fix(poetry): add ENOENT error handling for missing poetry binary (#538)

* fix(poetry): add ENOENT error handling for missing poetry binary

Throw a clear "poetry is not accessible" error instead of the raw
"spawnSync poetry ENOENT" when the poetry binary is not installed.

Implements TC-4563

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor(poetry): address sourcery-ai review suggestions

- Thread resolved poetryBin through to _getPoetryShowTreeOutput and
  _getPoetryShowAllOutput to avoid duplicate resolution
- Attach original error as cause in ENOENT path for debugging
- Add happy-path test for _verifyPoetryAccessible

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(poetry): skip binary verification when env vars bypass invocation

Guard _verifyPoetryAccessible with an env-var bypass check so poetry
does not need to be installed when both TRUSTIFY_DA_POETRY_SHOW_TREE
and TRUSTIFY_DA_POETRY_SHOW_ALL are set.

Implements TC-4660

Assisted-by: Claude Code

* fix(poetry): move _verifyPoetryAccessible above _getDependencyData JSDoc

The method was inserted between the JSDoc block and _getDependencyData,
causing the @param docs to appear as if they belonged to the wrong method.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/providers/python_poetry.js

@@ -40,6 +40,17 @@ export default class Python_poetry extends Base_pyproject {
 		return 'poetry'
 	}
 
+	_verifyPoetryAccessible(poetryBin) {
+		try {
+			invokeCommand(poetryBin, ['--version'])
+		} catch (error) {
+			if (error.code === 'ENOENT') {
+				throw new Error(`poetry is not accessible at "${poetryBin}"`, { cause: error })
+			}
+			throw new Error('failed to check for poetry binary', { cause: error })
+		}
+	}
+
 	/**
 	 * @param {string} manifestDir
 	 * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -49,9 +60,15 @@ export default class Python_poetry extends Base_pyproject {
 	 */
 	// eslint-disable-next-line no-unused-vars
 	async _getDependencyData(manifestDir, _workspaceDir, parsed, opts) {
+		let poetryBin = getCustomPath('poetry', opts)
+		let envBypass = environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')
+			&& environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')
+		if (!envBypass) {
+			this._verifyPoetryAccessible(poetryBin)
+		}
 		let hasDevGroup = !!(parsed.tool?.poetry?.group?.dev || parsed.tool?.poetry?.['dev-dependencies'])
-		let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts)
-		let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts)
+		let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin)
+		let showAllOutput = this._getPoetryShowAllOutput(manifestDir, poetryBin)
 		let versionMap = this._parsePoetryShowAll(showAllOutput)
 		let lockDir = this._findLockFileDir(manifestDir, opts)
 		let markerData = this._extractMarkerData(lockDir, parsed)
@@ -62,14 +79,13 @@ export default class Python_poetry extends Base_pyproject {
 	 * Get poetry show --tree output.
 	 * @param {string} manifestDir
 	 * @param {boolean} hasDevGroup
-	 * @param {Object} opts
+	 * @param {string} poetryBin
 	 * @returns {string}
 	 */
-	_getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts) {
+	_getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin) {
 		if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')) {
 			return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_TREE'], 'base64').toString('utf-8')
 		}
-		let poetryBin = getCustomPath('poetry', opts)
 		let args = ['show', '--tree', '--no-ansi']
 		if (hasDevGroup) {
 			args.push('--without', 'dev')
@@ -80,14 +96,13 @@ export default class Python_poetry extends Base_pyproject {
 	/**
 	 * Get poetry show --all output (flat list with resolved versions).
 	 * @param {string} manifestDir
-	 * @param {Object} opts
+	 * @param {string} poetryBin
 	 * @returns {string}
 	 */
-	_getPoetryShowAllOutput(manifestDir, opts) {
+	_getPoetryShowAllOutput(manifestDir, poetryBin) {
 		if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')) {
 			return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_ALL'], 'base64').toString('utf-8')
 		}
-		let poetryBin = getCustomPath('poetry', opts)
 		return invokeCommand(poetryBin, ['show', '--no-ansi', '--all'], { cwd: manifestDir }).toString()
 	}
 

test/providers/python_pyproject.test.js

@@ -2,6 +2,7 @@ import fs from 'fs'
 import path from 'path'
 
 import { expect } from 'chai'
+import esmock from 'esmock'
 import { useFakeTimers } from 'sinon'
 
