feat(releases): upgrade to picomatch 4.0.3 and use for glob matching

- Add pnpm override for picomatch 4.0.3
- Refactor wildcard implementation in releases/github.ts to use picomatch
- Replace parseWildcardPattern() with createMatcher() using picomatch.isMatch()
- Support full glob syntax including braces, multiple wildcards, and globstar
- Maintain backward compatibility with prefix/suffix objects and RegExp patterns
- Update JSDoc to document glob support and provide examples
- Add comprehensive picomatch integration tests covering:
  - Simple wildcard patterns
  - Multiple wildcards
  - Brace expansion
  - Exact matches
  - Prefix/suffix wildcards
  - Globstar patterns
  - Case sensitivity

Fix external-imports script bugs:
- Correct distDir path resolution (was pointing to scripts/dist instead of dist)
- Fix regex pattern consumption issue by creating separate test pattern
- Add comment periods for consistency with codebase style

The new implementation provides more robust pattern matching using picomatch
while maintaining the same API. Existing code using simple wildcards like
'yoga-sync-*.mjs' will continue to work, but can now also use advanced glob
features like '{yoga,models}-*.{mjs,js}' for more flexible matching.

Author: jdalton

package.json

@@ -787,6 +787,7 @@
       "@sigstore/sign": "4.1.0",
       "ansi-regex": "6.2.2",
       "lru-cache": "11.2.2",
+      "picomatch": "4.0.3",
       "semver": "7.7.2",
       "string-width": "8.1.0",
       "strip-ansi": "7.1.2",

pnpm-lock.yaml

@@ -15,7 +15,7 @@ import { externalPackages, scopedPackages } from '../build-externals/config.mjs'
 const logger = getDefaultLogger()
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const distDir = path.resolve(__dirname, '..', 'dist')
+const distDir = path.resolve(__dirname, '..', '..', 'dist')
 const distExternalDir = path.join(distDir, 'external')
 
 // Build list of all external packages to rewrite
@@ -60,18 +60,21 @@ async function fixFileImports(filePath, verbose = false) {
   const externalPrefix = getExternalPathPrefix(filePath)
 
   for (const pkg of allExternalPackages) {
-    // Escape special regex characters in package name
+    // Escape special regex characters in package name.
     const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 
-    // Match require('pkg') or require("pkg")
-    // Don't match if it's already pointing to ./external/ or ../external/
+    // Match require('pkg') or require("pkg").
+    // Don't match if it's already pointing to ./external/ or ../external/.
     const requirePattern = new RegExp(
       `require\\((['"])(?!\\.\\.?\\/external\\/)${escapedPkg}\\1\\)`,
       'g',
     )
 
-    if (requirePattern.test(content)) {
-      // Replace with require('./external/pkg') or require('../external/pkg')
+    // Create a new regex for testing to avoid consuming matches.
+    const testPattern = new RegExp(requirePattern.source)
+
+    if (testPattern.test(content)) {
+      // Replace with require('./external/pkg') or require('../external/pkg').
       const replacement = `require('${externalPrefix}/${pkg}')`
       content = content.replace(requirePattern, replacement)
       modified = true
@@ -105,7 +108,7 @@ async function processDirectory(dir, verbose = false) {
     for (const entry of entries) {
       const fullPath = path.join(dir, entry.name)
 
-      // Skip the external directory itself
+      // Skip the external directory itself.
       if (entry.isDirectory() && fullPath === distExternalDir) {
         continue
       }
@@ -120,7 +123,7 @@ async function processDirectory(dir, verbose = false) {
       }
     }
   } catch (error) {
-    // Skip directories that don't exist
+    // Skip directories that don't exist.
     if (error.code !== 'ENOENT') {
       throw error
     }

scripts/fix/external-imports.mjs

@@ -5,6 +5,8 @@
 import { chmodSync, existsSync } from 'fs'
 import { readFile, writeFile } from 'fs/promises'
 
