: hits the existing venv when its entry-point already exists. `findPython()` locates `python3` (or `python` on Windows) on PATH. Parallel to `from-download.ts` — that one handles single-binary tools from GitHub releases; this handles Python packages from PyPI or git.
+- **`external-tools/skillspector` — resolver for [NVIDIA SkillSpector](https://github.com/NVIDIA/skillspector).** Third-party-skill security scanner; sibling to AgentShield in fleet security tooling. 4-tier resolution (VFS → PATH → DLX-venv → fail) matching the canonical shape used by `external-tools/uv/`. PATH tier distinguishes pipx-installed binaries (`source: 'pipx'`) from plain PATH binaries (`source: 'path'`). DLX-venv tier composes `from-pip-venv` against the pinned upstream git SHA — upstream has no PyPI release or GH tags as of 2026-06-01.
+
+### Fixed
+
+- **`walkUp` emits `D:/` not `D:` at a Windows drive root.** `normalizePath('D:\\')` collapses the trailing separator to `D:` — correct in general (where `D:` means current dir on the `D:` drive), wrong for the filesystem root `walkUp` must yield. A new `normalizeWalkDir` helper preserves the root slash on bare drive letters and defers to `normalizePath` everywhere else.
+
+## [6.0.5](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.5) - 2026-05-28
+
+### Fixed
+
+- **`/*@__PURE__*/` annotations in three modules** were positioned where rolldown (and any bundler honoring tree-shaking pure-call hints) ignored them, emitting `INVALID_ANNOTATION` warnings during downstream builds. The annotations are now adjacent to their `require()` call expressions in `globs/matcher` (`getMatchesGlob`'s `path.matchesGlob` probe) and `strings/width` (`getEastAsianWidth`'s lazy load). A stale `/*@__PURE__*/` on the `Logger` class declaration in `logger/node` was removed — class declarations are not call expressions and the annotation was being silently dropped.
+
 ## [6.0.4](https://github.com/SocketDev/socket-lib/releases/tag/v6.0.4) - 2026-05-28
 
 ### Added

package/dist/ai/discover.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_bin_which = require('../bin/which.js');
 const require_errors_message = require('../errors/message.js');
@@ -93,7 +94,7 @@ function readDiskCache(cachePath) {
 	if (!(0, node_fs.existsSync)(cachePath)) return;
 	try {
 		const parsed = require_primordials_json.JSONParse((0, node_fs.readFileSync)(cachePath, "utf8"));
-		if (typeof parsed !== "object" || parsed === null || typeof parsed.writtenAt !== "number" || Date.now() - parsed.writtenAt > CACHE_TTL_MS) return;
+		if (typeof parsed !== "object" || parsed === null || typeof parsed.writtenAt !== "number" || require_primordials_date.DateNow() - parsed.writtenAt > CACHE_TTL_MS) return;
 		return parsed.agents;
 	} catch {
 		return;
@@ -111,7 +112,7 @@ async function writeDiskCache(cachePath, agents) {
 		await (0, node_fs_promises.mkdir)(node_path.default.dirname(cachePath), { recursive: true });
 		(0, node_fs.writeFileSync)(cachePath, require_primordials_json.JSONStringify({
 			agents,
-			writtenAt: Date.now()
+			writtenAt: require_primordials_date.DateNow()
 		}, void 0, 2) + "\n");
 	} catch (e) {
 		logger.error(`discoverAiAgents: cache write failed (${require_errors_message.errorMessage(e)})`);

package/dist/ai/spawn.js

@@ -1,11 +1,14 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_date = require('../primordials/date.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_ai_discover = require('./discover.js');
 const require_process_spawn_errors = require('../process/spawn/errors.js');
 const require_process_spawn_child = require('../process/spawn/child.js');
+const require_primordials_promise = require('../primordials/promise.js');
 
