Bundle zod as external dependency

jdalton · jdalton · commit 6fee37bed8cc · 2025-10-07T20:11:15.000-04:00
diff --git a/.config/rollup.base.config.mjs b/.config/rollup.base.config.mjs
@@ -154,7 +154,8 @@ export default function baseConfig(extendConfig = {}) {
       if (
         id.includes('/external/') &&
         !id.endsWith('/external/ink-table.mjs') &&
-        !id.endsWith('/external/yoga-layout.mjs')
+        !id.endsWith('/external/yoga-layout.mjs') &&
+        !id.endsWith('/external/zod.mjs')
       ) {
         return true
       }
diff --git a/.config/rollup.dist.config.mjs b/.config/rollup.dist.config.mjs
@@ -352,6 +352,7 @@ export default async () => {
         [SHADOW_PNPM_BIN]: `${srcPath}/shadow/pnpm/bin.mts`,
         'external/ink-table': `${srcPath}/external/ink-table.mjs`,
         'external/yoga-layout': `${srcPath}/external/yoga-layout.mjs`,
+        'external/zod': `${srcPath}/external/zod.mjs`,
         ...(constants.ENV[INLINED_SOCKET_CLI_SENTRY_BUILD]
           ? {
               [INSTRUMENT_WITH_SENTRY]: `${srcPath}/${INSTRUMENT_WITH_SENTRY}.mts`,
diff --git a/.github/workflows/publish-socketbin.yml b/.github/workflows/publish-socketbin.yml
@@ -66,12 +66,40 @@ jobs:
       - name: Build stub
         run: pnpm run build:sea:stub
 
+      - name: Setup UPX (Linux/Windows)
+        if: matrix.platform != 'darwin'
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          install-only: true
+
       - name: Build binary
         run: |
           pnpm run build:sea -- \
             --platform=${{ matrix.platform }} \
             --arch=${{ matrix.arch }}
 
+      - name: Compress binary with UPX (Linux/Windows)
+        if: matrix.platform != 'darwin'
+        run: |
+          # Find the binary file (different extensions for different platforms)
+          BINARY_FILE=$(find dist/sea -name "socket-*" -type f | head -1)
+          if [ -f "$BINARY_FILE" ]; then
+            echo "Compressing $BINARY_FILE with UPX..."
+            upx --best --lzma "$BINARY_FILE" || echo "UPX compression failed, continuing anyway"
+            ls -lh "$BINARY_FILE"
+          fi
+
+      - name: Sign binary (macOS)
+        if: matrix.platform == 'darwin'
+        run: |
+          # Sign the macOS binary with ad-hoc signature for distribution
+          BINARY_FILE=$(find dist/sea -name "socket-*" -type f | head -1)
+          if [ -f "$BINARY_FILE" ]; then
+            echo "Signing macOS binary: $BINARY_FILE"
+            codesign --sign - --force "$BINARY_FILE"
+            codesign -dv "$BINARY_FILE"
+          fi
+
       - name: Verify binary
         run: |
           ls -la dist/sea/socket-*
diff --git a/scripts/create-placeholder-packages.mjs b/scripts/create-placeholder-packages.mjs
@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 
 /**
  * @fileoverview Creates minimal placeholder packages for @socketbin/* to enable trusted publisher.
@@ -131,11 +130,9 @@ npm install -g socket
 async function main() {
   console.log('Creating @socketbin placeholder packages...\n')
 
-  const packageDirs = []
-  for (const { platform, arch } of platforms) {
-    const dir = await createPlaceholderPackage(platform, arch)
-    packageDirs.push(dir)
-  }
+  const packageDirs = await Promise.all(
+    platforms.map(({ arch, platform }) => createPlaceholderPackage(platform, arch))
+  )
 
   console.log('\n📦 Placeholder packages created!\n')
   console.log('To publish them:')
@@ -230,5 +227,5 @@ main()
 
 main().catch(error => {
   console.error('Error:', error)
-  process.exit(1)
+  throw error
 })
diff --git a/scripts/generate-binary-package.mjs b/scripts/generate-binary-package.mjs
@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 
 /**
  * @fileoverview Generates package.json for @socketbin/* binary packages.
@@ -7,8 +6,8 @@
 
