socket 1.0.61 → 1.0.63

package/dist/cli.js

@@ -9,12 +9,12 @@ var utils = require('./utils.js');
 var fs = require('node:fs/promises');
 var require$$5 = require('node:module');
 var constants = require('./constants.js');
+var words = require('../external/@socketsecurity/registry/lib/words');
 var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var fs$1 = require('node:fs');
 var path = require('node:path');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var arrays = require('../external/@socketsecurity/registry/lib/arrays');
-var words = require('../external/@socketsecurity/registry/lib/words');
 var registry = require('../external/@socketsecurity/registry');
 var npm = require('../external/@socketsecurity/registry/lib/npm');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
@@ -1990,7 +1990,7 @@ async function handleCreateNewScan({
   tmp
 }) {
   if (autoManifest) {
-    logger.logger.info('Auto generating manifest files ...');
+    logger.logger.info('Auto-generating manifest files ...');
     const sockJson = await utils.readOrDefaultSocketJson(cwd);
     const detected = await detectManifestActions(sockJson, cwd);
     await generateAutoManifest({
@@ -1999,14 +1999,24 @@ async function handleCreateNewScan({
       outputKind,
       verbose: false
     });
-    logger.logger.info('Auto generation finished. Proceeding with Scan creation.');
+    logger.logger.info('Auto-generation finished. Proceeding with Scan creation.');
   }
-  const fileNamesCResult = await fetchSupportedScanFileNames();
-  if (!fileNamesCResult.ok) {
-    await outputCreateNewScan(fileNamesCResult, outputKind, interactive);
+  const supportedFilesCResult = await fetchSupportedScanFileNames();
+  if (!supportedFilesCResult.ok) {
+    await outputCreateNewScan(supportedFilesCResult, outputKind, interactive);
     return;
   }
-  const packagePaths = await utils.getPackageFilesForScan(cwd, targets, fileNamesCResult.data);
+
+  // Lazily access constants.spinner.
+  const {
+    spinner
+  } = constants;
+  spinner.start('Searching for local files to include in scan...');
+  const supportedFiles = supportedFilesCResult.data;
+  const packagePaths = await utils.getPackageFilesForScan(targets, supportedFiles, {
+    cwd
+  });
+  spinner.stop();
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: packagePaths.length > 0,
@@ -2017,11 +2027,15 @@ async function handleCreateNewScan({
   if (!wasValidInput) {
     return;
   }
+  debug.debugFn('notice', `found: ${packagePaths.length} local ${words.pluralize('file', packagePaths.length)}`);
+  debug.debugDir('inspect', {
+    packagePaths
+  });
   if (readOnly) {
     logger.logger.log('[ReadOnly] Bailing now');
     return;
   }
-  const data = await fetchCreateOrgFullScan(packagePaths, orgSlug, defaultBranch, pendingHead, tmp, cwd, {
+  const fullScanCResult = await fetchCreateOrgFullScan(packagePaths, orgSlug, defaultBranch, pendingHead, tmp, cwd, {
     commitHash,
     commitMessage,
     committers,
@@ -2029,8 +2043,8 @@ async function handleCreateNewScan({
     repoName,
     branchName
   });
-  if (data.ok && report) {
-    if (data.data?.id) {
+  if (fullScanCResult.ok && report) {
+    if (fullScanCResult.data?.id) {
       await handleScanReport({
         filePath: '-',
         fold: 'version',
@@ -2038,7 +2052,7 @@ async function handleCreateNewScan({
         orgSlug,
         outputKind,
         reportLevel: 'error',
-        scanId: data.data.id,
+        scanId: fullScanCResult.data.id,
         short: false
       });
     } else {
@@ -2046,11 +2060,11 @@ async function handleCreateNewScan({
         ok: false,
         message: 'Missing Scan ID',
         cause: 'Server did not respond with a scan ID',
-        data: data.data
+        data: fullScanCResult.data
       }, outputKind, interactive);
     }
   } else {
-    await outputCreateNewScan(data, outputKind, interactive);
+    await outputCreateNewScan(fullScanCResult, outputKind, interactive);
   }
 }
 
