test(coverage): cover spawn-cdxgen + spawn-socket-patch bespoke Dlx flows

Adds 11 tests across two new test files for the bespoke Dlx logic in cdxgen and socket-patch (Vfs and auto-dispatch are tested via the shared define-tool-spawn factory):

- spawn-cdxgen.mts: local-binary path, local script via node, spawnDlx fallback, unexpected-resolution-type throw, custom stdio

- spawn-socket-patch.mts: local-binary path, local script via node, GitHub-release path, legacy npm dlx fallback, custom stdio, options.env merge

Author: jdalton

packages/cli/test/unit/utils/dlx/spawn-cdxgen.test.mts

@@ -0,0 +1,118 @@
+/**
+ * Unit tests for the bespoke `spawnCdxgenDlx` flow.
+ *
+ * The Vfs / auto-dispatch code is tested via define-tool-spawn.test.mts.
+ * This file targets the cdxgen-specific paths: local-override execution
+ * (binary or JS via node) and the `spawnDlx` fallback for the npm dlx route.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockSpawn = vi.hoisted(() => vi.fn())
+const mockSpawnDlx = vi.hoisted(() => vi.fn())
+const mockResolveCdxgen = vi.hoisted(() => vi.fn())
+const mockDetectExecutableType = vi.hoisted(() => vi.fn())
+
+vi.mock('@socketsecurity/lib/spawn', () => ({
+  spawn: mockSpawn,
+}))
+
+vi.mock('@socketsecurity/lib/dlx/detect', () => ({
+  detectExecutableType: mockDetectExecutableType,
+}))
+
+vi.mock('../../../../src/utils/dlx/spawn.mts', () => ({
+  spawnDlx: mockSpawnDlx,
+}))
+
+vi.mock('../../../../src/utils/dlx/resolve-binary.mts', () => ({
+  resolveCdxgen: mockResolveCdxgen,
+}))
+
+import { spawnCdxgenDlx } from '../../../../src/utils/dlx/spawn-cdxgen.mts'
+
+describe('spawnCdxgenDlx', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('runs a local cdxgen binary when SOCKET_CLI_CDXGEN_LOCAL_PATH is set', async () => {
+    mockResolveCdxgen.mockReturnValue({
+      type: 'local',
+      path: '/local/cdxgen',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'binary' })
+    mockSpawn.mockReturnValue('p')
+
+    const result = await spawnCdxgenDlx(
+      ['-r', '.'],
+      undefined,
+      undefined,
+    )
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      '/local/cdxgen',
+      ['-r', '.'],
+      expect.objectContaining({ stdio: 'inherit' }),
+    )
+    expect(result).toEqual({ spawnPromise: 'p' })
+  })
+
+  it('runs the local cdxgen.js via node when not a binary', async () => {
+    mockResolveCdxgen.mockReturnValue({
+      type: 'local',
+      path: '/local/cdxgen.js',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'script' })
+    mockSpawn.mockReturnValue('p')
+
+    await spawnCdxgenDlx([], undefined, undefined)
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      'node',
+      ['/local/cdxgen.js'],
+      expect.any(Object),
+    )
+  })
+
+  it('falls back to spawnDlx when resolution.type is "dlx"', async () => {
+    mockResolveCdxgen.mockReturnValue({
+      type: 'dlx',
+      details: { name: '@cyclonedx/cdxgen', version: '11.0.0' },
+    })
+    mockSpawnDlx.mockResolvedValue({ spawnPromise: 'p' })
+
+    const result = await spawnCdxgenDlx([], undefined, undefined)
+
+    expect(mockSpawnDlx).toHaveBeenCalled()
+    expect(result).toEqual({ spawnPromise: 'p' })
+  })
+
+  it('throws when resolveCdxgen returns an unexpected type', async () => {
+    mockResolveCdxgen.mockReturnValue({
+      type: 'github-release',
+      details: {} as any,
+    })
+
+    await expect(spawnCdxgenDlx([], undefined, undefined)).rejects.toThrow(
+      /resolveCdxgen returned resolution\.type="github-release"/,
+    )
+  })
+
+  it('honors a custom stdio passed via spawnExtra', async () => {
+    mockResolveCdxgen.mockReturnValue({
+      type: 'local',
+      path: '/local/cdxgen',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'binary' })
+    mockSpawn.mockReturnValue('p')
+
+    await spawnCdxgenDlx([], undefined, { stdio: 'pipe' } as any)
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      '/local/cdxgen',
+      [],
+      expect.objectContaining({ stdio: 'pipe' }),
+    )
+  })
+})

