fix(regex): sort-regex-alternations — 8 rewrites + 1 order-significant disable

Reorder regex alternation arms alphabetically per
socket/sort-regex-alternations. All reordered alternations have
mutually-exclusive arms (different leading chars or anchors), so
match semantics are preserved.

One site (glob.mts `(\\.|[^{(])`) keeps the original order because
`\\.` must be tried before `[^{(]` — otherwise `[^{(]` swallows the
backslash and breaks escape-pair consumption — and gets an inline
`socket-hook: allow regex-alternation-order` marker with rationale.

Files:
- packages/cli/.config/esbuild.cli.mts (2 alternations)
- packages/cli/scripts/cover.mts (2 alternations)
- packages/cli/src/commands/mcp/lib/artifacts.mts
- packages/cli/src/utils/ecosystem/windows-shims.mts
- packages/cli/src/utils/fs/glob.mts (disable)
- packages/cli/src/utils/output/adapters/zpm.mts
- packages/cli/test/integration/api/bundle-validation.test.mts (2)
- packages/cli/test/integration/bundle-validation.test.mts (2)

Author: jdalton

packages/cli/.config/esbuild.cli.mts

@@ -26,7 +26,7 @@ const rootPath = path.join(__dirname, '..')
 const inlinedEnvVars = getInlinedEnvVars()
 
 // Matches ./external/, ../external/, ../../external/, etc. (forward and back slashes).
-const socketLibExternalPathRegExp = /^(?:\.[/\\]|(?:\.\.[/\\])+)external[/\\]/
+const socketLibExternalPathRegExp = /^(?:(?:\.\.[/\\])+|\.[/\\])external[/\\]/
 
 export function findSocketLibPath(importerPath: string) {
   const match = importerPath.match(/^(.*\/@socketsecurity\/lib)\b/)
@@ -156,7 +156,7 @@ const config: BuildOptions = {
       setup(build: PluginBuild) {
         // Stub iconv-lite and encoding to avoid bundling issues.
         build.onResolve(
-          { filter: /^(encoding|iconv-lite)(\/|$)/ },
+          { filter: /^(encoding|iconv-lite)(?:$|\/)/ },
           (args: OnResolveArgs) => {
             return {
               path: args.path,

packages/cli/scripts/cover.mts

@@ -136,7 +136,7 @@ async function main() {
         )
         const output = (codeCoverageResult.stdout + codeCoverageResult.stderr)
           .replace(ansiRegex, '')
-          .replace(/(?:✧|︎|⚡)\s*/g, '')
+          .replace(/(?:⚡|✧|︎)\s*/g, '')
           .trim()
 
         // Extract and display test summary
@@ -215,7 +215,7 @@ async function main() {
       // Remove ANSI color codes
       .replace(ansiRegex, '')
       // Remove spinner artifacts
-      .replace(/(?:✧|︎|⚡)\s*/g, '')
+      .replace(/(?:⚡|✧|︎)\s*/g, '')
       .trim()
 
     // Extract test summary (Test Files ... Duration)

packages/cli/src/commands/mcp/lib/artifacts.mts

@@ -47,7 +47,7 @@ export function deduplicateArtifacts(
 }
 
 export function isSourceDist(release: string): boolean {
-  return /\.(tar\.gz|tar\.bz2|zip)$/i.test(release) || /sdist/i.test(release)
+  return /\.(tar\.bz2|tar\.gz|zip)$/i.test(release) || /sdist/i.test(release)
 }
 
 export function isUniversalWheel(release: string): boolean {

packages/cli/src/utils/ecosystem/windows-shims.mts

@@ -70,7 +70,7 @@ export function resolveBinPathSync(binPath: string): string {
     //   node "C:\path\to\npm-cli.js" "$@"
     //   "%_prog%"  "%dp0%\node_modules\npm\bin\npm-cli.js" %*
     const nodePathMatch = content.match(
-      /(?:node\s+["']|"%dp0%\\)([^"'\s]+(?:npm-cli|pnpm|yarn)\.(?:c?js|mjs))["'\s]/i,
+      /(?:"%dp0%\\|node\s+["'])([^"'\s]+(?:npm-cli|pnpm|yarn)\.(?:c?js|mjs))["'\s]/i,
     )
     if (nodePathMatch && nodePathMatch.length > 1 && nodePathMatch[1]) {
       const matchedPath = nodePathMatch[1]

packages/cli/src/utils/fs/glob.mts

@@ -129,7 +129,7 @@ export function ignorePatternToMinimatch(pattern: string): string {
   // Minimatch pattern `src/\{a,b}.js` is equivalent to gitignore pattern `src/{a,b}.js`.
   const escapedPatternWithoutLeadingSlash =
     patternWithoutLeadingSlash.replaceAll(
-      /(?=((?:\\.|[^{(])*))\1([{(])/guy,
+      /(?=((?:\\.|[^{(])*))\1([{(])/guy, // socket-hook: allow regex-alternation-order -- `\\.` must come first so escape pairs are consumed atomically.
       '$1\\$2',
     )
   const matchInsideSuffix = patternToTest.endsWith('/**') ? '/*' : ''

packages/cli/src/utils/output/adapters/zpm.mts

@@ -24,7 +24,7 @@ import type { ScrubberAdapter } from '../scrubber.mts'
 // Matches lines like "➤ YN0000: ..." or "➤ Done in ..." regardless of
 // leading whitespace. Zpm uses U+27A4 BLACK RIGHTWARDS ARROWHEAD as
 // the bullet. The YN\d{4} code pattern is structured and distinctive.
-const ZPM_LOG_RE = /^\s*(?:➤|YN\d{4}:|Done in\s)/
+const ZPM_LOG_RE = /^\s*(?:Done in\s|YN\d{4}:|➤)/
 
 export const zpmAdapter: ScrubberAdapter = {
   name: 'zpm',

packages/cli/test/integration/api/bundle-validation.test.mts

@@ -84,9 +84,9 @@ export function hasAbsolutePaths(content: string): {
   // Match absolute paths but exclude URLs and node: protocol.
   const patterns = [
     // Match require('/abs/path') or require('C:\\path').
-    /require\(["'](?:\/[^"'\n]+|[A-Z]:\\[^"'\n]+)["']\)/g,
+    /require\(["'](?:[A-Z]:\\[^"'\n]+|\/[^"'\n]+)["']\)/g,
     // Match import from '/abs/path'.
-    /import\s+.*?from\s+["'](?:\/[^"'\n]+|[A-Z]:\\[^"'\n]+)["']/g,
+    /import\s+.*?from\s+["'](?:[A-Z]:\\[^"'\n]+|\/[^"'\n]+)["']/g,
   ]
 
   const matches: string[] = []

packages/cli/test/integration/bundle-validation.test.mts

@@ -84,9 +84,9 @@ export function hasAbsolutePaths(content: string): {
   // Match absolute paths but exclude URLs and node: protocol.
   const patterns = [
     // Match require('/abs/path') or require('C:\\path').
-    /require\(["'](?:\/[^"'\n]+|[A-Z]:\\[^"'\n]+)["']\)/g,
+    /require\(["'](?:[A-Z]:\\[^"'\n]+|\/[^"'\n]+)["']\)/g,
     // Match import from '/abs/path'.
-    /import\s+.*?from\s+["'](?:\/[^"'\n]+|[A-Z]:\\[^"'\n]+)["']/g,
+    /import\s+.*?from\s+["'](?:[A-Z]:\\[^"'\n]+|\/[^"'\n]+)["']/g,
   ]
 
   const matches: string[] = []