@@ -5290,16 +5304,16 @@ async function runCdxgen(yargvWithYes) {
       // based on the node_modules folder, for a more accurate SBOM.
       try {
         await shadowNpmBin(NPX$1, [...yesArgs,
-        // Lazily access constants.ENV.INLINED_SYNP_VERSION.
-        `synp@${constants.ENV.INLINED_SYNP_VERSION}`, '--source-file', `./${YARN_LOCK}`]);
+        // Lazily access constants.ENV.INLINED_SOCKET_CLI_SYNP_VERSION.
+        `synp@${constants.ENV.INLINED_SOCKET_CLI_SYNP_VERSION}`, '--source-file', `./${YARN_LOCK}`]);
         yargv.type = NPM$6;
         cleanupPackageLock = true;
       } catch {}
     }
   }
   await shadowNpmBin(NPX$1, [...yesArgs,
-  // Lazily access constants.ENV.INLINED_CYCLONEDX_CDXGEN_VERSION.
-  `@cyclonedx/cdxgen@${constants.ENV.INLINED_CYCLONEDX_CDXGEN_VERSION}`, ...argvToArray(yargv)]);
+  // Lazily access constants.ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION.
+  `@cyclonedx/cdxgen@${constants.ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION}`, ...argvToArray(yargv)]);
   if (cleanupPackageLock) {
     try {
       await fs$1.promises.rm(`./${PACKAGE_LOCK_JSON}`);
@@ -7015,7 +7029,19 @@ function matchLsCmdViewHumanStdout(stdout, name) {
 function matchQueryCmdStdout(stdout, name) {
   return stdout.includes(`"${name}"`);
 }
-const depsIncludesByAgent = new Map([[BUN$3, matchLsCmdViewHumanStdout], [NPM$5, matchQueryCmdStdout], [PNPM$4, matchQueryCmdStdout], [VLT$4, matchQueryCmdStdout], [YARN_BERRY$3, matchLsCmdViewHumanStdout], [YARN_CLASSIC$3, matchLsCmdViewHumanStdout]]);
+function lsStdoutIncludes(pkgEnvDetails, stdout, name) {
+  switch (pkgEnvDetails.agent) {
+    case BUN$3:
+    case YARN_BERRY$3:
+    case YARN_CLASSIC$3:
+      return matchLsCmdViewHumanStdout(stdout, name);
+    case PNPM$4:
+    case VLT$4:
+    case NPM$5:
+    default:
+      return matchQueryCmdStdout(stdout, name);
+  }
+}
 