+import picomatch from 'picomatch'
+
 import { safeMkdir } from '../fs.js'
 import { httpDownload, httpRequest } from '../http-request.js'
 import { getDefaultLogger } from '../logger.js'
@@ -269,15 +271,19 @@ export function getAuthHeaders(): Record<string, string> {
 /**
  * Pattern for matching release assets.
  * Can be either:
- * - A string with wildcard (*) for simple glob patterns (e.g., 'yoga-sync-*.mjs')
- * - A prefix/suffix pair for explicit matching
+ * - A string with glob pattern syntax
+ * - A prefix/suffix pair for explicit matching (backward compatible)
  * - A RegExp for complex patterns
  *
- * String patterns support a single wildcard (*) which matches any characters:
- * - 'yoga-sync-*.mjs' → prefix: 'yoga-sync-', suffix: '.mjs'
- * - 'models-*.tar.gz' → prefix: 'models-', suffix: '.tar.gz'
- * - '*-models.tar.gz' → prefix: '', suffix: '-models.tar.gz'
- * - 'yoga-*' → prefix: 'yoga-', suffix: ''
+ * String patterns support full glob syntax via picomatch.
+ * Examples:
+ * - Simple wildcard: yoga-sync-*.mjs matches yoga-sync-abc123.mjs
+ * - Complex: models-*.tar.gz matches models-2024-01-15.tar.gz
+ * - Prefix wildcard: *-models.tar.gz matches foo-models.tar.gz
+ * - Suffix wildcard: yoga-* matches yoga-layout
+ * - Brace expansion: {yoga,models}-*.{mjs,js} matches yoga-abc.mjs or models-xyz.js
+ *
+ * For backward compatibility, prefix/suffix objects are still supported but glob patterns are recommended.
  */
 export type AssetPattern = string | { prefix: string; suffix: string } | RegExp
 
@@ -292,55 +298,39 @@ export interface FindReleaseAssetResult {
 }
 
 /**
- * Parse a wildcard pattern string into prefix/suffix components.
- * Supports a single wildcard (*) character.
+ * Create a matcher function for a pattern using picomatch for glob patterns
+ * or simple prefix/suffix matching for object patterns.
  *
- * @param pattern - Pattern string with optional wildcard (e.g., 'yoga-sync-*.mjs')
- * @returns Prefix/suffix pair for matching
- * @throws Error if pattern contains multiple wildcards
+ * @param pattern - Pattern to match (string glob, prefix/suffix object, or RegExp)
+ * @returns Function that tests if a string matches the pattern
  *
  * @example
  * ```ts
- * parseWildcardPattern('yoga-sync-*.mjs')
- * // Returns: { prefix: 'yoga-sync-', suffix: '.mjs' }
- *
- * parseWildcardPattern('models-*.tar.gz')
- * // Returns: { prefix: 'models-', suffix: '.tar.gz' }
+ * const matcher = createMatcher('yoga-sync-*.mjs')
+ * matcher('yoga-sync-abc123.mjs') // true
+ * matcher('models-xyz.tar.gz') // false
  *
- * parseWildcardPattern('*-models.tar.gz')
- * // Returns: { prefix: '', suffix: '-models.tar.gz' }
- *
- * parseWildcardPattern('yoga-*')
- * // Returns: { prefix: 'yoga-', suffix: '' }
- *
- * parseWildcardPattern('exact-name.txt')
- * // Returns: { prefix: 'exact-name.txt', suffix: '' } (exact match)
+ * const matcher2 = createMatcher({ prefix: 'yoga-', suffix: '.mjs' })
+ * matcher2('yoga-sync.mjs') // true
+ * matcher2('yoga-layout.js') // false
  * ```
  */
-function parseWildcardPattern(pattern: string): {
-  prefix: string
-  suffix: string
-} {
-  const wildcardIndex = pattern.indexOf('*')
-
-  // No wildcard - treat as exact match (prefix only).
-  if (wildcardIndex === -1) {
-    return { prefix: pattern, suffix: '' }
+function createMatcher(
+  pattern: string | { prefix: string; suffix: string } | RegExp,
+): (input: string) => boolean {
+  if (typeof pattern === 'string') {
+    // Use picomatch for glob pattern matching.
+    const isMatch = picomatch(pattern)
+    return (input: string) => isMatch(input)
   }
 
