test(crawlers): more npm + composer coverage

* npm: extract `parse_yarn_dir_output` and `parse_pnpm_root_output`
  from their shell-out wrappers so the path-derivation logic is
  unit-testable without a real `yarn` / `pnpm` binary; add tests
  covering happy path + empty stdout for both parsers and for the
  previously-extracted `parse_bun_bin_output`.
* npm: cover `read_package_json` empty-string branches, `NpmCrawler`
  construction, `get_node_modules_paths` global_prefix passthrough
  and global-mode-without-prefix, and `find_workspace_node_modules`
  recursion / skip-list behavior.
* composer: cover `get_global_vendor_paths` via COMPOSER_HOME env
  var and the HOME/.composer + HOME/.config/composer platform
  fallbacks, plus `crawl_all` dedup across vendor paths.

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

crates/socket-patch-core/src/crawlers/npm_crawler.rs

@@ -113,8 +113,14 @@ pub fn get_yarn_global_prefix() -> Option<String> {
     if !output.status.success() {
         return None;
     }
+    parse_yarn_dir_output(&String::from_utf8_lossy(&output.stdout))
+}
 
-    let dir = String::from_utf8_lossy(&output.stdout).trim().to_string();
+/// Pure parser for `yarn global dir` stdout. Returns `<dir>/node_modules`
+/// or `None` on empty input. Extracted so the path-derivation logic is
+/// unit-testable without shelling out.
+pub fn parse_yarn_dir_output(stdout: &str) -> Option<String> {
+    let dir = stdout.trim().to_string();
     if dir.is_empty() {
         return None;
     }
@@ -134,8 +140,13 @@ pub fn get_pnpm_global_prefix() -> Option<String> {
     if !output.status.success() {
         return None;
     }
+    parse_pnpm_root_output(&String::from_utf8_lossy(&output.stdout))
+}
 
-    let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+/// Pure parser for `pnpm root -g` stdout. Returns the trimmed path or
+/// `None` on empty input.
+pub fn parse_pnpm_root_output(stdout: &str) -> Option<String> {
+    let path = stdout.trim().to_string();
     if path.is_empty() {
         return None;
     }

crates/socket-patch-core/tests/crawler_composer_e2e.rs

@@ -216,6 +216,147 @@ async fn get_vendor_paths_local_full_setup_returns_vendor() {
     assert_eq!(paths, vec![vendor]);
 }
 