 function getDependencyEntries(pkgEnvDetails) {
   const {
@@ -7050,20 +7076,20 @@ const {
   YARN_BERRY: YARN_BERRY$2,
   YARN_CLASSIC: YARN_CLASSIC$2
 } = constants;
-function includesNpm(lockSrc, name) {
+function npmLockSrcIncludes(lockSrc, name) {
   // Detects the package name in the following cases:
   //   "name":
   return lockSrc.includes(`"${name}":`);
 }
-function includesBun(lockSrc, name, lockName) {
+function bunLockSrcIncludes(lockSrc, name, lockName) {
   // This is a bit counterintuitive. When lockName ends with a .lockb
   // we treat it as a yarn.lock. When lockName ends with a .lock we
   // treat it as a package-lock.json. The bun.lock format is not identical
   // package-lock.json, however it close enough for npmLockIncludes to work.
-  const lockfileScanner = lockName?.endsWith(LOCK_EXT) ? includesNpm : includesYarn;
+  const lockfileScanner = lockName?.endsWith(LOCK_EXT) ? npmLockSrcIncludes : yarnLockSrcIncludes;
   return lockfileScanner(lockSrc, name);
 }
-function includesPnpm(lockSrc, name) {
+function pnpmLockSrcIncludes(lockSrc, name) {
   const escapedName = regexps.escapeRegExp(name);
   return new RegExp(
   // Detects the package name.
@@ -7075,12 +7101,12 @@ function includesPnpm(lockSrc, name) {
   //   /name@
   `(?<=^\\s*)(?:'${escapedName}'|/?${escapedName}(?=[:@]))`, 'm').test(lockSrc);
 }
-function includesVlt(lockSrc, name) {
+function vltLockSrcIncludes(lockSrc, name) {
   // Detects the package name in the following cases:
   //   "name"
   return lockSrc.includes(`"${name}"`);
 }
-function includesYarn(lockSrc, name) {
+function yarnLockSrcIncludes(lockSrc, name) {
   const escapedName = regexps.escapeRegExp(name);
   return new RegExp(
   // Detects the package name in the following cases:
@@ -7090,7 +7116,23 @@ function includesYarn(lockSrc, name) {
   //   , name@
   `(?<=(?:^\\s*|,\\s*)"?)${escapedName}(?=@)`, 'm').test(lockSrc);
 }
-const lockfileIncludesByAgent = new Map([[BUN$2, includesBun], [NPM$4, includesNpm], [PNPM$3, includesPnpm], [VLT$3, includesVlt], [YARN_BERRY$2, includesYarn], [YARN_CLASSIC$2, includesYarn]]);
+function lockSrcIncludes(pkgEnvDetails, lockSrc, name, lockName) {
+  switch (pkgEnvDetails.agent) {
+    case BUN$2:
+      return bunLockSrcIncludes(lockSrc, name, lockName);
+    case PNPM$3:
+      return pnpmLockSrcIncludes(lockSrc, name);
+    case VLT$3:
+      return vltLockSrcIncludes(lockSrc, name);
+    case YARN_BERRY$2:
+      return yarnLockSrcIncludes(lockSrc, name);
+    case YARN_CLASSIC$2:
+      return yarnLockSrcIncludes(lockSrc, name);
+    case NPM$4:
+    default:
+      return npmLockSrcIncludes(lockSrc, name);
+  }
+}
 
 const {
   BUN: BUN$1,
@@ -7151,7 +7193,13 @@ async function npmQuery(npmExecPath, cwd) {
   } catch {}
   return cleanupQueryStdout(stdout);
 }
-async function lsBun(pkgEnvDetails, cwd) {
+async function lsBun(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
+  };
   try {
     // Bun does not support filtering by production packages yet.
     // https://github.com/oven-sh/bun/issues/8283
@@ -7163,11 +7211,23 @@ async function lsBun(pkgEnvDetails, cwd) {
   } catch {}
   return '';
 }
-async function lsNpm(pkgEnvDetails, cwd) {
+async function lsNpm(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
+  };
   return await npmQuery(pkgEnvDetails.agentExecPath, cwd);
 }
-async function lsPnpm(pkgEnvDetails, cwd, options) {
-  const npmExecPath = options?.npmExecPath;
+async function lsPnpm(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd(),
+    npmExecPath
+  } = {
+    __proto__: null,
+    ...options
+  };
   if (npmExecPath && npmExecPath !== NPM$3) {
     const result = await npmQuery(npmExecPath, cwd);
     if (result) {
@@ -7187,7 +7247,13 @@ async function lsPnpm(pkgEnvDetails, cwd, options) {
   } catch {}
   return parsableToQueryStdout(stdout);
 }
-async function lsVlt(pkgEnvDetails, cwd) {
+async function lsVlt(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
+  };
   let stdout = '';
   try {
     // See https://docs.vlt.sh/cli/commands/list#options.
@@ -7199,7 +7265,13 @@ async function lsVlt(pkgEnvDetails, cwd) {
   } catch {}
   return cleanupQueryStdout(stdout);
 }
-async function lsYarnBerry(pkgEnvDetails, cwd) {
+async function lsYarnBerry(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
+  };
   try {
     // Yarn Berry does not support filtering by production packages yet.
     // https://github.com/yarnpkg/berry/issues/5117
@@ -7211,7 +7283,13 @@ async function lsYarnBerry(pkgEnvDetails, cwd) {
   } catch {}
   return '';
 }
-async function lsYarnClassic(pkgEnvDetails, cwd) {
+async function lsYarnClassic(pkgEnvDetails, options) {
+  const {
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
+  };
   try {
     // However, Yarn Classic does support it.
     // https://github.com/yarnpkg/yarn/releases/tag/v1.0.0
@@ -7225,7 +7303,23 @@ async function lsYarnClassic(pkgEnvDetails, cwd) {
   } catch {}
   return '';
 }
-const lsByAgent = new Map([[BUN$1, lsBun], [NPM$3, lsNpm], [PNPM$2, lsPnpm], [VLT$2, lsVlt], [YARN_BERRY$1, lsYarnBerry], [YARN_CLASSIC$1, lsYarnClassic]]);
+async function listPackages(pkgEnvDetails, options) {
+  switch (pkgEnvDetails.agent) {
+    case BUN$1:
+      return await lsBun(pkgEnvDetails, options);
+    case PNPM$2:
+      return await lsPnpm(pkgEnvDetails, options);
+    case VLT$2:
+      return await lsVlt(pkgEnvDetails, options);
+    case YARN_BERRY$1:
+      return await lsYarnBerry(pkgEnvDetails, options);
+    case YARN_CLASSIC$1:
+      return await lsYarnClassic(pkgEnvDetails, options);
+    case NPM$3:
+    default:
+      return await lsNpm(pkgEnvDetails, options);
+  }
+}
 
