@socketsecurity/lib 6.0.8 → 6.0.9

package/dist/external/tar-fs.js

@@ -121,7 +121,7 @@ var require_fast_fifo = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/b4a@1.8.0/node_modules/b4a/index.js
+//#region node_modules/.pnpm/b4a@1.8.1/node_modules/b4a/index.js
 var require_b4a = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function isBuffer(value) {
 		return _p_BufferIsBuffer(value) || value instanceof Uint8Array;
@@ -499,13 +499,51 @@ var require_text_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/streamx@2.25.0/node_modules/streamx/index.js
+//#region node_modules/.pnpm/streamx@2.27.0/node_modules/streamx/lib/errors.js
+var require_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = class StreamError extends Error {
+		constructor(msg, code, fn = StreamError) {
+			super(msg);
+			this.code = code;
+			if (Error.captureStackTrace) Error.captureStackTrace(this, fn);
+		}
+		static isStreamDestroyed(err) {
+			return err && err.code === "STREAM_DESTROYED";
+		}
+		static isPrematureClose(err) {
+			return err && err.code === "PREMATURE_CLOSE";
+		}
+		static isAborted(err) {
+			return err && err.code === "ABORTED";
+		}
+		static isBadArgument(err) {
+			return err && err.code === "BAD_ARGUMENT";
+		}
+		get name() {
+			return "StreamError";
+		}
+		static STREAM_DESTROYED() {
+			return new StreamError("Stream was destroyed", "STREAM_DESTROYED", StreamError.STREAM_DESTROYED);
+		}
+		static PREMATURE_CLOSE(msg = "Premature close") {
+			return new StreamError(msg, "PREMATURE_CLOSE", StreamError.PREMATURE_CLOSE);
+		}
+		static ABORTED() {
+			return new StreamError("Stream aborted", "ABORTED", StreamError.ABORTED);
+		}
+		static BAD_ARGUMENT(msg = "Bad argument") {
+			return new StreamError(msg, "BAD_ARGUMENT", StreamError.BAD_ARGUMENT);
+		}
+	};
+}));
+
+//#endregion
+//#region node_modules/.pnpm/streamx@2.27.0/node_modules/streamx/index.js
 var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { EventEmitter } = require_default();
-	const STREAM_DESTROYED = /* @__PURE__ */ new _p_ErrorCtor("Stream was destroyed");
-	const PREMATURE_CLOSE = /* @__PURE__ */ new _p_ErrorCtor("Premature close");
 	const FIFO = require_fast_fifo();
 	const TextDecoder = require_text_decoder();
+	const StreamError = require_errors();
 	const qmt = typeof queueMicrotask === "undefined" ? (fn) => global.process.nextTick(fn) : queueMicrotask;
 	const OPENING = 1;
 	const PREDESTROYING = 2;
@@ -709,7 +747,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return (this.stream._duplexState & READ_DONE) !== 0;
 		}
 		pipe(pipeTo, cb) {
-			if (this.pipeTo !== null) throw new _p_ErrorCtor("Can only pipe to one destination");
+			if (this.pipeTo !== null) throw StreamError.BAD_ARGUMENT("Can only pipe to one destination");
 			if (typeof cb !== "function") cb = null;
 			this.stream._duplexState |= READ_PIPE_DRAINED;
 			this.pipeTo = pipeTo;
@@ -868,14 +906,14 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (stream === this.to) {
 				this.to = null;
 				if (this.from !== null) {
-					if ((this.from._duplexState & READ_DONE) === 0 || !this.pipeToFinished) this.from.destroy(this.error || /* @__PURE__ */ new _p_ErrorCtor("Writable stream closed prematurely"));
+					if ((this.from._duplexState & READ_DONE) === 0 || !this.pipeToFinished) this.from.destroy(this.error || StreamError.PREMATURE_CLOSE("Writable stream closed"));
 					return;
 				}
 			}
 			if (stream === this.from) {
 				this.from = null;
 				if (this.to !== null) {
-					if ((stream._duplexState & READ_DONE) === 0) this.to.destroy(this.error || /* @__PURE__ */ new _p_ErrorCtor("Readable stream closed before ending"));
+					if ((stream._duplexState & READ_DONE) === 0) this.to.destroy(this.error || StreamError.PREMATURE_CLOSE("Readable stream closed"));
 					return;
 				}
 			}
@@ -901,7 +939,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function afterDestroy(err) {
