npm-paths.mts

import { existsSync } from 'node:fs'
import Module from 'node:module'
import path from 'node:path'

import { resolveBinPathSync } from '@socketsecurity/registry/lib/bin'
import { logger } from '@socketsecurity/registry/lib/logger'

import constants, { NODE_MODULES, NPM } from '../constants.mts'
import { findBinPathDetailsSync, findNpmDirPathSync } from './path-resolve.mts'

function exitWithBinPathError(binName: string): never {
  logger.fail(
    `Socket unable to locate ${binName}; ensure it is available in the PATH environment variable`,
  )
  // The exit code 127 indicates that the command or binary being executed
  // could not be found.
  // eslint-disable-next-line n/no-process-exit
  process.exit(127)
  // This line is never reached in production, but helps tests.
  throw new Error('process.exit called')
}

// Find a binary next to the running node binary (process.execPath).
// This avoids picking up a project-local binary from node_modules/.bin
// on PATH, e.g. the standalone "npx" package which bundles npm@5.1.0
// that is incompatible with Node 22+.
function findBinNextToNode(binName: string): string | undefined {
  const nodeDir = path.dirname(process.execPath)
  const binPath = path.join(nodeDir, binName)
  if (existsSync(binPath)) {
    try {
      return resolveBinPathSync(binPath)
    } catch {
      return undefined
    }
  }
  return undefined
}

let _npmBinPath: string | undefined
export function getNpmBinPath(): string {
  if (_npmBinPath === undefined) {
    _npmBinPath = getNpmBinPathDetails().path
    if (!_npmBinPath) {
      exitWithBinPathError(NPM)
    }
  }
  return _npmBinPath
}

let _npmBinPathDetails: ReturnType<typeof findBinPathDetailsSync> | undefined
function getNpmBinPathDetails(): ReturnType<typeof findBinPathDetailsSync> {
  if (_npmBinPathDetails === undefined) {
    // First try to find npm next to the node binary to avoid picking up
    // a project-local npm from node_modules/.bin on PATH.
    const npmNextToNode = findBinNextToNode(NPM)
    if (npmNextToNode) {
      _npmBinPathDetails = { name: NPM, path: npmNextToNode, shadowed: false }
    } else {
      _npmBinPathDetails = findBinPathDetailsSync(NPM)
    }
  }
  return _npmBinPathDetails
}

let _npmDirPath: string | undefined
export function getNpmDirPath() {
  if (_npmDirPath === undefined) {
    const npmBinPath = getNpmBinPath()
    _npmDirPath = npmBinPath ? findNpmDirPathSync(npmBinPath) : undefined
    if (!_npmDirPath) {
      _npmDirPath = constants.ENV.SOCKET_CLI_NPM_PATH || undefined
    }
    if (!_npmDirPath) {
      let message = 'Unable to find npm CLI install directory.'
      if (npmBinPath) {
        message += `\nSearched parent directories of ${path.dirname(npmBinPath)}.`
      }
      message +=
        '\n\nThis is may be a bug with socket-npm related to changes to the npm CLI.'
      message += `\nPlease report to ${constants.SOCKET_CLI_ISSUES_URL}.`
      logger.fail(message)
      // The exit code 127 indicates that the command or binary being executed
      // could not be found.
      // eslint-disable-next-line n/no-process-exit
      process.exit(127)
      // This line is never reached in production, but helps tests.
      throw new Error('process.exit called')
    }
  }
  return _npmDirPath
}

let _npmRequire: NodeJS.Require | undefined
export function getNpmRequire(): NodeJS.Require {
  if (_npmRequire === undefined) {
    const npmDirPath = getNpmDirPath()
    const npmNmPath = path.join(npmDirPath, `${NODE_MODULES}/npm`)
    _npmRequire = Module.createRequire(
      path.join(
        existsSync(npmNmPath) ? npmNmPath : npmDirPath,
        '<dummy-basename>',
      ),
    )
  }
  return _npmRequire
}

let _npxBinPath: string | undefined
export function getNpxBinPath(): string {
  if (_npxBinPath === undefined) {
    _npxBinPath = getNpxBinPathDetails().path
    if (!_npxBinPath) {
      exitWithBinPathError('npx')
    }
  }
  return _npxBinPath
}

let _npxBinPathDetails: ReturnType<typeof findBinPathDetailsSync> | undefined
function getNpxBinPathDetails(): ReturnType<typeof findBinPathDetailsSync> {
  if (_npxBinPathDetails === undefined) {
    // First try to find npx next to the node binary to avoid picking up
    // a project-local npx from node_modules/.bin on PATH (e.g., the
    // standalone npx package which bundles npm@5.1.0, incompatible
    // with Node 22+).
    const npxNextToNode = findBinNextToNode('npx')
    if (npxNextToNode) {
      _npxBinPathDetails = { name: 'npx', path: npxNextToNode, shadowed: false }
    } else {
      _npxBinPathDetails = findBinPathDetailsSync('npx')
    }
  }
  return _npxBinPathDetails
}

export function isNpmBinPathShadowed() {
  return getNpmBinPathDetails().shadowed
}

export function isNpxBinPathShadowed() {
  return getNpxBinPathDetails().shadowed
}