fix(cli): use the public npm registry for the self-update check (#1395)

The self-update check now always uses the public npm registry instead of resolving it from the local npm config, so it behaves the same regardless of the directory the CLI runs in.

- Extract it into runSelfUpdateCheck() with a unit test covering the pinned registry.
- Drop the now-unused registry-url / registry-auth-token dependencies.

Author: jdalton

package.json

@@ -174,8 +174,6 @@
     "oxlint": "1.15.0",
     "pony-cause": "2.1.11",
     "postject": "1.0.0-alpha.6",
-    "registry-auth-token": "5.1.0",
-    "registry-url": "7.2.0",
     "rollup": "4.50.1",
     "semver": "7.7.2",
     "synp": "1.9.14",

pnpm-lock.yaml

@@ -4,10 +4,6 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 
 import meow from 'meow'
 import { messageWithCauses, stackWithCauses } from 'pony-cause'
-import lookupRegistryAuthToken from 'registry-auth-token'
-import lookupRegistryUrl from 'registry-url'
-import updateNotifier from 'tiny-updater'
-import colors from 'yoctocolors-cjs'
 
 import { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'
 import { logger } from '@socketsecurity/registry/lib/logger'
@@ -17,6 +13,7 @@ import constants from './constants.mts'
 import { AuthError, InputError, captureException } from './utils/errors.mts'
 import { failMsgWithBadge } from './utils/fail-msg-with-badge.mts'
 import { meowWithSubcommands } from './utils/meow-with-subcommands.mts'
+import { runSelfUpdateCheck } from './utils/self-update.mts'
 import { serializeResultJson } from './utils/serialize-result-json.mts'
 import {
   finalizeTelemetry,
@@ -25,7 +22,6 @@ import {
   trackCliError,
   trackCliStart,
 } from './utils/telemetry/integration.mts'
-import { socketPackageLink } from './utils/terminal-link.mts'
 
 const __filename = fileURLToPath(import.meta.url)
 
@@ -39,22 +35,7 @@ void (async () => {
   // Track CLI start for telemetry.
   await trackCliStart(process.argv)
 
-  const registryUrl = lookupRegistryUrl()
-  await updateNotifier({
-    authInfo: lookupRegistryAuthToken(registryUrl, { recursive: true }),
-    name: constants.SOCKET_CLI_BIN_NAME,
-    registryUrl,
-    ttl: 86_400_000 /* 24 hours in milliseconds */,
-    version: constants.ENV.INLINED_SOCKET_CLI_VERSION,
-    logCallback: (name: string, version: string, latest: string) => {
-      logger.log(
-        `\n\n📦 Update available for ${colors.cyan(name)}: ${colors.gray(version)} → ${colors.green(latest)}`,
-      )
-      logger.log(
-        `📝 ${socketPackageLink('npm', name, `files/${latest}/CHANGELOG.md`, 'View changelog')}`,
-      )
-    },
-  })
+  await runSelfUpdateCheck()
 
   try {
     await meowWithSubcommands(

src/cli.mts

@@ -0,0 +1,25 @@
+import updateNotifier from 'tiny-updater'
+import colors from 'yoctocolors-cjs'
+
+import { logger } from '@socketsecurity/registry/lib/logger'
+
+import constants from '../constants.mts'
+import { socketPackageLink } from './terminal-link.mts'
+
+// Check the public npm registry for a newer socket release.
+export async function runSelfUpdateCheck(): Promise<void> {
+  await updateNotifier({
+    name: constants.SOCKET_CLI_BIN_NAME,
+    registryUrl: 'https://registry.npmjs.org/',
+    ttl: 86_400_000 /* 24 hours in milliseconds */,
+    version: constants.ENV.INLINED_SOCKET_CLI_VERSION,
+    logCallback: (name: string, version: string, latest: string) => {
+      logger.log(
+        `\n\n📦 Update available for ${colors.cyan(name)}: ${colors.gray(version)} → ${colors.green(latest)}`,
+      )
+      logger.log(
+        `📝 ${socketPackageLink('npm', name, `files/${latest}/CHANGELOG.md`, 'View changelog')}`,
+      )
+    },
+  })
+}

src/utils/self-update.mts

@@ -0,0 +1,19 @@
+import updateNotifier from 'tiny-updater'
+import { describe, expect, it, vi } from 'vitest'
+
+import { runSelfUpdateCheck } from './self-update.mts'
+
+vi.mock('tiny-updater', () => ({
+  default: vi.fn(async () => false),
+}))
+
+describe('runSelfUpdateCheck', () => {
+  it('checks the public npm registry', async () => {
+    await runSelfUpdateCheck()
+
+    expect(updateNotifier).toHaveBeenCalledTimes(1)
+    const options = vi.mocked(updateNotifier).mock.calls[0]![0]
+    expect(options.registryUrl).toBe('https://registry.npmjs.org/')
+    expect('authInfo' in options).toBe(false)
+  })
+})