packages/cli/test/unit/utils/dlx/spawn-socket-patch.test.mts

@@ -0,0 +1,142 @@
+/**
+ * Unit tests for the bespoke `spawnSocketPatchDlx` flow.
+ *
+ * The Vfs / auto-dispatch code is tested via define-tool-spawn.test.mts.
+ * This file targets the three-way Dlx dispatch (local override / GitHub
+ * release / legacy npm fallback).
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockSpawn = vi.hoisted(() => vi.fn())
+const mockSpawnDlx = vi.hoisted(() => vi.fn())
+const mockDownloadGitHubReleaseBinary = vi.hoisted(() => vi.fn())
+const mockResolveSocketPatch = vi.hoisted(() => vi.fn())
+const mockDetectExecutableType = vi.hoisted(() => vi.fn())
+
+vi.mock('@socketsecurity/lib/spawn', () => ({
+  spawn: mockSpawn,
+}))
+
+vi.mock('@socketsecurity/lib/dlx/detect', () => ({
+  detectExecutableType: mockDetectExecutableType,
+}))
+
+vi.mock('../../../../src/utils/dlx/spawn.mts', () => ({
+  downloadGitHubReleaseBinary: mockDownloadGitHubReleaseBinary,
+  spawnDlx: mockSpawnDlx,
+}))
+
+vi.mock('../../../../src/utils/dlx/resolve-binary.mts', () => ({
+  resolveSocketPatch: mockResolveSocketPatch,
+}))
+
+import { spawnSocketPatchDlx } from '../../../../src/utils/dlx/spawn-socket-patch.mts'
+
+describe('spawnSocketPatchDlx', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('runs a local socket-patch binary when SOCKET_CLI_SOCKET_PATCH_LOCAL_PATH is set', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'local',
+      path: '/local/socket-patch',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'binary' })
+    mockSpawn.mockReturnValue('p')
+
+    const result = await spawnSocketPatchDlx(
+      ['apply'],
+      undefined,
+      undefined,
+    )
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      '/local/socket-patch',
+      ['apply'],
+      expect.objectContaining({ stdio: 'inherit' }),
+    )
+    expect(result).toEqual({ spawnPromise: 'p' })
+  })
+
+  it('runs the local script via node when not a binary', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'local',
+      path: '/local/socket-patch.js',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'script' })
+    mockSpawn.mockReturnValue('p')
+
+    await spawnSocketPatchDlx([], undefined, undefined)
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      'node',
+      ['/local/socket-patch.js'],
+      expect.any(Object),
+    )
+  })
+
+  it('downloads from GitHub releases when resolution.type is "github-release"', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'github-release',
+      details: { name: 'socket-patch', version: '2.0.0' },
+    })
+    mockDownloadGitHubReleaseBinary.mockResolvedValue('/cache/socket-patch')
+    mockSpawn.mockReturnValue('p')
+
+    const result = await spawnSocketPatchDlx(['apply'], undefined, undefined)
+
+    expect(mockDownloadGitHubReleaseBinary).toHaveBeenCalled()
+    expect(mockSpawn).toHaveBeenCalledWith(
+      '/cache/socket-patch',
+      ['apply'],
+      expect.objectContaining({ stdio: 'inherit' }),
+    )
+    expect(result).toEqual({ spawnPromise: 'p' })
+  })
+
+  it('falls back to spawnDlx for legacy npm-package resolutions', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'dlx',
+      details: { name: 'socket-patch', version: '1.0.0' },
+    })
+    mockSpawnDlx.mockResolvedValue({ spawnPromise: 'p' })
+
+    const result = await spawnSocketPatchDlx([], undefined, undefined)
+
+    expect(mockSpawnDlx).toHaveBeenCalled()
+    expect(result).toEqual({ spawnPromise: 'p' })
+  })
+
+  it('honors a custom stdio passed via spawnExtra', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'github-release',
+      details: { name: 'socket-patch', version: '2.0.0' },
+    })
+    mockDownloadGitHubReleaseBinary.mockResolvedValue('/cache/socket-patch')
+    mockSpawn.mockReturnValue('p')
+
+    await spawnSocketPatchDlx([], undefined, { stdio: 'pipe' } as any)
+
+    expect(mockSpawn).toHaveBeenCalledWith(
+      '/cache/socket-patch',
+      [],
+      expect.objectContaining({ stdio: 'pipe' }),
+    )
+  })
+
+  it('merges options.env into the child env (local path)', async () => {
+    mockResolveSocketPatch.mockReturnValue({
+      type: 'local',
+      path: '/local/socket-patch',
+    })
+    mockDetectExecutableType.mockReturnValue({ type: 'binary' })
+    mockSpawn.mockReturnValue('p')
+
+    await spawnSocketPatchDlx([], { env: { FOO: 'bar' } } as any, undefined)
+
+    const callEnv = mockSpawn.mock.calls[0][2].env
+    expect(callEnv.FOO).toBe('bar')
+  })
+})