refactor(manifest/bazel): address review feedback, fix lint

Walker:
- Lower MAX_WORKSPACE_ROOTS from 256 to 16; well above realistic
  monorepo counts, tighter guard against pathological inputs.

Orchestrator:
- Inject the workspace-walker prune policy via ExtractBazelOptions
  (`ignoreDirNames`, `ignoreDirPrefixes`) instead of hardcoding it
  inside the orchestrator. The CLI command now owns the policy and
  supplies the codebase-wide IGNORED_DIRS plus the Bazel-specific
  bits (`.socket-auto-manifest`, VCS/IDE dirs, `bazel-*` prefix).
- Drop the `dist*` prefix from the prune policy — it's a JS/web
  convention, not Bazel-specific, and shouldn't be hardcoded.
- Drop the Bzlmod-mode "defensive fallback" probe over the
  conventional Maven hub names. `bazel mod show_extension` is the
  authoritative source under Bzlmod; customer-supplied extras
  (`--bazel-maven-repo=`) still get probed. WORKSPACE mode keeps
  the probe path unchanged. The fallback had no real-world
  justification.
- Hoist the per-workspace `buildQueryOpts` helper to module scope
  (eslint consistent-function-scoping).
- Verbose-mode logging in `reapBazelServer` and `removeTempdir`
  catch blocks so the operator can see why a cleanup step failed
  instead of having it swallowed silently.

Lint:
- bazel-query-runner.mts: add missing `await` on three
  `return runBazelOneShot(...)` sites (@typescript-eslint/return-await).
- bazel-repo-discovery.test.mts: hoist five inline `probe` closures
  to module-scope named consts.
- extract_bazel_to_maven.test.mts: hoist `readManifest` and an
  inline mock factory to module scope; reorder type imports.
- extract_bazel_to_pypi.mts: merge duplicate imports of
  `bazel-pypi-discovery.mts`.
- extract_bazel_to_maven.mts: reorder type imports.

Author: simonhj

src/commands/manifest/bazel/bazel-cquery.test.mts

@@ -75,7 +75,9 @@ describe('buildMetadataCqueryArgv', () => {
     })
     expect(argv).toContain('cquery')
     expect(argv).toContain('--output=jsonproto')
-    expect(argv).toContain('--proto:output_rule_attrs=tags,maven_coordinates,maven_url')
+    expect(argv).toContain(
+      '--proto:output_rule_attrs=tags,maven_coordinates,maven_url',
+    )
     expect(argv).toContain('--keep_going')
     expect(argv).toContain('--lockfile_mode=off')
     const expr = argv.find(a => a.includes('attr("tags"'))
@@ -164,7 +166,9 @@ describe('parseCqueryJsonproto', () => {
                 {
                   name: 'tags',
                   type: 'STRING_LIST',
-                  string_list_value: ['maven_coordinates=com.example:snake:2.0'],
+                  string_list_value: [
+                    'maven_coordinates=com.example:snake:2.0',
+                  ],
                 },
               ],
             },

src/commands/manifest/bazel/bazel-query-runner.mts

@@ -309,7 +309,7 @@ async function runBazelOneShot(
 export async function runBazelModShowVisibleRepos(
   opts: BazelQueryOptions,
 ): Promise<BazelQueryResult> {
-  return runBazelOneShot(
+  return await runBazelOneShot(
     buildBazelModShowVisibleReposArgv(opts),
     opts,
     'bazel mod dump_repo_mapping',
@@ -325,7 +325,7 @@ export async function runBazelModShowVisibleRepos(
 export async function runBazelModShowMavenExtension(
   opts: BazelQueryOptions,
 ): Promise<BazelQueryResult> {
-  return runBazelOneShot(
+  return await runBazelOneShot(
     buildBazelModShowMavenExtensionArgv(opts),
     opts,
     'bazel mod show_extension rules_jvm_external maven',
@@ -340,7 +340,7 @@ export async function runBazelModShowMavenExtension(
 export async function runBazelModShowPipExtension(
   opts: BazelQueryOptions,
 ): Promise<BazelQueryResult> {
-  return runBazelOneShot(
+  return await runBazelOneShot(
     buildBazelModShowPipExtensionArgv(opts),
     opts,
     'bazel mod show_extension rules_python pip',

src/commands/manifest/bazel/bazel-query-runner.test.mts

@@ -373,8 +373,7 @@ describe('buildMavenProbeFor', () => {
     mocked.mockResolvedValueOnce({
       code: 1,
       stdout: '',
-      stderr:
-        "ERROR: No repository visible as '@nope' from main repository\n",
+      stderr: "ERROR: No repository visible as '@nope' from main repository\n",
     })
     const probe = buildMavenProbeFor({
       bin: 'bazel',
@@ -385,8 +384,7 @@ describe('buildMavenProbeFor', () => {
     expect(result).toEqual({
       code: 1,
       stdout: '',
-      stderr:
-        "ERROR: No repository visible as '@nope' from main repository\n",
+      stderr: "ERROR: No repository visible as '@nope' from main repository\n",
     })
   })
 })

src/commands/manifest/bazel/bazel-repo-discovery.test.mts

@@ -44,6 +44,22 @@ const probeResult = (over: Partial<ProbeResult> = {}): ProbeResult => ({
   ...over,
 })
 
