@coana-tech/cli 14.12.109 → 14.12.111

package/cli.mjs

@@ -206525,6 +206525,7 @@ var Spinner = class _Spinner {
 };
 
 // ../utils/src/command-utils.ts
+var DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;
 async function execAndLogOnFailure(cmd, dir, options, logLevel = "info") {
   const result = await execNeverFail(cmd, dir, options);
   if (result.error) logCommandOutput(result, cmd, dir, logLevel);
@@ -206549,10 +206550,11 @@ async function execNeverFail(cmd, dir, options) {
   return new Promise((resolve45) => {
     let args2;
     if (typeof cmd !== "string") [cmd, ...args2] = cmd;
+    const timeout = options?.timeout ?? DEFAULT_TIMEOUT_MS;
     const childProcess = execFile(
       cmd,
       args2,
-      { ...options, cwd: dir, maxBuffer: 1024 * 1024 * 1024, shell: args2 === void 0 },
+      { ...options, cwd: dir, maxBuffer: 1024 * 1024 * 1024, shell: args2 === void 0, timeout },
       (error, stdout, stderr) => {
         resolve45({ error, stdout, stderr });
       }
@@ -225413,6 +225415,7 @@ var Spinner2 = class _Spinner {
 };
 
 // ../utils/dist/command-utils.js
+var DEFAULT_TIMEOUT_MS2 = 30 * 60 * 1e3;
 async function execAndLogOnFailure3(cmd, dir, options, logLevel = "info") {
   const result = await execNeverFail3(cmd, dir, options);
   if (result.error)
@@ -225436,7 +225439,8 @@ async function execNeverFail3(cmd, dir, options) {
     let args2;
     if (typeof cmd !== "string")
       [cmd, ...args2] = cmd;
-    const childProcess = execFile2(cmd, args2, { ...options, cwd: dir, maxBuffer: 1024 * 1024 * 1024, shell: args2 === void 0 }, (error, stdout, stderr) => {
+    const timeout = options?.timeout ?? DEFAULT_TIMEOUT_MS2;
+    const childProcess = execFile2(cmd, args2, { ...options, cwd: dir, maxBuffer: 1024 * 1024 * 1024, shell: args2 === void 0, timeout }, (error, stdout, stderr) => {
       resolve45({ error, stdout, stderr });
     });
     if (options?.pipe) {
@@ -232202,6 +232206,7 @@ var pullDockerImage = memoize(async (image) => {
   }
   return true;
 });
+var ONE_DAY_IN_MS = 24 * 60 * 60 * 1e3;
 var TMP_DIR_IN_DOCKER = "/coana-tmp";
 var SOCKET_PATH_IN_DOCKER = "/coana.sock";
 var OtherModulesCommunicator = class {
@@ -232268,7 +232273,7 @@ var OtherModulesCommunicator = class {
           succeeded = await execPipeAndLogOnFailure2(
             [await getNodeExecutable(), PACKAGE_MANAGER_SCRIPT_PATH(), commandName, ...finalArgs],
             subprojectPath,
-            { env }
+            { env, timeout: ONE_DAY_IN_MS }
           );
         } else {
           finalArgs.push(...extraDockerArgs ?? []);
@@ -232342,7 +232347,7 @@ var OtherModulesCommunicator = class {
           succeeded = await execPipeAndLogOnFailure2(
             [await getNodeExecutable(), scriptPath, commandName, ...finalArgs],
             subprojectPath,
-            { env }
+            { env, timeout: ONE_DAY_IN_MS }
           );
         } else {
           const dockerImage = await findReachabilityAnalyzersDockerImage(ecosystem);
@@ -232387,7 +232392,7 @@ var OtherModulesCommunicator = class {
       -v=${this.options.coanaSocketPath}:${SOCKET_PATH_IN_DOCKER}
       ${await getEcosystemSpecificDockerArgs(ecosystem)}
       ${envArgs} ${image} ${entryPoint} ${commandName} ${args2}`;
-    return execPipeAndLogOnFailure2(cmd, subprojectPath, { env });
+    return execPipeAndLogOnFailure2(cmd, subprojectPath, { env, timeout: ONE_DAY_IN_MS });
   }
   async getWorkspacePaths(packageManagerName, subprojectPath) {
     return this.runPackageManagerCommandWithOutput("getWorkspacePaths", packageManagerName, subprojectPath);
@@ -235780,7 +235785,7 @@ function toSocketReachabilitySchema(vulnerability) {
 }
 
 // dist/internal/socket-report-socket-dependency-tree.js
