refactor: adopt safeMkdir utilities from @socketsecurity/lib

jdalton · jdalton · commit 34a2689ba946 · 2025-10-31T11:32:59.000-04:00
Replace fs.mkdir/fs.mkdirSync with safeMkdir/safeMkdirSync across codebase.
These utilities gracefully handle EEXIST errors for concurrent directory
creation, eliminating manual error handling code.
diff --git a/packages/cli/src/bootstrap/node.mts b/packages/cli/src/bootstrap/node.mts
@@ -18,6 +18,8 @@ import { spawn } from 'node:child_process'
 import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
 
+import { safeMkdir } from '@socketsecurity/lib/fs'
+
 import { getNodeDisableSigusr1Flags } from './shared/node-flags.mjs'
 import {
   getCliEntryPoint,
@@ -44,7 +46,7 @@ async function downloadCli(): Promise<void> {
   const dlxDir = getDlxDir()
   const cliDir = getCliPackageDir()
 
-  await fs.mkdir(dlxDir, { recursive: true })
+  await safeMkdir(dlxDir)
 
   console.error(`Downloading ${packageName}...`)
 
@@ -75,7 +77,7 @@ async function downloadCli(): Promise<void> {
       try {
         const tarballPath = path.join(dlxDir, tarballName.trim())
 
-        await fs.mkdir(cliDir, { recursive: true })
+        await safeMkdir(cliDir)
 
         const tarExtractProcess = spawn(
           'tar',
diff --git a/packages/cli/src/commands/fix/ghsa-tracker.mts b/packages/cli/src/commands/fix/ghsa-tracker.mts
@@ -1,8 +1,7 @@
-import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
 import { debug, debugDir } from '@socketsecurity/lib/debug'
-import { readJson, writeJson } from '@socketsecurity/lib/fs'
+import { readJson, safeMkdir, writeJson } from '@socketsecurity/lib/fs'
 
 import { getSocketFixBranchName } from './git.mts'
 
@@ -47,7 +46,7 @@ export async function saveGhsaTracker(
   const trackerPath = path.join(cwd, TRACKER_FILE)
 
   // Ensure .socket directory exists.
-  await fs.mkdir(path.dirname(trackerPath), { recursive: true })
+  await safeMkdir(path.dirname(trackerPath))
 
   await writeJson(trackerPath, tracker, { spaces: 2 })
   debug(`ghsa-tracker: saved ${tracker.fixed.length} records to ${trackerPath}`)
diff --git a/packages/cli/src/commands/install/setup-tab-completion.mts b/packages/cli/src/commands/install/setup-tab-completion.mts
@@ -2,6 +2,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 
 import { debug } from '@socketsecurity/lib/debug'
+import { safeMkdirSync } from '@socketsecurity/lib/fs'
 
 import ENV from '../../constants/env.mts'
 import { homePath, rootPath } from '../../constants/paths.mts'
@@ -35,7 +36,7 @@ export async function setupTabCompletion(targetName: string): Promise<
 
   if (!fs.existsSync(targetDir)) {
     debug('create: target dir')
-    fs.mkdirSync(targetDir, { recursive: true })
+    safeMkdirSync(targetDir)
   }
 
   updateInstalledTabCompletionScript(targetPath)
diff --git a/packages/cli/src/commands/patch/handle-patch-get.mts b/packages/cli/src/commands/patch/handle-patch-get.mts
@@ -6,6 +6,7 @@ import {
   DOT_SOCKET_DIR,
   MANIFEST_JSON,
 } from '@socketsecurity/lib/constants/paths'
+import { safeMkdir } from '@socketsecurity/lib/fs'
 import { logger } from '@socketsecurity/lib/logger'
 import { normalizePath } from '@socketsecurity/lib/path'
 import { pluralize } from '@socketsecurity/lib/words'
@@ -64,7 +65,7 @@ export async function handlePatchGet({
 
     // Create output directory if it doesn't exist.
     if (!existsSync(targetDir)) {
-      await fs.mkdir(targetDir, { recursive: true })
+      await safeMkdir(targetDir)
     }
 
     spinner?.text('Copying patch files')
@@ -87,7 +88,7 @@ export async function handlePatchGet({
       // Create subdirectories if needed.
       if (!existsSync(targetFileDir)) {
         // eslint-disable-next-line no-await-in-loop
-        await fs.mkdir(targetFileDir, { recursive: true })
+        await safeMkdir(targetFileDir)
       }
 
