@coana-tech/cli 14.11.18 → 14.12.0

package/cli-wrapper.mjs

@@ -5,6 +5,7 @@ import { dirname, join } from 'path';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+process.env.COANA_ROOT = __dirname;
 process.env.REPOS_PATH = join(__dirname, 'repos');
 process.env.COANA_REPOS_PATH = join(__dirname, 'repos', 'coana-tech');
 process.env.REACHABILITY_ANALYZERS_SCRIPT_PATH = join(

package/cli.mjs

@@ -210274,9 +210274,8 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash)
       const base = basename7(file);
       const workspaceDir = dirname8(file) || ".";
       if (base === "pyproject.toml" || base === "setup.py" && await isSetupPySetuptools(file)) {
-        const normalizedDir = workspaceDir === "." ? "." : workspaceDir;
-        if (!properPythonProjects.includes(normalizedDir)) {
-          properPythonProjects.push(normalizedDir);
+        if (!properPythonProjects.includes(workspaceDir)) {
+          properPythonProjects.push(workspaceDir);
         }
       }
     }
@@ -210288,14 +210287,23 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash)
       const ecosystem = getAdvisoryEcosystemFromPurlType(artifact.type);
       if (!ecosystem)
         continue;
-      const manifestFiles = artifact.manifestFiles?.map((ref) => ref.file) ?? [];
-      const allAncestorIds = getAllToplevelAncestors(artifactMap, artifact.id);
-      allAncestorIds.forEach((ancestorId) => {
-        const ancestor = artifactMap.get(ancestorId);
-        if (ancestor?.manifestFiles) {
-          manifestFiles.push(...ancestor.manifestFiles.map((ref) => ref.file));
+      const manifestFiles = [];
+      switch (ecosystem) {
+        case "MAVEN": {
+          manifestFiles.push(...(await getFilesRelative(rootWorkingDirectory)).filter((file) => (0, import_picomatch2.default)("{{*-*.,}pom{.xml,},gradle.lockfile}")(basename7(file))));
+          break;
         }
-      });
+        case "NUGET": {
+          manifestFiles.push(...(await getFilesRelative(rootWorkingDirectory)).filter((file) => (0, import_picomatch2.default)("{*.csproj,packages.lock.json}")(basename7(file))));
+          break;
+        }
+        default: {
+          artifact.manifestFiles?.forEach((ref) => manifestFiles.push(ref.file));
+          const allAncestorIds = getAllToplevelAncestors(artifactMap, artifact.id);
+          allAncestorIds.forEach((ancestorId) => artifactMap.get(ancestorId)?.manifestFiles?.forEach((ref) => manifestFiles.push(ref.file)));
+          break;
+        }
+      }
       let manifestAndWorkspace = manifestFiles.map((manifestFile) => [
         manifestFile,
         inferWorkspaceFromManifestPath(ecosystem, manifestFile, properPythonProjects)
@@ -210323,33 +210331,14 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash)
         }
         const workspaceData = ecosystemToWorkspaceToAnalysisData[ecosystem][workspace];
         if (workspaceData.type === "socket") {
-          switch (ecosystem) {
-            case "MAVEN": {
-              if (!workspaceData.data.manifestFiles.length) {
-                const allFiles2 = await getFilesRelative(rootWorkingDirectory);
-                const manifestFiles2 = allFiles2.filter((file) => (0, import_picomatch2.default)("{{*-*.,}pom{.xml,},gradle.lockfile}")(basename7(file)));
-                workspaceData.data.manifestFiles.push(...manifestFiles2);
-              }
-              break;
-            }
-            case "NUGET": {
-              if (!workspaceData.data.manifestFiles.length) {
-                const allFiles2 = await getFilesRelative(rootWorkingDirectory);
-                const manifestFiles2 = allFiles2.filter((file) => (0, import_picomatch2.default)("{*.csproj,packages.lock.json}")(basename7(file)));
-                workspaceData.data.manifestFiles.push(...manifestFiles2);
-              }
-              break;
-            }
-            default: {
-              if (!workspaceData.data.manifestFiles.includes(manifestFile)) {
-                workspaceData.data.manifestFiles.push(manifestFile);
-              }
-              break;
-            }
+          if (!workspaceData.data.manifestFiles.includes(manifestFile)) {
+            workspaceData.data.manifestFiles.push(manifestFile);
           }
           workspaceData.data.artifacts.push(artifact);
         }