 //#region src/ai/spawn.mts
 /**
@@ -98,7 +101,7 @@ function isOverloaded(stdout, stderr) {
 async function pickAgent(requested, cwd) {
 	const discovered = await require_ai_discover.discoverAiAgents({ repoRoot: cwd });
 	if (requested) {
-		if (!(requested in discovered)) throw new Error(`spawnAiAgent: requested agent "${requested}" is not on PATH. Install the CLI or pass a different agent. Discovered: ${require_primordials_object.ObjectKeys(discovered).join(", ") || "(none)"}`);
+		if (!(requested in discovered)) throw new require_primordials_error.ErrorCtor(`spawnAiAgent: requested agent "${requested}" is not on PATH. Install the CLI or pass a different agent. Discovered: ${require_primordials_object.ObjectKeys(discovered).join(", ") || "(none)"}`);
 		return requested;
 	}
 	if ("claude" in discovered) return "claude";
@@ -107,7 +110,7 @@ async function pickAgent(requested, cwd) {
 		"opencode",
 		"gemini"
 	]) if (candidate in discovered) return candidate;
-	throw new Error("spawnAiAgent: no AI agent CLI on PATH. Install one of: claude, codex, opencode, gemini.");
+	throw new require_primordials_error.ErrorCtor("spawnAiAgent: no AI agent CLI on PATH. Install one of: claude, codex, opencode, gemini.");
 }
 /**
 * Spawn an AI agent CLI subprocess with the locked-down flag set.
@@ -137,7 +140,7 @@ async function spawnAiAgent(opts) {
 	let stderr = "";
 	let exitCode = 0;
 	let attempts = 0;
-	const start = Date.now();
+	const start = require_primordials_date.DateNow();
 	while (attempts < MAX_ATTEMPTS) {
 		attempts += 1;
 		stdout = "";
@@ -166,11 +169,11 @@ async function spawnAiAgent(opts) {
 			}
 		}
 		if (!isOverloaded(stdout, stderr) || attempts >= MAX_ATTEMPTS) break;
-		await new Promise((resolve) => setTimeout(resolve, backoffFor(attempts)));
+		await new require_primordials_promise.PromiseCtor((resolve) => setTimeout(resolve, backoffFor(attempts)));
 	}
 	return {
 		attempts,
-		durationMs: Date.now() - start,
+		durationMs: require_primordials_date.DateNow() - start,
 		exitCode,
 		stderr,
 		stdout

package/dist/ai/worktree.js

@@ -2,9 +2,14 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_math = require('../primordials/math.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_primordials_date = require('../primordials/date.js');
 const require_errors_message = require('../errors/message.js');
 const require_process_spawn_errors = require('../process/spawn/errors.js');
 const require_process_spawn_child = require('../process/spawn/child.js');
+const require_primordials_promise = require('../primordials/promise.js');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
@@ -51,7 +56,7 @@ async function runOne(item, index, worktreeBranch, worktreePath, baseRepo, branc
 	const add = tryGit(baseRepo, "worktree", "add", "-b", worktreeBranch, worktreePath, branch);
 	if (!add.ok) return {
 		cleanup: "kept",
-		error: /* @__PURE__ */ new Error(`git worktree add failed: ${add.output}`),
+		error: new require_primordials_error.ErrorCtor(`git worktree add failed: ${add.output}`),
 		merged: false,
 		status: "rejected",
 		worktreePath
@@ -73,7 +78,7 @@ async function runOne(item, index, worktreeBranch, worktreePath, baseRepo, branc
 	if (error === void 0 && hasCommitted) {
 		const merge = tryGit(baseRepo, "merge", "--ff-only", worktreeBranch);
 		if (merge.ok) merged = true;
-		else error = /* @__PURE__ */ new Error(`git merge --ff-only failed: ${merge.output}`);
+		else error = new require_primordials_error.ErrorCtor(`git merge --ff-only failed: ${merge.output}`);
 	}
 	let didCleanup = "kept";
 	if (error === void 0 && (cleanup === "always" || cleanup === "on-empty" && !hasCommitted && !hasUncommitted)) {
@@ -130,9 +135,9 @@ async function runOne(item, index, worktreeBranch, worktreePath, baseRepo, branc
 async function spawnAiAgentsInWorktrees(items, fn, options) {
 	const cleanup = options.cleanup ?? "always";
 	const namePrefix = options.namePrefix ?? "agent-task";
-	const concurrency = Math.max(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, MAX_CONCURRENCY));
+	const concurrency = require_primordials_math.MathMax(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, MAX_CONCURRENCY));
 	const baseRepo = options.baseRepo;
-	if (!(0, node_fs.existsSync)(node_path.default.join(baseRepo, ".git"))) throw new Error(`spawnAiAgentsInWorktrees: baseRepo is not a git checkout: ${baseRepo}`);
+	if (!(0, node_fs.existsSync)(node_path.default.join(baseRepo, ".git"))) throw new require_primordials_error.ErrorCtor(`spawnAiAgentsInWorktrees: baseRepo is not a git checkout: ${baseRepo}`);
 	const branch = options.branch ?? currentBranch(baseRepo);
 	const worktreeRoot = options.worktreeRoot ?? node_path.default.join(process.platform === "win32" ? process.env["TEMP"] ?? "." : "/tmp", `${namePrefix}-${Date.now()}`);
 	const settled = [];
@@ -143,10 +148,10 @@ async function spawnAiAgentsInWorktrees(items, fn, options) {
 			cursor += 1;
 			if (idx >= items.length) return;
 			const item = items[idx];
-			settled[idx] = await runOne(item, idx, `${namePrefix}-${idx}-${Date.now()}`, node_path.default.join(worktreeRoot, `${namePrefix}-${idx}`), baseRepo, branch, cleanup, fn);
+			settled[idx] = await runOne(item, idx, `${namePrefix}-${idx}-${require_primordials_date.DateNow()}`, node_path.default.join(worktreeRoot, `${namePrefix}-${idx}`), baseRepo, branch, cleanup, fn);
 		}
 	}
-	await Promise.all(Array.from({ length: concurrency }, () => worker()));
+	await require_primordials_promise.PromiseAll(require_primordials_array.ArrayFrom({ length: concurrency }, () => worker()));
 	return settled;
 }
 function tryGit(cwd, ...args) {

