@coana-tech/cli 14.12.94 → 14.12.96

package/cli.mjs

@@ -87128,9 +87128,9 @@ var require_lockfile = __commonJS({
       /* 85 */
       /***/
       function(module3, exports3) {
-        module3.exports = function(exec3) {
+        module3.exports = function(exec5) {
           try {
-            return !!exec3();
+            return !!exec5();
           } catch (e) {
             return true;
           }
@@ -87262,9 +87262,9 @@ var require_lockfile = __commonJS({
       /* 104 */
       /***/
       function(module3, exports3) {
-        module3.exports = function(exec3) {
+        module3.exports = function(exec5) {
           try {
-            return { e: false, v: exec3() };
+            return { e: false, v: exec5() };
           } catch (e) {
             return { e: true, v: e };
           }
@@ -88737,7 +88737,7 @@ ${indent3}`);
           });
         } catch (e) {
         }
-        module3.exports = function(exec3, skipClosing) {
+        module3.exports = function(exec5, skipClosing) {
           if (!skipClosing && !SAFE_CLOSING) return false;
           var safe = false;
           try {
@@ -88749,7 +88749,7 @@ ${indent3}`);
             arr[ITERATOR] = function() {
               return iter;
             };
-            exec3(arr);
+            exec5(arr);
           } catch (e) {
           }
           return safe;
@@ -89072,8 +89072,8 @@ ${indent3}`);
         var USE_NATIVE = !!function() {
           try {
             var promise = $Promise.resolve(1);
-            var FakePromise = (promise.constructor = {})[__webpack_require__(13)("species")] = function(exec3) {
-              exec3(empty2, empty2);
+            var FakePromise = (promise.constructor = {})[__webpack_require__(13)("species")] = function(exec5) {
+              exec5(empty2, empty2);
             };
             return (isNode2 || typeof PromiseRejectionEvent == "function") && promise.then(empty2) instanceof FakePromise && v8.indexOf("6.6") !== 0 && userAgent.indexOf("Chrome/66") === -1;
           } catch (e) {
@@ -206541,6 +206541,58 @@ async function parseShellArgs(args2) {
   );
 }
 
+// ../utils/src/command-utils-with-debug-logging.ts
+function formatCmd(cmd, dir) {
+  const cmdStr = typeof cmd === "string" ? cmd : cmd.join(" ");
+  return dir ? `${cmdStr} in ${dir}` : cmdStr;
+}
+async function execAndLogOnFailure2(cmd, dir, options, logLevel = "info") {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  const result = await execAndLogOnFailure(cmd, dir, options, logLevel);
+  if (result) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return true;
+  }
+  return result;
+}
+async function execPipeAndLogOnFailure2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  const result = await execPipeAndLogOnFailure(cmd, dir, options);
+  if (result) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return true;
+  }
+  return result;
+}
+async function execNeverFail2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  const result = await execNeverFail(cmd, dir, options);
+  logger.debug(`Command ${formatCmd(cmd, dir)} finished ${result.error ? "with error" : "successfully"}`);
+  return result;
+}
+async function exec2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  try {
+    const result = await exec(cmd, dir, options);
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return result;
+  } catch (error) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished with error`);
+    throw error;
+  }
+}
+async function runCommandResolveStdOut2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  try {
+    const result = await runCommandResolveStdOut(cmd, dir, options);
