Skip to content

Commit 320c757

Browse files
jdaltonjdalton
committed
fix(build-externals): unstub pacote fetchers and related helpers
The bundled externals were stubbing pacote's dir/file/remote/git fetchers on the assumption we only pass registry specs, but packPackage()/extractPackage() routinely pass directory/tarball/url specs and RegistryFetcher streams registry tarballs through RemoteFetcher internally. Also unstub @npmcli/git (needed by normalize.gitHead) and @npmcli/run-script (needed for prepack). Also removes env/socket-cli-shadow, which no consumer references after Socket CLI dropped its shadow infrastructure. Adds regression tests covering each unstubbed fetcher plus EditablePackageJson.prepare() gitHead and packPackage() prepack paths.
1 parent 067487e commit 320c757

8 files changed

Lines changed: 167 additions & 494 deletions

File tree

‎.claude/hooks/check-new-deps/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
},
1212
"dependencies": {
1313
"@socketregistry/packageurl-js": "1.4.2",
14-
"@socketsecurity/lib": "5.21.0",
14+
"@socketsecurity/lib": "5.23.0",
1515
"@socketsecurity/sdk": "4.0.1"
1616
},
1717
"devDependencies": {

‎docs/api-index.md‎

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -124,30 +124,29 @@ Each entry links to the source module and shows the first sentence of its `@file
124124

125125
## env/
126126

127-
| Subpath | Description |
128-
| ------------------------------------------------------------------------------ | -------------------------------------------------------------- |
129-
| [`@socketsecurity/lib/env/ci`](../src/env/ci.ts) | CI environment variable getter. |
130-
| [`@socketsecurity/lib/env/debug`](../src/env/debug.ts) | DEBUG environment variable getter. |
131-
| [`@socketsecurity/lib/env/github`](../src/env/github.ts) | GitHub Actions environment variable getters. |
132-
| [`@socketsecurity/lib/env/helpers`](../src/env/helpers.ts) | Environment variable type conversion helpers. |
133-
| [`@socketsecurity/lib/env/home`](../src/env/home.ts) | HOME environment variable getter with Windows fallback. |
134-
| [`@socketsecurity/lib/env/locale`](../src/env/locale.ts) | Locale and language environment variable getters. |
135-
| [`@socketsecurity/lib/env/node-auth-token`](../src/env/node-auth-token.ts) | NODE_AUTH_TOKEN environment variable getter. |
136-
| [`@socketsecurity/lib/env/node-env`](../src/env/node-env.ts) | NODE_ENV environment variable getter. |
137-
| [`@socketsecurity/lib/env/npm`](../src/env/npm.ts) | NPM environment variable getters. |
138-
| [`@socketsecurity/lib/env/package-manager`](../src/env/package-manager.ts) | Package manager environment detection. |
139-
| [`@socketsecurity/lib/env/path`](../src/env/path.ts) | PATH environment variable getter. |
140-
| [`@socketsecurity/lib/env/pre-commit`](../src/env/pre-commit.ts) | PRE_COMMIT environment variable getter. |
141-
| [`@socketsecurity/lib/env/rewire`](../src/env/rewire.ts) | Environment variable rewiring utilities for testing. |
142-
| [`@socketsecurity/lib/env/shell`](../src/env/shell.ts) | SHELL environment variable getter. |
143-
| [`@socketsecurity/lib/env/socket`](../src/env/socket.ts) | Socket Security environment variable getters. |
144-
| [`@socketsecurity/lib/env/socket-cli`](../src/env/socket-cli.ts) | Socket CLI environment variables. |
145-
| [`@socketsecurity/lib/env/socket-cli-shadow`](../src/env/socket-cli-shadow.ts) | Socket CLI shadow mode environment variables. |
146-
| [`@socketsecurity/lib/env/temp-dir`](../src/env/temp-dir.ts) | Temporary directory environment variable getters. |
147-
| [`@socketsecurity/lib/env/term`](../src/env/term.ts) | TERM environment variable getter. |
148-
| [`@socketsecurity/lib/env/test`](../src/env/test.ts) | Test environment variable getters and detection. |
149-
| [`@socketsecurity/lib/env/windows`](../src/env/windows.ts) | Windows environment variable getters. |
150-
| [`@socketsecurity/lib/env/xdg`](../src/env/xdg.ts) | XDG Base Directory Specification environment variable getters. |
127+
| Subpath | Description |
128+
| -------------------------------------------------------------------------- | -------------------------------------------------------------- |
129+
| [`@socketsecurity/lib/env/ci`](../src/env/ci.ts) | CI environment variable getter. |
130+
| [`@socketsecurity/lib/env/debug`](../src/env/debug.ts) | DEBUG environment variable getter. |
131+
| [`@socketsecurity/lib/env/github`](../src/env/github.ts) | GitHub Actions environment variable getters. |
132+
| [`@socketsecurity/lib/env/helpers`](../src/env/helpers.ts) | Environment variable type conversion helpers. |
133+
| [`@socketsecurity/lib/env/home`](../src/env/home.ts) | HOME environment variable getter with Windows fallback. |
134+
| [`@socketsecurity/lib/env/locale`](../src/env/locale.ts) | Locale and language environment variable getters. |
135+
| [`@socketsecurity/lib/env/node-auth-token`](../src/env/node-auth-token.ts) | NODE_AUTH_TOKEN environment variable getter. |
136+
| [`@socketsecurity/lib/env/node-env`](../src/env/node-env.ts) | NODE_ENV environment variable getter. |
137+
| [`@socketsecurity/lib/env/npm`](../src/env/npm.ts) | NPM environment variable getters. |
138+
| [`@socketsecurity/lib/env/package-manager`](../src/env/package-manager.ts) | Package manager environment detection. |
139+
| [`@socketsecurity/lib/env/path`](../src/env/path.ts) | PATH environment variable getter. |
140+
| [`@socketsecurity/lib/env/pre-commit`](../src/env/pre-commit.ts) | PRE_COMMIT environment variable getter. |
141+
| [`@socketsecurity/lib/env/rewire`](../src/env/rewire.ts) | Environment variable rewiring utilities for testing. |
142+
| [`@socketsecurity/lib/env/shell`](../src/env/shell.ts) | SHELL environment variable getter. |
143+
| [`@socketsecurity/lib/env/socket`](../src/env/socket.ts) | Socket Security environment variable getters. |
144+
| [`@socketsecurity/lib/env/socket-cli`](../src/env/socket-cli.ts) | Socket CLI environment variables. |
145+
| [`@socketsecurity/lib/env/temp-dir`](../src/env/temp-dir.ts) | Temporary directory environment variable getters. |
146+
| [`@socketsecurity/lib/env/term`](../src/env/term.ts) | TERM environment variable getter. |
147+
| [`@socketsecurity/lib/env/test`](../src/env/test.ts) | Test environment variable getters and detection. |
148+
| [`@socketsecurity/lib/env/windows`](../src/env/windows.ts) | Windows environment variable getters. |
149+
| [`@socketsecurity/lib/env/xdg`](../src/env/xdg.ts) | XDG Base Directory Specification environment variable getters. |
151150

