refactor: drop leading underscores from module-private identifiers

Per the fleet's socket/no-underscore-identifier rule, leading
underscores on identifiers don't enforce privacy in TypeScript —
module boundaries (not exporting) and `_internal/` directories
do. The convention was carried over from other languages and added
noise without enforcement.

Renamed 48 identifiers across 31 files: memo-cache variables
in packages/cli/src/util/* (yarn/pnpm/npm/git/sea path caches),
config caches in src/util/config.mts, src/util/socket/sdk.mts,
src/util/git/github.mts; test-fixture and mock locals across
test/unit/, test/integration/, test/e2e/. All renames are
`_foo` → `foo`. One conflict (`_isYarnBerry` collided with the
exported `isYarnBerry` function in the same module scope)
resolved as `_isYarnBerry` → `cachedIsYarnBerry`.

Other fleet-rule fixes pulled in by re-cascading + verifying:
- execSync → @socketsecurity/lib-stable/spawn.spawnSync in
  scripts/environment-variables.mts and two dlx-spawn tests
  (prefer-spawn-over-execsync).
- McpHandleRequest type widened to `auth?: AuthInfo` (drop
  `| undefined`) with a per-line bypass for
  optional-explicit-undefined — the SDK target's
  exactOptionalPropertyTypes-strict shape rejects bare-undefined
  here while the lint rule wants it for pairing.
- Misc cascade-applied content drift from upstream wheelhouse
  rule + script fixes.

Verified: pnpm run check --all passes; pnpm test passes.

Author: jdalton

packages/cli/scripts/environment-variables.mts

@@ -12,7 +12,7 @@
  *     EnvironmentVariables.getTestVariables(vars)
  */
 
-import { execSync } from 'node:child_process'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn'
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import crypto from 'node:crypto'
@@ -50,10 +50,14 @@ export class EnvironmentVariables {
     // Get current git commit hash.
     let gitHash = ''
     try {
-      gitHash = execSync('git rev-parse --short HEAD', {
+      const r = spawnSync('git', ['rev-parse', '--short', 'HEAD'], {
         cwd: rootPath,
-        encoding: 'utf-8',
-      }).trim()
+        stdio: 'pipe',
+        stdioString: true,
+      })
+      if (r.status === 0 && typeof r.stdout === 'string') {
+        gitHash = r.stdout.trim()
+      }
     } catch {}
 
     // Get external tool versions from bundle-tools.json.

packages/cli/src/commands/fix/cmd-fix.mts

@@ -423,7 +423,7 @@ export async function run(
     const isGhsa = upperInput.startsWith('GHSA-')
     const isCve = upperInput.startsWith('CVE-')
     const isPurl = rawInput.startsWith('pkg:')
-    if (isGhsa || isCve || isPurl) {
+    if (isCve || isGhsa || isPurl) {
       // `handle-fix.mts` validates IDs with case-sensitive format regexes:
       //   * GHSA — prefix must be uppercase, body segments lowercase [a-z0-9]
       //   * CVE  — prefix must be uppercase, body is all digits (case-free)

packages/cli/src/commands/manifest/run-cdxgen.mts

@@ -98,7 +98,7 @@ export async function detectNodejsCdxgenSources(
       findUp(NODE_MODULES, { cwd, onlyDirectories: true }),
     ])
   return {
-    hasLockfile: Boolean(pnpmLockPath || npmLockPath || yarnLockPath),
+    hasLockfile: Boolean(npmLockPath || pnpmLockPath || yarnLockPath),
     hasNodeModules: Boolean(nodeModulesPath),
   }
 }

packages/cli/src/commands/mcp/handle-mcp.mts

@@ -36,15 +36,15 @@ export async function handleMcp(opts: HandleMcpOptions): Promise<void> {
     const clientId = opts.oauthClientId ?? ''
     const clientSecret = opts.oauthClientSecret ?? ''
     const partial =
-      (issuer || clientId || clientSecret) &&
-      !(issuer && clientId && clientSecret)
+      (clientId || clientSecret || issuer) &&
+      !(clientId && clientSecret && issuer)
     if (partial) {
       logger.error(
         'Incomplete OAuth configuration for HTTP mode. Set SOCKET_OAUTH_ISSUER, SOCKET_OAUTH_INTROSPECTION_CLIENT_ID, and SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET together.',
       )
       process.exit(1)
     }
-    const oauthEnabled = Boolean(issuer && clientId && clientSecret)
+    const oauthEnabled = Boolean(clientId && clientSecret && issuer)
     if (!oauthEnabled && !baseConfig.getApiToken()) {
       logger.error(
         'No SOCKET_API_TOKEN configured and OAuth is not enabled. Run `socket login` or set OAuth env vars (SOCKET_OAUTH_ISSUER, SOCKET_OAUTH_INTROSPECTION_CLIENT_ID, SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET) before starting HTTP mode.',