-function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1ReachabilityScanId) {
+function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1ReachabilityScanId, workspaceDiagnostics) {
   const artifactIdToArtifact = Object.fromEntries(artifacts.map((artifact) => [artifact.id, artifact]));
   for (const vulnerability of vulnerabilities) {
     const component = artifactIdToArtifact[vulnerability.artifactId];
@@ -235808,7 +235813,8 @@ function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1Reac
   }
   return {
     components: artifacts,
-    tier1ReachabilityScanId
+    tier1ReachabilityScanId,
+    workspaceDiagnostics
   };
 }
 
@@ -250700,7 +250706,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.109";
+var version3 = "14.12.111";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;
@@ -250921,6 +250927,7 @@ var CliCore = class {
       workspaces.forEach((workspace) => logger.info(bold(`    ${workspace}`)));
     });
     const vulnsWithResults = [];
+    const allWorkspaceDiagnostics = [];
     const allEcosystems = Object.entries(ecosystemToWorkspaceToAnalysisData);
     const totalEcosystems = allEcosystems.length;
     let currentOverallWorkspace = 0;
@@ -250930,7 +250937,7 @@ var CliCore = class {
       if (!isEcosystemToAnalyze) {
         logger.info(`Skipping reachability analysis for ecosystem ${getPurlType(ecosystem)} since it is not included in the list of ecosystems to analyze.`);
       }
-      vulnsWithResults.push(...Object.values(await this.runReachabilityAnalysisForWorkspaces(
+      const { vulnerabilities, diagnostics } = await this.runReachabilityAnalysisForWorkspaces(
         workspaceToAnalysisData,
         ecosystemToWorkspaceToVulnerabilities[ecosystem] ?? {},
         {},
@@ -250943,15 +250950,81 @@ var CliCore = class {
           currentOverallWorkspace++;
           logger.info(bold(`Analyzing ecosystem ${ecosystem} for project ${workspaceName} (${workspaceNumber}/${totalWorkspacesForCurrentEcosystem}) - Overall progress: Project ${currentOverallWorkspace}/${totalWorkspaces}, ecosystem ${ecosystemIndex + 1}/${totalEcosystems}`));
         }
-      )).flat());
+      );
+      vulnsWithResults.push(...Object.values(vulnerabilities).flat());
+      for (const [workspacePath, workspaceDiagnostics] of Object.entries(diagnostics)) {
+        allWorkspaceDiagnostics.push({
+          subprojectPath: relative19(this.rootWorkingDirectory, workspacePath) || ".",
+          workspacePath: ".",
+          purl_type: getPurlType(ecosystem),
+          diagnostics: workspaceDiagnostics
+        });
+      }
       this.sendProgress("RUN_ON_SUBPROJECT", false, this.rootWorkingDirectory);
     }
+    this.displayWorkspaceDiagnosticsSummary(allWorkspaceDiagnostics);
     await this.shareLogIfAnalysisError(vulnsWithResults);
-    const socketReport = toSocketFactsSocketDependencyTree(artifacts, vulnsWithResults, this.reportId);
+    const socketReport = toSocketFactsSocketDependencyTree(artifacts, vulnsWithResults, this.reportId, allWorkspaceDiagnostics);
     const outputFile = resolve43(this.options.socketMode);
     await writeFile14(outputFile, JSON.stringify(socketReport, null, 2));
     logger.info(kleur_default.green(`Socket report written to: ${outputFile}`));
   }
+  displayWorkspaceDiagnosticsSummary(diagnosticsEntries) {
+    const warnings = [];
+    const infos = [];
+    const typeToEntry = /* @__PURE__ */ new Map();
+    for (const entry of diagnosticsEntries) {
+      for (const warning of entry.diagnostics.warnings) {
+        const existing = typeToEntry.get(warning.type);
+        const workspaceLabel = `${entry.subprojectPath} (${entry.purl_type})`;
+        if (existing) {
+          existing.workspaces.push(workspaceLabel);
+        } else {