 		const stream = this.stream;
-		if (!err && this.error !== STREAM_DESTROYED) err = this.error;
+		if (!err && !StreamError.isStreamDestroyed(this.error)) err = this.error;
 		if (err) stream.emit("error", err);
 		stream._duplexState |= DESTROYED;
 		stream.emit("close");
@@ -1017,7 +1055,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		destroy(err) {
 			if ((this._duplexState & DESTROY_STATUS) === 0) {
-				if (!err) err = STREAM_DESTROYED;
+				if (!err) err = StreamError.STREAM_DESTROYED();
 				this._duplexState = (this._duplexState | DESTROYING) & NON_PRIMARY;
 				if (this._readableState !== null) {
 					this._readableState.highWaterMark = 0;
@@ -1047,6 +1085,15 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				if (opts.encoding) this.setEncoding(opts.encoding);
 			}
 		}
+		static deferred(fn, opts) {
+			const out = new PassThrough(opts);
+			fn().then((src) => {
+				if (src === null) return out.end();
+				if (out.destroying) return;
+				pipeline(src, out, noop);
+			}).catch((err) => out.destroy(err));
+			return out;
+		}
 		setEncoding(encoding) {
 			const dec = new TextDecoder(encoding);
 			const map = this._readableState.map || echo;
@@ -1165,7 +1212,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			function ondata(data) {
 				if (promiseReject === null) return;
 				if (error) promiseReject(error);
-				else if (data === null && (stream._duplexState & READ_DONE) === 0) promiseReject(STREAM_DESTROYED);
+				else if (data === null && (stream._duplexState & READ_DONE) === 0) promiseReject(StreamError.STREAM_DESTROYED());
 				else promiseResolve({
 					value: data,
 					done: data === null
@@ -1339,7 +1386,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function pipeline(stream, ...streams) {
 		const all = _p_ArrayIsArray(stream) ? [...stream, ...streams] : [stream, ...streams];
 		const done = all.length && typeof all[all.length - 1] === "function" ? all.pop() : null;
-		if (all.length < 2) throw new _p_ErrorCtor("Pipeline requires at least 2 streams");
+		if (all.length < 2) throw StreamError.BAD_ARGUMENT("Pipeline requires at least 2 streams");
 		let src = all[0];
 		let dest = null;
 		let error = null;
@@ -1362,15 +1409,15 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				fin = true;
 				if (!autoDestroy) done(error);
 			});
-			if (autoDestroy) dest.on("close", () => done(error || (fin ? null : PREMATURE_CLOSE)));
+			if (autoDestroy) dest.on("close", () => done(error || (fin ? null : StreamError.PREMATURE_CLOSE())));
 		}
 		return dest;
 		function errorHandle(s, rd, wr, onerror) {
 			s.on("error", onerror);
 			s.on("close", onclose);
 			function onclose() {
-				if (rd && s._readableState && !s._readableState.ended) return onerror(PREMATURE_CLOSE);
-				if (wr && s._writableState && !s._writableState.ended) return onerror(PREMATURE_CLOSE);
+				if (rd && s._readableState && !s._readableState.ended) return onerror(StreamError.PREMATURE_CLOSE());
+				if (wr && s._writableState && !s._writableState.ended) return onerror(StreamError.PREMATURE_CLOSE());
 			}
 		}
 		function onerror(err) {
@@ -1402,7 +1449,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function getStreamError(stream, opts = {}) {
 		const err = stream._readableState && stream._readableState.error || stream._writableState && stream._writableState.error;
-		return !opts.all && err === STREAM_DESTROYED ? null : err;
+		return !opts.all && StreamError.isStreamDestroyed(err) ? null : err;
 	}
 	function isReadStreamx(stream) {
 		return isStreamx(stream) && stream.readable;
@@ -1418,7 +1465,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function noop() {}
 	function abort() {
-		this.destroy(/* @__PURE__ */ new _p_ErrorCtor("Stream aborted."));
+		this.destroy(StreamError.ABORTED());
 	}
 	function isWritev(s) {
 		return s._writev !== Writable.prototype._writev && s._writev !== Duplex.prototype._writev;

