Support bespoke npm manager

Author: jdalton

src/utils/fs.mts

@@ -1,4 +1,4 @@
-import { promises as fs, readFileSync, statSync } from 'node:fs'
+import { existsSync, promises as fs, readFileSync, statSync } from 'node:fs'
 import path from 'node:path'
 
 import { remove } from '@socketsecurity/registry/lib/fs'
@@ -65,6 +65,10 @@ export async function findUp(
   return undefined
 }
 
+export function isDirectorySync(filepath: string): boolean {
+  return existsSync(filepath) && !!safeStatsSync(filepath)?.isDirectory()
+}
+
 export type ReadFileOptions = Remap<
   ObjectEncodingOptions &
     Abortable & {

src/utils/npm-config.mts

@@ -6,7 +6,7 @@ import {
   // @ts-ignore: TypeScript types unavailable.
 } from '@npmcli/config/lib/definitions'
 
-import { getNpmPath } from './npm-paths.mts'
+import { getNpmDirPath } from './npm-paths.mts'
 
 import type { ArboristOptions } from '../shadow/npm/arborist/types.mts'
 import type { SemVer } from 'semver'
@@ -31,7 +31,7 @@ export async function getNpmConfig(
     execPath = process.execPath,
     nodeVersion = process.version,
     npmCommand = 'install',
-    npmPath = getNpmPath(),
+    npmPath = getNpmDirPath(),
     npmVersion,
     platform = process.platform,
   } = { __proto__: null, ...options } as NpmConfigOptions

src/utils/npm-paths.mts

@@ -5,7 +5,7 @@ import path from 'node:path'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import constants from '../constants.mts'
-import { findBinPathDetailsSync, findNpmPathSync } from './path-resolve.mts'
+import { findBinPathDetailsSync, findNpmDirPathSync } from './path-resolve.mts'
 
 const { NODE_MODULES, NPM, NPX, SOCKET_CLI_ISSUES_URL } = constants
 
@@ -38,12 +38,16 @@ function getNpmBinPathDetails(): ReturnType<typeof findBinPathDetailsSync> {
   return _npmBinPathDetails
 }
 
-let _npmPath: string | undefined
-export function getNpmPath() {
-  if (_npmPath === undefined) {
+let _npmDirPath: string | undefined
+export function getNpmDirPath() {
+  if (_npmDirPath === undefined) {
     const npmBinPath = getNpmBinPath()
-    _npmPath = npmBinPath ? findNpmPathSync(npmBinPath) : undefined
-    if (!_npmPath) {
+    _npmDirPath = npmBinPath ? findNpmDirPathSync(npmBinPath) : undefined
+    if (!_npmDirPath) {
+      // Lazily access constants.ENV.SOCKET_CLI_NPM_PATH.
+      _npmDirPath = constants.ENV.SOCKET_CLI_NPM_PATH || undefined
+    }
+    if (!_npmDirPath) {
       let message = 'Unable to find npm CLI install directory.'
       if (npmBinPath) {
         message += `\nSearched parent directories of ${path.dirname(npmBinPath)}.`
@@ -56,17 +60,17 @@ export function getNpmPath() {
       process.exit(127)
     }
   }
-  return _npmPath
+  return _npmDirPath
 }
 
 let _npmRequire: NodeJS.Require | undefined
 export function getNpmRequire(): NodeJS.Require {
   if (_npmRequire === undefined) {
-    const npmPath = getNpmPath()
-    const npmNmPath = path.join(npmPath, NODE_MODULES, NPM)
+    const npmDirPath = getNpmDirPath()
+    const npmNmPath = path.join(npmDirPath, NODE_MODULES, NPM)
     _npmRequire = Module.createRequire(
       path.join(
-        existsSync(npmNmPath) ? npmNmPath : npmPath,
+        existsSync(npmNmPath) ? npmNmPath : npmDirPath,
         '<dummy-basename>',
       ),
     )

src/utils/path-resolve.mts

@@ -6,7 +6,7 @@ import which from 'which'
 import { resolveBinPathSync } from '@socketsecurity/registry/lib/npm'
 
 import constants from '../constants.mts'
-import { safeStatsSync } from './fs.mts'
+import { isDirectorySync, safeStatsSync } from './fs.mts'
 import {
   filterBySupportedScanFiles,
   globWithGitIgnore,
@@ -43,26 +43,24 @@ export function findBinPathDetailsSync(binName: string): {
   return { name: binName, path: theBinPath, shadowed: shadowIndex !== -1 }
 }
 
-export function findNpmPathSync(npmBinPath: string): string | undefined {
+export function findNpmDirPathSync(npmBinPath: string): string | undefined {
   // Lazily access constants.WIN32.
   const { WIN32 } = constants
   let thePath = npmBinPath
   while (true) {
     const libNmNpmPath = path.join(thePath, 'lib/node_modules/npm')
-    // mise puts its npm bin in a path like:
+    // mise, which uses opaque binaries, puts its npm bin in a path like:
     //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/bin/npm.
     // HOWEVER, the location of the npm install is:
     //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/lib/node_modules/npm.
     if (
       // Use existsSync here because statsSync, even with { throwIfNoEntry: false },
       // will throw an ENOTDIR error for paths like ./a-file-that-exists/a-directory-that-does-not.
       // See https://github.com/nodejs/node/issues/56993.
-      existsSync(libNmNpmPath) &&
-      safeStatsSync(libNmNpmPath)?.isDirectory()
+      isDirectorySync(libNmNpmPath)
     ) {
-      thePath = path.join(libNmNpmPath, 'npm')
+      thePath = libNmNpmPath
     }
-    const nmPath = path.join(thePath, 'node_modules')
     if (
       // npm bin paths may look like:
       //   /usr/local/share/npm/bin/npm
@@ -74,8 +72,9 @@ export function findNpmPathSync(npmBinPath: string): string | undefined {
       // In practically all cases the npm path contains a node_modules folder:
       //   /usr/local/share/npm/bin/npm/node_modules
       //   C:\Program Files\nodejs\node_modules
-      existsSync(nmPath) &&
-      safeStatsSync(nmPath)?.isDirectory() &&
+      (isDirectorySync(path.join(thePath, 'node_modules')) ||
+        // In some bespoke cases the node_modules folder is one level back.
+        isDirectorySync(path.join(thePath, '../node_modules'))) &&
       // Optimistically look for the default location.
       (path.basename(thePath) === 'npm' ||
         // Chocolatey installs npm bins in the same directory as node bins.