+          const newEntry = { message: warning.message, workspaces: [workspaceLabel], severity: warning.severity };
+          typeToEntry.set(warning.type, newEntry);
+          if (warning.severity === "warning") {
+            warnings.push(newEntry);
+          } else {
+            infos.push(newEntry);
+          }
+        }
+      }
+    }
+    if (warnings.length === 0 && infos.length === 0) {
+      return;
+    }
+    logger.info("");
+    if (warnings.length > 0) {
+      logger.info(bold(kleur_default.red("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      logger.info(bold(kleur_default.red("                    REACHABILITY ANALYSIS WARNINGS                  ")));
+      logger.info(bold(kleur_default.red("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      for (const { message: message2, workspaces } of warnings) {
+        logger.info("");
+        logger.info(kleur_default.red(`\u26A0 ${message2}:`));
+        for (const workspace of workspaces) {
+          logger.info(kleur_default.red(`    ${workspace}`));
+        }
+      }
+      logger.info("");
+      logger.info(bold(kleur_default.red("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      logger.info("");
+    }
+    if (infos.length > 0) {
+      logger.info(bold(kleur_default.cyan("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      logger.info(bold(kleur_default.cyan("                    REACHABILITY ANALYSIS INFO                      ")));
+      logger.info(bold(kleur_default.cyan("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      for (const { message: message2, workspaces } of infos) {
+        logger.info("");
+        logger.info(kleur_default.cyan(`\u2139 ${message2}:`));
+        for (const workspace of workspaces) {
+          logger.info(kleur_default.cyan(`    ${workspace}`));
+        }
+      }
+      logger.info("");
+      logger.info(bold(kleur_default.cyan("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550")));
+      logger.info("");
+    }
+  }
   async shareLogIfAnalysisError(vulns) {
     if (this.dashboardAPI.disableAnalyticsSharing) {
       return;
@@ -251180,7 +251253,7 @@ Subproject: ${subproject}`);
       const { ecosystem, subprojectPath, workspacePaths } = subProjAndWsPath;
       const { projectInfo, workspaceToVulnerabilities } = await this.getDependencyTreeAndVulnerabilities(otherModulesCommunicator, subProjAndWsPath);
       const workspacePathToDataForAnalysis = Object.fromEntries(Object.entries(projectInfo).map(([workspacePath, projectInfo2]) => [workspacePath, projectInfo2.dataForAnalysis]));
-      const workspaceToAugmentedVulnerabilities = await this.runReachabilityAnalysisForWorkspaces(workspacePathToDataForAnalysis, workspaceToVulnerabilities, Object.fromEntries(workspacePaths.map((wsPath) => [wsPath, projectInfo[wsPath].dataForAnalysis.directDependenciesMap ?? {}])), otherModulesCommunicator, subprojectPath, ecosystem, reachabilitySupported);
+      const { vulnerabilities: workspaceToAugmentedVulnerabilities } = await this.runReachabilityAnalysisForWorkspaces(workspacePathToDataForAnalysis, workspaceToVulnerabilities, Object.fromEntries(workspacePaths.map((wsPath) => [wsPath, projectInfo[wsPath].dataForAnalysis.directDependenciesMap ?? {}])), otherModulesCommunicator, subprojectPath, ecosystem, reachabilitySupported);
       return workspacePaths.filter((workspacePath) => {
         return workspaceToAugmentedVulnerabilities[workspacePath] !== void 0;
       }).map((workspacePath) => {
@@ -251204,12 +251277,12 @@ Subproject: ${subproject}`);
     let npmAnalysisMutex = Promise.resolve();
     const workspaceToAugmentedVulnerabilities = Object.fromEntries(await asyncMap(workspaces, async (workspacePath, index2) => {
       analysisStarting?.(workspacePath, index2 + 1, totalWorkspaces);
