Use resolveBinPath for Windows support

Author: jdalton

.dep-stats.json

@@ -3,13 +3,13 @@
     "@apideck/better-ajv-errors": "0.3.6",
     "@octokit/rest": "21.1.1",
     "@pnpm/lockfile-file": "^9.1.3",
-    "@socketregistry/hyrious__bun.lockb": "1.0.14",
+    "@socketregistry/hyrious__bun.lockb": "1.0.15",
     "@socketregistry/indent-string": "1.0.11",
     "@socketregistry/is-interactive": "1.0.2",
     "@socketregistry/is-unicode-supported": "1.0.2",
     "@socketregistry/packageurl-js": "1.0.3",
     "@socketsecurity/config": "2.1.3",
-    "@socketsecurity/registry": "1.0.127",
+    "@socketsecurity/registry": "1.0.128",
     "@socketsecurity/sdk": "1.4.5",
     "blessed": "0.1.81",
     "blessed-contrib": "4.11.0",
@@ -68,12 +68,12 @@
   "external": {
     "@apideck/better-ajv-errors": "0.3.6",
     "@pnpm/lockfile-file": "^9.1.3",
-    "@socketregistry/hyrious__bun.lockb": "1.0.14",
+    "@socketregistry/hyrious__bun.lockb": "1.0.15",
     "@socketregistry/indent-string": "1.0.11",
     "@socketregistry/is-interactive": "1.0.2",
     "@socketregistry/packageurl-js": "1.0.3",
     "@socketsecurity/config": "2.1.3",
-    "@socketsecurity/registry": "1.0.127",
+    "@socketsecurity/registry": "1.0.128",
     "@socketsecurity/sdk": "1.4.5",
     "blessed": "0.1.81",
     "blessed-contrib": "4.11.0",

package-lock.json

@@ -73,13 +73,13 @@
     "@apideck/better-ajv-errors": "0.3.6",
     "@octokit/rest": "21.1.1",
     "@pnpm/lockfile-file": "^9.1.3",
-    "@socketregistry/hyrious__bun.lockb": "1.0.14",
+    "@socketregistry/hyrious__bun.lockb": "1.0.15",
     "@socketregistry/indent-string": "1.0.11",
     "@socketregistry/is-interactive": "1.0.2",
     "@socketregistry/is-unicode-supported": "1.0.2",
     "@socketregistry/packageurl-js": "1.0.3",
     "@socketsecurity/config": "2.1.3",
-    "@socketsecurity/registry": "1.0.127",
+    "@socketsecurity/registry": "1.0.128",
     "@socketsecurity/sdk": "1.4.5",
     "blessed": "0.1.81",
     "blessed-contrib": "4.11.0",
@@ -141,8 +141,8 @@
     "@types/update-notifier": "^6.0.8",
     "@types/which": "^3.0.4",
     "@types/yargs-parser": "^21.0.3",
-    "@typescript-eslint/eslint-plugin": "^8.26.0",
-    "@typescript-eslint/parser": "^8.26.0",
+    "@typescript-eslint/eslint-plugin": "^8.26.1",
+    "@typescript-eslint/parser": "^8.26.1",
     "@vitest/coverage-v8": "3.0.8",
     "cross-env": "^7.0.3",
     "del-cli": "^6.0.0",
@@ -169,7 +169,7 @@
     "synp": "^1.9.14",
     "type-coverage": "^2.29.7",
     "typescript": "5.4.5",
-    "typescript-eslint": "^8.26.0",
+    "typescript-eslint": "^8.26.1",
     "unplugin-purge-polyfills": "^0.0.7",
     "vitest": "3.0.8"
   },

package.json

@@ -248,14 +248,16 @@ const lazyNmBinPath = () =>
   // Lazily access constants.rootPath.
   path.join(constants.rootPath, `${NODE_MODULES}/.bin`)
 
-// Harden Node security.
-// https://nodejs.org/en/learn/getting-started/security-best-practices
+// Redefine nodeHardenFlags to account for the INLINED_SOCKET_CLI_SENTRY_BUILD
+// environment variable.
 const lazyNodeHardenFlags = () =>
   // The '@rollup/plugin-replace' will replace "process.env[INLINED_SOCKET_CLI_SENTRY_BUILD]".
   // Lazily access constants.WIN32.
   process.env[INLINED_SOCKET_CLI_SENTRY_BUILD] || constants.WIN32
     ? []
-    : // We have contributed the following patches to our dependencies to make
+    : // Harden Node security.
+      // https://nodejs.org/en/learn/getting-started/security-best-practices
+      // We have contributed the following patches to our dependencies to make
       // Node's --frozen-intrinsics workable.
       // √ https://github.com/SBoudrias/Inquirer.js/pull/1683
       // √ https://github.com/pnpm/components/pull/23

src/constants.ts

@@ -1,4 +1,4 @@
-import { existsSync, promises as fs, realpathSync, statSync } from 'node:fs'
+import { existsSync, promises as fs, statSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
 
@@ -8,6 +8,7 @@ import { glob as tinyGlob } from 'tinyglobby'
 import which from 'which'
 
 import { debugLog } from '@socketsecurity/registry/lib/debug'
+import { resolveBinPath } from '@socketsecurity/registry/lib/npm'
 
 import { directoryPatterns } from './ignore-by-default'
 import constants from '../constants'
@@ -179,27 +180,29 @@ export function findBinPathDetailsSync(binName: string): {
   path: string | undefined
   shadowed: boolean
 } {
-  let shadowIndex = -1
-  const bins =
+  const binPaths =
     which.sync(binName, {
       all: true,
       nothrow: true
     }) ?? []
-  let binPath: string | undefined
-  for (let i = 0, { length } = bins; i < length; i += 1) {
-    const bin = realpathSync.native(bins[i]!)
+  let shadowIndex = -1
+  let theBinPath: string | undefined
+  for (let i = 0, { length } = binPaths; i < length; i += 1) {
+    const binPath = binPaths[i]!
     // Skip our bin directory if it's in the front.
-    if (path.dirname(bin) === shadowBinPath) {
+    if (path.dirname(binPath) === shadowBinPath) {
       shadowIndex = i
     } else {
-      binPath = bin
+      theBinPath = resolveBinPath(binPath)
       break
     }
   }
-  return { name: binName, path: binPath, shadowed: shadowIndex !== -1 }
+  return { name: binName, path: theBinPath, shadowed: shadowIndex !== -1 }
 }
 
 export function findNpmPathSync(npmBinPath: string): string | undefined {
+  // Lazily access constants.WIN32.
+  const { WIN32 } = constants
   let thePath = npmBinPath
   while (true) {
     const nmPath = path.join(thePath, NODE_MODULES)
@@ -223,8 +226,7 @@ export function findNpmPathSync(npmBinPath: string): string | undefined {
       // Optimistically look for the default location.
       (path.basename(thePath) === NPM ||
         // Chocolatey installs npm bins in the same directory as node bins.
-        // Lazily access constants.WIN32.
-        (constants.WIN32 && existsSync(path.join(thePath, `${NPM}.cmd`))))
+        (WIN32 && existsSync(path.join(thePath, `${NPM}.cmd`))))
     ) {
       return thePath
     }