 const CMD_NAME = 'socket optimize';
 
@@ -7330,16 +7424,38 @@ function updatePkgJsonField(editablePkgJson, field, value) {
   } : value]);
   editablePkgJson.fromJSON(`${JSON.stringify(Object.fromEntries(entries), null, 2)}\n`);
 }
-function updateOverridesField(pkgEnvDetails, overrides) {
-  updatePkgJsonField(pkgEnvDetails.editablePkgJson, OVERRIDES, overrides);
+function updateOverridesField(editablePkgJson, overrides) {
+  updatePkgJsonField(editablePkgJson, OVERRIDES, overrides);
+}
+function updateResolutionsField(editablePkgJson, overrides) {
+  updatePkgJsonField(editablePkgJson, RESOLUTIONS, overrides);
 }
-function updateResolutionsField(pkgEnvDetails, overrides) {
-  updatePkgJsonField(pkgEnvDetails.editablePkgJson, RESOLUTIONS, overrides);
+function updatePnpmField(editablePkgJson, overrides) {
+  updatePkgJsonField(editablePkgJson, PNPM$1, overrides);
 }
-function updatePnpmField(pkgEnvDetails, overrides) {
-  updatePkgJsonField(pkgEnvDetails.editablePkgJson, PNPM$1, overrides);
+function updateManifest(agent, editablePkgJson, overrides) {
+  switch (agent) {
+    case BUN:
+      updateResolutionsField(editablePkgJson, overrides);
+      return;
+    case PNPM$1:
+      updatePnpmField(editablePkgJson, overrides);
+      return;
+    case VLT$1:
+      updateOverridesField(editablePkgJson, overrides);
+      return;
+    case YARN_BERRY:
+      updateResolutionsField(editablePkgJson, overrides);
+      return;
+    case YARN_CLASSIC:
+      updateResolutionsField(editablePkgJson, overrides);
+      return;
+    case NPM$2:
+    default:
+      updateOverridesField(editablePkgJson, overrides);
+      return;
+  }
 }
-const updateManifestByAgent = new Map([[BUN, updateResolutionsField], [NPM$2, updateOverridesField], [PNPM$1, updatePnpmField], [VLT$1, updateOverridesField], [YARN_BERRY, updateResolutionsField], [YARN_CLASSIC, updateResolutionsField]]);
 
 const {
   NPM: NPM$1,
@@ -7379,7 +7495,9 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   // npmExecPath will === the agent name IF it CANNOT be resolved.
   npmExecPath === NPM$1 && !state.warnedPnpmWorkspaceRequiresNpm) {
     state.warnedPnpmWorkspaceRequiresNpm = true;
+    spinner?.stop();
     logger?.warn(utils.cmdPrefixMessage(CMD_NAME, `${agent} workspace support requires \`npm ls\`, falling back to \`${agent} list\``));
+    spinner?.start();
   }
   const overridesDataObjects = [];
   if (isWorkspace || pkgEnvDetails.editablePkgJson.content['private']) {
@@ -7387,7 +7505,6 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   } else {
     overridesDataObjects.push(getOverridesDataNpm(pkgEnvDetails), getOverridesDataYarnClassic(pkgEnvDetails));
   }
-  spinner?.setText(`Adding overrides to ${workspace}...`);
   const depAliasMap = new Map();
   const depEntries = getDependencyEntries(pkgEnvDetails);
   const manifestEntries = manifestNpmOverrides.filter(({
@@ -7396,6 +7513,8 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   // Roughly check Node range as semver.coerce will strip leading
   // v's, carets (^), comparators (<,<=,>,>=,=), and tildes (~).
   vendor.semverExports.coerce(data.engines.node), pkgEnvDetails.pkgRequirements.node));
+  const addingText = `Adding overrides to ${workspace}...`;
+  let loggedAddingText = false;
 
