fix: make --version exit with code 0 instead of 2 (#1125)

* fix: make --version exit with code 0 instead of 2

The --version flag was defined and parsed but never explicitly handled
at the root command level, causing it to fall through to showHelp with
exit code 2. This broke automation (e.g. Ansible) that checks the exit
code of `socket --version`.

* fix: add patch command to public commands set

The patch command was registered and unhidden but missing from the
hardcoded public commands validation set, causing a spurious
"Received an unknown command: patch" error on every CLI invocation.
Also removes the workaround in test utils that stripped this error.

---------

Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

Author: mtorp

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.74",
+  "version": "1.1.75",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",

src/commands/cli.test.mts

@@ -6,6 +6,7 @@ import constants, {
   FLAG_CONFIG,
   FLAG_DRY_RUN,
   FLAG_HELP,
+  FLAG_VERSION,
 } from '../constants.mts'
 
 describe('socket root command', async () => {
@@ -48,6 +49,7 @@ describe('socket root command', async () => {
             manifest                    Generate a dependency manifest for certain ecosystems
             npm                         Wraps npm with Socket security scanning
             npx                         Wraps npx with Socket security scanning
+            patch                       Apply, manage, and rollback Socket security patches for vulnerable dependencies
             raw-npm                     Run npm without the Socket wrapper
             raw-npx                     Run npx without the Socket wrapper
 
@@ -87,6 +89,17 @@ describe('socket root command', async () => {
     },
   )
 
+  cmdit(
+    [FLAG_VERSION, FLAG_CONFIG, '{}'],
+    `should support ${FLAG_VERSION}`,
+    async cmd => {
+      const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+      // Version output should be a semver string.
+      expect(stdout).toMatch(/^\d+\.\d+\.\d+/)
+      expect(code, 'version should exit with code 0').toBe(0)
+    },
+  )
+
   cmdit(
     ['mootools', FLAG_DRY_RUN, FLAG_CONFIG, '{"apiToken":"fakeToken"}'],
     'should require args with just dry-run',

src/utils/meow-with-subcommands.mts

@@ -553,7 +553,7 @@ export async function meowWithSubcommands(
       'optimize',
       'organization',
       'package',
-      //'patch',
+      'patch',
       // PNPM,
       'raw-npm',
       'raw-npx',
@@ -612,6 +612,7 @@ export async function meowWithSubcommands(
       `  manifest                    ${description(subcommands['manifest'])}`,
       `  npm                         ${description(subcommands[NPM])}`,
       `  npx                         ${description(subcommands[NPX])}`,
+      `  patch                       ${description(subcommands['patch'])}`,
       `  raw-npm                     ${description(subcommands['raw-npm'])}`,
       `  raw-npx                     ${description(subcommands['raw-npx'])}`,
       '',
@@ -743,9 +744,21 @@ export async function meowWithSubcommands(
     help: lines.map(l => indentString(l, HELP_INDENT)).join('\n'),
   })
 
-  const { dryRun, help: helpFlag } = cli2.flags as {
+  const {
+    dryRun,
+    help: helpFlag,
+    version: versionFlag,
+  } = cli2.flags as {
     dryRun: boolean
     help: boolean
+    version: boolean
+  }
+
+  // Handle --version: print version and exit successfully.
+  if (versionFlag) {
+    logger.log(constants.ENV.INLINED_SOCKET_CLI_VERSION)
+    process.exitCode = 0
+    return
   }
 
   // ...else we provide basic instructions and help.

test/utils.mts

@@ -78,11 +78,6 @@ function normalizeBanner(str: string): string {
       )
       // Replace cwd path with "<redacted>".
       .replace(/cwd: [^\n"]+/g, 'cwd: <redacted>')
-      // Strip "Received an unknown command: patch" error line that appears
-      // when socket-patch binary is not available in the test build.
-      // Also consume any leading whitespace on the next line so indentation
-      // stays consistent when the error line is absent.
-      .replace(/[^\n]*Received an unknown command: patch[^\n]*\n\s*/g, '')
   )
 }