packages/cli/src/commands/mcp/transport-http.mts

@@ -43,6 +43,7 @@ type AuthenticatedRequest = IncomingMessage & { auth?: AuthInfo | undefined }
 // exactOptionalPropertyTypes. Cast our internal type to this at the
 // call boundary when handing off; that's the narrow constraint, not
 // our internal shape.
+// oxlint-disable-next-line socket/optional-explicit-undefined -- SDK target type uses `auth?: AuthInfo` (no `| undefined`); under exactOptionalPropertyTypes the bare-undefined form rejects this assignment. Pair to the SDK shape, not the local AuthenticatedRequest.
 type McpHandleRequest = IncomingMessage & { auth?: AuthInfo }
 
 interface Session {

packages/cli/src/commands/scan/cmd-scan-create.mts

@@ -433,12 +433,12 @@ export async function run(
     reachabilityFlags['reachDisableAnalytics']?.default
 
   const isUsingAnyReachabilityFlags =
-    isUsingNonDefaultMemoryLimit ||
-    isUsingNonDefaultTimeout ||
-    isUsingNonDefaultConcurrency ||
-    isUsingNonDefaultAnalytics ||
     hasReachEcosystems ||
     hasReachExcludePaths ||
+    isUsingNonDefaultAnalytics ||
+    isUsingNonDefaultConcurrency ||
+    isUsingNonDefaultMemoryLimit ||
+    isUsingNonDefaultTimeout ||
     reachEnableAnalysisSplitting ||
     reachLazyMode ||
     reachSkipCache

packages/cli/src/commands/scan/perform-reachability-analysis.mts

@@ -117,7 +117,7 @@ export async function performReachabilityAnalysis(
 
   let tarHash: string | undefined
 
-  if (uploadManifests && orgSlug && packagePaths) {
+  if (orgSlug && packagePaths && uploadManifests) {
     // Setup SDK for uploading manifests
     const sockSdkCResult = await setupSdk()
     if (!sockSdkCResult.ok) {

packages/cli/src/flags.mts

@@ -27,9 +27,9 @@ type RawSpaceSizeFlags = {
   maxSemiSpaceSize: number
 }
 
-let _rawSpaceSizeFlags: RawSpaceSizeFlags | undefined
+let rawSpaceSizeFlags: RawSpaceSizeFlags | undefined
 
-let _maxOldSpaceSizeFlag: number | undefined
+let maxOldSpaceSizeFlag: number | undefined
 
 // Ensure export because dist/flags.js is required in src/constants.mts.
 // eslint-disable-next-line n/exports-style
@@ -38,14 +38,14 @@ if (typeof exports === 'object' && exports !== null) {
   exports.getMaxOldSpaceSizeFlag = getMaxOldSpaceSizeFlag
 }
 
-let _maxSemiSpaceSizeFlag: number | undefined
+let maxSemiSpaceSizeFlag: number | undefined
 
 export function getMaxOldSpaceSizeFlag(): number {
-  if (_maxOldSpaceSizeFlag === undefined) {
+  if (maxOldSpaceSizeFlag === undefined) {
     const rawFlag = getRawSpaceSizeFlags().maxOldSpaceSize
     // Check if flag was explicitly set (> 0).
     if (rawFlag > 0) {
-      _maxOldSpaceSizeFlag = rawFlag
+      maxOldSpaceSizeFlag = rawFlag
     } else {
       const match = /(?<=--max-old-space-size=)\d+/.exec(
         NODE_OPTIONS ?? '',
@@ -54,48 +54,48 @@ export function getMaxOldSpaceSizeFlag(): number {
         const parsed = Number(match)
         /* c8 ignore start - regex (\d+) guarantees a numeric string; defensive guard */
         if (Number.isNaN(parsed) || parsed < 0) {
-          _maxOldSpaceSizeFlag = 0
+          maxOldSpaceSizeFlag = 0
           /* c8 ignore stop */
         } else {
-          _maxOldSpaceSizeFlag = parsed
+          maxOldSpaceSizeFlag = parsed
         }
       }
     }
     // Only apply default if no value was set (null/undefined, not 0).
-    if (_maxOldSpaceSizeFlag == null) {
+    if (maxOldSpaceSizeFlag == null) {
       // Default value determined by available system memory.
-      _maxOldSpaceSizeFlag = Math.floor(
+      maxOldSpaceSizeFlag = Math.floor(
         // Total system memory in MiB.
         (os.totalmem() / 1_024 / 1_024) *
           // Set 75% of total memory (safe buffer to avoid system pressure).
           0.75,
       )
     }
   }
-  return _maxOldSpaceSizeFlag
+  return maxOldSpaceSizeFlag
 }
 
