bughunt npm probe: alias + linked strategy

Author: claude

.github/workflows/bughunt-npm.yml

@@ -0,0 +1,68 @@
+name: bughunt npm probe
+on:
+  push:
+    branches: ['bughunt/npm/**']
+permissions:
+  contents: read
+jobs:
+  probe:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        npm: ['10.9.4', '12.1.0']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+      - name: Build CLI
+        run: cargo build --release -p socket-patch-cli
+      - name: Install npm
+        run: npm install -g npm@${{ matrix.npm }} && npm --version
+      - name: Probe
+        run: |
+          BIN="$PWD/target/release/socket-patch"
+          [ -f "$BIN.exe" ] && BIN="$BIN.exe"
+          W="$RUNNER_TEMP/probe"; mkdir -p "$W"
+          cat > "$W/stage.js" <<'JS'
+          const fs=require('fs'),path=require('path'),crypto=require('crypto');
+          const [proj,purl,pkgdir]=process.argv.slice(2);
+          const before=fs.readFileSync(path.join(pkgdir,'index.js'));
+          const after=Buffer.concat([Buffer.from('/* SOCKET-PATCHED */\n'),before]);
+          const gh=b=>crypto.createHash('sha256').update(Buffer.concat([Buffer.from('blob '+b.length+'\0'),b])).digest('hex');
+          fs.mkdirSync(path.join(proj,'.socket','blobs'),{recursive:true});
+          const m={patches:{[purl]:{uuid:'1a2b3c4d-5e6f-4a1b-8c2d-0123456789ab',exportedAt:'2026-01-01T00:00:00Z',
+            files:{'package/index.js':{beforeHash:gh(before),afterHash:gh(after)}},
+            vulnerabilities:{'GHSA-xxxx-yyyy-zzzz':{cves:['CVE-2024-99999'],summary:'s',severity:'high',description:'d'}},
+            description:'m',license:'MIT',tier:'free'}},setup:{manual:['npm']}};
+          fs.writeFileSync(path.join(proj,'.socket','manifest.json'),JSON.stringify(m,null,2));
+          fs.writeFileSync(path.join(proj,'.socket','blobs',gh(after)),after);
+          fs.writeFileSync(path.join(proj,'.socket','blobs',gh(before)),before);
+          JS
+          head20() { node -e "process.stdout.write(require('fs').readFileSync(process.argv[1],'utf8').slice(0,20).replace(/\n/g,' '))" "$1"; }
+          echo "::group::alias (issue 356)"
+          A="$W/alias"; mkdir -p "$A"; cd "$A"
+          echo '{"name":"app","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0","lp":"npm:left-pad@1.3.0"}}' > package.json
+          npm install --no-audit --no-fund >/dev/null 2>&1
+          node "$W/stage.js" . pkg:npm/left-pad@1.3.0 node_modules/left-pad
+          "$BIN" apply --json --offline > apply.json; echo "apply exit $?"
+          "$BIN" vex --output v.json --json --offline > vex.json; echo "vex exit $?"
+          echo "RESULT alias ${{ matrix.os }} npm ${{ matrix.npm }}: left-pad=[$(head20 node_modules/left-pad/index.js)] lp=[$(head20 node_modules/lp/index.js)] vex=$(node -e "const d=require('./v.json');console.log(d.statements.map(s=>s.status).join(','))")"
+          echo "::endgroup::"
+          echo "::group::linked (issue 359)"
+          L="$W/linked"; mkdir -p "$L"; cd "$L"
+          echo '{"name":"app","version":"1.0.0","private":true,"dependencies":{"is-odd":"3.0.1"}}' > package.json
+          echo 'install-strategy=linked' > .npmrc
+          npm install --no-audit --no-fund >/dev/null 2>&1
+          ls -la node_modules node_modules/.store || true
+          P=$(ls -d node_modules/.store/is-number@6.0.0-*/node_modules/is-number)
+          node "$W/stage.js" . pkg:npm/is-number@6.0.0 "$P"
+          "$BIN" apply --offline; RC=$?
+          echo "RESULT linked ${{ matrix.os }} npm ${{ matrix.npm }}: apply exit $RC is-number=[$(head20 "$P/index.js")]"
+          echo "::endgroup::"