package/dist/external-tools/jre/detect-platform-arch.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_constants_platform = require('../../constants/platform.js');
 const require_primordials_object = require('../../primordials/object.js');
+const require_constants_platform = require('../../constants/platform.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 

package/dist/external-tools/manifest.js

@@ -2,9 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_integrity = require('../integrity.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_integrity = require('../integrity.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_fs_read_json = require('../fs/read-json.js');
 

package/dist/external-tools/python/asset-names.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_constants_platform = require('../../constants/platform.js');
 const require_primordials_object = require('../../primordials/object.js');
+const require_constants_platform = require('../../constants/platform.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 

package/dist/external-tools/python/uv-install.d.ts

@@ -0,0 +1,89 @@
+/**
+ * @file Uv project install helpers — the locked-source-of-truth half of the
+ *   "uv project + dlx materialize" model.
+ *   uv (Astral's Python package manager) drives a uv PROJECT — a directory with
+ *   `pyproject.toml` + `uv.lock` (+ optional `[tool.uv] exclude-newer`). The
+ *   lock manifests every transitive version, so the project is the most
+ *   locked-down, most-version-pinned form a Python tool install can take.
+ *   Two entry points, used together:
+ *
+ *   1. `uvSyncProject` — `uv sync --locked --project <dir>`. Installs the lock's
+ *      exact closure into the project's own `.venv` and FAILS if `uv.lock` is
+ *      out of date vs `pyproject.toml` (the `--locked` gate). This is the
+ *      verification-grade install: it proves the lock resolves.
+ *   2. `uvExportMaterialize` — `uv export --locked` → a flat, hash-pinned
+ *      requirements list, then `uv pip install --target <dir>` into a
+ *      content-addressed dlx dir (no venv → no symlinks / absolute `home=`, so
+ *      the result is relocatable + SEA-VFS-embeddable). Mirrors
+ *      `downloadPipPackage`'s lock-guarded, idempotent shape. Both take an
+ *      explicit `uvBin` (typically `resolveUv().path`) and never mutate a
+ *      shared interpreter — the project venv and the dlx target are
+ *      self-contained.
+ */
+/**
+ * Export a uv project's locked closure to a flat requirements list, then
+ * `uv pip install --target` it into a content-addressed dlx dir. The dlx dir
+ * holds plain files (no venv), so it is relocatable and embeddable in a smol
+ * binary's VFS — the bundle-safe analog of `uvSyncProject`'s `.venv`.
+ *
+ * Lock-guarded + idempotent (reuses `pip-install`'s `isAlreadyInstalled` /
+ * `isStaleLock`): a non-empty target dir short-circuits, and concurrent callers
+ * serialize on a `.installing` sentinel one level up from the target. Throws on
+ * a failed uv command or if the lock can't be acquired after MAX_RETRIES.
+ */
+export declare function uvExportMaterialize(options: UvExportMaterializeOptions, retryCount?: number): Promise<UvExportMaterializeResult>;
+/**
+ * Content-addressed dlx dir for a uv project's materialized closure:
+ * `~/.socket/_dlx/<cacheKey(projectDir)>/site-packages`. Keyed on the project
+ * dir so each project gets an isolated target; the analog of `pipPackageDir`.
+ */
+export declare function uvProjectTargetDir(projectDir: string): string;
+/**
+ * Run `uv sync --locked` against a uv project. Installs the lock's exact
+ * dependency closure into the project's `.venv`; the `--locked` flag turns a
+ * lock-vs-manifest drift into a hard failure (uv exits non-zero) rather than a
+ * silent re-resolution — this is what makes it verification-grade. Throws when
+ * uv exits non-zero (drift, missing lock, or a resolution failure).
+ */
+export declare function uvSyncProject(options: UvSyncProjectOptions): Promise<void>;
+export interface UvSyncProjectOptions {
+    /**
+     * Absolute path to the `uv` executable (typically `resolveUv().path`).
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the uv project dir (holds `pyproject.toml` + `uv.lock`).
+     */
+    readonly projectDir: string;
+    /**
+     * Default true — pass `--locked` so a lock-vs-manifest drift fails hard.
+     * Set false ONLY to bootstrap/refresh a lock (never in a verify path).
+     */
+    readonly locked?: boolean | undefined;
+}
+export interface UvExportMaterializeOptions {
+    /**
+     * Absolute path to the `uv` executable.
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the uv project dir to export from.
+     */
+    readonly projectDir: string;
+    /**
+     * Override the content-addressed target dir. Defaults to
+     * `uvProjectTargetDir(projectDir)`.
+     */
+    readonly targetDir?: string | undefined;
+}
+export interface UvExportMaterializeResult {
+    /**
+     * `true` when this call ran uv; `false` when an existing install was reused.
+     */
+    readonly installed: boolean;
+    /**
+     * Directory the closure was installed into. Put this on `PYTHONPATH` to run
+     * the tool: `python -m <module>`.
+     */
+    readonly targetDir: string;
+}