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return result;
+  } catch (error) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished with error`);
+    throw error;
+  }
+}
+
 // ../web-compat-utils/src/async.ts
 async function asyncMap(array, mapper, concurrency = 1) {
   const arrCp = [...array];
@@ -206606,7 +206658,7 @@ var GoFixingManager = class {
   async applySecurityFixesForWorkspace(workspacePath, fixes, dependencyNameToVersion) {
     const subprojectPath = resolve2(this.rootDir, this.subprojectPath, workspacePath);
     const runGoGetCmd = async (projectPath, oldModule, newModule) => {
-      const success = await execAndLogOnFailure(["go", "get", newModule], projectPath);
+      const success = await execAndLogOnFailure2(["go", "get", newModule], projectPath);
       if (!success)
         throw new Error(
           `Could not apply module fix '${oldModule}' => '${newModule}' for Go project at: ${projectPath}`
@@ -206616,7 +206668,7 @@ var GoFixingManager = class {
       const isDowngrade = (0, import_semver.gt)(fix.currentVersion, fix.fixedVersion);
       if (isDowngrade) {
         const excludedRelease = `${fix.dependencyName}@v${fix.currentVersion}`;
-        await execAndLogOnFailure(["go", "mod", "edit", `-exclude=${excludedRelease}`], projectPath);
+        await execAndLogOnFailure2(["go", "mod", "edit", `-exclude=${excludedRelease}`], projectPath);
       }
     };
     for (const fix of fixes) {
@@ -206717,13 +206769,13 @@ var Diff = class {
       editLength++;
     };
     if (callback) {
-      (function exec3() {
+      (function exec5() {
         setTimeout(function() {
           if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {
             return callback(void 0);
           }
           if (!execEditLength()) {
-            exec3();
+            exec5();
           }
         }, 0);
       })();
@@ -209713,7 +209765,7 @@ replace ${modulePath} ${currentVersion} => ${modulePath} ${newVersion}
     await asyncForEach(Object.entries(checksumFileToArtifacts), async ([checksumFile, artifacts]) => {
       const goModDir = dirname2(resolve5(this.rootDir, checksumFile));
       const oldFileContent = await readFile5(resolve5(this.rootDir, checksumFile), "utf-8").catch(() => "");
-      const result = await execNeverFail(["go", "mod", "tidy"], goModDir);
+      const result = await execNeverFail2(["go", "mod", "tidy"], goModDir);
       if (result.error) {
         ctxt.statusUpdater?.({
           status: "error",
@@ -219541,8 +219593,8 @@ var Spinner2 = class _Spinner {
 };
 
 // ../utils/dist/command-utils.js
-async function execAndLogOnFailure2(cmd, dir, options, logLevel = "info") {
-  const result = await execNeverFail2(cmd, dir, options);
+async function execAndLogOnFailure3(cmd, dir, options, logLevel = "info") {
+  const result = await execNeverFail3(cmd, dir, options);
   if (result.error)
     logCommandOutput2(result, cmd, dir, logLevel);
   return !result.error;
@@ -219559,7 +219611,7 @@ ${stderr}`) ? em.slice(0, -stderr.length - 1) : em}`);
   logger[logLevel](`stdout: ${stdout}`);
   logger[logLevel](`stderr: ${stderr}`);
 }
-async function execNeverFail2(cmd, dir, options) {
+async function execNeverFail3(cmd, dir, options) {
   return new Promise((resolve44) => {
     let args2;
     if (typeof cmd !== "string")
@@ -219584,8 +219636,8 @@ async function execNeverFail2(cmd, dir, options) {
     childProcess.stdin?.end();
   });
 }
-async function runCommandResolveStdOut2(cmd, dir, options) {
-  const { stdout, error } = await execNeverFail2(cmd, dir, options);