-  // Check for multiple wildcards.
-  const lastWildcardIndex = pattern.lastIndexOf('*')
-  if (wildcardIndex !== lastWildcardIndex) {
-    throw new Error(
-      `Pattern contains multiple wildcards: ${pattern}. Only single wildcard (*) is supported.`,
-    )
+  if (pattern instanceof RegExp) {
+    return (input: string) => pattern.test(input)
   }
 
-  // Split at wildcard position.
-  const prefix = pattern.slice(0, wildcardIndex)
-  const suffix = pattern.slice(wildcardIndex + 1)
-
-  return { prefix, suffix }
+  // Prefix/suffix object pattern (backward compatible).
+  const { prefix, suffix } = pattern
+  return (input: string) => input.startsWith(prefix) && input.endsWith(suffix)
 }
 
 /**
@@ -349,14 +339,14 @@ function parseWildcardPattern(pattern: string): {
  * then finds the first asset matching the provided pattern.
  *
  * @param toolPrefix - Tool name prefix to search for (e.g., 'yoga-layout-')
- * @param assetPattern - Pattern to match asset names (string with wildcard, prefix/suffix object, or RegExp)
+ * @param assetPattern - Pattern to match asset names (glob string, prefix/suffix object, or RegExp)
  * @param repoConfig - Repository configuration (owner/repo)
  * @param options - Additional options
  * @returns Result with tag and asset name, or null if not found
  *
  * @example
  * ```ts
- * // Find yoga-sync asset with wildcard pattern
+ * // Find yoga-sync asset with glob pattern
  * const result = await findReleaseAsset(
  *   'yoga-layout-',
  *   'yoga-sync-*.mjs',
@@ -367,7 +357,7 @@ function parseWildcardPattern(pattern: string): {
  *
  * @example
  * ```ts
- * // Find models tar.gz with wildcard pattern
+ * // Find models tar.gz with glob pattern
  * const result = await findReleaseAsset(
  *   'models-',
  *   'models-*.tar.gz',
@@ -377,6 +367,16 @@ function parseWildcardPattern(pattern: string): {
  *
  * @example
  * ```ts
+ * // Find asset with glob braces pattern
+ * const result = await findReleaseAsset(
+ *   'yoga-layout-',
+ *   'yoga-{sync,layout}-*.{mjs,js}',
+ *   { owner: 'SocketDev', repo: 'socket-btm' }
+ * )
+ * ```
+ *
+ * @example
+ * ```ts
  * // Find asset with object pattern (backward compatible)
  * const result = await findReleaseAsset(
  *   'yoga-layout-',
@@ -404,13 +404,8 @@ export async function findReleaseAsset(
   const { owner, repo } = repoConfig
   const { quiet = false } = options
 
-  // Normalize string patterns to prefix/suffix objects.
-  let normalizedPattern: { prefix: string; suffix: string } | RegExp
-  if (typeof assetPattern === 'string') {
-    normalizedPattern = parseWildcardPattern(assetPattern)
-  } else {
-    normalizedPattern = assetPattern
-  }
+  // Create matcher function for the pattern.
+  const isMatch = createMatcher(assetPattern)
 
   return await pRetry(
     async () => {
@@ -435,20 +430,10 @@ export async function findReleaseAsset(
           continue
         }
 
-        // Find matching asset in this release.
-        let matchingAsset: { name: string } | undefined
-
-        if (normalizedPattern instanceof RegExp) {
-          matchingAsset = assets.find((a: { name: string }) =>
-            normalizedPattern.test(a.name),
-          )
-        } else {
-          const { prefix, suffix } = normalizedPattern