       // eslint-disable-next-line no-await-in-loop
diff --git a/packages/cli/src/commands/scan/create-scan-from-github.mts b/packages/cli/src/commands/scan/create-scan-from-github.mts
@@ -2,14 +2,14 @@ import {
   createWriteStream,
   existsSync,
   promises as fs,
-  mkdirSync,
   mkdtempSync,
 } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { pipeline } from 'node:stream/promises'
 
 import { debug, debugDir } from '@socketsecurity/lib/debug'
+import { safeMkdirSync } from '@socketsecurity/lib/fs'
 import { logger } from '@socketsecurity/lib/logger'
 import { confirm, select } from '@socketsecurity/lib/prompts'
 
@@ -467,7 +467,7 @@ async function streamDownloadWithFetch(
     // before starting the download.
     const dir = path.dirname(localPath)
     if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true })
+      safeMkdirSync(dir)
     }
 
     const fileStream = createWriteStream(localPath)
diff --git a/packages/cli/src/commands/self-update/handle-self-update.mts b/packages/cli/src/commands/self-update/handle-self-update.mts
@@ -12,6 +12,7 @@ import path from 'node:path'
 import colors from 'yoctocolors-cjs'
 
 import { detectPackageManager } from '@socketsecurity/lib/env/package-manager'
+import { safeMkdir } from '@socketsecurity/lib/fs'
 import { getIpcStubPath } from '@socketsecurity/lib/ipc'
 import { logger } from '@socketsecurity/lib/logger'
 
@@ -157,8 +158,8 @@ async function updateStubBinary(
     const downloadsDir = getSocketCliUpdaterDownloadsDir()
     const stagingDir = getSocketCliUpdaterStagingDir()
 
-    await fs.mkdir(downloadsDir, { recursive: true })
-    await fs.mkdir(stagingDir, { recursive: true })
+    await safeMkdir(downloadsDir)
+    await safeMkdir(stagingDir)
 
     const timestamp = Date.now()
     const tarballPath = path.join(downloadsDir, `stub-${timestamp}.tgz`)
@@ -376,7 +377,7 @@ Examples
 
   // Create temporary directory for download.
   const tempDir = path.join(os.tmpdir(), `socket-update-${Date.now()}`)
-  await fs.mkdir(tempDir, { recursive: true })
+  await safeMkdir(tempDir)
 
   try {
     const tarballPath = path.join(tempDir, 'package.tgz')
diff --git a/packages/cli/src/index.mts b/packages/cli/src/index.mts
@@ -10,11 +10,11 @@
 
 // CommonJS globals are available since we're outputting to CJS format.
 const {
-  mkdirSync,
   readFileSync,
   unlinkSync,
   writeFileSync,
 } = require('node:fs')
+const { safeMkdirSync } = require('@socketsecurity/lib/fs')
 const Module = require('node:module')
 const path = require('node:path')
 const { brotliDecompressSync } = require('node:zlib')
@@ -27,7 +27,7 @@ const compressed = readFileSync(cliBzPath)
 const decompressed = brotliDecompressSync(compressed)
 
 // Ensure build/ directory exists.
-mkdirSync(buildPath, { recursive: true })
+safeMkdirSync(buildPath)
 
 // Write to build/ directory (gitignored, local to package).
 const tempCliPath = path.join(buildPath, `cli-runtime-${process.pid}.js`)
diff --git a/packages/cli/src/utils/config.test.mts b/packages/cli/src/utils/config.test.mts
@@ -1,7 +1,8 @@
-import { mkdirSync, mkdtempSync, promises as fs, writeFileSync } from 'node:fs'
+import { mkdtempSync, promises as fs, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 
+import { safeMkdirSync } from '@socketsecurity/lib/fs'
 import { beforeEach, describe, expect, it } from 'vitest'
 
 import {
@@ -59,7 +60,7 @@ describe('utils/config', () => {
 
       try {
         // Create nested directories.
-        mkdirSync(nestedDir, { recursive: true })
+        safeMkdirSync(nestedDir)
 
