@coana-tech/cli 14.12.153 → 14.12.155

package/cli.mjs

@@ -234634,6 +234634,7 @@ function isShortestPath(root3, vulnPath) {
 
 // ../web-compat-utils/src/analysis-error-keys.ts
 var CLI_ANALYSIS_ERROR_MESSAGE = "Sharing log due to analysis error";
+var ANALYSIS_LOW_CONFIDENCE_MESSAGE = "Analysis had low confidence in result";
 
 // ../web-compat-utils/src/pluralize.ts
 function pluralize(count, word) {
@@ -235720,6 +235721,10 @@ var ERROR_CATEGORY_MESSAGES = {
       "Check https://docs.socket.dev/docs/reachability-analysis#reachability-ecosystem-support for more details"
     ]
   },
+  lowConfidence: {
+    title,
+    details: [TIER2_FALLBACK_MESSAGE, "The analysis produced only a partial result, which is of insufficient quality to accurately determine the reachability of this advisory."]
+  },
   general: {
     title,
     details: [TIER2_FALLBACK_MESSAGE, "Check the logs for more details on the specific error"]
@@ -235781,7 +235786,9 @@ function displayWorkspaceDiagnosticsSummaryInternal(diagnosticsEntries, vulns) {
         failedToInstallPackages.add(packageInstallMatch[1]);
       }
       let category = "general";
-      if (errorMessageLower.includes("install") || errorMessageLower.includes("npm") || errorMessageLower.includes("pip") || errorMessageLower.includes("dependency")) {
+      if (errorMessageLower.includes(ANALYSIS_LOW_CONFIDENCE_MESSAGE.toLowerCase())) {
+        category = "lowConfidence";
+      } else if (errorMessageLower.includes("install") || errorMessageLower.includes("npm") || errorMessageLower.includes("pip") || errorMessageLower.includes("dependency")) {
         category = "install";
       } else if (errorMessageLower.includes("timeout") || errorMessageLower.includes("timed out")) {
         category = "timeout";
@@ -250895,7 +250902,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.153";
+var version3 = "14.12.155";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;
@@ -251167,6 +251174,15 @@ var CliCore = class {
       }
       this.sendProgress("RUN_ON_SUBPROJECT", false, this.rootWorkingDirectory);
     }
+    for (const vuln of vulnsWithResults) {
+      if (vuln.codeAwareScanResult.type === "success" && vuln.codeAwareScanResult.lowConfidence === true && vuln.codeAwareScanResult.detectedOccurrences?.stacks?.length === 0) {
+        vuln.codeAwareScanResult = {
+          type: "analysisError",
+          message: ANALYSIS_LOW_CONFIDENCE_MESSAGE
+        };
+        vuln.reachability = "UNKNOWN";
+      }
+    }
     displayResultsSummary(vulnsWithResults, allWorkspaceTimings);
     displayWorkspaceDiagnosticsSummary(allWorkspaceDiagnostics, vulnsWithResults);
     await this.shareLogIfAnalysisError(vulnsWithResults);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.153",
+  "version": "14.12.155",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -110825,7 +110825,7 @@ async function runJellyAnalysis(mainProjectRoot, projectRoot, jellyOptions, reac
       }
     );
     if (reachabilityAnalysisOptions.printLogFile)
-      logger.info("JS analysis log file:", await readFile8(logFile, "utf-8"));
+      logger.info("JS analysis log file:", logFile);
     const analysisDiagnostics = JSON.parse(await readFile8(diagnosticsFile, "utf-8"));
     const callStacks = JSON.parse(await readFile8(callStackFile, "utf-8"));
     const matches = {};
@@ -110952,12 +110952,14 @@ var JSCodeAwareVulnerabilityScanner = class _JSCodeAwareVulnerabilityScanner {
       analysisOptionsFromHeuristic.approx = process.env.JELLY_APPROX === "true" || experiment === "JELLY_APPROX";
       const analysisRes = await runJellyAnalysis(this.mainProjectDir, this.projectDir, analysisOptionsFromHeuristic, this.options, timeoutInSeconds, vulnerabilities, experiment, telemetryHandler, analyzerTelemetryHandler);
       const { analysisDiagnostics: diagnostics, matches } = analysisRes;
+      const lowConfidence = diagnostics.round < 2 && (diagnostics.timeout || diagnostics.aborted);
       return {
         type: "success",
         diagnostics,
         terminatedEarly: diagnostics.aborted || diagnostics.timeout || diagnostics.lowmemory,
         reachedDependencies: diagnostics.packages > 0,
         affectedPurls: analysisRes.affectedPurls,
+        lowConfidence,
         computeDetectedOccurrences: ({ url: url2 }) => this.transformSourceLocations(matches[url2] ?? { analysisLevel: "function-level", affectedPackages: [], stacks: [] })
       };
     } catch (e) {
@@ -113078,7 +113080,8 @@ function augmentVulnsWithDetectedOccurrences(vulns, codeAwareScanner, heuristic,
       terminatedEarly: result.terminatedEarly,
       heuristicName: heuristic.name,
       affectedPurls: result.affectedPurls,
-      detectedOccurrences
+      detectedOccurrences,
+      lowConfidence: result.lowConfidence
     };
   }
   logger.debug("Done augmenting with detected occurrences");