   // Chunk package names to process them in parallel 3 at a time.
   await require$$7.pEach(manifestEntries, 3, async ({
@@ -7434,17 +7553,21 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
           if (!isWorkspaceRoot) {
             state.addedInWorkspaces.add(workspace);
           }
+          if (!loggedAddingText) {
+            spinner?.setText(addingText);
+            loggedAddingText = true;
+          }
         }
         depAliasMap.set(origPkgName, thisSpec);
       }
     }
     if (isWorkspaceRoot) {
-      // The AgentDepsIncludesFn and AgentLockIncludesFn types overlap in their
-      // first two parameters. AgentLockIncludesFn accepts an optional third
-      // parameter which AgentDepsIncludesFn will ignore so we cast thingScanner
-      // as an AgentLockIncludesFn type.
-      const thingScanner = isLockScanned ? lockfileIncludesByAgent.get(agent) : depsIncludesByAgent.get(agent);
-      const thingToScan = isLockScanned ? lockSrc : await lsByAgent.get(agent)(pkgEnvDetails, pkgPath, {
+      // The lockSrcIncludes and lsStdoutIncludes functions overlap in their
+      // first two parameters. lockSrcIncludes accepts an optional third parameter
+      // which lsStdoutIncludes will ignore.
+      const thingScanner = isLockScanned ? lockSrcIncludes : lsStdoutIncludes;
+      const thingToScan = isLockScanned ? lockSrc : await listPackages(pkgEnvDetails, {
+        cwd: pkgPath,
         npmExecPath
       });
       // Chunk package names to process them in parallel 3 at a time.
@@ -7453,7 +7576,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         type
       }) => {
         const overrideExists = objects.hasOwn(overrides, origPkgName);
-        if (overrideExists || thingScanner(thingToScan, origPkgName, lockName)) {
+        if (overrideExists || thingScanner(pkgEnvDetails, thingToScan, origPkgName, lockName)) {
           const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
           const origDepAlias = depAliasMap.get(origPkgName);
           const sockRegDepAlias = depAliasMap.get(sockRegPkgName);
@@ -7491,6 +7614,10 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
             overrides[origPkgName] = newSpec;
             const addedOrUpdated = overrideExists ? 'updated' : 'added';
             state[addedOrUpdated].add(sockRegPkgName);
+            if (!loggedAddingText) {
+              spinner?.setText(addingText);
+              loggedAddingText = true;
+            }
           }
         }
       });
@@ -7519,7 +7646,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         overrides,
         type
       } of overridesDataObjects) {
-        updateManifestByAgent.get(type)(pkgEnvDetails, objects.toSortedObject(overrides));
+        updateManifest(type, pkgEnvDetails.editablePkgJson, objects.toSortedObject(overrides));
       }
     }
     await pkgEnvDetails.editablePkgJson.save();
@@ -7583,7 +7710,7 @@ async function applyOptimization(pkgEnvDetails, {
   const {
     spinner
   } = constants;
-  spinner.start('Socket optimizing...');
+  spinner.start();
   const state = await addOverrides(pkgEnvDetails, pkgEnvDetails.pkgPath, {
     logger: logger.logger,
     pin,
@@ -14212,5 +14339,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=758b903c-de42-4d5b-988b-b07da95f2793
+//# debugId=9f81fe97-c2db-4ad9-9cf7-ae11682e5f3c
 //# sourceMappingURL=cli.js.map