-      const vulnerabilities = workspaceToVulnerabilities[workspacePath] ?? [];
+      const vulnerabilities2 = workspaceToVulnerabilities[workspacePath] ?? [];
       const workspacePrefix = shouldIncludeWorkspaceInLogs ? `[${workspacePath}] ` : "";
-      logger.info(`${workspacePrefix}Process workspace ${workspacePath} with ${vulnerabilities.length} ${pluralize(vulnerabilities.length, "vulnerability")}`);
+      logger.info(`${workspacePrefix}Process workspace ${workspacePath} with ${vulnerabilities2.length} ${pluralize(vulnerabilities2.length, "vulnerability")}`);
       try {
         const dataForAnalysis = workspacePathToDataForAnalysis[workspacePath];
-        const [vulnsSatisfyingThreshold, vulnerabilitiesBelowThreshold] = this.options.minSeverity ? partition(vulnerabilities, (v) => !v.severity || shouldAnalyzeBasedOnSeverity(v.severity, this.options.minSeverity)) : [vulnerabilities, []];
+        const [vulnsSatisfyingThreshold, vulnerabilitiesBelowThreshold] = this.options.minSeverity ? partition(vulnerabilities2, (v) => !v.severity || shouldAnalyzeBasedOnSeverity(v.severity, this.options.minSeverity)) : [vulnerabilities2, []];
         const [vulnsUnreachableFromPrecomputation, vulnerabilitiesToAnalyze] = this.options.useUnreachableFromPrecomputation ? partition(vulnsSatisfyingThreshold, (v) => "precomputedReachabilityResult" in v && v.precomputedReachabilityResult?.type === "unreachable") : [[], vulnsSatisfyingThreshold];
         const vulnerabilitiesBelowThresholdWithResults = vulnerabilitiesBelowThreshold.map((v) => ({
           ...v,
@@ -251226,25 +251299,33 @@ Subproject: ${subproject}`);
           }
         }));
         if (vulnerabilitiesBelowThreshold.length > 0) {
-          logger.info(`${workspacePrefix}Reachability analysis skipped for ${vulnerabilitiesBelowThreshold.length} ${pluralize(vulnerabilities.length, "vulnerability")} with severity below the min severity threshold: ${this.options.minSeverity}`);
+          logger.info(`${workspacePrefix}Reachability analysis skipped for ${vulnerabilitiesBelowThreshold.length} ${pluralize(vulnerabilities2.length, "vulnerability")} with severity below the min severity threshold: ${this.options.minSeverity}`);
         }
         if (vulnsUnreachableFromPrecomputation.length > 0) {
-          logger.info(`${workspacePrefix}Reachability analysis skipped for ${vulnsUnreachableFromPrecomputation.length} ${pluralize(vulnerabilities.length, "vulnerability")} that ${vulnerabilities.length !== 1 ? "are" : "is"} already known to be unreachable from precomputed (Tier 2) reachability analysis`);
+          logger.info(`${workspacePrefix}Reachability analysis skipped for ${vulnsUnreachableFromPrecomputation.length} ${pluralize(vulnerabilities2.length, "vulnerability")} that ${vulnerabilities2.length !== 1 ? "are" : "is"} already known to be unreachable from precomputed (Tier 2) reachability analysis`);
         }
         if (vulnerabilitiesToAnalyze.length > 0) {
-          logger.info(`${workspacePrefix}Running reachability analysis for ${vulnerabilitiesToAnalyze.length} ${pluralize(vulnerabilities.length, "vulnerability")}`);
+          logger.info(`${workspacePrefix}Running reachability analysis for ${vulnerabilitiesToAnalyze.length} ${pluralize(vulnerabilities2.length, "vulnerability")}`);
         }
         let augmentedVulnerabilitiesToAnalyze;
+        let workspaceDiagnostics = {
+          sourceFilesDetected: "UNKNOWN",
+          preinstalledDependencies: "UNKNOWN",
+          warnings: []
+        };
         if (vulnerabilitiesToAnalyze.length === 0) {
           augmentedVulnerabilitiesToAnalyze = [];
         } else if (reachabilitySupported && !this.shouldExcludeAnalyzingWorkspace(subprojectPath, workspacePath, workspacePrefix)) {
