add macOS global package crawling fallbacks and pyenv support (#34)

NPM crawler: add find_node_dirs_sync() helper and macOS fallback paths
(Homebrew, nvm, volta, fnm) with deduplication in get_global_node_modules_paths().
Python crawler: add pyenv site-packages discovery via PYENV_ROOT.
E2E tests: add macOS auto-discovery smoke tests for npm and pypi.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_npm.rs

@@ -483,6 +483,38 @@ fn test_npm_apply_force() {
     );
 }
 
+/// macOS auto-discovery: `scan -g --json` without `--global-prefix` uses real path probing.
+#[cfg(target_os = "macos")]
+#[test]
+#[ignore]
+fn test_npm_macos_global_auto_discovery() {
+    if !has_command("npm") {
+        eprintln!("SKIP: npm not found on PATH");
+        return;
+    }
+
+    let cwd_dir = tempfile::tempdir().unwrap();
+    let cwd = cwd_dir.path();
+
+    // Run scan -g without --global-prefix to exercise macOS auto-discovery
+    let (code, stdout, stderr) = run(cwd, &["scan", "-g", "--json"]);
+
+    // Should complete without error (exit 0)
+    assert_eq!(
+        code, 0,
+        "scan -g --json failed (exit {code}).\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+
+    // Output should be valid JSON with scannedPackages field
+    let scan: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("invalid JSON from scan -g: {e}\nstdout:\n{stdout}"));
+    assert!(
+        scan["scannedPackages"].is_u64(),
+        "scannedPackages should be a number, got: {}",
+        scan["scannedPackages"]
+    );
+}
+
 /// UUID shortcut: `socket-patch <UUID>` should behave like `socket-patch get <UUID>`.
 #[test]
 #[ignore]

crates/socket-patch-cli/tests/e2e_pypi.rs

@@ -571,6 +571,38 @@ fn test_pypi_save_only() {
     );
 }
 
+/// macOS auto-discovery: `scan -g --json` without `--global-prefix` uses real path probing.
+#[cfg(target_os = "macos")]
+#[test]
+#[ignore]
+fn test_pypi_macos_global_auto_discovery() {
+    if !has_python3() {
+        eprintln!("SKIP: python3 not found on PATH");
+        return;
+    }
+
+    let cwd_dir = tempfile::tempdir().unwrap();
+    let cwd = cwd_dir.path();
+
+    // Run scan -g without --global-prefix to exercise macOS auto-discovery
+    let (code, stdout, stderr) = run(cwd, &["scan", "-g", "--json"]);
+
+    // Should complete without error (exit 0)
+    assert_eq!(
+        code, 0,
+        "scan -g --json failed (exit {code}).\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+
+    // Output should be valid JSON with scannedPackages field
+    let scan: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("invalid JSON from scan -g: {e}\nstdout:\n{stdout}"));
+    assert!(
+        scan["scannedPackages"].is_u64(),
+        "scannedPackages should be a number, got: {}",
+        scan["scannedPackages"]
+    );
+}
+
 /// UUID shortcut: `socket-patch <UUID>` should behave like `socket-patch get <UUID>`.
 #[test]
 #[ignore]

crates/socket-patch-core/src/crawlers/npm_crawler.rs

@@ -173,6 +173,45 @@ pub fn get_bun_global_prefix() -> Option<String> {
     )
 }
 
+// ---------------------------------------------------------------------------
+// Helpers: synchronous wildcard directory resolver
+// ---------------------------------------------------------------------------
+
+/// Resolve a path with `"*"` wildcard segments synchronously.
+///
+/// Each segment is either a literal directory name or `"*"` which matches any
+/// directory entry. Symlinks are followed via `std::fs::metadata`.
+fn find_node_dirs_sync(base: &Path, segments: &[&str]) -> Vec<PathBuf> {
+    if !base.is_dir() {
+        return Vec::new();
+    }
+    if segments.is_empty() {
+        return vec![base.to_path_buf()];
+    }
+
+    let first = segments[0];
+    let rest = &segments[1..];
+
+    if first == "*" {
+        let mut results = Vec::new();
+        if let Ok(entries) = std::fs::read_dir(base) {
+            for entry in entries.flatten() {
+                // Follow symlinks: use metadata() not symlink_metadata()
+                let is_dir = entry
+                    .metadata()
+                    .map(|m| m.is_dir())
+                    .unwrap_or(false);
+                if is_dir {
+                    results.extend(find_node_dirs_sync(&base.join(entry.file_name()), rest));
+                }
+            }
+        }
+        results
+    } else {
+        find_node_dirs_sync(&base.join(first), rest)
+    }
+}
+
 // ---------------------------------------------------------------------------
 // NpmCrawler
 // ---------------------------------------------------------------------------
@@ -297,19 +336,60 @@ impl NpmCrawler {
 
     /// Collect global `node_modules` paths from all known package managers.
     fn get_global_node_modules_paths(&self) -> Vec<PathBuf> {
+        let mut seen = HashSet::new();
         let mut paths = Vec::new();
 