package/repos/coana-tech/jelly-private/dist/bundle/jelly.js

@@ -1485,6 +1485,44 @@ var require_constraintvarproducer = __commonJS({
   }
 });
 
+// lib/misc/large-array.js
+var require_large_array = __commonJS({
+  "lib/misc/large-array.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.LargeArray = void 0;
+    var MAX_CHUNK_SIZE = 1 << 25;
+    var LargeArray = class {
+      static {
+        __name(this, "LargeArray");
+      }
+      chunks = [[]];
+      _size = 0;
+      get length() {
+        return this._size;
+      }
+      set length(_value) {
+        this.chunks.length = 0;
+        this.chunks.push([]);
+        this._size = 0;
+      }
+      push(value) {
+        const chunk = this.chunks[this.chunks.length - 1];
+        if (chunk.length >= MAX_CHUNK_SIZE)
+          this.chunks.push([value]);
+        else
+          chunk.push(value);
+        this._size++;
+      }
+      *[Symbol.iterator]() {
+        for (const chunk of this.chunks)
+          yield* chunk;
+      }
+    };
+    exports.LargeArray = LargeArray;
+  }
+});
+
 // lib/analysis/fragmentstate.js
 var require_fragmentstate = __commonJS({
   "lib/analysis/fragmentstate.js"(exports) {
@@ -1505,6 +1543,7 @@ var require_fragmentstate = __commonJS({
     var constraintvarproducer_1 = require_constraintvarproducer();
     var asthelpers_1 = require_asthelpers();
     var files_1 = require_files();
+    var large_array_1 = require_large_array();
     var FragmentState = class _FragmentState {
       static {
         __name(this, "FragmentState");
@@ -1526,8 +1565,8 @@ var require_fragmentstate = __commonJS({
       externalCallbacksProcessed = /* @__PURE__ */ new Set();
       arrayEntriesListeners = /* @__PURE__ */ new Map();
       objectPropertiesListeners = /* @__PURE__ */ new Map();
-      postponedListenerCalls = [];
-      postponedListenerCalls2 = [];
+      postponedListenerCalls = new large_array_1.LargeArray();
+      postponedListenerCalls2 = new large_array_1.LargeArray();
       nodesWithNewEdges = /* @__PURE__ */ new Set();
       prevNumEdges = 0;
       requireGraph = /* @__PURE__ */ new Map();
@@ -2144,6 +2183,7 @@ var require_diagnostics = __commonJS({
       wave = 0;
       round = 0;
       analyzerRounds = 0;
+      propagationRounds = 0;
       listenerNotificationRounds = 0;
       lastPrintDiagnosticsTime = 0;
       lastTelemetryTime = 0;
@@ -2636,7 +2676,9 @@ var require_solver = __commonJS({
           vars: f.getNumberOfVarsWithTokens(),
           tokens: f.numberOfTokens,
           subsetEdges: f.numberOfSubsetEdges,
-          round: d.round,
+          analyzerRounds: d.analyzerRounds,
+          propagationRounds: d.propagationRounds,
+          indirectionRound: d.round,
           wave: d.wave,
           propagations: d.propagations,
           unprocessedVars: this.unprocessedTokens.size,
@@ -3076,7 +3118,8 @@ var require_solver = __commonJS({
         this.phase = phase;
         if (logger_1.default.isDebugEnabled())
           logger_1.default.debug("Processing constraints until fixpoint...");
-        const f = this.fragmentState;
+        const { fragmentState: f, diagnostics: d } = this;
+        d.propagationRounds++;
         f.a.timeoutTimer.checkTimeout();
         (0, memory_1.checkMemoryLow)();
         await this.checkAbort();
@@ -3084,14 +3127,14 @@ var require_solver = __commonJS({
           logger_1.default.verbose(`Propagating (tokens: ${this.unprocessedTokens.size}, non-bounded: ${f.postponedListenerCalls.length}, bounded: ${f.postponedListenerCalls2.length})`);
         let wave = 1, round = 1;
         while (this.unprocessedTokens.size > 0 || f.postponedListenerCalls.length > 0 || f.postponedListenerCalls2.length > 0) {
-          this.diagnostics.wave = wave;
-          this.diagnostics.round = round;
+          d.wave = wave;
+          d.round = round;
           if (logger_1.default.isVerboseEnabled())
             logger_1.default.verbose(`Fixpoint wave: ${wave} (call edges: ${f.numberOfCallToFunctionEdges}, vars: ${f.getNumberOfVarsWithTokens()}, tokens: ${f.numberOfTokens}, subsets: ${f.numberOfSubsetEdges})`);