+const probePopulatedGuava: RepoProbe = async () => ({
+  code: 0,
+  stdout: '@maven//:guava\n',
+  stderr: '',
+})
+
+const probePopulatedX: RepoProbe = async () => ({
+  code: 0,
+  stdout: '@maven//:x\n',
+  stderr: '',
+})
+
+const probeThrows: RepoProbe = async () => {
+  throw new Error('bazel exploded')
+}
+
 describe('bazel-repo-discovery', () => {
   describe('parseShowExtensionOutput', () => {
     it('extracts hub repos with (imported by ...) annotations only', () => {
@@ -122,7 +138,7 @@ describe('bazel-repo-discovery', () => {
           probeResult({
             code: 1,
             stderr:
-              "WARNING: Evaluation of query \"@maven_install//...\" failed: no targets found beneath ''\n",
+              'WARNING: Evaluation of query "@maven_install//..." failed: no targets found beneath \'\'\n',
           }),
         ),
       ).toBe<ProbeStatus>('empty')
@@ -156,19 +172,13 @@ describe('bazel-repo-discovery', () => {
 
   describe('probeCandidate', () => {
     it('returns the classified status from a probe', async () => {
-      const probe: RepoProbe = async () => ({
-        code: 0,
-        stdout: '@maven//:guava\n',
-        stderr: '',
-      })
-      expect(await probeCandidate('maven', probe)).toBe<ProbeStatus>('populated')
+      expect(
+        await probeCandidate('maven', probePopulatedGuava),
+      ).toBe<ProbeStatus>('populated')
     })
 
     it('returns not-defined when the probe throws', async () => {
-      const probe: RepoProbe = async () => {
-        throw new Error('bazel exploded')
-      }
-      expect(await probeCandidate('crash', probe)).toBe<ProbeStatus>(
+      expect(await probeCandidate('crash', probeThrows)).toBe<ProbeStatus>(
         'not-defined',
       )
     })
@@ -204,30 +214,17 @@ describe('bazel-repo-discovery', () => {
     }
 
     it('probeCandidate stays silent without verbose', async () => {
-      const probe: RepoProbe = async () => ({
-        code: 0,
-        stdout: '@maven//:x\n',
-        stderr: '',
-      })
-      await probeCandidate('maven', probe)
+      await probeCandidate('maven', probePopulatedX)
       expect(logSpy).not.toHaveBeenCalled()
     })
 
     it('probeCandidate logs the status under verbose', async () => {
-      const probe: RepoProbe = async () => ({
-        code: 0,
-        stdout: '@maven//:x\n',
-        stderr: '',
-      })
-      await probeCandidate('maven', probe, true)
+      await probeCandidate('maven', probePopulatedX, true)
       expect(loggedLines()).toMatch(/probe @maven:\s*populated/)
     })
 
     it('probeCandidate logs the throw reason under verbose', async () => {
-      const probe: RepoProbe = async () => {
-        throw new Error('bazel exploded')
-      }
-      await probeCandidate('crash', probe, true)
+      await probeCandidate('crash', probeThrows, true)
       expect(loggedLines()).toMatch(
         /probe @crash:\s*not-defined \(probe threw: bazel exploded\)/,
       )

src/commands/manifest/bazel/bazel-workspace-walk.mts

@@ -20,9 +20,8 @@ import path from 'node:path'
 
 import { logger } from '@socketsecurity/registry/lib/logger'
 
-// Hard ceiling on number of workspace roots we will surface. Real monorepos
-// have well under 50; this cap is a guard against pathological inputs.
-const MAX_WORKSPACE_ROOTS = 256
+// Hard ceiling on workspace roots; 16 sits well above realistic monorepo counts while tightening the guard against pathological inputs.
+const MAX_WORKSPACE_ROOTS = 16
 // Hard ceiling on directory walk depth. Deepest workspace marker observed
 // across the OSS corpus surveyed is 9 (bazel-self test fixtures); deepest
 // in realistic application code is 7 (checkmk's thirdparty layout). Cap

src/commands/manifest/bazel/cmd-manifest-bazel.mts

@@ -10,10 +10,25 @@ import { commonFlags } from '../../../flags.mts'
 import { checkCommandInput } from '../../../utils/check-input.mts'
 import { InputError } from '../../../utils/errors.mts'
 import { getOutputKind } from '../../../utils/get-output-kind.mts'
+import { IGNORED_DIRS } from '../../../utils/glob.mts'
 import { meowOrExit } from '../../../utils/meow-with-subcommands.mts'
 import { getFlagListOutput } from '../../../utils/output-formatting.mts'
 import { readOrDefaultSocketJson } from '../../../utils/socket-json.mts'
 
+// Walker prune policy for `socket manifest bazel`. Combines the
+// codebase-wide ignore list with VCS/IDE dirs and the walker's own
+// output dir, and Bazel's `bazel-*` output_base symlinks (prefix).
+const BAZEL_WALKER_IGNORE_DIR_NAMES: ReadonlySet<string> = new Set([
+  ...IGNORED_DIRS,
+  '.hg',
+  '.idea',
+  '.pnpm-store',
+  '.socket-auto-manifest',
+  '.svn',
+  '.vscode',
+])
+const BAZEL_WALKER_IGNORE_DIR_PREFIXES: readonly string[] = ['bazel-']
+
 import type {
   CliCommandConfig,
   CliCommandContext,
@@ -303,6 +318,8 @@ async function run(
         bazelRc: bazelRc as string | undefined,
         bin: bazel as string | undefined,
         cwd,
+        ignoreDirNames: BAZEL_WALKER_IGNORE_DIR_NAMES,
+        ignoreDirPrefixes: BAZEL_WALKER_IGNORE_DIR_PREFIXES,
         out: out as string,
         verbose: Boolean(verbose),
       })