+          let analysisResult;
           if (ecosystem === "NPM" && concurrency > 1) {
-            augmentedVulnerabilitiesToAnalyze = await this.runReachabilityAnalysisWithoutConcurrency(async () => npmAnalysisMutex, (mutex) => {
+            analysisResult = await this.runReachabilityAnalysisWithoutConcurrency(async () => npmAnalysisMutex, (mutex) => {
               npmAnalysisMutex = mutex;
             }, otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze, workspacePrefix);
           } else {
-            augmentedVulnerabilitiesToAnalyze = await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze, workspacePrefix);
+            analysisResult = await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze, workspacePrefix);
           }
+          augmentedVulnerabilitiesToAnalyze = analysisResult.vulnerabilities;
+          workspaceDiagnostics = analysisResult.diagnostics;
         } else {
           augmentedVulnerabilitiesToAnalyze = vulnerabilitiesToAnalyze.map((v) => ({
             ...v,
@@ -251259,26 +251340,32 @@ Subproject: ${subproject}`);
           ...augmentedVulnerabilitiesToAnalyze,
           ...vulnerabilitiesBelowThresholdWithResults
         ];
-        return [workspacePath, augmentedVulnerabilities];
+        return [workspacePath, { vulnerabilities: augmentedVulnerabilities, diagnostics: workspaceDiagnostics }];
       } catch (e) {
         logger.error(`${workspacePrefix}Reachability analysis failed for workspace ${workspacePath} in subproject ${subprojectPath}: ${e.message}`);
         return [
           workspacePath,
-          vulnerabilities.map((v) => ({
-            ...v,
-            results: {
-              type: "otherError",
-              message: e.message || "Unknown error"
-            }
-          }))
+          {
+            vulnerabilities: vulnerabilities2.map((v) => ({
+              ...v,
+              results: {
+                type: "otherError",
+                message: e.message || "Unknown error"
+              }
+            })),
+            diagnostics: { sourceFilesDetected: "UNKNOWN", preinstalledDependencies: "UNKNOWN", warnings: [] }
+          }
         ];
       }
     }, concurrency));
-    const successfulWorkspaceToAugmentedVulnerabilities = Object.fromEntries(Object.entries(workspaceToAugmentedVulnerabilities).filter(([_, vulns]) => vulns !== void 0));
+    const successfulWorkspaceResults = Object.fromEntries(Object.entries(workspaceToAugmentedVulnerabilities).filter(([_, result]) => result !== void 0));
+    const successfulWorkspaceToAugmentedVulnerabilities = mapValues(successfulWorkspaceResults, (result) => result.vulnerabilities);
     if (ecosystem === "MAVEN" || ecosystem === "NUGET") {
       pruneVulnerablePathsToShortestPathsOnly(ecosystem, successfulWorkspaceToAugmentedVulnerabilities);
     }
-    return mapValues(successfulWorkspaceToAugmentedVulnerabilities, (augmentedVulnerabilities, workspacePath) => this.transformToReportVulnerabilities(augmentedVulnerabilities, workspaceToDirectDependencies[workspacePath] ?? {}, subprojectPath, workspacePath, this.rootWorkingDirectory));
+    const vulnerabilities = mapValues(successfulWorkspaceToAugmentedVulnerabilities, (augmentedVulnerabilities, workspacePath) => this.transformToReportVulnerabilities(augmentedVulnerabilities, workspaceToDirectDependencies[workspacePath] ?? {}, subprojectPath, workspacePath, this.rootWorkingDirectory));
+    const diagnostics = mapValues(successfulWorkspaceResults, (result) => result.diagnostics);
+    return { vulnerabilities, diagnostics };
     function pruneVulnerablePathsToShortestPathsOnly(ecosystem2, workspaceToAugmentedVulnerabilities2) {
       const vulnerabilityToWorkspaceToStacks = {};
