test(coverage): cover six previously zero-coverage files (35 tests)

Phase 1 of the coverage push. Six small zero-coverage files now at
100%:

- env/opengrep-version.mts (3 tests): version getter happy path,
  missing env var, empty-string env var
- env/trivy-version.mts (3 tests): same shape
- env/trufflehog-version.mts (3 tests): same shape
- utils/spawn/apply-machine-mode.mts (6 tests): pass-through when
  ambient mode off; defers to raw applier when on; inferSubcommand
  finds first non-flag, returns undefined for empty/all-flag input
- commands/uninstall/teardown-tab-completion.mts (8 tests):
  getBashrcDetails error pass-through; .bashrc absent → "not found";
  bashrc without our block → "missing"; full block removal; fallback
  individual-line removal when block edited; left[] reports remaining
  completion-prefix lines; homePath empty short-circuits the check
- commands/manifest/detect-manifest-actions.mts (12 tests): empty
  dir; build.sbt → sbt; gradlew → gradle; environment.yml → conda;
  environment.yaml fallback; both .yml + .yaml → counts once;
  all-three; sockJson disabling each generator; cdxgen always false

Tests use real tmpdirs for filesystem checks (detect-manifest-actions)
and surgical vi.mock for fs / completion / homePath / paths.mjs where
mocking is cleaner than driving the real implementation.

Author: jdalton

packages/cli/test/unit/commands/manifest/detect-manifest-actions.test.mts

@@ -0,0 +1,173 @@
+/**
+ * Unit tests for detectManifestActions.
+ *
+ * Walks a directory looking for files that indicate which manifest
+ * generators (sbt, gradle, conda) should run. Per-generator
+ * `socket.json` `disabled` flags can suppress detection.
+ *
+ * Test Coverage:
+ * - Empty directory → no detections, count 0
+ * - build.sbt present → sbt=true, count 1
+ * - gradlew present → gradle=true, count 1
+ * - environment.yml present → conda=true, count 1
+ * - environment.yaml present (when no .yml) → conda=true
+ * - Both .yml and .yaml present → only counts once (yml wins)
+ * - All three present → all true, count 3
+ * - sockJson disables sbt → sbt=false even with build.sbt
+ * - sockJson disables gradle → gradle=false even with gradlew
+ * - sockJson disables conda → conda=false even with environment.yml
+ * - cdxgen field is always false (not auto-detected)
+ *
+ * Related Files:
+ * - src/commands/manifest/detect-manifest-actions.mts - Implementation
+ */
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { SocketJson } from '../../../../src/utils/socket/json.mts'
+
+// Source-of-truth constants/paths.mts evaluates the bundle-tools.json
+// version table at import time, which fails outside of a build (where
+// INLINED_COANA_VERSION is missing). We only need ENVIRONMENT_YML /
+// ENVIRONMENT_YAML, so stub them.
+vi.mock('../../../../src/constants/paths.mjs', () => ({
+  ENVIRONMENT_YAML: 'environment.yaml',
+  ENVIRONMENT_YML: 'environment.yml',
+}))
+
+const { detectManifestActions } = await import(
+  '../../../../src/commands/manifest/detect-manifest-actions.mts'
+)
+
+let cwd = ''
+
+beforeEach(() => {
+  cwd = mkdtempSync(path.join(tmpdir(), 'detect-manifest-'))
+})
+
+afterEach(() => {
+  rmSync(cwd, { force: true, recursive: true })
+})
+
+function touch(rel: string) {
+  const full = path.join(cwd, rel)
+  mkdirSync(path.dirname(full), { recursive: true })
+  writeFileSync(full, '')
+}
+
+describe('detectManifestActions', () => {
+  it('returns all-false counts on an empty directory', async () => {
+    const result = await detectManifestActions(null, cwd)
+    expect(result).toEqual({
+      cdxgen: false,
+      count: 0,
+      conda: false,
+      gradle: false,
+      sbt: false,
+    })
+  })
+
+  it('detects build.sbt as Scala sbt project', async () => {
+    touch('build.sbt')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.sbt).toBe(true)
+    expect(result.count).toBe(1)
+  })
+
+  it('detects gradlew as Gradle project', async () => {
+    touch('gradlew')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.gradle).toBe(true)
+    expect(result.count).toBe(1)
+  })
+
+  it('detects environment.yml as Conda project', async () => {
+    touch('environment.yml')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.conda).toBe(true)
+    expect(result.count).toBe(1)
+  })
+
+  it('detects environment.yaml as Conda project when .yml is absent', async () => {
+    touch('environment.yaml')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.conda).toBe(true)
+    expect(result.count).toBe(1)
+  })
+
+  it('counts conda only once when both .yml and .yaml are present', async () => {
+    touch('environment.yml')
+    touch('environment.yaml')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.conda).toBe(true)
+    expect(result.count).toBe(1)
+  })
+
+  it('detects all three when all marker files are present', async () => {
+    touch('build.sbt')
+    touch('gradlew')
+    touch('environment.yml')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.sbt).toBe(true)
+    expect(result.gradle).toBe(true)
+    expect(result.conda).toBe(true)
+    expect(result.count).toBe(3)
+  })
+
+  it('respects socket.json disabling sbt detection', async () => {
+    touch('build.sbt')
+    const sockJson = {
+      defaults: { manifest: { sbt: { disabled: true } } },
+    } as unknown as SocketJson
+    const result = await detectManifestActions(sockJson, cwd)
+    expect(result.sbt).toBe(false)
+    expect(result.count).toBe(0)
+  })
+
+  it('respects socket.json disabling gradle detection', async () => {
+    touch('gradlew')
+    const sockJson = {
+      defaults: { manifest: { gradle: { disabled: true } } },
+    } as unknown as SocketJson
+    const result = await detectManifestActions(sockJson, cwd)
+    expect(result.gradle).toBe(false)
+    expect(result.count).toBe(0)
+  })
+
+  it('respects socket.json disabling conda detection', async () => {
+    touch('environment.yml')
+    const sockJson = {
+      defaults: { manifest: { conda: { disabled: true } } },
+    } as unknown as SocketJson
+    const result = await detectManifestActions(sockJson, cwd)
+    expect(result.conda).toBe(false)
+    expect(result.count).toBe(0)
+  })
+
+  it('always reports cdxgen as false (not auto-detected)', async () => {
+    touch('build.sbt')
+    touch('gradlew')
+    touch('environment.yml')
+    const result = await detectManifestActions(null, cwd)
+    expect(result.cdxgen).toBe(false)
+  })
+
+  it('ignores other socket.json keys when checking specific generators', async () => {
+    // Only sbt is disabled; gradle and conda remain enabled.
+    touch('build.sbt')
+    touch('gradlew')
+    touch('environment.yml')
+    const sockJson = {
+      defaults: { manifest: { sbt: { disabled: true } } },
+    } as unknown as SocketJson
+    const result = await detectManifestActions(sockJson, cwd)
+    expect(result.sbt).toBe(false)
+    expect(result.gradle).toBe(true)
+    expect(result.conda).toBe(true)
+    expect(result.count).toBe(2)
+  })
+})