           if (options_1.options.maxWaves !== void 0 && wave > options_1.options.maxWaves) {
             f.warn("Fixpoint wave limit reached, aborting propagation");
-            this.diagnostics.waveLimitReached++;
-            this.diagnostics.unprocessedTokensSize = 0;
+            d.waveLimitReached++;
+            d.unprocessedTokensSize = 0;
             this.unprocessedTokens.clear();
             f.nodesWithNewEdges.clear();
             f.postponedListenerCalls.length = 0;
@@ -3111,43 +3154,43 @@ var require_solver = __commonJS({
                 for (const [v, rep] of repmap)
                   this.redirect(v, rep);
                 f.prevNumEdges = f.numberOfSubsetEdges;
-                this.diagnostics.totalCycleEliminationTime += timer1.elapsed();
-                this.diagnostics.totalCycleEliminationRuns++;
+                d.totalCycleEliminationTime += timer1.elapsed();
+                d.totalCycleEliminationRuns++;
                 if (logger_1.default.isVerboseEnabled())
                   logger_1.default.verbose(`Cycle detection roots: ${nodes.size} roots, edges: ${edgesBefore} -> ${f.numberOfSubsetEdges} (${(0, timer_1.nanoToMs)(timer1.elapsed())})`);
                 const timer2 = new timer_1.default();
                 if (logger_1.default.isVerboseEnabled())
-                  logger_1.default.verbose(`Processing ${this.diagnostics.unprocessedTokensSize} new token${this.diagnostics.unprocessedTokensSize !== 1 ? "s" : ""}`);
+                  logger_1.default.verbose(`Processing ${d.unprocessedTokensSize} new token${d.unprocessedTokensSize !== 1 ? "s" : ""}`);
                 for (let i = reps.length - 1; i >= 0; i--) {
                   const v = reps[i];
                   this.processTokens(v);
                   await this.checkAbort(true);
                 }
-                this.diagnostics.totalPropagationTime += timer2.elapsed();
+                d.totalPropagationTime += timer2.elapsed();
                 f.nodesWithNewEdges.clear();
               }
               const timer3 = new timer_1.default();
               for (const v of this.unprocessedTokens.keys())
                 this.processTokens(v);
-              this.diagnostics.totalPropagationTime += timer3.elapsed();
+              d.totalPropagationTime += timer3.elapsed();
             } else {
               if (logger_1.default.isVerboseEnabled())
-                logger_1.default.verbose(`Processing ${this.diagnostics.unprocessedTokensSize} new token${this.diagnostics.unprocessedTokensSize !== 1 ? "s" : ""}`);
+                logger_1.default.verbose(`Processing ${d.unprocessedTokensSize} new token${d.unprocessedTokensSize !== 1 ? "s" : ""}`);
               const timer = new timer_1.default();
               for (const v of this.unprocessedTokens.keys()) {
                 this.processTokens(v);
                 await this.checkAbort(true);
               }
-              this.diagnostics.totalPropagationTime += timer.elapsed();
+              d.totalPropagationTime += timer.elapsed();
             }
           }
-          if (this.unprocessedTokens.size !== 0 || this.diagnostics.unprocessedTokensSize !== this.unprocessedTokens.size)
-            assert_1.default.fail(`worklist non-empty: unprocessedTokens.size: ${this.unprocessedTokens.size}, unprocessedTokensSize: ${this.diagnostics.unprocessedTokensSize}`);
+          if (this.unprocessedTokens.size !== 0 || d.unprocessedTokensSize !== this.unprocessedTokens.size)
+            assert_1.default.fail(`worklist non-empty: unprocessedTokens.size: ${this.unprocessedTokens.size}, unprocessedTokensSize: ${d.unprocessedTokensSize}`);
           if (f.postponedListenerCalls.length > 0) {
             if (logger_1.default.isVerboseEnabled())
               logger_1.default.verbose(`Processing non-bounded listener calls: ${f.postponedListenerCalls.length}`);
             const timer = new timer_1.default();
-            this.diagnostics.listenerNotificationRounds++;
+            d.listenerNotificationRounds++;
             for (const [fun, arg] of f.postponedListenerCalls) {