 export function getMaxSemiSpaceSizeFlag(): number {
-  if (_maxSemiSpaceSizeFlag === undefined) {
-    _maxSemiSpaceSizeFlag = getRawSpaceSizeFlags().maxSemiSpaceSize
-    if (!_maxSemiSpaceSizeFlag) {
+  if (maxSemiSpaceSizeFlag === undefined) {
+    maxSemiSpaceSizeFlag = getRawSpaceSizeFlags().maxSemiSpaceSize
+    if (!maxSemiSpaceSizeFlag) {
       const match = /(?<=--max-semi-space-size=)\d+/.exec(
         NODE_OPTIONS ?? '',
       )?.[0]
       if (match) {
         const parsed = Number(match)
         /* c8 ignore start - regex (\d+) guarantees a numeric string; defensive guard */
         if (Number.isNaN(parsed) || parsed < 0) {
-          _maxSemiSpaceSizeFlag = 0
+          maxSemiSpaceSizeFlag = 0
           /* c8 ignore stop */
         } else {
-          _maxSemiSpaceSizeFlag = parsed
+          maxSemiSpaceSizeFlag = parsed
         }
       } else {
-        _maxSemiSpaceSizeFlag = 0
+        maxSemiSpaceSizeFlag = 0
       }
     }
-    if (!_maxSemiSpaceSizeFlag) {
+    if (!maxSemiSpaceSizeFlag) {
       const maxOldSpaceSize = getMaxOldSpaceSizeFlag()
       // Dynamically scale semi-space size based on max-old-space-size.
       // https://nodejs.org/api/cli.html#--max-semi-space-sizesize-in-mib
@@ -104,15 +104,15 @@ export function getMaxSemiSpaceSizeFlag(): number {
         // generation size. This helps stay within safe memory limits on
         // constrained systems or CI.
         if (maxOldSpaceSize <= 512) {
-          _maxSemiSpaceSizeFlag = 4
+          maxSemiSpaceSizeFlag = 4
         } else if (maxOldSpaceSize <= 1_024) {
-          _maxSemiSpaceSizeFlag = 8
+          maxSemiSpaceSizeFlag = 8
         } else if (maxOldSpaceSize <= 2_048) {
-          _maxSemiSpaceSizeFlag = 16
+          maxSemiSpaceSizeFlag = 16
         } else if (maxOldSpaceSize <= 4_096) {
-          _maxSemiSpaceSizeFlag = 32
+          maxSemiSpaceSizeFlag = 32
         } else {
-          _maxSemiSpaceSizeFlag = 64
+          maxSemiSpaceSizeFlag = 64
         }
       } else {
         // For large heaps (> 8 GiB), compute semi-space size using a log-scaled
@@ -132,15 +132,15 @@ export function getMaxSemiSpaceSizeFlag(): number {
         // (e.g. large arrays, buffers).
         const log2OldSpace = Math.log2(maxOldSpaceSize)
         const scaledSemiSpace = Math.floor(log2OldSpace) * 8
-        _maxSemiSpaceSizeFlag = scaledSemiSpace
+        maxSemiSpaceSizeFlag = scaledSemiSpace
       }
     }
   }
-  return _maxSemiSpaceSizeFlag
+  return maxSemiSpaceSizeFlag
 }
 
 export function getRawSpaceSizeFlags(): RawSpaceSizeFlags {
-  if (_rawSpaceSizeFlags === undefined) {
+  if (rawSpaceSizeFlags === undefined) {
     const cli = meow({
       argv: process.argv.slice(2),
       // Prevent meow from potentially exiting early.
@@ -174,12 +174,12 @@ export function getRawSpaceSizeFlags(): RawSpaceSizeFlags {
     }
     /* c8 ignore stop */
 
-    _rawSpaceSizeFlags = {
+    rawSpaceSizeFlags = {
       maxOldSpaceSize,
       maxSemiSpaceSize,
     }
   }
-  return _rawSpaceSizeFlags!
+  return rawSpaceSizeFlags!
 }
 
 /**
@@ -188,9 +188,9 @@ export function getRawSpaceSizeFlags(): RawSpaceSizeFlags {
  * @internal
  */
 export function resetFlagCache(): void {
-  _rawSpaceSizeFlags = undefined
-  _maxOldSpaceSizeFlag = undefined
-  _maxSemiSpaceSizeFlag = undefined
+  rawSpaceSizeFlags = undefined
+  maxOldSpaceSizeFlag = undefined
+  maxSemiSpaceSizeFlag = undefined
 }
 // Ensure export because dist/flags.js is required in src/constants.mts.
 // eslint-disable-next-line n/exports-style