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
-import { parseArgs } from 'node:util'
 import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootDir = path.join(__dirname, '..')
@@ -23,11 +22,10 @@ const { values } = parseArgs({
   }
 })
 
-const { platform, arch, version, tool = 'cli', outdir } = values
+const { arch, outdir, platform, tool = 'cli', version } = values
 
 if (!platform || !arch || !version) {
-  console.error('Usage: generate-binary-package.mjs --platform=darwin --arch=arm64 --version=1.1.24')
-  process.exit(1)
+  throw new Error('Usage: generate-binary-package.mjs --platform=darwin --arch=arm64 --version=1.1.24')
 }
 
 // Clean version (remove 'v' prefix if present)
@@ -154,7 +152,7 @@ async function generatePackage() {
         await fs.chmod(targetBinary, 0o755)
       }
       console.log(`Copied binary: ${sourceBinary} -> ${targetBinary}`)
-    } catch (error) {
+    } catch {
       console.warn(`Warning: Binary not found at ${sourceBinary}`)
       console.warn('Binary should be copied manually or in CI')
     }
@@ -163,7 +161,7 @@ async function generatePackage() {
     console.log(`\nTo publish:\n  cd ${packageDir}\n  npm publish --provenance --access public`)
   } catch (error) {
     console.error('Error generating package:', error)
-    process.exit(1)
+    throw error
   }
 }
 
diff --git a/scripts/lint-affected.mjs b/scripts/lint-affected.mjs
@@ -4,9 +4,9 @@
  * Supports cross-repository linting for Socket projects.
  */
 
+import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
-import { promises as fs } from 'node:fs'
 
 import WIN32 from '@socketsecurity/registry/lib/constants/WIN32'
 import { logger } from '@socketsecurity/registry/lib/logger'
diff --git a/scripts/verify-socketbin-packages.mjs b/scripts/verify-socketbin-packages.mjs
@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 
 /**
  * @fileoverview Verifies that all @socketbin/* packages exist on npm registry.
diff --git a/src/cli.mts b/src/cli.mts
@@ -46,9 +46,12 @@ import { scheduleUpdateCheck } from './utils/update-manager.mts'
 
 const __filename = fileURLToPath(import.meta.url)
 
-// Check for --no-log flag early and silence logger if present
+// Check for --no-log or --json flag early and silence logger if present
+// When --json is set, we want clean JSON output without any logger noise
 const noLog =
-  process.argv.includes('--no-log') || process.argv.includes('--noLog')
+  process.argv.includes('--no-log') ||
+  process.argv.includes('--noLog') ||
+  process.argv.includes('--json')
 if (noLog) {
   // Silence all logger methods
   const noop = () => logger
@@ -117,7 +120,8 @@ void (async () => {
 
     if (isJson) {
       const errorResult = formatErrorForJson(e)
-      logger.log(serializeResultJson(errorResult))
+      // Use console.log directly for JSON output to ensure it's not silenced
+      console.log(serializeResultJson(errorResult))
     } else {
       // Add 2 newlines in stderr to bump below any spinner.
       logger.error('\n')
diff --git a/src/commands/manifest/output-requirements.mts b/src/commands/manifest/output-requirements.mts
@@ -32,7 +32,8 @@ export async function outputRequirements(
     const json = serializeResultJson(result)
 
     if (out === '-') {
-      logger.log(json)
+      // Use console.log directly for JSON output to ensure it's not silenced
+      console.log(json)
     } else {
       fs.writeFileSync(out, json, 'utf8')
     }
diff --git a/src/commands/patch/manifest-schema.mts b/src/commands/patch/manifest-schema.mts
@@ -1,6 +1,6 @@
 /** @fileoverview Patch manifest schema for Socket CLI. Defines Zod validation schemas for patch manifest format including patch records with package specifiers, file hashes, and patch file locations. */
 