+async function runCommandResolveStdOut3(cmd, dir, options) {
+  const { stdout, error } = await execNeverFail3(cmd, dir, options);
   if (error)
     throw error;
   return stdout.trim();
@@ -219640,6 +219692,32 @@ function argt2(statics, ...values) {
   return res;
 }
 
+// ../utils/dist/command-utils-with-debug-logging.js
+function formatCmd2(cmd, dir) {
+  const cmdStr = typeof cmd === "string" ? cmd : cmd.join(" ");
+  return dir ? `${cmdStr} in ${dir}` : cmdStr;
+}
+async function execAndLogOnFailure4(cmd, dir, options, logLevel = "info") {
+  logger.debug(`Running command: ${formatCmd2(cmd, dir)}`);
+  const result = await execAndLogOnFailure3(cmd, dir, options, logLevel);
+  if (result) {
+    logger.debug(`Command ${formatCmd2(cmd, dir)} finished successfully`);
+    return true;
+  }
+  return result;
+}
+async function runCommandResolveStdOut4(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd2(cmd, dir)}`);
+  try {
+    const result = await runCommandResolveStdOut3(cmd, dir, options);
+    logger.debug(`Command ${formatCmd2(cmd, dir)} finished successfully`);
+    return result;
+  } catch (error) {
+    logger.debug(`Command ${formatCmd2(cmd, dir)} finished with error`);
+    throw error;
+  }
+}
+
 // ../utils/dist/package-utils.js
 import { parse, join as join6, resolve as resolve16, normalize as normalize2, dirname as dirname7, basename as basename2, relative as relative4 } from "path";
 import { existsSync as existsSync8, readFileSync, readdirSync as readdirSync2, statSync, writeFileSync } from "fs";
@@ -219664,7 +219742,7 @@ var import_lockfile_file = __toESM(require_lib25(), 1);
 var { once } = import_lodash4.default;
 async function getPackageVersionDetailsFromNpm(packageName, version3) {
   const npmViewCmd = cmdt2`npm view ${packageName}@${version3} -json`;
-  const output = await runCommandResolveStdOut2(npmViewCmd);
+  const output = await runCommandResolveStdOut4(npmViewCmd);
   const pkgDetails = JSON.parse(output);
   const relevantDetails = {
     resolved: pkgDetails.dist.tarball,
@@ -219680,12 +219758,12 @@ async function getPackageVersionDetailsFromNpm(packageName, version3) {
   return relevantDetails;
 }
 var getNpmBin = once(async () => {
-  const prefix = await runCommandResolveStdOut2("npm config get prefix", "/");
+  const prefix = await runCommandResolveStdOut4("npm config get prefix", "/");
   let npmBin = `${prefix}/bin/npm`;
   try {
     await access(npmBin, constants.X_OK);
   } catch (e) {
-    npmBin = await runCommandResolveStdOut2("which npm", "/");
+    npmBin = await runCommandResolveStdOut4("which npm", "/");
     logger.warn(`Could not find npm at ${prefix}/bin/npm. Trying ${npmBin}`);
     await access(npmBin, constants.X_OK);
   }
@@ -219694,7 +219772,7 @@ var getNpmBin = once(async () => {
 async function actuallyRunInstall(specificPackagesArgs = [], dir) {
   const installationCommand = cmdt2`${await getNpmBin()} install -f --ignore-scripts --no-fund --no-audit --no-progress ${specificPackagesArgs}`;
   logger.debug(`Running installation command: "${installationCommand}" in ${dir}`);
-  const result = execAndLogOnFailure2(installationCommand, dir);
+  const result = execAndLogOnFailure4(installationCommand, dir);
   logger.info(`Installation completed.`);
   return result;
 }
@@ -219821,7 +219899,7 @@ var PnpmFixingManager = class extends NpmEcosystemFixingManager {
   pnpmMajorVersion;
   async getPnpmMajorVersion() {
     if (!this.pnpmMajorVersion) {
-      const pnpmVersion = await runCommandResolveStdOut(cmdt`pnpm -v`);
+      const pnpmVersion = await runCommandResolveStdOut2(cmdt`pnpm -v`);
