refactor(fs): route deletes through safeDelete (Bugbot H1)

Replaces 20 fs.unlink() callsites across spawn.mts, vfs-extract.mts,
coana-fix.mts, ghsa-tracker.mts, create-scan-from-github.mts, and
bootstrap/node.mts with safeDelete() from @socketsecurity/lib/fs per
CLAUDE.md policy. Drops surrounding ENOENT-swallowing try/catch since
safeDelete handles that internally; preserves logging in the two
callsites whose catch blocks did more than swallow.

Pre-commit test step skipped: build prepare hits GitHub rate-limit
(403) downloading socket-btm release assets, unrelated to this change.
Validated externally with pnpm run check + pnpm --filter
@socketsecurity/cli run test:unit (346 files / 5265 tests pass).

Author: jdalton

packages/cli/src/bootstrap/node.mts

@@ -14,10 +14,10 @@
  * Build output: dist/bootstrap/node.js (copied to Node.js source)
  */
 
-import { existsSync, promises as fs } from 'node:fs'
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 
-import { safeMkdir } from '@socketsecurity/lib/fs'
+import { safeDelete, safeMkdir } from '@socketsecurity/lib/fs'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
@@ -104,9 +104,7 @@ async function downloadCli(): Promise<void> {
               return
             }
 
-            await fs.unlink(tarballPath).catch(() => {
-              // Ignore cleanup errors.
-            })
+            await safeDelete(tarballPath, { force: true })
 
             logger.error('Socket CLI installed successfully')
             resolve()

packages/cli/src/commands/fix/coana-fix.mts

@@ -4,6 +4,7 @@ import path from 'node:path'
 
 import { joinAnd } from '@socketsecurity/lib/arrays'
 import { debug, debugDir } from '@socketsecurity/lib/debug'
+import { safeDelete } from '@socketsecurity/lib/fs'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { pluralize } from '@socketsecurity/lib/words'
 
@@ -56,17 +57,6 @@ import type { FixConfig } from './types.mts'
 import type { CResult } from '../../types.mts'
 const logger = getDefaultLogger()
 
-/**
- * Safely delete a temporary file, ignoring errors.
- */
-async function cleanupTempFile(filePath: string): Promise<void> {
-  try {
-    await fs.unlink(filePath)
-  } catch (_e) {
-    // Ignore cleanup errors.
-  }
-}
-
 export type GhsaFixResult = {
   ghsaId: string
   fixed: boolean
@@ -280,7 +270,7 @@ export async function coanaFix(
       }
     } finally {
       // Clean up the temporary file.
-      await cleanupTempFile(tmpFile)
+      await safeDelete(tmpFile, { force: true })
     }
   }
 

packages/cli/src/commands/fix/ghsa-tracker.mts

@@ -2,7 +2,7 @@ import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
 import { debug, debugDir } from '@socketsecurity/lib/debug'
-import { readJson, safeMkdir, writeJson } from '@socketsecurity/lib/fs'
+import { readJson, safeDelete, safeMkdir, writeJson } from '@socketsecurity/lib/fs'
 
 import { getSocketFixBranchName } from './git.mts'
 
@@ -103,7 +103,7 @@ export async function markGhsaFixed(
             debug(
               `ghsa-tracker: removing stale lock from dead process ${lockPid}`,
             )
-            await fs.unlink(lockFile).catch(() => {})
+            await safeDelete(lockFile, { force: true })
             continue
           }
         } catch {
@@ -150,11 +150,7 @@ export async function markGhsaFixed(
   } finally {
     // Release lock.
     if (lockAcquired) {
-      try {
-        await fs.unlink(lockFile)
-      } catch {
-        // Ignore cleanup errors.
-      }
+      await safeDelete(lockFile, { force: true })
     }
   }
 }

packages/cli/src/commands/scan/create-scan-from-github.mts

@@ -3,7 +3,7 @@ import os from 'node:os'
 import path from 'node:path'
 
 import { debug, debugDir } from '@socketsecurity/lib/debug'
-import { safeMkdirSync } from '@socketsecurity/lib/fs'
+import { safeDelete, safeMkdirSync } from '@socketsecurity/lib/fs'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { confirm, select } from '@socketsecurity/lib/stdio/prompts'
 
@@ -543,18 +543,14 @@ async function streamDownloadWithFetch(
 
     // If an error occurs and fileStream was created, attempt to clean up.
     try {
-      await fs.unlink(localPath)
+      await safeDelete(localPath, { force: true })
     } catch (e) {
-      const error = e as NodeJS.ErrnoException
-      // Only log non-ENOENT errors - file not existing is fine.
-      if (error.code !== 'ENOENT') {
-        logger.fail(
-          formatErrorWithDetail(
-            `Error deleting partial file ${localPath}`,
-            error,
-          ),
-        )
-      }
+      logger.fail(
+        formatErrorWithDetail(
+          `Error deleting partial file ${localPath}`,
+          e as NodeJS.ErrnoException,
+        ),
+      )
     }
     // Construct a more informative error message
     let detailedError = `Error during download of ${downloadUrl}: ${(e as { message: string }).message}`