package/dist/external-tools/python/uv-install.js

@@ -0,0 +1,165 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_process_spawn_child = require('../../process/spawn/child.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_fs_safe = require('../../fs/safe.js');
+const require_dlx_cache = require('../../dlx/cache.js');
+const require_external_tools_python_pip_install = require('./pip-install.js');
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/python/uv-install.ts
+/**
+* @file Uv project install helpers — the locked-source-of-truth half of the
+*   "uv project + dlx materialize" model.
+*   uv (Astral's Python package manager) drives a uv PROJECT — a directory with
+*   `pyproject.toml` + `uv.lock` (+ optional `[tool.uv] exclude-newer`). The
+*   lock manifests every transitive version, so the project is the most
+*   locked-down, most-version-pinned form a Python tool install can take.
+*   Two entry points, used together:
+*
+*   1. `uvSyncProject` — `uv sync --locked --project <dir>`. Installs the lock's
+*      exact closure into the project's own `.venv` and FAILS if `uv.lock` is
+*      out of date vs `pyproject.toml` (the `--locked` gate). This is the
+*      verification-grade install: it proves the lock resolves.
+*   2. `uvExportMaterialize` — `uv export --locked` → a flat, hash-pinned
+*      requirements list, then `uv pip install --target <dir>` into a
+*      content-addressed dlx dir (no venv → no symlinks / absolute `home=`, so
+*      the result is relocatable + SEA-VFS-embeddable). Mirrors
+*      `downloadPipPackage`'s lock-guarded, idempotent shape. Both take an
+*      explicit `uvBin` (typically `resolveUv().path`) and never mutate a
+*      shared interpreter — the project venv and the dlx target are
+*      self-contained.
+*/
+const MAX_RETRIES = 3;
+const WAIT_TICKS = 30;
+/**
+* Export a uv project's locked closure to a flat requirements list, then
+* `uv pip install --target` it into a content-addressed dlx dir. The dlx dir
+* holds plain files (no venv), so it is relocatable and embeddable in a smol
+* binary's VFS — the bundle-safe analog of `uvSyncProject`'s `.venv`.
+*
+* Lock-guarded + idempotent (reuses `pip-install`'s `isAlreadyInstalled` /
+* `isStaleLock`): a non-empty target dir short-circuits, and concurrent callers
+* serialize on a `.installing` sentinel one level up from the target. Throws on
+* a failed uv command or if the lock can't be acquired after MAX_RETRIES.
+*/
+async function uvExportMaterialize(options, retryCount = 0) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const { projectDir, uvBin } = opts;
+	const targetDir = opts.targetDir ?? uvProjectTargetDir(projectDir);
+	if (retryCount >= MAX_RETRIES) throw new Error(`uvExportMaterialize: could not acquire install lock after ${MAX_RETRIES} retries for ${targetDir}; a peer may be stuck or the lock is stale — remove it and retry`);
+	if (await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) return {
+		installed: false,
+		targetDir
+	};
+	const lockDir = node_path.default.dirname(targetDir);
+	await require_fs_safe.safeMkdir(lockDir, { recursive: true });
+	const lockFile = node_path.default.join(lockDir, ".installing");