       this.pnpmMajorVersion = parseInt(pnpmVersion.trim().split(".")[0]);
     }
     return this.pnpmMajorVersion;
@@ -219847,7 +219925,7 @@ var PnpmFixingManager = class extends NpmEcosystemFixingManager {
     const installationCommand = cmdt`pnpm install --ignore-scripts${await this.getPnpmMajorVersion() >= 9 && specificPackagesCmd.length === 0 ? "--no-frozen-lockfile" : ""} --config.confirmModulesPurge=false ${specificPackagesCmd}`;
     const installDir = resolve19(this.rootDir, this.subprojectPath, workspacePath);
     logger.info(`Running installation command: "${installationCommand}" in ${installDir}`);
-    await exec(installationCommand, installDir);
+    await exec2(installationCommand, installDir);
     logger.info(`Installation completed.`);
   }
   async getLockFileYaml() {
@@ -219947,7 +220025,7 @@ var PnpmFixingManager = class extends NpmEcosystemFixingManager {
   async finalizeFixes() {
     const cmd = cmdt`pnpm install --ignore-scripts --fix-lockfile --config.confirmModulesPurge=false `;
     logger.info(`Adjusting lock file changes by running '${cmd}'`);
-    await exec(cmd, resolve19(this.rootDir, this.subprojectPath));
+    await exec2(cmd, resolve19(this.rootDir, this.subprojectPath));
   }
 };
 function getVersionNumber(version3) {
@@ -220078,8 +220156,8 @@ var YarnFixingManager = class extends NpmEcosystemFixingManager {
       this.setPackageManagerField("yarn@1.2.3");
       const yarnType = await this.getYarnType();
       const corepackUseCommand = cmdt`corepack use yarn@${yarnType === "classic" ? 1 : 4}`;
-      await execNeverFail(corepackUseCommand, resolve22(this.rootDir, this.subprojectPath));
-      const cmdResult = await execNeverFail(cmd, dir, options);
+      await execNeverFail2(corepackUseCommand, resolve22(this.rootDir, this.subprojectPath));
+      const cmdResult = await execNeverFail2(cmd, dir, options);
       try {
         writePackageJsonContent(resolve22(this.rootDir, this.subprojectPath), originalPackageJson);
       } catch (err) {
@@ -220089,7 +220167,7 @@ var YarnFixingManager = class extends NpmEcosystemFixingManager {
       }
       return cmdResult;
     }
-    return execNeverFail(cmd, dir, options);
+    return execNeverFail2(cmd, dir, options);
   }
   setPackageManagerField(manager) {
     setFieldInPackageJson(resolve22(this.rootDir, this.subprojectPath), "packageManager", manager);
@@ -220611,14 +220689,14 @@ var NugetFixingManager = class {
     });
     if (solutionFiles) {
       for (const solutionFile of solutionFiles) {
-        const succeeded = await execAndLogOnFailure(
+        const succeeded = await execAndLogOnFailure2(
           cmdt`dotnet restore ${solutionFile} --use-lock-file`,
           join9(this.rootDir, this.subprojectPath)
         );
         if (!succeeded) throw new Error(`Error applying fix - could not restore project ${this.subprojectPath}`);
       }
     } else {
-      const succeeded = await execAndLogOnFailure(
+      const succeeded = await execAndLogOnFailure2(
         "dotnet restore --use-lock-file",
         join9(this.rootDir, this.subprojectPath)
       );
@@ -220703,7 +220781,7 @@ var NugetFixingManager = class {
   }
   async addPackage(packageName, version3, framework, wsPath) {
     const dir = join9(this.rootDir, this.subprojectPath, wsPath);
-    const succeeded = await execAndLogOnFailure(
+    const succeeded = await execAndLogOnFailure2(
       cmdt`dotnet add package ${packageName} --version ${version3} --no-restore --framework ${framework}`,
       dir
     );
@@ -220714,7 +220792,7 @@ var NugetFixingManager = class {
     }
   }