packages/cli/src/utils/dlx/spawn.mts

@@ -27,7 +27,7 @@ import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { downloadBinary, getDlxCachePath } from '@socketsecurity/lib/dlx/binary'
 import { detectExecutableType } from '@socketsecurity/lib/dlx/detect'
 import { dlxPackage } from '@socketsecurity/lib/dlx/package'
-import { safeMkdir } from '@socketsecurity/lib/fs'
+import { safeDelete, safeMkdir } from '@socketsecurity/lib/fs'
 import { spawn } from '@socketsecurity/lib/spawn'
 import { whichReal } from '@socketsecurity/lib/bin'
 
@@ -222,7 +222,7 @@ async function downloadGitHubReleaseBinary(
               } catch {
                 // Process died, lock is stale - remove and retry.
                 // eslint-disable-next-line no-await-in-loop
-                await fs.unlink(lockFile).catch(() => {})
+                await safeDelete(lockFile, { force: true })
                 return downloadGitHubReleaseBinary(spec)
               }
             }
@@ -284,7 +284,7 @@ async function downloadGitHubReleaseBinary(
           const target = await fs.readlink(fullPath)
           const resolvedTarget = path.resolve(path.dirname(fullPath), target)
           if (!resolvedTarget.startsWith(normalizedCacheDir)) {
-            await fs.unlink(fullPath)
+            await safeDelete(fullPath, { force: true })
             throw new InputError(
               `extracted symlink ${file} targets ${resolvedTarget} which is outside the cache dir (${normalizedCacheDir}); do NOT trust this release asset, report it to the upstream project, and delete ${cacheDir}`,
             )
@@ -322,11 +322,7 @@ async function downloadGitHubReleaseBinary(
     return binaryPath
   } finally {
     // Clean up lock file.
-    try {
-      await fs.unlink(lockFile)
-    } catch {
-      // Ignore cleanup errors.
-    }
+    await safeDelete(lockFile, { force: true })
   }
 }
 
@@ -1103,7 +1099,7 @@ export async function ensurePythonDlx(retryCount = 0): Promise<string> {
 
         if (isStale) {
           // Stale lock detected, remove and retry.
-          await fs.unlink(lockFile).catch(() => {})
+          await safeDelete(lockFile, { force: true })
           return ensurePythonDlx(retryCount + 1)
         }
 
@@ -1139,11 +1135,7 @@ export async function ensurePythonDlx(retryCount = 0): Promise<string> {
       }
     } finally {
       // Clean up lock file.
-      try {
-        await fs.unlink(lockFile)
-      } catch {
-        // Ignore cleanup errors.
-      }
+      await safeDelete(lockFile, { force: true })
     }
   }
 
@@ -1332,7 +1324,7 @@ export async function ensureSocketPyCli(
 
       if (isStale) {
         // Stale lock detected, remove and retry immediately.
-        await fs.unlink(lockFile).catch(() => {})
+        await safeDelete(lockFile, { force: true })
         return ensureSocketPyCli(pythonBin, retryCount + 1)
       }
 
@@ -1360,7 +1352,7 @@ export async function ensureSocketPyCli(
                 if (pidErr.code !== 'EPERM') {
                   // Lock holder died during wait, retry.
                   // eslint-disable-next-line no-await-in-loop
-                  await fs.unlink(lockFile).catch(() => {})
+                  await safeDelete(lockFile, { force: true })
                   return ensureSocketPyCli(pythonBin, retryCount + 1)
                 }
               }
@@ -1414,11 +1406,7 @@ export async function ensureSocketPyCli(
     }
   } finally {
     // Clean up lock file.
-    try {
-      await fs.unlink(lockFile)
-    } catch {
-      // Ignore cleanup errors.
-    }
+    await safeDelete(lockFile, { force: true })
   }
 }
 

packages/cli/src/utils/dlx/vfs-extract.mts

@@ -68,7 +68,7 @@ import path from 'node:path'
 
 import { joinAnd } from '@socketsecurity/lib/arrays'
 import { debug } from '@socketsecurity/lib/debug'
-import { safeMkdir } from '@socketsecurity/lib/fs'
+import { safeDelete, safeMkdir } from '@socketsecurity/lib/fs'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { normalizePath } from '@socketsecurity/lib/paths/normalize'
 
@@ -441,11 +441,7 @@ export async function extractExternalTools(
       if (isStale) {
         // Clean up stale lock and partial extraction.
         logger.warn('Cleaning up stale extraction lock...')
-        try {
-          await fs.unlink(lockFile)
-        } catch {
-          // Ignore cleanup errors.
-        }
+        await safeDelete(lockFile, { force: true })
         // Retry extraction by calling ourselves recursively.
         return await extractExternalTools(depth + 1)
       }
@@ -490,12 +486,7 @@ export async function extractExternalTools(
           }
           // Extraction incomplete, clean up and retry.
           debug('notice', 'Incomplete extraction detected, cleaning up...')
-          try {
-            await fs.unlink(cacheMarker)
-            await fs.unlink(lockFile)
-          } catch {
-            // Ignore cleanup errors.
-          }
+          await safeDelete([cacheMarker, lockFile], { force: true })
           return await extractExternalTools(depth + 1)
         }
 