-        if (artifact.vulnerabilities && artifact.vulnerabilities.length > 0) {
+      }
+      if (artifact.vulnerabilities && artifact.vulnerabilities.length > 0) {
+        for (const workspace of i5(manifestAndWorkspace.map(([, workspace2]) => workspace2))) {
           for (const vuln of artifact.vulnerabilities) {
             const vulnerability = {
               url: vuln.ghsaId,
@@ -225499,7 +225488,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.11.18";
+var version2 = "14.12.0";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.11.18",
+  "version": "14.12.0",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -74547,7 +74547,7 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
   }
   static initFromDependencyTree(dependencyTree, timeoutInSeconds, statusUpdater) {
     return new _DotnetCodeAwareVulnerabilityScanner({
-      [randomUUID()]: {
+      [serializeNugetDependencyToPackageUrl(dependencyTree)]: {
         src: dependencyTree.src,
         bin: dependencyTree.bin,
         ecosystemSpecificPackageInfo: {
@@ -74611,7 +74611,7 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
       try {
         const nugetDependencyChain = await convertDependencyChain(dependencyChain, tmpDir);
         const scanner = new _DotnetCodeAwareVulnerabilityScanner({
-          [randomUUID()]: {
+          [serializeNugetDependencyToPackageUrl(nugetDependencyChain[0])]: {
             src: nugetDependencyChain[0].src,
             bin: nugetDependencyChain[0].bin,
             ecosystemSpecificPackageInfo: {
@@ -74653,8 +74653,8 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
       const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runDotnetDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --cocoa ${cocoaPath} --tree-sitter-c-sharp ${treeSitterCSharpPath}`);
       if (result.error)
         return void 0;
-      const directNodes = JSON.parse(await readFile4(outputFile, "utf-8")).result;
-      return directNodes?.filter((node) => !Object.hasOwn(this.apps, node.packageId))?.map((node) => parsePackageUrlToNugetDependency(node.packageId).packageName);
+      const packageIds = JSON.parse(await readFile4(outputFile, "utf-8")).result;
+      return packageIds?.filter((packageId) => !Object.hasOwn(this.apps, packageId))?.map((packageId) => parsePackageUrlToNugetDependency(packageId).packageName);
     });
   }
   async runAnalysis(vulnerabilities, heuristic, _analyzesAllVulns, _experiment) {
@@ -74692,19 +74692,18 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
         diagnostics,
         terminatedEarly: diagnostics.timeout,
         reachedDependencies: true,
-        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _DotnetCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerabilityAccessPaths2)
+        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _DotnetCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, i(vulnerabilityAccessPaths2.map((vulnerabilityAccessPath) => vulnerabilityAccessPath.slice(1).split(":")[0])))
       };
     });
   }
-  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableAccessPaths) {
+  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableClasses) {
     const affectedPackages = /* @__PURE__ */ new Set();
     const classStacks = [];
-    for (const vulnerableMethod of vulnerableAccessPaths) {
-      const classForVulnerableMethod = vulnerableMethod.slice(1).split(":")[0];
-      const vulnerablePathsForMethod = vulnerablePaths[classForVulnerableMethod];
-      if (!vulnerablePathsForMethod)
+    for (const vulnerableClass of vulnerableClasses) {
+      const vulnerablePathsForClass = vulnerablePaths[vulnerableClass];
+      if (!vulnerablePathsForClass)
         continue;
-      classStacks.push(...vulnerablePathsForMethod.map((vulnPath) => {
+      classStacks.push(...vulnerablePathsForClass.map((vulnPath) => {
         if (vulnPath.length < 2)
           throw new Error("The path should always have length at least two.");
         return vulnPath.map(({ fullyQualifiedName, confidence, packageId }) => ({
@@ -74713,7 +74712,7 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
           confidence
         }));
       }));
-      vulnerablePathsForMethod.flatMap((vulnPath) => vulnPath.slice(1).map(({ packageId }) => parsePackageUrlToNugetDependency(packageId))).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