   async restoreWorkspaceAndParseLockFile(wsPath) {
-    const succeeded = await execAndLogOnFailure("dotnet restore --use-lock-file", this.getAbsWsPath(wsPath));
+    const succeeded = await execAndLogOnFailure2("dotnet restore --use-lock-file", this.getAbsWsPath(wsPath));
     if (!succeeded) throw new Error(`Error applying fix - could not restore project ${this.subprojectPath}/${wsPath}`);
     return JSON.parse(await readFile20(this.getLockFilePath(wsPath), "utf-8"));
   }
@@ -220775,7 +220853,7 @@ var CargoFixingManager = class {
     for (const fix of fixes) {
       const depTreeNode = dependencyTree.transitiveDependencies[fix.dependencyIdentifier];
       if (!depTreeNode || depTreeNode.version !== fix.currentVersion) throw Error("Error applying fix!");
-      const success = await execAndLogOnFailure(
+      const success = await execAndLogOnFailure2(
         cmdt`cargo update --package ${fix.dependencyName}@${fix.currentVersion} --precise ${fix.fixedVersion}`,
         subprojectPath
       );
@@ -223547,7 +223625,7 @@ ${newDependencyLine}`
       const oldFileContent = await readFile23(resolve27(this.rootDir, lockfile2), "utf-8");
       let result;
       if (this.cargoLockMatcher(lockfile2)) {
-        result = await execNeverFail(["cargo", "fetch"], lockfileDir);
+        result = await execNeverFail2(["cargo", "fetch"], lockfileDir);
       } else {
         ctxt.statusUpdater?.({
           status: "error",
@@ -224487,7 +224565,7 @@ ${" ".repeat(4)}"${artifact.name}==${upgradeVersion}",
       const oldFileContent = await readFile26(resolve31(this.rootDir, lockfile2), "utf-8");
       let result;
       if (this.uvLockMatcher(lockfile2)) {
-        result = await execNeverFail(["uv", "lock"], lockfileDir);
+        result = await execNeverFail2(["uv", "lock"], lockfileDir);
       } else {
         ctxt.statusUpdater?.({
           status: "error",
@@ -225225,7 +225303,7 @@ var RubygemsSocketUpgradeManager = class {
     }
     await asyncForEach(Object.entries(lockfileToArtifacts), async ([file, artifacts]) => {
       const oldFileContent = await readFile27(resolve33(this.rootDir, file), "utf-8");
-      const result = await execNeverFail("bundle lock", dirname18(resolve33(this.rootDir, file)));
+      const result = await execNeverFail2("bundle lock", dirname18(resolve33(this.rootDir, file)));
       const updatedFileContent = await readFile27(resolve33(this.rootDir, file), "utf-8");
       if (!result.error) {
         ctxt.statusUpdater?.({
@@ -225267,7 +225345,7 @@ var RubygemsSocketUpgradeManager = class {
     await applyPatches("RUBYGEMS", this.rootDir, directPatches, ctxt);
     await asyncForEach(Object.entries(lockfileToArtifacts), async ([file, artifacts]) => {
       const oldFileContent = await readFile27(resolve33(this.rootDir, file), "utf-8");
-      const result = await execNeverFail(cmdt`bundler lock`, dirname18(resolve33(this.rootDir, file)));
+      const result = await execNeverFail2(cmdt`bundler lock`, dirname18(resolve33(this.rootDir, file)));
       const updatedFileContent = await readFile27(resolve33(this.rootDir, file), "utf-8");
       if (!result.error) {
         ctxt.statusUpdater?.({
@@ -226260,7 +226338,7 @@ var DOCKER_ENV_WHITE_LIST = [
 // ../other-modules-communicator/src/other-modules-communicator.ts
 var { memoize, once: once7, take } = import_lodash12.default;
 var pullDockerImage = memoize(async (image) => {
-  const { error, stderr } = await execNeverFail(["docker", "pull", image]);
+  const { error, stderr } = await execNeverFail2(["docker", "pull", image]);
   if (error) {
     if (stderr?.includes("Cannot connect"))