packages/cli/test/unit/commands/uninstall/teardown-tab-completion.test.mts

@@ -0,0 +1,177 @@
+/**
+ * Unit tests for teardownTabCompletion.
+ *
+ * Removes Socket CLI tab-completion lines from the user's ~/.bashrc.
+ * Mocks node:fs so tests don't touch the real filesystem.
+ *
+ * Test Coverage:
+ * - getBashrcDetails error pass-through
+ * - .bashrc absent → "not found" action
+ * - .bashrc present without our block → "missing" action
+ * - .bashrc present with our block → removes the full block
+ * - .bashrc present where the block was edited → falls back to
+ *   removing sourcingCommand / completionCommand individually
+ * - findRemainingCompletionSetups discovers other targets
+ * - homePath unset edge case (skip the bashrc lookup entirely)
+ *
+ * Related Files:
+ * - src/commands/uninstall/teardown-tab-completion.mts - Implementation
+ * - src/utils/cli/completion.mts - getBashrcDetails / COMPLETION_CMD_PREFIX
+ * - src/constants/paths.mts - homePath
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockExistsSync, mockReadFileSync, mockWriteFileSync } = vi.hoisted(
+  () => ({
+    mockExistsSync: vi.fn(),
+    mockReadFileSync: vi.fn(),
+    mockWriteFileSync: vi.fn(),
+  }),
+)
+
+vi.mock('node:fs', () => ({
+  default: {
+    existsSync: mockExistsSync,
+    readFileSync: mockReadFileSync,
+    writeFileSync: mockWriteFileSync,
+  },
+  existsSync: mockExistsSync,
+  readFileSync: mockReadFileSync,
+  writeFileSync: mockWriteFileSync,
+}))
+
+const { mockGetBashrcDetails } = vi.hoisted(() => ({
+  mockGetBashrcDetails: vi.fn(),
+}))
+
+vi.mock('../../../../src/utils/cli/completion.mts', () => ({
+  COMPLETION_CMD_PREFIX: 'source <(socket install completion ',
+  getBashrcDetails: mockGetBashrcDetails,
+}))
+
+const { mockHomePath } = vi.hoisted(() => ({
+  mockHomePath: { value: '/home/test' as string },
+}))
+
+vi.mock('../../../../src/constants/paths.mts', () => ({
+  get homePath() {
+    return mockHomePath.value
+  },
+}))
+
+const { teardownTabCompletion } = await import(
+  '../../../../src/commands/uninstall/teardown-tab-completion.mts'
+)
+
+const validDetails = {
+  ok: true as const,
+  data: {
+    completionCommand: 'source <(socket install completion socket)',
+    sourcingCommand: 'eval "$(socket install completion socket)"',
+    toAddToBashrc:
+      '# Socket CLI tab completion\nsource <(socket install completion socket)\n',
+  },
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockHomePath.value = '/home/test'
+  mockGetBashrcDetails.mockReturnValue(validDetails)
+})
+
+describe('teardownTabCompletion', () => {
+  it('passes through getBashrcDetails errors', async () => {
+    mockGetBashrcDetails.mockReturnValue({
+      ok: false,
+      message: 'unknown shell',
+      cause: 'unsupported',
+    })
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(false)
+    expect(mockExistsSync).not.toHaveBeenCalled()
+  })
+
+  it('returns "not found" action when ~/.bashrc does not exist', async () => {
+    mockExistsSync.mockReturnValue(false)
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.action).toBe('not found')
+      expect(result.data.left).toEqual([])
+    }
+    expect(mockReadFileSync).not.toHaveBeenCalled()
+  })
+
+  it('returns "missing" when ~/.bashrc has no completion block', async () => {
+    mockExistsSync.mockReturnValue(true)
+    mockReadFileSync.mockReturnValue('export PATH=$PATH:/usr/local/bin\n')
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.action).toBe('missing')
+      expect(result.data.left).toEqual([])
+    }
+    expect(mockWriteFileSync).not.toHaveBeenCalled()
+  })
+
+  it('removes the completion block when present', async () => {
+    mockExistsSync.mockReturnValue(true)