-import { z } from 'zod'
+import { z } from '../../external/zod.mjs'
 
 export type PatchManifest = z.infer<typeof PatchManifestSchema>
 
diff --git a/src/commands/scan/output-diff-scan.mts b/src/commands/scan/output-diff-scan.mts
@@ -10,7 +10,6 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import constants from '../../constants.mts'
 import { failMsgWithBadge } from '../../utils/fail-msg-with-badge.mts'
 import { serializeResultJson } from '../../utils/serialize-result-json.mts'
-import { fileLink } from '../../utils/terminal-link.mts'
 
 import type { CResult, OutputKind } from '../../types.mts'
 import type { SocketSdkSuccessResult } from '@socketsecurity/sdk'
@@ -84,21 +83,22 @@ async function handleJson(
   const json = serializeResultJson(data)
 
   if (file && file !== '-') {
-    logger.log(`Writing json to \`${file}\``)
+    // Writing to file in background, don't output messages to keep JSON clean
     fs.writeFile(file, json, err => {
       if (err) {
-        logger.fail(`Writing to \`${file}\` failed...`)
-        logger.error(err)
-      } else {
-        logger.success(`Data successfully written to \`${fileLink(file)}\``)
+        // Output error as JSON when --json flag is used
+        console.error(
+          serializeResultJson({
+            ok: false,
+            message: `Writing to \`${file}\` failed`,
+            cause: err.message,
+          }),
+        )
       }
-      logger.error(dashboardMessage)
     })
   } else {
-    // only .log goes to stdout
-    logger.info(`\n Diff scan result: \n`)
-    logger.log(json)
-    logger.info(dashboardMessage)
+    // Use console.log directly for JSON output to ensure it's not silenced
+    console.log(json)
   }
 }
 
diff --git a/src/commands/scan/output-scan-report.mts b/src/commands/scan/output-scan-report.mts
@@ -104,11 +104,15 @@ export async function outputScanReport(
       : toJsonReport(scanReport.data as ScanReport, includeLicensePolicy)
 
     if (filepath && filepath !== '-') {
-      logger.log('Writing json report to', filepath)
+      // Don't output any message when --json is set to keep output clean
+      if (outputKind !== 'json') {
+        logger.log('Writing json report to', filepath)
+      }
       return await fs.writeFile(filepath, json)
     }
 
-    logger.log(json)
+    // Use console.log directly for JSON output to ensure it's not silenced
+    console.log(json)
     return
   }
 
diff --git a/src/commands/scan/output-scan-view.mts b/src/commands/scan/output-scan-view.mts
@@ -40,26 +40,36 @@ export async function outputScanView(
     const json = serializeResultJson(result)
 
     if (filePath && filePath !== '-') {
-      logger.info('Writing json results to', filePath)
+      // Don't output any message when --json is set to keep output clean
+      if (outputKind !== 'json') {
+        logger.info('Writing json results to', filePath)
+      }
       try {
         await fs.writeFile(filePath, json, 'utf8')
-        logger.info(`Data successfully written to ${fileLink(filePath)}`)
+        if (outputKind !== 'json') {
+          logger.info(`Data successfully written to ${fileLink(filePath)}`)
+        }
       } catch (e) {
         process.exitCode = 1
-        logger.fail('There was an error trying to write the markdown to disk')
-        logger.error(e)
-        logger.log(
-          serializeResultJson({
-            ok: false,
-            message: 'File Write Failure',
-            cause: 'Failed to write json to disk',
-          }),
-        )
+        if (outputKind === 'json') {
+          // Use console.log directly for JSON output to ensure it's not silenced
+          console.log(
+            serializeResultJson({
+              ok: false,
+              message: 'File Write Failure',
+              cause: 'Failed to write json to disk',
+            }),
+          )
+        } else {
+          logger.fail('There was an error trying to write the json to disk')
+          logger.error(e)
+        }
       }
       return
     }
 