 import Python_pip_pyproject from '../../src/providers/python_pip_pyproject.js'
@@ -645,3 +646,105 @@ suite('testing the python-pyproject data provider', () => {
 	Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true })
 	clock.restore()
 })
+
+suite('testing python-poetry error handling', () => {
+	/** Verifies that a missing poetry binary produces a clear error message. */
+	test('verify error when poetry binary is not accessible', async () => {
+		let provider = await esmock('../../src/providers/python_poetry.js', {
+			'../../src/tools.js': {
+				getCustomPath: () => '/nonexistent/poetry',
+				invokeCommand: () => {
+					let err = new Error('spawn /nonexistent/poetry ENOENT')
+					err.code = 'ENOENT'
+					throw err
+				}
+			}
+		})
+
+		let instance = new provider.default()
+		expect(() => instance._verifyPoetryAccessible('/nonexistent/poetry'))
+			.to.throw('poetry is not accessible at "/nonexistent/poetry"')
+	}).timeout(TIMEOUT)
+
+	/** Verifies that an accessible poetry binary does not throw. */
+	test('verify no error when poetry binary is accessible', async () => {
+		let provider = await esmock('../../src/providers/python_poetry.js', {
+			'../../src/tools.js': {
+				getCustomPath: () => 'poetry',
+				invokeCommand: () => Buffer.from('Poetry (version 1.8.0)')
+			}
+		})
+
+		let instance = new provider.default()
+		expect(() => instance._verifyPoetryAccessible('poetry')).to.not.throw()
+	}).timeout(TIMEOUT)
+
+	/** Verifies that non-ENOENT errors are re-thrown with cause chain preserved. */
+	test('verify non-ENOENT errors are re-thrown with cause', async () => {
+		let originalError = new Error('permission denied')
+		originalError.code = 'EACCES'
+
+		let provider = await esmock('../../src/providers/python_poetry.js', {
+			'../../src/tools.js': {
+				getCustomPath: () => 'poetry',
+				invokeCommand: () => {
+					throw originalError
+				}
+			}
+		})
+
+		let instance = new provider.default()
+		expect(() => instance._verifyPoetryAccessible('poetry'))
+			.to.throw('failed to check for poetry binary')
+	}).timeout(TIMEOUT)
+
+	/** Verifies that _getDependencyData skips binary verification when both env vars bypass poetry. */
+	test('verify _getDependencyData skips binary check when both env vars are set', async () => {
+		let provider = await esmock('../../src/providers/python_poetry.js', {
+			'../../src/tools.js': {
+				getCustomPath: () => '/nonexistent/poetry',
+				environmentVariableIsPopulated: (name) => {
+					return name === 'TRUSTIFY_DA_POETRY_SHOW_TREE' || name === 'TRUSTIFY_DA_POETRY_SHOW_ALL'
+				},
+				invokeCommand: () => {
+					let err = new Error('spawn /nonexistent/poetry ENOENT')
+					err.code = 'ENOENT'
+					throw err
+				}
+			}
+		})
+
+		let instance = new provider.default()
+		instance._getPoetryShowTreeOutput = () => ''
+		instance._getPoetryShowAllOutput = () => ''
+		instance._parsePoetryShowAll = () => new Map()
+		instance._findLockFileDir = () => '/tmp'
+		instance._extractMarkerData = () => ({})
+		instance._parsePoetryTree = () => ({ directDeps: [], graph: new Map() })
+
+		await instance._getDependencyData('/tmp', '/tmp', { tool: {} }, {})
+	}).timeout(TIMEOUT)
+
+	/** Verifies that _getDependencyData runs binary verification when env vars are not set. */
+	test('verify _getDependencyData runs binary check when env vars are not set', async () => {
+		let provider = await esmock('../../src/providers/python_poetry.js', {
+			'../../src/tools.js': {
+				getCustomPath: () => '/nonexistent/poetry',
+				environmentVariableIsPopulated: () => false,
+				invokeCommand: () => {
+					let err = new Error('spawn /nonexistent/poetry ENOENT')
+					err.code = 'ENOENT'
+					throw err
+				}
+			}
+		})
+
+		let instance = new provider.default()
+		try {
+			await instance._getDependencyData('/tmp', '/tmp', { tool: {} }, {})
+			expect.fail('Expected error to be thrown')
+		} catch (e) {
+			expect(e.message).to.include('poetry is not accessible')
+		}
+	}).timeout(TIMEOUT)
+})