       for (const [workspacePath, augmentedVulnerabilities] of Object.entries(workspaceToAugmentedVulnerabilities2))
@@ -251329,13 +251416,13 @@ Subproject: ${subproject}`);
       resolveCurrentAnalysis = resolve45;
     }));
     await previousAnalysis;
-    let augmentedVulnerabilitiesToAnalyze;
+    let analysisResult;
     try {
-      augmentedVulnerabilitiesToAnalyze = await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze, workspacePrefix);
+      analysisResult = await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze, workspacePrefix);
     } finally {
       resolveCurrentAnalysis();
     }
-    return augmentedVulnerabilitiesToAnalyze;
+    return analysisResult;
   }
   shouldExcludeAnalyzingWorkspace(subprojectPath, workspacePath, workspacePrefix = "") {
     const shouldExcludeWorkspaceForAnalysis = shouldIgnoreDueToExcludeDirsOrChangedFiles({
@@ -251354,10 +251441,14 @@ Subproject: ${subproject}`);
     for (const v of result)
       v.results = typeof v.vulnerabilityAccessPaths === "string" ? { type: "noAnalysisCheck", message: v.vulnerabilityAccessPaths } : { type: "missingVulnerabilityPattern" };
     logger.info(`${workspacePrefix}Reachability analysis not possible for ${result.length} of the ${pluralize(vulnerabilities.length, "vulnerability")}`);
-    if (!vulnsWithActualAPIPatterns.length)
-      return result;
+    if (!vulnsWithActualAPIPatterns.length) {
+      return {
+        vulnerabilities: result,
+        diagnostics: { sourceFilesDetected: "UNKNOWN", preinstalledDependencies: "UNKNOWN", warnings: [] }
+      };
+    }
     this.sendProgress("REACHABILITY_ANALYSIS", true, subprojectPath, workspacePath);
-    result.push(...await otherModulesCommunicator.runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, ecosystem, vulnerabilities, {
+    const analysisResult = await otherModulesCommunicator.runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, ecosystem, vulnerabilities, {
       timeoutSeconds: {
         allVulnRuns: this.analysisTimeoutInSeconds,
         bucketedRuns: bucketedAnalysisTimeoutInSeconds
@@ -251371,9 +251462,10 @@ Subproject: ${subproject}`);
       disableBucketing: !!this.options.disableAnalysisSplitting,
       lightweightReachability: this.options.lightweightReachability,
       skipCacheUsage: this.options.skipCacheUsage
-    }));
+    });
+    result.push(...analysisResult.vulnerabilities);
     this.sendProgress("REACHABILITY_ANALYSIS", false, subprojectPath, workspacePath);
-    return result;
+    return { vulnerabilities: result, diagnostics: analysisResult.diagnostics };
   }
   async sendProgress(type, isStartEvent, subprojectPath, workspacePath) {
     await this.dashboardAPI.registerCLIProgress({
@@ -251590,7 +251682,7 @@ compareReportsCommand.name("compare-reports").argument("<baselineReportPath>", "
 var findVulnerabilities = new Command();
 findVulnerabilities.name("find-vulnerabilities").requiredOption("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket.").action(async (options) => {
   const { artifacts } = await fetchArtifactsFromManifestsTarHash(options.manifestsTarHash);
-  console.log(i(artifacts.flatMap((a4) => a4.vulnerabilities?.map((v) => v.ghsaId) ?? [])));
+  console.log(JSON.stringify(i(artifacts.flatMap((a4) => a4.vulnerabilities?.map((v) => v.ghsaId) ?? []))));
 });
 program2.name("coana-cli").addCommand(run2, { isDefault: true }).addCommand(findVulnerabilities).addCommand(applyFixes).addCommand(compareReportsCommand).addCommand(computeFixesAndUpgradePurlsCmd, { hidden: true }).configureHelp({ sortSubcommands: true }).version(version3);
 program2.parseAsync();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.109",
+  "version": "14.12.111",
   "description": "Coana CLI",
   "type": "module",
   "bin": {