         // Create socket.yml in the tmpdir root.
         writeFileSync(
diff --git a/packages/cli/src/utils/dlx/binary.mts b/packages/cli/src/utils/dlx/binary.mts
@@ -29,7 +29,7 @@ import os from 'node:os'
 import path from 'node:path'
 
 import { generateCacheKey } from '@socketsecurity/lib/dlx'
-import { readJson } from '@socketsecurity/lib/fs'
+import { readJson, safeMkdir } from '@socketsecurity/lib/fs'
 import { normalizePath } from '@socketsecurity/lib/path'
 import { getSocketDlxDir } from '@socketsecurity/lib/paths'
 import { spawn } from '@socketsecurity/lib/spawn'
@@ -202,7 +202,7 @@ async function downloadBinary(
 
   try {
     // Ensure directory exists.
-    await fs.mkdir(path.dirname(destPath), { recursive: true })
+    await safeMkdir(path.dirname(destPath))
 
     // Get the response as a buffer and compute hash.
     const arrayBuffer = await response.arrayBuffer()
@@ -391,7 +391,7 @@ export async function dlxBinary(
 
   if (downloaded) {
     // Ensure cache directory exists.
-    await fs.mkdir(cacheEntryDir, { recursive: true })
+    await safeMkdir(cacheEntryDir)
 
     // Download the binary.
     computedChecksum = await downloadBinary(url, binaryPath, checksum)
diff --git a/packages/cli/src/utils/git/github.mts b/packages/cli/src/utils/git/github.mts
@@ -39,7 +39,12 @@ import {
   debugNs,
   isDebugNs,
 } from '@socketsecurity/lib/debug'
-import { readJson, safeStatsSync, writeJson } from '@socketsecurity/lib/fs'
+import {
+  readJson,
+  safeMkdir,
+  safeStatsSync,
+  writeJson,
+} from '@socketsecurity/lib/fs'
 import { spawn } from '@socketsecurity/lib/spawn'
 import { parseUrl } from '@socketsecurity/lib/url'
 
@@ -77,7 +82,7 @@ export async function writeCache(
   const githubCachePath = getGithubCachePath()
   const cacheJsonPath = path.join(githubCachePath, `${key}.json`)
   if (!existsSync(githubCachePath)) {
-    await fs.mkdir(githubCachePath, { recursive: true })
+    await safeMkdir(githubCachePath)
   }
   await writeJson(cacheJsonPath, data as JsonContent)
 }
diff --git a/packages/cli/src/utils/manifest/patch-backup.mts b/packages/cli/src/utils/manifest/patch-backup.mts
@@ -26,6 +26,7 @@ import { dirname, join } from 'node:path'
 import ssri from 'ssri'
 
 import { get, put, remove } from '@socketsecurity/lib/cacache'
+import { safeMkdir } from '@socketsecurity/lib/fs'
 
 export interface BackupFileInfo {
   integrity: string // ssri format: sha256-base64
@@ -131,7 +132,7 @@ async function updateMetadata(
 
     // Write back
     const metadataPath = getMetadataPath(uuid)
-    await fs.mkdir(dirname(metadataPath), { recursive: true })
+    await safeMkdir(dirname(metadataPath))
     await fs.writeFile(
       metadataPath,
       JSON.stringify(updatedMetadata, null, 2),
@@ -240,7 +241,7 @@ export async function restoreBackup(
     })
 
     // Ensure parent directory exists
-    await fs.mkdir(dirname(filePath), { recursive: true })
+    await safeMkdir(dirname(filePath))
 
     // Write back to original location
     await fs.writeFile(filePath, entry.data)
diff --git a/packages/cli/src/utils/manifest/patches.mts b/packages/cli/src/utils/manifest/patches.mts
@@ -23,6 +23,7 @@
 import { promises as fs } from 'node:fs'
 import { dirname, join } from 'node:path'
 
+import { safeMkdir } from '@socketsecurity/lib/fs'
 import { z } from 'zod'
 
 const MANIFEST_VERSION = '1.0.0'
@@ -166,7 +167,7 @@ export async function writeManifest(
   const manifestPath = getManifestPath(cwd)
 
   // Ensure parent directory exists
-  await fs.mkdir(dirname(manifestPath), { recursive: true })
+  await safeMkdir(dirname(manifestPath))
 
   // Write atomically (write to temp file, then rename)
   const tempPath = `${manifestPath}.tmp`
diff --git a/packages/cli/src/utils/python/standalone.mts b/packages/cli/src/utils/python/standalone.mts
@@ -49,6 +49,7 @@ import semver from 'semver'
 import { whichBin } from '@socketsecurity/lib/bin'
 import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { downloadBinary, getDlxCachePath } from '@socketsecurity/lib/dlx-binary'
+import { safeMkdir } from '@socketsecurity/lib/fs'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import ENV from '../../constants/env.mts'
@@ -193,7 +194,7 @@ async function downloadPython(pythonDir: string): Promise<void> {
   const tarballName = 'python-standalone.tar.gz'
 