+// ── global mode discovery ──────────────────────────────────────
+
+/// `get_vendor_paths(global=true, global_prefix=None)` falls through to
+/// `get_global_vendor_paths` which checks `COMPOSER_HOME` env var.
+/// Stubbing it to a fixture root with `<root>/vendor/` populated must
+/// surface that path.
+#[tokio::test]
+#[serial_test::serial]
+async fn get_vendor_paths_global_via_composer_home_env() {
+    let tmp = tempfile::tempdir().unwrap();
+    let composer_home = tmp.path();
+    let vendor = composer_home.join("vendor");
+    tokio::fs::create_dir_all(&vendor).await.unwrap();
+
+    let prev_composer = std::env::var("COMPOSER_HOME").ok();
+    std::env::set_var("COMPOSER_HOME", composer_home);
+
+    let crawler = ComposerCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: None,
+        batch_size: 100,
+    };
+    let paths = crawler.get_vendor_paths(&opts).await.unwrap();
+
+    std::env::remove_var("COMPOSER_HOME");
+    if let Some(v) = prev_composer {
+        std::env::set_var("COMPOSER_HOME", v);
+    }
+
+    assert!(
+        paths.iter().any(|p| p == &vendor),
+        "COMPOSER_HOME-derived vendor dir must be returned; got {paths:?}"
+    );
+}
+
+/// COMPOSER_HOME unset + HOME pointing at a tempdir with `.composer/`
+/// must fall through to the HOME/.composer platform default.
+#[tokio::test]
+#[serial_test::serial]
+async fn get_vendor_paths_global_via_home_dot_composer_fallback() {
+    let tmp = tempfile::tempdir().unwrap();
+    let dot_composer = tmp.path().join(".composer");
+    let vendor = dot_composer.join("vendor");
+    tokio::fs::create_dir_all(&vendor).await.unwrap();
+
+    let prev_composer = std::env::var("COMPOSER_HOME").ok();
+    let prev_home = std::env::var("HOME").ok();
+    std::env::remove_var("COMPOSER_HOME");
+    std::env::set_var("HOME", tmp.path());
+
+    let crawler = ComposerCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: None,
+        batch_size: 100,
+    };
+    let paths = crawler.get_vendor_paths(&opts).await.unwrap();
+
+    if let Some(v) = prev_composer {
+        std::env::set_var("COMPOSER_HOME", v);
+    }
+    if let Some(v) = prev_home {
+        std::env::set_var("HOME", v);
+    } else {
+        std::env::remove_var("HOME");
+    }
+
+    assert!(
+        paths.iter().any(|p| p == &vendor),
+        "HOME/.composer fallback vendor dir must be returned; got {paths:?}"
+    );
+}
+
+/// HOME with `.config/composer/` but no `.composer/` exercises the
+/// second candidate in the platform-default list.
+#[tokio::test]
+#[serial_test::serial]
+async fn get_vendor_paths_global_via_home_xdg_config_composer_fallback() {
+    let tmp = tempfile::tempdir().unwrap();
+    let xdg = tmp.path().join(".config").join("composer");
+    let vendor = xdg.join("vendor");
+    tokio::fs::create_dir_all(&vendor).await.unwrap();
+
+    let prev_composer = std::env::var("COMPOSER_HOME").ok();
+    let prev_home = std::env::var("HOME").ok();
+    std::env::remove_var("COMPOSER_HOME");
+    std::env::set_var("HOME", tmp.path());
+
+    let crawler = ComposerCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: None,
+        batch_size: 100,
+    };
+    let paths = crawler.get_vendor_paths(&opts).await.unwrap();
+
+    if let Some(v) = prev_composer {
+        std::env::set_var("COMPOSER_HOME", v);
+    }
+    if let Some(v) = prev_home {
+        std::env::set_var("HOME", v);
+    } else {
+        std::env::remove_var("HOME");
+    }
+
+    assert!(
+        paths.iter().any(|p| p == &vendor),
+        "HOME/.config/composer fallback vendor dir must be returned; got {paths:?}"
+    );
+}
+
+/// `crawl_all` should dedup packages discovered across multiple
+/// vendor paths sharing the same installed package — exercises the
+/// `seen.contains` early-continue arm.
+#[tokio::test]
+async fn crawl_all_dedups_across_vendor_paths() {
+    let tmp = tempfile::tempdir().unwrap();
+    let custom_vendor = tmp.path().join("custom-vendor");
+    let composer_dir = custom_vendor.join("composer");
+    tokio::fs::create_dir_all(&composer_dir).await.unwrap();
+    let pkg_dir = custom_vendor.join("monolog").join("monolog");
+    tokio::fs::create_dir_all(&pkg_dir).await.unwrap();
+    let installed = r#"{"packages":[{"name":"monolog/monolog","version":"3.5.0"},{"name":"monolog/monolog","version":"3.5.0"}]}"#;
+    tokio::fs::write(composer_dir.join("installed.json"), installed).await.unwrap();
+    tokio::fs::write(tmp.path().join("composer.json"), b"{}").await.unwrap();
+
+    let crawler = ComposerCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: Some(custom_vendor),
+        batch_size: 100,
+    };
+    let result = crawler.crawl_all(&opts).await;
+    assert_eq!(result.len(), 1, "duplicates inside installed.json must dedup");
+}
+
 #[tokio::test]
 async fn get_vendor_paths_local_with_lock_marker_also_works() {
     let tmp = tempfile::tempdir().unwrap();

crates/socket-patch-core/tests/crawler_npm_e2e.rs

@@ -6,7 +6,8 @@
 use std::path::Path;
 
 use socket_patch_core::crawlers::npm_crawler::{
-    build_npm_purl, parse_bun_bin_output, parse_package_name, read_package_json,
+    build_npm_purl, parse_bun_bin_output, parse_package_name, parse_pnpm_root_output,
+    parse_yarn_dir_output, read_package_json,
 };
 use socket_patch_core::crawlers::types::CrawlerOptions;
 use socket_patch_core::crawlers::NpmCrawler;
@@ -119,6 +120,71 @@ async fn read_package_json_missing_version_returns_none() {
     assert_eq!(result, None);
 }
 
+/// Both fields present but empty strings — parse succeeds but the
+/// downstream is_empty guard must reject.
+#[tokio::test]
+async fn read_package_json_empty_name_returns_none() {
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = tmp.path().join("package.json");
+    tokio::fs::write(&pkg, r#"{"name":"","version":"1.0.0"}"#).await.unwrap();
+    assert_eq!(read_package_json(&pkg).await, None);
+}
+
+#[tokio::test]
+async fn read_package_json_empty_version_returns_none() {
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = tmp.path().join("package.json");
+    tokio::fs::write(&pkg, r#"{"name":"lodash","version":""}"#).await.unwrap();
+    assert_eq!(read_package_json(&pkg).await, None);
+}
+
+// ── NpmCrawler construction ────────────────────────────────────
+
+#[test]
+fn npm_crawler_new_and_default_construct_cleanly() {
+    let _a = NpmCrawler::new();
+    let _b = NpmCrawler::default();
+}
+
+// ── get_node_modules_paths ─────────────────────────────────────
+
+/// `global_prefix` always takes precedence over discovery, even when
+/// `global` flag is also set.
+#[tokio::test]
+async fn get_node_modules_paths_global_prefix_passthrough() {
+    let tmp = tempfile::tempdir().unwrap();
+    let custom = tmp.path().join("custom-nm");
+    tokio::fs::create_dir_all(&custom).await.unwrap();
+
+    let crawler = NpmCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: false,
+        global_prefix: Some(custom.clone()),
+        batch_size: 100,
+    };
+    let paths = crawler.get_node_modules_paths(&opts).await.unwrap();
+    assert_eq!(paths, vec![custom]);
+}
+
+/// `global_prefix` even when only `global` is set without a prefix —
+/// must fall through to `get_global_node_modules_paths()`. Since the
+/// test env may have npm/yarn/pnpm/bun installed, we just assert the
+/// call returns Ok (it can return any set of real or empty paths).
+#[tokio::test]
+async fn get_node_modules_paths_global_mode_no_prefix() {
+    let tmp = tempfile::tempdir().unwrap();
+    let crawler = NpmCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: None,
+        batch_size: 100,
+    };
+    // Just must not panic — the actual list depends on the host.
+    let _paths = crawler.get_node_modules_paths(&opts).await.unwrap();
+}
+
 // ── parse_bun_bin_output ───────────────────────────────────────
 
