fix(test): repair stripTrailingSlash normalize regression, TDZ mock, stale-lock test, and patch lib errorStack

Author: jdalton

CHANGELOG.md

@@ -194,9 +194,9 @@ export function projectIgnorePathsToReachExcludePaths(
 }
 
 export function stripTrailingSlash(value: string): string {
-  return value.length > 1 && normalizePath(value).endsWith('/')
-    ? value.slice(0, -1)
-    : value
+  // normalizePath collapses separators AND drops any trailing slash, so the
+  // normalized form IS the stripped form (root '/' stays '/').
+  return value.length > 1 ? normalizePath(value) : value
 }
 
 export function toPosixPath(value: string): string {

packages/cli/src/commands/scan/exclude-paths.mts

@@ -123,7 +123,10 @@ vi.mock(import('../../../../src/util/socket/sdk.mjs'), () => ({
 }))
 
 // Mock TOKEN_PREFIX constant to avoid security check false positives.
-const MOCK_TOKEN_PREFIX = 'test_'
+// vi.hoisted so the hoisted vi.mock factory below can read it (a plain
+// module-level const is still in its TDZ when the factory runs against a
+// statically imported system-under-test).
+const MOCK_TOKEN_PREFIX = vi.hoisted(() => 'test_')
 vi.mock(import('../../../../src/constants/socket.mjs'), () => ({
   TOKEN_PREFIX: MOCK_TOKEN_PREFIX,
   TOKEN_PREFIX_LENGTH: MOCK_TOKEN_PREFIX.length,

packages/cli/test/unit/commands/whoami/cmd-whoami.test.mts

@@ -378,9 +378,8 @@ describe('downloadGitHubReleaseBinary', () => {
   it('recovers from a stale lock (dead PID) and re-runs download', async () => {
     const eexistErr = Object.assign(new Error('EEXIST'), { code: 'EEXIST' })
 
-    // First call: EEXIST. After stale cleanup, the recursive call's
-    // writeFile succeeds. To exit the recursive call, make the binary
-    // appear right after download/extract.
+    // First writeFile: EEXIST (lock held). After the stale cleanup recurses,
+    // the recursive call short-circuits on the cache check (existsSync below).
     let writeCount = 0
     mockFsWriteFile.mockImplementation(async () => {
       writeCount += 1
@@ -390,40 +389,31 @@ describe('downloadGitHubReleaseBinary', () => {
       return undefined
     })
 
-    // Lock file polling reads the PID; we'll make it return so that the
-    // first poll iteration goes to lock-aliveness check (i % 5 === 4 only on i=4).
-    // Simpler path: make the binary appear before the loop even fires.
-    let existsCount = 0
-    mockExistsSync.mockImplementation(() => {
-      existsCount += 1
-      // call 1: initial cache check (false)
-      // call 2+ depends on flow. After we send recursion, we want the
-      // recursive call to short-circuit on cache-check.
-      return existsCount >= 3
-    })
-
+    // Dead lock holder: the liveness probe (process.kill(pid, 0)) throws.
     const realKill = process.kill
-    // First kill(0) call (in stale check) throws -> stale.
     let killCount = 0
     ;(process as { kill: unknown }).kill = vi.fn(() => {
       killCount += 1
-      if (killCount === 1) {
-        // We're inside the stale-check path (kill(pid, 0)) — wait no,
-        // the lock-busy branch is only hit on EEXIST. Stale check happens
-        // inside the inner `for` poll's `i % 5 === 4` branch.
-        // Actually the FIRST EEXIST goes into the wait-loop, not the stale
-        // check directly. So skip — just throw consistently to mark stale.
-        throw new Error('ESRCH')
-      }
-      return true
+      throw new Error('ESRCH')
     })
 
+    // Keep the binary absent until the liveness probe has run, so the wait
+    // loop reaches the i % 5 === 4 stale check instead of returning early;
+    // after the stale cleanup, the recursive call's cache check succeeds.
+    mockExistsSync.mockImplementation(() => killCount >= 1)
+
+    // setTimeout: bypass the actual 1s polls so reaching i = 4 is instant.
+    const realSetTimeout = globalThis.setTimeout
+    ;(globalThis as { setTimeout: unknown }).setTimeout = ((cb: () => void) => {
+      cb()
+      return 0 as never
+    }) as never
+
     try {
-      // Either branch is fine — we just want coverage.
-      await downloadGitHubReleaseBinary(baseSpec).catch(() => {
-        // Some branches may throw timeout — accept it.
-      })
+      const result = await downloadGitHubReleaseBinary(baseSpec)
+      expect(result).toContain('tool')
     } finally {
+      ;(globalThis as { setTimeout: unknown }).setTimeout = realSetTimeout
       ;(process as { kill: unknown }).kill = realKill
     }
 

packages/cli/test/unit/util/dlx/spawn-download-binary.test.mts

@@ -0,0 +1,21 @@
+diff --git a/dist/errors/stack.js b/dist/errors/stack.js
+index 320e3b3bf7144a9ecf1933d7050cb921b25ce807..95a74e12c5abc93d2d1e744b81bb830d89febd90 100644
+--- a/dist/errors/stack.js
++++ b/dist/errors/stack.js
+@@ -2,6 +2,7 @@
+ /* Socket Lib - Built with rolldown */
+ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+ let src_external_pony_cause = require("../external/pony-cause");
++let src_errors_predicates = require("./predicates");
+ 
+ //#region src/errors/stack.ts
+ /**
+@@ -18,7 +19,7 @@ let src_external_pony_cause = require("../external/pony-cause");
+ * errorStack(e) })` safely.
+ */
+ function errorStack(value) {
+-	if (isError(value)) return (0, src_external_pony_cause.stackWithCauses)(value);
++	if (src_errors_predicates.isError(value)) return (0, src_external_pony_cause.stackWithCauses)(value);
+ }
+ 
+ //#endregion

patches/@socketsecurity__lib@6.0.9.patch

@@ -383,6 +383,12 @@ patchedDependencies:
   # bundle loads on node-smol SEA builds, which ship without http2. Consumer:
   # packages/cli SEA binary.
   '@sigstore/sign@4.1.0': patches/@sigstore__sign@4.1.0.patch
+  # The 6.0.9 rolldown build of dist/errors/stack.js drops the isError import
+  # (source imports it from ./predicates), so every errorStack() call throws
+  # ReferenceError. Restores the require so errorStack works. Consumer:
+  # packages/cli src/util/command/registry-core.mts. Removable once a fixed
+  # @socketsecurity/lib ships (source on main is already correct).
+  '@socketsecurity/lib@6.0.9': patches/@socketsecurity__lib@6.0.9.patch
   # signal-exit is deduped to v4, which exports a named onExit instead of the
   # v3 default export execa calls; restores the call contract. Consumer:
   # packages/cli bundled npm tooling.