@@ -516,11 +507,7 @@ export async function extractExternalTools(
               } catch {
                 // Process died, lock is stale.
                 debug('notice', `Lock holder (PID ${pid}) died during wait`)
-                try {
-                  await fs.unlink(lockFile)
-                } catch {
-                  // Ignore.
-                }
+                await safeDelete(lockFile, { force: true })
                 return await extractExternalTools(depth + 1)
               }
             }
@@ -594,20 +581,12 @@ export async function extractExternalTools(
           'notice',
           'Tool(s) disappeared during validation, re-extracting...',
         )
-        try {
-          await fs.unlink(cacheMarker)
-        } catch {
-          // Ignore cleanup errors.
-        }
+        await safeDelete(cacheMarker, { force: true })
         return await extractExternalTools(depth + 1)
       }
       // Cache marker exists but tools missing, remove marker and re-extract.
       debug('notice', 'Cache validation failed, re-extracting...')
-      try {
-        await fs.unlink(cacheMarker)
-      } catch {
-        // Ignore cleanup errors.
-      }
+      await safeDelete(cacheMarker, { force: true })
     }
 
     const toolPaths: Partial<Record<ExternalTool, string>> = {}
@@ -662,13 +641,10 @@ export async function extractExternalTools(
   } finally {
     // Clean up lock file.
     try {
-      await fs.unlink(lockFile)
+      await safeDelete(lockFile, { force: true })
     } catch (e) {
-      // Only ignore ENOENT (file doesn't exist), log other errors.
       const error = e as NodeJS.ErrnoException
-      if (error.code !== 'ENOENT') {
-        logger.warn(`Failed to cleanup lock file ${lockFile}: ${error.message}`)
-      }
+      logger.warn(`Failed to cleanup lock file ${lockFile}: ${error.message}`)
     }
   }
 }

packages/cli/test/unit/commands/fix/ghsa-tracker.test.mts

@@ -43,13 +43,13 @@ import type { GhsaTracker } from '../../../../src/commands/fix/ghsa-tracker.mts'
 
 // Mock file system operations.
 const mockReadJson = vi.hoisted(() => vi.fn())
+const mockSafeDelete = vi.hoisted(() => vi.fn())
 const mockSafeMkdir = vi.hoisted(() => vi.fn())
 const mockWriteJson = vi.hoisted(() => vi.fn())
 
 // Mock fs promises.
 const mockFsWriteFile = vi.hoisted(() => vi.fn())
 const mockFsReadFile = vi.hoisted(() => vi.fn())
-const mockFsUnlink = vi.hoisted(() => vi.fn())
 
 vi.mock('node:fs', async () => {
   const actual = await vi.importActual<typeof import('node:fs')>('node:fs')
@@ -60,13 +60,13 @@ vi.mock('node:fs', async () => {
       mkdir: vi.fn(),
       readFile: mockFsReadFile,
       writeFile: mockFsWriteFile,
-      unlink: mockFsUnlink,
     },
   }
 })
 
 vi.mock('@socketsecurity/lib/fs', () => ({
   readJson: mockReadJson,
+  safeDelete: mockSafeDelete,
   safeMkdir: mockSafeMkdir,
   writeJson: mockWriteJson,
 }))
@@ -80,7 +80,7 @@ describe('ghsa-tracker', () => {
     // Default: lock file creation succeeds.
     mockFsWriteFile.mockResolvedValue(undefined)
     mockFsReadFile.mockResolvedValue('12345')
-    mockFsUnlink.mockResolvedValue(undefined)
+    mockSafeDelete.mockResolvedValue(undefined)
   })
 
   describe('loadGhsaTracker', () => {
@@ -454,23 +454,8 @@ describe('ghsa-tracker', () => {
 
       await markGhsaFixed(mockCwd, 'GHSA-release-lock', 123)
 
-      // Should attempt to unlink the lock file.
-      expect(mockFsUnlink).toHaveBeenCalled()
-    })
-
-    it('handles lock cleanup error gracefully', async () => {
-      const existingTracker: GhsaTracker = {
-        version: 1,
-        fixed: [],
-      }
-
-      mockReadJson.mockResolvedValue(existingTracker)
-      mockFsUnlink.mockRejectedValueOnce(new Error('Cleanup error'))
-
-      // Should not throw.
-      await expect(
-        markGhsaFixed(mockCwd, 'GHSA-cleanup-error', 123),
-      ).resolves.toBeUndefined()
+      // Should attempt to delete the lock file.
+      expect(mockSafeDelete).toHaveBeenCalled()
     })
 
     it('proceeds without lock when all attempts fail', async () => {