 /// Bun's global node_modules lives at `<bun-root>/install/global/node_modules`
@@ -145,6 +211,41 @@ fn parse_bun_bin_output_root_path_returns_none() {
     assert_eq!(parse_bun_bin_output("/"), None);
 }
 
+// ── parse_yarn_dir_output ──────────────────────────────────────
+
+/// yarn global dir prints `<dir>`; we append `/node_modules`.
+#[test]
+fn parse_yarn_dir_output_appends_node_modules() {
+    let parsed = parse_yarn_dir_output("/Users/foo/.yarn/global\n");
+    assert_eq!(
+        parsed.as_deref(),
+        Some("/Users/foo/.yarn/global/node_modules")
+    );
+}
+
+#[test]
+fn parse_yarn_dir_output_empty_returns_none() {
+    assert_eq!(parse_yarn_dir_output(""), None);
+    assert_eq!(parse_yarn_dir_output("\n  \n"), None);
+}
+
+// ── parse_pnpm_root_output ─────────────────────────────────────
+
+#[test]
+fn parse_pnpm_root_output_returns_trimmed_path() {
+    let parsed = parse_pnpm_root_output("/home/foo/.local/share/pnpm/global/5/node_modules\n");
+    assert_eq!(
+        parsed.as_deref(),
+        Some("/home/foo/.local/share/pnpm/global/5/node_modules")
+    );
+}
+
+#[test]
+fn parse_pnpm_root_output_empty_returns_none() {
+    assert_eq!(parse_pnpm_root_output(""), None);
+    assert_eq!(parse_pnpm_root_output("   \n  "), None);
+}
+
 // ── find_by_purls ──────────────────────────────────────────────
 
 #[tokio::test]
@@ -233,6 +334,44 @@ async fn crawl_all_skips_dirs_without_package_json() {
     assert!(result.is_empty());
 }
 
+/// `find_workspace_node_modules` should recurse into subdirectories
+/// looking for nested `node_modules`, while skipping hidden dirs and
+/// well-known build-output dirs.
+#[tokio::test]
+async fn crawl_all_recurses_into_workspace_packages() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Root has no node_modules but a workspace subdir does.
+    let pkg_dir = tmp.path().join("packages").join("ws-a");
+    stage_npm_pkg(&pkg_dir.join("node_modules"), "lodash", "4.17.21").await;
+
+    let crawler = NpmCrawler;
+    let opts = options_at(tmp.path());
+    let result = crawler.crawl_all(&opts).await;
+    let names: Vec<&str> = result.iter().map(|p| p.name.as_str()).collect();
+    assert!(
+        names.contains(&"lodash"),
+        "workspace recursion must discover nested node_modules; got {names:?}"
+    );
+}
+
+#[tokio::test]
+async fn crawl_all_skips_hidden_and_skip_dirs() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Hidden dirs and SKIP_DIRS entries (dist/build/coverage/tmp/...) are skipped.
+    stage_npm_pkg(&tmp.path().join(".hidden").join("node_modules"), "should-not-find", "1.0").await;
+    stage_npm_pkg(&tmp.path().join("dist").join("node_modules"), "also-not", "1.0").await;
+    // But a real workspace dir should be picked up.
+    stage_npm_pkg(&tmp.path().join("real-ws").join("node_modules"), "found-me", "1.0").await;
+
+    let crawler = NpmCrawler;
+    let opts = options_at(tmp.path());
+    let result = crawler.crawl_all(&opts).await;
+    let names: Vec<&str> = result.iter().map(|p| p.name.as_str()).collect();
+    assert!(names.contains(&"found-me"));
+    assert!(!names.contains(&"should-not-find"), "hidden dir must be skipped");
+    assert!(!names.contains(&"also-not"), "SKIP_DIRS dir must be skipped");
+}
+
 #[tokio::test]
 async fn crawl_all_skips_dirs_with_corrupt_package_json() {
     let tmp = tempfile::tempdir().unwrap();