-          matchingAsset = assets.find(
-            (a: { name: string }) =>
-              a.name.startsWith(prefix) && a.name.endsWith(suffix),
-          )
-        }
+        // Find matching asset in this release using the matcher function.
+        const matchingAsset = assets.find((a: { name: string }) =>
+          isMatch(a.name),
+        )
 
         if (matchingAsset) {
           if (!quiet) {

src/releases/github.ts

@@ -4,6 +4,8 @@
 
 import { describe, expect, it } from 'vitest'
 
+import picomatch from 'picomatch'
+
 import {
   getAuthHeaders,
   SOCKET_BTM_REPO,
@@ -114,4 +116,66 @@ describe('releases/github', () => {
       }
     })
   })
+
+  describe('picomatch integration', () => {
+    it('should match simple wildcard patterns', () => {
+      const isMatch = picomatch('yoga-sync-*.mjs')
+      expect(isMatch('yoga-sync-abc123.mjs')).toBe(true)
+      expect(isMatch('yoga-sync-2024-01-15.mjs')).toBe(true)
+      expect(isMatch('models-xyz.tar.gz')).toBe(false)
+      expect(isMatch('yoga-sync.js')).toBe(false)
+    })
+
+    it('should match patterns with multiple wildcards', () => {
+      const isMatch = picomatch('models-*-*.tar.gz')
+      expect(isMatch('models-2024-01-15.tar.gz')).toBe(true)
+      expect(isMatch('models-foo-bar.tar.gz')).toBe(true)
+      expect(isMatch('models-xyz.tar.gz')).toBe(false)
+    })
+
+    it('should match patterns with braces', () => {
+      const isMatch = picomatch('yoga-{sync,layout}-*.{mjs,js}')
+      expect(isMatch('yoga-sync-abc.mjs')).toBe(true)
+      expect(isMatch('yoga-layout-xyz.js')).toBe(true)
+      expect(isMatch('yoga-sync-abc.ts')).toBe(false)
+      expect(isMatch('yoga-other-xyz.mjs')).toBe(false)
+    })
+
+    it('should match exact patterns without wildcards', () => {
+      const isMatch = picomatch('exact-name.txt')
+      expect(isMatch('exact-name.txt')).toBe(true)
+      expect(isMatch('exact-name.md')).toBe(false)
+      expect(isMatch('other-name.txt')).toBe(false)
+    })
+
+    it('should match patterns starting with wildcard', () => {
+      const isMatch = picomatch('*-models.tar.gz')
+      expect(isMatch('foo-models.tar.gz')).toBe(true)
+      expect(isMatch('bar-models.tar.gz')).toBe(true)
+      expect(isMatch('models.tar.gz')).toBe(false)
+    })
+
+    it('should match patterns ending with wildcard', () => {
+      const isMatch = picomatch('yoga-*')
+      expect(isMatch('yoga-sync')).toBe(true)
+      expect(isMatch('yoga-layout')).toBe(true)
+      expect(isMatch('yoga-')).toBe(true)
+      expect(isMatch('models-sync')).toBe(false)
+    })
+
+    it('should support double-star globstar patterns', () => {
+      const isMatch = picomatch('**/*.mjs')
+      expect(isMatch('yoga-sync.mjs')).toBe(true)
+      expect(isMatch('dir/yoga-sync.mjs')).toBe(true)
+      expect(isMatch('deep/nested/dir/file.mjs')).toBe(true)
+      expect(isMatch('file.js')).toBe(false)
+    })
+
+    it('should be case-sensitive by default', () => {
+      const isMatch = picomatch('yoga-sync-*.mjs')
+      expect(isMatch('yoga-sync-ABC.mjs')).toBe(true)
+      expect(isMatch('Yoga-Sync-abc.mjs')).toBe(false)
+      expect(isMatch('YOGA-SYNC-abc.MJS')).toBe(false)
+    })
+  })
 })