+      vulnerablePathsForClass.flatMap((vulnPath) => vulnPath).filter(({ packageId }) => !appPackageIds.has(packageId)).map(({ packageId }) => parsePackageUrlToNugetDependency(packageId)).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
     }
     return {
       analysisLevel: "class-level",
@@ -88392,7 +88391,7 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
   }
   static initFromDependencyTree(dependencyTree, timeoutInSeconds, statusUpdater) {
     return new _JavaCodeAwareVulnerabilityScanner({
-      [randomUUID2()]: {
+      [serializeMavenDependencyToPackageUrl(dependencyTree)]: {
         src: dependencyTree.src,
         bin: dependencyTree.bin,
         ecosystemSpecificPackageInfo: {
@@ -88456,7 +88455,7 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
       try {
         const mavenDependencyChain = await convertDependencyChain2(dependencyChain, tmpDir);
         const scanner = new _JavaCodeAwareVulnerabilityScanner({
-          [randomUUID2()]: {
+          [serializeMavenDependencyToPackageUrl(mavenDependencyChain[0])]: {
             src: mavenDependencyChain[0].src,
             bin: mavenDependencyChain[0].bin,
             ecosystemSpecificPackageInfo: {
@@ -88498,8 +88497,8 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
       const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runJvmDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --alucard ${alucardPath} --tree-sitter-java ${treeSitterJavaPath} --tree-sitter-kotlin ${treeSitterKotlinPath} --tree-sitter-scala ${treeSitterScalaPath}`);
       if (result.error)
         return void 0;
-      const directNodes = JSON.parse(await readFile5(outputFile, "utf-8")).result;
-      return directNodes?.filter((node) => !Object.hasOwn(this.apps, node.packageId))?.map((node) => parsePackageUrlToMavenDependency(node.packageId).packageName);
+      const packageIds = JSON.parse(await readFile5(outputFile, "utf-8")).result;
+      return packageIds?.filter((packageId) => !Object.hasOwn(this.apps, packageId))?.map((packageId) => parsePackageUrlToMavenDependency(packageId).packageName);
     });
   }
   async runAnalysis(vulnerabilities, heuristic, _analyzesAllVulns, _experiment) {
@@ -88537,19 +88536,18 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
         diagnostics,
         terminatedEarly: diagnostics.timeout,
         reachedDependencies: true,
-        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _JavaCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerabilityAccessPaths2)
+        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _JavaCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, i(vulnerabilityAccessPaths2.map((vulnerabilityAccessPath) => vulnerabilityAccessPath.slice(1).split(":")[0])))
       };
     });
   }
-  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableAccessPaths) {
+  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableClasses) {
     const affectedPackages = /* @__PURE__ */ new Set();
     const classStacks = [];
-    for (const vulnerableMethod of vulnerableAccessPaths) {
-      const classForVulnerableMethod = vulnerableMethod.slice(1).split(":")[0];
-      const vulnerablePathsForMethod = vulnerablePaths[classForVulnerableMethod];
-      if (!vulnerablePathsForMethod)
+    for (const vulnerableClass of vulnerableClasses) {
+      const vulnerablePathsForClass = vulnerablePaths[vulnerableClass];
+      if (!vulnerablePathsForClass)
         continue;
-      classStacks.push(...vulnerablePathsForMethod.map((vulnPath) => {
+      classStacks.push(...vulnerablePathsForClass.map((vulnPath) => {
         if (vulnPath.length < 2)
           throw new Error("The path should always have length at least two.");
         return vulnPath.map(({ fullyQualifiedName, confidence, packageId }) => ({
@@ -88558,7 +88556,7 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
           confidence
         }));
       }));
-      vulnerablePathsForMethod.flatMap((vulnPath) => vulnPath.slice(1).map(({ packageId }) => parsePackageUrlToMavenDependency(packageId))).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
+      vulnerablePathsForClass.flatMap((vulnPath) => vulnPath).filter(({ packageId }) => !appPackageIds.has(packageId)).map(({ packageId }) => parsePackageUrlToMavenDependency(packageId)).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