+	try {
+		await node_fs.promises.writeFile(lockFile, node_process.default.pid.toString(), { flag: "wx" });
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		let stale = false;
+		try {
+			stale = require_external_tools_python_pip_install.isStaleLock(Number.parseInt((await node_fs.promises.readFile(lockFile, "utf8")).trim(), 10));
+		} catch {
+			stale = true;
+		}
+		if (stale) {
+			await require_fs_safe.safeDelete(lockFile, { force: true });
+			return uvExportMaterialize(options, retryCount + 1);
+		}
+		for (let i = 0; i < WAIT_TICKS; i += 1) {
+			await new Promise((resolve) => {
+				setTimeout(resolve, 1e3);
+			});
+			if (await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) return {
+				installed: false,
+				targetDir
+			};
+		}
+		return uvExportMaterialize(options, retryCount + 1);
+	}
+	try {
+		await require_fs_safe.safeMkdir(targetDir, { recursive: true });
+		const requirementsPath = node_path.default.join(lockDir, "requirements.locked.txt");
+		await require_process_spawn_child.spawn(uvBin, [
+			"export",
+			"--locked",
+			"--no-emit-project",
+			"--no-dev",
+			"--project",
+			projectDir,
+			"--output-file",
+			requirementsPath
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		await require_process_spawn_child.spawn(uvBin, [
+			"pip",
+			"install",
+			"--target",
+			targetDir,
+			"--requirement",
+			requirementsPath
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		await require_fs_safe.safeDelete(requirementsPath, { force: true });
+		if (!await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) throw new Error(`uvExportMaterialize: uv pip install --target ${targetDir} reported success but the target is still empty`);
+		return {
+			installed: true,
+			targetDir
+		};
+	} finally {
+		await require_fs_safe.safeDelete(lockFile, { force: true });
+	}
+}
+/**
+* Content-addressed dlx dir for a uv project's materialized closure:
+* `~/.socket/_dlx/<cacheKey(projectDir)>/site-packages`. Keyed on the project
+* dir so each project gets an isolated target; the analog of `pipPackageDir`.
+*/
+function uvProjectTargetDir(projectDir) {
+	return node_path.default.join(require_paths_socket.getSocketDlxDir(), require_dlx_cache.generateCacheKey(projectDir), "site-packages");
+}
+/**
+* Run `uv sync --locked` against a uv project. Installs the lock's exact
+* dependency closure into the project's `.venv`; the `--locked` flag turns a
+* lock-vs-manifest drift into a hard failure (uv exits non-zero) rather than a
+* silent re-resolution — this is what makes it verification-grade. Throws when
+* uv exits non-zero (drift, missing lock, or a resolution failure).
+*/
+async function uvSyncProject(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const { projectDir, uvBin } = opts;
+	await require_process_spawn_child.spawn(uvBin, [
+		"sync",
+		...opts.locked === false ? [] : ["--locked"],
+		"--project",
+		projectDir
+	], {
+		shell: require_constants_platform.WIN32,
+		stdio: "inherit"
+	});
+}
+
+//#endregion
+exports.uvExportMaterialize = uvExportMaterialize;
+exports.uvProjectTargetDir = uvProjectTargetDir;
+exports.uvSyncProject = uvSyncProject;