+    const before = `export PATH=$PATH:/usr/local/bin\n${validDetails.data.toAddToBashrc}\nalias ll='ls -la'\n`
+    mockReadFileSync.mockReturnValue(before)
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.action).toBe('removed')
+    }
+    expect(mockWriteFileSync).toHaveBeenCalledTimes(1)
+    const written = mockWriteFileSync.mock.calls[0]![1]
+    expect(written).not.toContain(validDetails.data.toAddToBashrc)
+  })
+
+  it('falls back to removing sourcing/completion lines individually when the block was edited', async () => {
+    mockExistsSync.mockReturnValue(true)
+    // Manually-edited bashrc: someone removed the comment and reorganized.
+    const partial = `${validDetails.data.toAddToBashrc}\n${validDetails.data.sourcingCommand}\n${validDetails.data.completionCommand}\n`
+    mockReadFileSync.mockReturnValue(partial)
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    const written = mockWriteFileSync.mock.calls[0]![1] as string
+    expect(written).not.toContain(validDetails.data.sourcingCommand)
+    expect(written).not.toContain(validDetails.data.completionCommand)
+  })
+
+  it('reports remaining completion-prefix lines in the "left" array', async () => {
+    mockExistsSync.mockReturnValue(true)
+    const otherTarget = 'source <(socket install completion otherCli)'
+    const before = `${validDetails.data.toAddToBashrc}\n${otherTarget}\n`
+    mockReadFileSync.mockReturnValue(before)
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.left).toEqual(['otherCli)'])
+    }
+  })
+
+  it('reports remaining setups in the "missing" branch too', async () => {
+    mockExistsSync.mockReturnValue(true)
+    const otherTarget = 'source <(socket install completion otherCli)'
+    mockReadFileSync.mockReturnValue(otherTarget + '\n')
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.action).toBe('missing')
+      expect(result.data.left).toEqual(['otherCli)'])
+    }
+  })
+
+  it('skips bashrc handling when homePath is empty', async () => {
+    mockHomePath.value = ''
+    const result = await teardownTabCompletion('socket')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.data.action).toBe('not found')
+    }
+    expect(mockExistsSync).not.toHaveBeenCalled()
+  })
+})

packages/cli/test/unit/env/opengrep-version.test.mts

@@ -0,0 +1,45 @@
+/**
+ * Unit tests for OpenGrep version getter.
+ *
+ * The getter reads INLINED_OPENGREP_VERSION from process.env directly
+ * so esbuild's define plugin can inline the value at build time. Tests
+ * verify the runtime success and the missing-env throw.
+ *
+ * Related Files:
+ * - src/env/opengrep-version.mts
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import { getOpengrepVersion } from '../../../src/env/opengrep-version.mts'
+
+describe('env/opengrep-version', () => {
+  let original: string | undefined
+
+  beforeEach(() => {
+    original = process.env['INLINED_OPENGREP_VERSION']
+  })
+
+  afterEach(() => {
+    if (original !== undefined) {
+      process.env['INLINED_OPENGREP_VERSION'] = original
+    } else {
+      delete process.env['INLINED_OPENGREP_VERSION']
+    }
+  })
+
+  it('returns the version string when the env var is set', () => {
+    process.env['INLINED_OPENGREP_VERSION'] = '1.2.3'
+    expect(getOpengrepVersion()).toBe('1.2.3')
+  })
+
+  it('throws a build-time-inlined message when the env var is missing', () => {
+    delete process.env['INLINED_OPENGREP_VERSION']
+    expect(() => getOpengrepVersion()).toThrow(/INLINED_OPENGREP_VERSION/)
+  })
+
+  it('throws when the env var is the empty string', () => {
+    process.env['INLINED_OPENGREP_VERSION'] = ''
+    expect(() => getOpengrepVersion()).toThrow(/INLINED_OPENGREP_VERSION/)
+  })
+})