     }
     return {
       analysisLevel: "class-level",
@@ -95940,7 +95938,7 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
   }
   static initFromDependencyTree(dependencyTree, timeoutInSeconds, statusUpdater) {
     return new _RustCodeAwareVulnerabilityScanner({
-      [randomUUID3()]: {
+      [serializeRustDependencyToPackageUrl(dependencyTree)]: {
         src: dependencyTree.src,
         ecosystemSpecificPackageInfo: {
           type: "RUST",
@@ -96004,7 +96002,7 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
       try {
         const rustDependencyChain = await convertDependencyChain3(dependencyChain, tmpDir);
         const scanner = new _RustCodeAwareVulnerabilityScanner({
-          [randomUUID3()]: {
+          [serializeRustDependencyToPackageUrl(rustDependencyChain[0])]: {
             src: rustDependencyChain[0].src,
             ecosystemSpecificPackageInfo: {
               type: "RUST",
@@ -96046,8 +96044,8 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
       const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runRustDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --tree-sitter-rust ${treeSitterRustPath}`);
       if (result.error)
         return void 0;
-      const directNodes = JSON.parse(await readFile8(outputFile, "utf-8")).result;
-      return directNodes?.filter((node) => !Object.hasOwn(this.apps, node.packageId))?.map((node) => parsePackageUrlToRustDependency(node.packageId).packageName);
+      const packageIds = JSON.parse(await readFile8(outputFile, "utf-8")).result;
+      return packageIds?.filter((packageId) => !Object.hasOwn(this.apps, packageId))?.map((packageId) => parsePackageUrlToRustDependency(packageId).packageName);
     });
   }
   async runAnalysis(vulnerabilities, heuristic, _analyzesAllVulns) {
@@ -96086,19 +96084,21 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
         diagnostics,
         terminatedEarly: diagnostics.timeout,
         reachedDependencies: true,
-        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _RustCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerabilityAccessPaths2)
+        computeDetectedOccurrences: ({ vulnerabilityAccessPaths: vulnerabilityAccessPaths2 }) => _RustCodeAwareVulnerabilityScanner.computeDetectedOccurrences(appPackageIds, vulnerablePaths, i(vulnerabilityAccessPaths2.map(
+          // Note, rust uses '::' as path separator, so we need to split on ': ' and not only ':'
+          (vulnerabilityAccessPath) => vulnerabilityAccessPath.slice(1).split(": ")[0]
+        )))
       };
     });
   }
-  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableAccessPaths) {
+  static computeDetectedOccurrences(appPackageIds, vulnerablePaths, vulnerableClasses) {
     const affectedPackages = /* @__PURE__ */ new Set();
     const classStacks = [];
-    for (const vulnerableMethod of vulnerableAccessPaths) {
-      const classForVulnerableMethod = vulnerableMethod.slice(1).split(": ")[0];
-      const vulnerablePathsForMethod = vulnerablePaths[classForVulnerableMethod];
-      if (!vulnerablePathsForMethod)
+    for (const vulnerableClass of vulnerableClasses) {
+      const vulnerablePathsForClass = vulnerablePaths[vulnerableClass];
+      if (!vulnerablePathsForClass)
         continue;
-      classStacks.push(...vulnerablePathsForMethod.map((vulnPath) => {
+      classStacks.push(...vulnerablePathsForClass.map((vulnPath) => {
         if (vulnPath.length < 2)
           throw new Error("The path should always have length at least two.");
         return vulnPath.map(({ fullyQualifiedName, confidence, packageId }) => ({
@@ -96107,7 +96107,7 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
           confidence
         }));
       }));
-      vulnerablePathsForMethod.flatMap((vulnPath) => vulnPath.slice(1).map(({ packageId }) => parsePackageUrlToRustDependency(packageId))).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
+      vulnerablePathsForClass.flatMap((vulnPath) => vulnPath).filter(({ packageId }) => !appPackageIds.has(packageId)).map(({ packageId }) => parsePackageUrlToRustDependency(packageId)).forEach((node) => affectedPackages.add(`${node.packageName}@${node.version}`));
     }
     return {
       analysisLevel: "class-level",