-    logger.log(json)
+    // Use console.log directly for JSON output to ensure it's not silenced
+    console.log(json)
     return
   }
 
diff --git a/src/external/zod.d.mts b/src/external/zod.d.mts
@@ -0,0 +1 @@
+export * from 'zod'
diff --git a/src/external/zod.mjs b/src/external/zod.mjs
@@ -0,0 +1,5 @@
+/**
+ * @fileoverview Zod re-export for bundling as external dependency.
+ */
+
+export * from 'zod'
diff --git a/src/sea/install.mts b/src/sea/install.mts
@@ -21,9 +21,11 @@ const GITHUB_REPO = 'socket-cli'
 
 // Map Node.js platform/arch to our binary naming convention
 const PLATFORM_MAP: Record<string, string> = {
-  darwin: 'darwin',  // macOS
+  // macOS
+  darwin: 'darwin',
   linux: 'linux',
-  win32: 'win32'     // Windows
+  // Windows
+  win32: 'win32'
 }
 
 const ARCH_MAP: Record<string, string> = {
@@ -70,7 +72,7 @@ async function getPackageVersion(): Promise<string> {
  * Download a file from a URL with redirect handling.
  */
 async function downloadFile(url: string, destPath: string): Promise<void> {
-  return new Promise((resolve, reject) => {
+  return await new Promise((resolve, reject) => {
     const file = createWriteStream(destPath)
 
     const request = https.get(
@@ -192,7 +194,8 @@ async function install(): Promise<void> {
 if (import.meta.url === `file://${process.argv[1]}`) {
   install().catch(error => {
     console.error('Unexpected error:', error)
-    process.exitCode = 0  // Still don't fail npm install
+    // Still don't fail npm install
+    process.exitCode = 0
   })
 }
 
diff --git a/src/sea/npm-package/bin/socket.js b/src/sea/npm-package/bin/socket.js
@@ -8,8 +8,8 @@
 
 const { spawn } = require('node:child_process')
 const { existsSync, realpathSync } = require('node:fs')
-const path = require('node:path')
 const os = require('node:os')
+const path = require('node:path')
 
 // Detect platform and architecture
 const platform = os.platform()
@@ -49,7 +49,7 @@ try {
   } catch {
     // If realpath fails, continue with original path
   }
-} catch (error) {
+} catch {
   // Binary package not found or other error
   console.error(`Error: Socket CLI binary not available for ${platform}-${mappedArch}`)
   console.error(``)
@@ -89,6 +89,7 @@ try {
   console.error(``)
   console.error(`For help, visit: https://github.com/SocketDev/socket-cli/issues`)
 
+  // eslint-disable-next-line n/no-process-exit
   process.exit(1)
 }
 
@@ -118,6 +119,7 @@ child.on('exit', (code, signal) => {
     process.kill(process.pid, signal)
   } else {
     // Otherwise exit with child's exit code
+    // eslint-disable-next-line n/no-process-exit
     process.exit(code ?? 0)
   }
 })
@@ -133,5 +135,6 @@ child.on('error', error => {
   } else {
     console.error(`Failed to start Socket CLI:`, error.message)
   }
+  // eslint-disable-next-line n/no-process-exit
   process.exit(1)
 })
diff --git a/src/sea/npm-package/install.js b/src/sea/npm-package/install.js
@@ -13,7 +13,7 @@ const path = require('node:path')
 const {
   SOCKET_CLI_GITHUB_REPO,
   SOCKET_GITHUB_ORG,
-  // eslint-disable-next-line n/no-unpublished-require
+   
 } = require('../../dist/constants.js')
 
 const BINARY_NAME = 'socket'
diff --git a/src/utils/output.mts b/src/utils/output.mts

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,3 @@`
`1`		`-#!/usr/bin/env node`
`2`	`1`
`3`	`2`	`/**`
`4`	`3`	`* @fileoverview Verifies that all @socketbin/* packages exist on npm registry.`
Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,8 @@ export async function outputRequirements(`
`32`	`32`	`const json = serializeResultJson(result)`
`33`	`33`
`34`	`34`	`if (out === '-') {`
`35`		`- logger.log(json)`
	`35`	`+ // Use console.log directly for JSON output to ensure it's not silenced`
	`36`	`+ console.log(json)`
`36`	`37`	`} else {`
`37`	`38`	`fs.writeFileSync(out, json, 'utf8')`
`38`	`39`	`}`