package/dist/external-tools/skillspector/from-uv.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file `skillspectorFromUv()` — locked-uv-project tier of SkillSpector
+ *   resolution. Given a uv project dir (a `pyproject.toml` + `uv.lock` that pin
+ *   the upstream git SHA + its full transitive closure) and a resolved `uv`
+ *   binary, runs `uv sync --locked` to install that exact closure into the
+ *   project's `.venv` and returns the `skillspector` entry point. This is the
+ *   most locked-down tier — every dependency version is manifested in uv.lock,
+ *   and `--locked` hard-fails on lock drift (vs. `from-dlx`'s pip-from-git-SHA
+ *   venv, which re-resolves the closure freshly). Returns `undefined` when:
+ *
+ *   - No project dir / uv binary is supplied (the caller didn't opt in).
+ *   - The project files are absent, or `uv sync --locked` fails (lock drift, no
+ *     network, missing Python). Idempotent: a second call hits the synced venv
+ *     (`uv sync` is a no-op when the venv already matches the lock).
+ */
+import type { ResolvedSkillSpector } from './types';
+export interface SkillSpectorFromUvOptions {
+    /**
+     * Absolute path to the `uv` executable (typically `resolveUv().path`).
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the SkillSpector uv project dir (holds `pyproject.toml` +
+     * `uv.lock`). The fleet ships this under
+     * `setup-security-tools/skillspector/`.
+     */
+    readonly projectDir: string;
+}
+export declare function skillspectorFromUv(options: SkillSpectorFromUvOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function venvEntryPoint(projectDir: string): string;

package/dist/external-tools/skillspector/from-uv.js

@@ -0,0 +1,56 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_external_tools_python_uv_install = require('../python/uv-install.js');
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/skillspector/from-uv.ts
+/**
+* @file `skillspectorFromUv()` — locked-uv-project tier of SkillSpector
+*   resolution. Given a uv project dir (a `pyproject.toml` + `uv.lock` that pin
+*   the upstream git SHA + its full transitive closure) and a resolved `uv`
+*   binary, runs `uv sync --locked` to install that exact closure into the
+*   project's `.venv` and returns the `skillspector` entry point. This is the
+*   most locked-down tier — every dependency version is manifested in uv.lock,
+*   and `--locked` hard-fails on lock drift (vs. `from-dlx`'s pip-from-git-SHA
+*   venv, which re-resolves the closure freshly). Returns `undefined` when:
+*
+*   - No project dir / uv binary is supplied (the caller didn't opt in).
+*   - The project files are absent, or `uv sync --locked` fails (lock drift, no
+*     network, missing Python). Idempotent: a second call hits the synced venv
+*     (`uv sync` is a no-op when the venv already matches the lock).
+*/
+async function skillspectorFromUv(options) {
+	const { projectDir, uvBin } = {
+		__proto__: null,
+		...options
+	};
+	if (!projectDir || !uvBin) return;
+	if (!(0, node_fs.existsSync)(node_path.default.join(projectDir, "pyproject.toml")) || !(0, node_fs.existsSync)(node_path.default.join(projectDir, "uv.lock"))) return;
+	try {
+		await require_external_tools_python_uv_install.uvSyncProject({
+			projectDir,
+			uvBin
+		});
+	} catch {
+		return;
+	}
+	const entry = venvEntryPoint(projectDir);
+	if (!(0, node_fs.existsSync)(entry)) return;
+	return {
+		path: entry,
+		source: "uv"
+	};
+}
+function venvEntryPoint(projectDir) {
+	return node_process.default.platform === "win32" ? node_path.default.join(projectDir, ".venv", "Scripts", "skillspector.exe") : node_path.default.join(projectDir, ".venv", "bin", "skillspector");
+}
+
+//#endregion
+exports.skillspectorFromUv = skillspectorFromUv;
+exports.venvEntryPoint = venvEntryPoint;