+        let mut add = |p: PathBuf| {
+            if p.is_dir() && seen.insert(p.clone()) {
+                paths.push(p);
+            }
+        };
+
         if let Ok(npm_path) = get_npm_global_prefix() {
-            paths.push(PathBuf::from(npm_path));
+            add(PathBuf::from(npm_path));
         }
         if let Some(pnpm_path) = get_pnpm_global_prefix() {
-            paths.push(PathBuf::from(pnpm_path));
+            add(PathBuf::from(pnpm_path));
         }
         if let Some(yarn_path) = get_yarn_global_prefix() {
-            paths.push(PathBuf::from(yarn_path));
+            add(PathBuf::from(yarn_path));
         }
         if let Some(bun_path) = get_bun_global_prefix() {
-            paths.push(PathBuf::from(bun_path));
+            add(PathBuf::from(bun_path));
+        }
+
+        // macOS-specific fallback paths
+        if cfg!(target_os = "macos") {
+            let home = std::env::var("HOME").unwrap_or_default();
+
+            // Homebrew Apple Silicon
+            add(PathBuf::from("/opt/homebrew/lib/node_modules"));
+            // Homebrew Intel / default npm
+            add(PathBuf::from("/usr/local/lib/node_modules"));
+
+            if !home.is_empty() {
+                // nvm
+                for p in find_node_dirs_sync(
+                    &PathBuf::from(&home).join(".nvm/versions/node"),
+                    &["*", "lib", "node_modules"],
+                ) {
+                    add(p);
+                }
+                // volta
+                for p in find_node_dirs_sync(
+                    &PathBuf::from(&home).join(".volta/tools/image/node"),
+                    &["*", "lib", "node_modules"],
+                ) {
+                    add(p);
+                }
+                // fnm
+                for p in find_node_dirs_sync(
+                    &PathBuf::from(&home).join(".fnm/node-versions"),
+                    &["*", "installation", "lib", "node_modules"],
+                ) {
+                    add(p);
+                }
+            }
         }
 
         paths
@@ -790,6 +870,48 @@ mod tests {
         assert_eq!(packages[0].purl, "pkg:npm/@types/node@20.0.0");
     }
 
+    #[test]
+    fn test_find_node_dirs_sync_wildcard() {
+        // Create an nvm-like layout: base/v18.0.0/lib/node_modules
+        let dir = tempfile::tempdir().unwrap();
+        let nm1 = dir.path().join("v18.0.0/lib/node_modules");
+        let nm2 = dir.path().join("v20.1.0/lib/node_modules");
+        std::fs::create_dir_all(&nm1).unwrap();
+        std::fs::create_dir_all(&nm2).unwrap();
+
+        let results = find_node_dirs_sync(dir.path(), &["*", "lib", "node_modules"]);
+        assert_eq!(results.len(), 2);
+        assert!(results.contains(&nm1));
+        assert!(results.contains(&nm2));
+    }
+
+    #[test]
+    fn test_find_node_dirs_sync_empty() {
+        // Non-existent base path should return empty
+        let results = find_node_dirs_sync(Path::new("/nonexistent/path/xyz"), &["*", "lib"]);
+        assert!(results.is_empty());
+    }
+
+    #[test]
+    fn test_find_node_dirs_sync_literal() {
+        // All literal segments (no wildcard)
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("lib/node_modules");
+        std::fs::create_dir_all(&target).unwrap();
+
+        let results = find_node_dirs_sync(dir.path(), &["lib", "node_modules"]);
+        assert_eq!(results.len(), 1);
+        assert_eq!(results[0], target);
+    }
+
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn test_macos_get_global_node_modules_paths_no_panic() {
+        let crawler = NpmCrawler::new();
+        // Should not panic, even if no package managers are installed
+        let _paths = crawler.get_global_node_modules_paths();
+    }
+
     #[tokio::test]
     async fn test_find_by_purls() {
         let dir = tempfile::tempdir().unwrap();

crates/socket-patch-core/src/crawlers/python_crawler.rs

@@ -382,6 +382,22 @@ pub async fn get_global_python_site_packages() -> Vec<PathBuf> {
         }
     }
 
+    // pyenv (works on macOS and Linux)
+    if !cfg!(windows) {
+        let pyenv_root = std::env::var("PYENV_ROOT")
+            .map(PathBuf::from)
+            .unwrap_or_else(|_| PathBuf::from(&home_dir).join(".pyenv"));
+        let pyenv_versions = pyenv_root.join("versions");
+        let pyenv_matches = find_python_dirs(
+            &pyenv_versions,
+            &["*", "lib", "python3.*", "site-packages"],
+        )
+        .await;
+        for m in pyenv_matches {
+            add_path(m, &mut seen, &mut results);
+        }
+    }
+
     // Conda
     let anaconda = PathBuf::from(&home_dir).join("anaconda3");
     scan_well_known(&anaconda, "site-packages", &mut seen, &mut results).await;
@@ -736,6 +752,37 @@ mod tests {
         assert_eq!(results[0], sp1);
     }
 
+    #[tokio::test]
+    async fn test_find_python_dirs_pyenv_layout() {
+        // Create a pyenv-like layout: versions/3.11.5/lib/python3.11/site-packages
+        let dir = tempfile::tempdir().unwrap();
+        let sp1 = dir
+            .path()
+            .join("versions")
+            .join("3.11.5")
+            .join("lib")
+            .join("python3.11")
+            .join("site-packages");
+        let sp2 = dir
+            .path()
+            .join("versions")
+            .join("3.12.0")
+            .join("lib")
+            .join("python3.12")
+            .join("site-packages");
+        tokio::fs::create_dir_all(&sp1).await.unwrap();
+        tokio::fs::create_dir_all(&sp2).await.unwrap();
+
+        let results = find_python_dirs(
+            &dir.path().join("versions"),
+            &["*", "lib", "python3.*", "site-packages"],
+        )
+        .await;
+        assert_eq!(results.len(), 2);
+        assert!(results.contains(&sp1));
+        assert!(results.contains(&sp2));
+    }
+
     #[tokio::test]
     async fn test_crawl_all_python() {
         let dir = tempfile::tempdir().unwrap();