152151
## json/
153152

‎pnpm-lock.yaml‎

Lines changed: 2 additions & 15 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎scripts/build-externals/esbuild-config.mts‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,6 @@ const requireResolve = createRequire(import.meta.url)
3030
* to also match (used to scope relative-path stubs to a specific package).
3131
*/
3232
const STUB_MAP: Record<string, string | [RegExp, string]> = {
33-
// Git-based package specs (`git://`, `github:`, `gitlab:`). We only
34-
// pass registry specs (`name@version`); pacote/lib/git.js and
35-
// @npmcli/git are unreachable.
36-
'^@npmcli/git$': 'empty.cjs',
3733
// Vulnerability calculator — arb.audit() path only.
3834
'^@npmcli/metavuln-calculator$': 'empty.cjs',
3935
// Arborist CSS-selector query API — unused.
@@ -45,10 +41,6 @@ const STUB_MAP: Record<string, string | [RegExp, string]> = {
4541
// value is consumed but never acted on. Stub returns falsy =>
4642
// isGyp=false => branch skipped.
4743
'^@npmcli/node-gyp$': 'npmcli-node-gyp.cjs',
48-
// Lifecycle scripts — we always pass ignoreScripts: true, so every
49-
// runScript(...) call site in arborist/reify.js and arborist/rebuild.js
50-
// is guarded out.
51-
'^@npmcli/run-script$': 'empty.cjs',
5244
// Sigstore attestation — reachable only via arb.audit(), unused.
5345
'^@sigstore/(bundle|core|protobuf-specs|sign|tuf|verify)$': 'empty.cjs',
5446
// TUF root-of-trust — Sigstore-only dependency.
@@ -62,16 +54,25 @@ const STUB_MAP: Record<string, string | [RegExp, string]> = {
6254
'^proggy$': 'proggy.cjs',
6355
'^sigstore$': 'empty.cjs',
6456
'^tuf-js$': 'empty.cjs',
65-
// Pacote non-registry fetchers — eagerly required at the top of
66-
// pacote/lib/fetcher.js but only instantiated when the parsed spec
67-
// type matches. We only pass registry specs (name@version/range/tag)
68-
// → RegistryFetcher is the only one that ever fires. Scope each
69-
// stub to imports coming from inside pacote/lib so unrelated ./dir
70-
// etc. imports elsewhere aren't caught.
71-
'^\\./dir\\.js$': [/pacote[\\/]lib[\\/]/, 'pacote-fetcher-throw.cjs'],
72-
'^\\./file\\.js$': [/pacote[\\/]lib[\\/]/, 'pacote-fetcher-throw.cjs'],
73-
'^\\./git\\.js$': [/pacote[\\/]lib[\\/]/, 'pacote-fetcher-throw.cjs'],
74-
'^\\./remote\\.js$': [/pacote[\\/]lib[\\/]/, 'pacote-fetcher-throw.cjs'],
57+
// Pacote fetchers were previously stubbed on the assumption that
58+
// our API surface only passes registry specs. That assumption is
59+
// false:
60+
// - `./dir.js` is reached for directory specs that
61+
// `packPackage(path)` / `extractPackage(path)`
62+
// routinely pass.
63+
// - `./file.js` is reached for local tarball specs.
64+
// - `./remote.js` is reached for http(s) tarball specs AND
65+
// internally from registry.js's
66+
// `_tarballFromResolved()` which streams every
67+
// registry tarball as a remote fetch.
68+
// - `./git.js` is reached for `git+https://`, `github:`,
69+
// `gitlab:`, etc. specs. We don't test that
70+
// path, but our API surface doesn't forbid it,
71+
// and stubbing silently turns a valid spec into
72+
// "this pacote fetcher is stubbed out" at
73+
// runtime.
74+
// None of them can be safely stubbed at the API boundary we
75+
// expose, so leave all four fetchers real.
7576
// Arborist AuditReport — load() is gated on options.audit !== false
7677
// and we always pass audit: false. The require is eager but the
7778
// class is never instantiated.

‎src/env/socket-cli-shadow.ts‎

Lines changed: 0 additions & 100 deletions
This file was deleted.

0 commit comments

Comments
 (0)