               fun(arg);
               if (++this.postponedListenersProcessed % 100 === 0) {
@@ -3157,11 +3200,11 @@ var require_solver = __commonJS({
               }
             }
             f.postponedListenerCalls.length = this.postponedListenersProcessed = 0;
-            this.diagnostics.totalListenerCallTime += timer.elapsed();
+            d.totalListenerCallTime += timer.elapsed();
           } else if (f.postponedListenerCalls2.length > 0) {
             if (options_1.options.maxIndirections !== void 0 && round > options_1.options.maxIndirections) {
-              this.diagnostics.indirectionsLimitReached++;
-              this.diagnostics.unprocessedTokensSize = 0;
+              d.indirectionsLimitReached++;
+              d.unprocessedTokensSize = 0;
               this.unprocessedTokens.clear();
               f.nodesWithNewEdges.clear();
               f.postponedListenerCalls.length = 0;
@@ -3170,7 +3213,7 @@ var require_solver = __commonJS({
               if (logger_1.default.isVerboseEnabled())
                 logger_1.default.verbose(`Processing bounded listener calls: ${f.postponedListenerCalls2.length}`);
               const timer = new timer_1.default();
-              this.diagnostics.listenerNotificationRounds++;
+              d.listenerNotificationRounds++;
               const calls = Array.from(f.postponedListenerCalls2);
               f.postponedListenerCalls2.length = this.postponedListenersProcessed = 0;
               for (const [fun, args] of calls) {
@@ -3181,7 +3224,7 @@ var require_solver = __commonJS({
                   this.printDiagnostics();
                 }
               }
-              this.diagnostics.totalListenerCallTime += timer.elapsed();
+              d.totalListenerCallTime += timer.elapsed();
               if (logger_1.default.isVerboseEnabled() || options_1.options.diagnostics && options_1.options.printProgress)
                 logger_1.default.info(`${logger_1.isTTY ? logger_1.GREY : ""}Round ${round} completed after ${(0, timer_1.nanoToMs)(this.timer.elapsed())} (call edges: ${f.numberOfCallToFunctionEdges}, vars: ${f.getNumberOfVarsWithTokens()}, tokens: ${f.numberOfTokens}, subsets: ${f.numberOfSubsetEdges})${logger_1.isTTY ? logger_1.RESET : ""}`);
               round++;
@@ -3193,8 +3236,8 @@ var require_solver = __commonJS({
         }
         if (logger_1.default.isVerboseEnabled() || options_1.options.diagnostics && options_1.options.printProgress)
           logger_1.default.info(`${logger_1.isTTY ? logger_1.GREY : ""}${phase} completed after ${(0, timer_1.nanoToMs)(this.timer.elapsed())} (call edges: ${f.numberOfCallToFunctionEdges}, vars: ${f.getNumberOfVarsWithTokens()}, tokens: ${f.numberOfTokens}, subsets: ${f.numberOfSubsetEdges})${logger_1.isTTY ? logger_1.RESET : ""}`);
-        if (this.diagnostics.unprocessedTokensSize !== 0)
-          assert_1.default.fail(`unprocessedTokensSize non-zero after propagate: ${this.diagnostics.unprocessedTokensSize}`);
+        if (d.unprocessedTokensSize !== 0)
+          assert_1.default.fail(`unprocessedTokensSize non-zero after propagate: ${d.unprocessedTokensSize}`);
       }
       async checkAbort(throttle = false) {
         if (this.abort) {
@@ -5318,8 +5361,7 @@ var require_analyzer = __commonJS({
     var memory_1 = require_memory();
     var telemetry_emitter_1 = require_telemetry_emitter();
     async function analyzeFiles(files, solver) {
-      const a = solver.globalState;
-      const d = solver.diagnostics;
+      const { globalState: a, diagnostics: d } = solver;
       const timer = new timer_1.default();
       (0, options_1.resolveBaseDir)();
       telemetry_emitter_1.telemetryEmitter.phaseStarted("analysis", { fileCount: files.length });
@@ -5567,7 +5609,7 @@ var require_analyzer = __commonJS({
         if (a.approx) {
           a.approx.stop();
           if (options_1.options.approx && (options_1.options.diagnostics || options_1.options.diagnosticsJson))
-            solver.diagnostics.approx = a.approx.getDiagnostics();
+            d.approx = a.approx.getDiagnostics();
         }
       }
       if (d.aborted)