package/dist/external-tools/skillspector/resolve.d.ts

@@ -5,9 +5,13 @@
  *   1. VFS — smol binary's embedded skillspector (if packed)
  *   2. PATH — `which skillspector` (pipx-installed binaries land here too; the
  *      source field distinguishes `'pipx'` vs `'path'`)
- *   3. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA Returns
+ *   3. UV-project — `uv sync --locked` against a uv project (the most locked-down
+ *      tier; every transitive version pinned in uv.lock). Only runs when
+ *      `uvProjectDir` + `uvBin` are supplied.
+ *   4. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA (the
+ *      pip-from-git-SHA fallback when no uv project is available). Returns
  *      `undefined` when all enabled sources miss. Memoized per
- *      sha+cacheDir+localOnly tuple.
+ *      sha+cacheDir+uvProjectDir+localOnly tuple.
  */
 import type { ResolvedSkillSpector } from './types';
 export interface ResolveSkillSpectorOptions {
@@ -17,9 +21,20 @@ export interface ResolveSkillSpectorOptions {
      */
     readonly sha?: string | undefined;
     /**
-     * Tier-3 cache override. Defaults to `~/.socket/_dlx/skillspector/<sha>`.
+     * DLX cache override. Defaults to `~/.socket/_dlx/skillspector/<sha>`.
      */
     readonly cacheDir?: string | undefined;
+    /**
+     * UV-project tier: absolute path to a uv project dir (a `pyproject.toml` +
+     * `uv.lock` pinning the SHA + its closure). When set together with `uvBin`,
+     * the locked-uv tier runs ahead of the DLX-venv tier.
+     */
+    readonly uvProjectDir?: string | undefined;
+    /**
+     * UV-project tier: absolute path to the `uv` executable
+     * (typically `resolveUv().path`). Required to run the locked-uv tier.
+     */
+    readonly uvBin?: string | undefined;
     /**
      * When true, only the VFS + PATH tiers run. Use for check-mode invocations
      * that want to fail-fast if the tool isn't already installed.

package/dist/external-tools/skillspector/resolve.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_skillspector_from_dlx = require('./from-dlx.js');
 const require_external_tools_skillspector_from_path = require('./from-path.js');
+const require_external_tools_skillspector_from_uv = require('./from-uv.js');
 const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 
 //#region src/external-tools/skillspector/resolve.ts
@@ -14,20 +15,24 @@ const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 *   1. VFS — smol binary's embedded skillspector (if packed)
 *   2. PATH — `which skillspector` (pipx-installed binaries land here too; the
 *      source field distinguishes `'pipx'` vs `'path'`)
-*   3. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA Returns
+*   3. UV-project — `uv sync --locked` against a uv project (the most locked-down
+*      tier; every transitive version pinned in uv.lock). Only runs when
+*      `uvProjectDir` + `uvBin` are supplied.
+*   4. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA (the
+*      pip-from-git-SHA fallback when no uv project is available). Returns
 *      `undefined` when all enabled sources miss. Memoized per
-*      sha+cacheDir+localOnly tuple.
+*      sha+cacheDir+uvProjectDir+localOnly tuple.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(options) {
-	options = {
+	const opts = {
 		__proto__: null,
 		...options
 	};
-	return `${options.sha ?? ""}|${options.cacheDir ?? ""}|${options.localOnly ? "local" : "full"}`;
+	return `${opts.sha ?? ""}|${opts.cacheDir ?? ""}|${opts.uvProjectDir ?? ""}|${opts.localOnly ? "local" : "full"}`;
 }
 async function doResolveSkillSpector(options) {
-	options = {
+	const opts = {
 		__proto__: null,
 		...options
 	};
@@ -37,10 +42,18 @@ async function doResolveSkillSpector(options) {
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_skillspector_from_path.skillspectorFromPath();
 	if (fromPath) return fromPath;
-	if (options.localOnly || !options.sha) return;
+	if (opts.localOnly) return;
+	if (opts.uvProjectDir && opts.uvBin) {
+		const fromUv = await require_external_tools_skillspector_from_uv.skillspectorFromUv({
+			projectDir: opts.uvProjectDir,
+			uvBin: opts.uvBin
+		});
+		if (fromUv) return fromUv;
+	}
+	if (!opts.sha) return;
 	return require_external_tools_skillspector_from_dlx.skillspectorFromDlx({
-		sha: options.sha,
-		cacheDir: options.cacheDir
+		sha: opts.sha,
+		cacheDir: opts.cacheDir
 	});
 }
 /**