package/dist/ansi/strip.js

@@ -26,7 +26,7 @@ const ANSI_REGEX = /\x1b\[[0-9;]*m/g;
 *   ansiRegex({ onlyFirst: true }) // matches only the first code
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function ansiRegex(options) {
 	const { onlyFirst } = options ?? {};
 	return new require_primordials_regexp.RegExpCtor(`(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))|[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]`, onlyFirst ? void 0 : "g");
@@ -40,7 +40,7 @@ function ansiRegex(options) {
 *   stripAnsi('\u001b[1mBold\u001b[0m') // 'Bold'
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function stripAnsi(text) {
 	return require_primordials_string.StringPrototypeReplace(text, ANSI_REGEX, "");
 }

package/dist/archives/_internal.js

@@ -38,14 +38,14 @@ function assertArchiveExists(archivePath) {
 		throw err;
 	}
 }
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function getAdmZip() {
-	if (_AdmZip === void 0) _AdmZip = /* @__PURE__ */ require("../external/adm-zip.js");
+	if (_AdmZip === void 0) _AdmZip = /*@__PURE__*/ require("../external/adm-zip.js");
 	return _AdmZip;
 }
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function getTarFs() {
-	if (_tarFs === void 0) _tarFs = /* @__PURE__ */ require("../external/tar-fs.js");
+	if (_tarFs === void 0) _tarFs = /*@__PURE__*/ require("../external/tar-fs.js");
 	return _tarFs;
 }
 /**

package/dist/archives/zip.js

@@ -6,9 +6,9 @@ const require_paths_normalize = require('../paths/normalize.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
 const require_node_path = require('../node/path.js');
+const require_primordials_promise = require('../primordials/promise.js');
 const require_archives__internal = require('./_internal.js');
 const require_fs_safe = require('../fs/safe.js');
-const require_primordials_promise = require('../primordials/promise.js');
 
 //#region src/archives/zip.ts
 /**

package/dist/arrays/_internal.js

@@ -28,7 +28,7 @@ let _disjunctionFormatter;
 * @returns Cached Intl.ListFormat instance configured for conjunction
 *   formatting.
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function getConjunctionFormatter() {
 	if (_conjunctionFormatter === void 0)
  /* c8 ignore start */
@@ -56,7 +56,7 @@ function getConjunctionFormatter() {
 * @returns Cached Intl.ListFormat instance configured for disjunction
 *   formatting.
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function getDisjunctionFormatter() {
 	if (_disjunctionFormatter === void 0)
  /* c8 ignore start */

package/dist/arrays/chunk.js

@@ -40,7 +40,7 @@ const require_primordials_error = require('../primordials/error.js');
 *
 * @throws {Error} If chunk size is less than or equal to 0
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function arrayChunk(arr, size) {
 	const chunkSize = size ?? 2;
 	if (chunkSize <= 0) throw new require_primordials_error.ErrorCtor("Chunk size must be greater than 0");

package/dist/arrays/join.js

@@ -43,7 +43,7 @@ const require_arrays__internal = require('./_internal.js');
 *
 * @returns Formatted string with proper "and" conjunction
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function joinAnd(arr) {
 	return (/* @__PURE__ */ require_arrays__internal.getConjunctionFormatter()).format(arr);
 }
@@ -82,7 +82,7 @@ function joinAnd(arr) {
 *
 * @returns Formatted string with proper "or" disjunction
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function joinOr(arr) {
 	return (/* @__PURE__ */ require_arrays__internal.getDisjunctionFormatter()).format(arr);
 }

package/dist/arrays/unique.js

@@ -39,7 +39,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 *
 * @returns New array with duplicate values removed
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function arrayUnique(arr) {
 	return [...new require_primordials_map_set.SetCtor(arr)];
 }