   // Ensure directory exists.
-  await fs.mkdir(pythonDir, { recursive: true })
+  await safeMkdir(pythonDir)
 
   try {
     // Use downloadBinary to download the tarball with caching (without execution).
diff --git a/packages/cli/src/utils/registry/npm-registry.mts b/packages/cli/src/utils/registry/npm-registry.mts
@@ -21,6 +21,7 @@ import { promises as fs } from 'node:fs'
 import https from 'node:https'
 import path from 'node:path'
 
+import { safeMkdir } from '@socketsecurity/lib/fs'
 import { parseTarGzip } from 'nanotar'
 
 // Type helpers.
@@ -275,19 +276,15 @@ export async function extractTarball(
       const targetPath = path.join(targetDir, sanitizedPath)
 
       if (file.type === 'directory') {
-        await retryWithBackoff(() =>
-          fs.mkdir(targetPath, { recursive: true }),
-        ).catch(error => {
+        await retryWithBackoff(() => safeMkdir(targetPath)).catch(error => {
           throw new Error(
             `Failed to create directory ${targetPath}: ${error instanceof Error ? error.message : String(error)}`,
           )
         })
       } else if (file.type === 'file' && file.data) {
         // Ensure parent directory exists.
         const parentDir = path.dirname(targetPath)
-        await retryWithBackoff(() =>
-          fs.mkdir(parentDir, { recursive: true }),
-        ).catch(error => {
+        await retryWithBackoff(() => safeMkdir(parentDir)).catch(error => {
           const code = (error as NodeJS.ErrnoException)?.code
           if (code === 'ENOSPC') {
             throw new Error(
@@ -437,7 +434,7 @@ export async function extractBinaryFromTarball(
 
     // Ensure destination directory exists.
     const destDir = path.dirname(destination)
-    await fs.mkdir(destDir, { recursive: true })
+    await safeMkdir(destDir)
 
     // Write binary to destination.
     await fs.writeFile(
diff --git a/packages/cli/src/utils/sea/build.mts b/packages/cli/src/utils/sea/build.mts
@@ -8,7 +8,7 @@ import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
 
 import { WIN32 } from '@socketsecurity/lib/constants/platform'
-import { safeDelete } from '@socketsecurity/lib/fs'
+import { safeDelete, safeMkdir } from '@socketsecurity/lib/fs'
 import { httpRequest } from '@socketsecurity/lib/http-request'
 import { normalizePath } from '@socketsecurity/lib/path'
 import { getSocketHomePath } from '@socketsecurity/lib/paths'
@@ -72,7 +72,7 @@ export async function buildTarget(
   } as SeaBuildOptions
 
   // Ensure output directory exists.
-  await fs.mkdir(outputDir, { recursive: true })
+  await safeMkdir(outputDir)
 
   // Download Node.js binary for target platform.
   const nodeBinary = await downloadNodeBinary(
@@ -83,7 +83,7 @@ export async function buildTarget(
 
   // Generate output path.
   const outputPath = normalizePath(path.join(outputDir, target.outputName))
-  await fs.mkdir(outputDir, { recursive: true })
+  await safeMkdir(outputDir)
 
   // Generate SEA configuration.
   const configPath = await generateSeaConfig(entryPoint, outputPath)
@@ -169,7 +169,7 @@ export async function downloadNodeBinary(
       createHash('sha256').update(downloadUrl).digest('hex'),
     ),
   )
-  await fs.mkdir(tempDir, { recursive: true })
+  await safeMkdir(tempDir)
 
   try {
     // Save archive.
@@ -227,7 +227,7 @@ export async function downloadNodeBinary(
 
     // Ensure target directory exists.
     const targetDir = path.dirname(nodePath)
-    await fs.mkdir(targetDir, { recursive: true })
+    await safeMkdir(targetDir)
 
     // Move binary to final location.
     await fs.copyFile(extractedBinary, nodePath)
diff --git a/packages/cli/src/utils/update/store.mts b/packages/cli/src/utils/update/store.mts
diff --git a/packages/cli/test/helpers/workspace-helper.mts b/packages/cli/test/helpers/workspace-helper.mts