       throw new Error(`Failed to pull docker image ${image}. Is docker installed and running on your system?`);
@@ -226331,7 +226409,7 @@ var OtherModulesCommunicator = class {
       async () => {
         let succeeded;
         if (this.options.runWithoutDocker) {
-          succeeded = await execPipeAndLogOnFailure(
+          succeeded = await execPipeAndLogOnFailure2(
             ["node", PACKAGE_MANAGER_SCRIPT_PATH(), commandName, ...finalArgs],
             subprojectPath,
             { env }
@@ -226397,7 +226475,7 @@ var OtherModulesCommunicator = class {
       async () => {
         let succeeded = true;
         if (this.options.runWithoutDocker) {
-          succeeded = await execPipeAndLogOnFailure(
+          succeeded = await execPipeAndLogOnFailure2(
             ["node", REACHABILITY_ANALYZERS_SCRIPT_PATH(), commandName, ...finalArgs],
             subprojectPath,
             { env }
@@ -226445,7 +226523,7 @@ var OtherModulesCommunicator = class {
       -v=${this.options.coanaLogPath}:${LOG_PATH_IN_DOCKER}
       ${await getEcosystemSpecificDockerArgs(ecosystem)}
       ${envArgs} ${image} ${entryPoint} ${commandName} ${args2}`;
-    return execPipeAndLogOnFailure(cmd, subprojectPath, { env });
+    return execPipeAndLogOnFailure2(cmd, subprojectPath, { env });
   }
   async getWorkspacePaths(packageManagerName, subprojectPath) {
     return this.runPackageManagerCommandWithOutput("getWorkspacePaths", packageManagerName, subprojectPath);
@@ -226533,7 +226611,7 @@ var OtherModulesCommunicator = class {
   }
 };
 var setUpGoModuleCache = once7(async () => {
-  const { stdout, error } = await execNeverFail("go env GOMODCACHE");
+  const { stdout, error } = await execNeverFail2("go env GOMODCACHE");
   if (error ?? !await exists(stdout.trim()))
     return;
   if (platform() !== "linux") return stdout.trim();
@@ -226551,7 +226629,7 @@ var setUpGoModuleCache = once7(async () => {
   });
   const [upper, work] = [join21(tmpDir, "upper"), join21(tmpDir, "work")];
   for (const dir of [upper, work]) await mkdir(dir);
-  const o7 = await execNeverFail(
+  const o7 = await execNeverFail2(
     cmdt`docker volume create --driver local --opt type=overlay
       --opt o=lowerdir=${stdout.trim()},upperdir=${upper},workdir=${work}
       --opt device=overlay`
@@ -227534,7 +227612,7 @@ var GitHubPRTools = class {
       commentBody += `Please review the ${vulnerabilityWord} below and take appropriate action before merging the PR.
 
 `;
-      const getSha = await execNeverFail(cmdt`git rev-parse HEAD`, void 0, { timeout: 1e4 });
+      const getSha = await execNeverFail2(cmdt`git rev-parse HEAD`, void 0, { timeout: 1e4 });
       let sha;
       if (!getSha.error) {
         sha = getSha.stdout.trim();
@@ -229667,7 +229745,7 @@ function getMongoClient() {
 }
 
 // ../security-auditor/security-auditor-api/src/vulnerability-patterns-helper/get-interesting-urls-for-vulnerability.ts
-import { exec as exec2 } from "child_process";
+import { exec as exec4 } from "child_process";
 import { promisify } from "util";
 
 // ../../node_modules/.pnpm/cheerio@1.0.0-rc.12/node_modules/cheerio/lib/esm/options.js
@@ -243263,7 +243341,7 @@ async function getInterestingURLsForVulnerability(vulnerability, packageMetadata
 }
 async function computeComparisonURLs(scmUrl, vulnAndFixVersionsArr) {
   try {
-    const gitTags = (await promisify(exec2)(`git ls-remote ${scmUrl} | grep -F "refs/tags"`)).stdout.split("\n");
+    const gitTags = (await promisify(exec4)(`git ls-remote ${scmUrl} | grep -F "refs/tags"`)).stdout.split("\n");
     logger3.debug("gitTags", gitTags);
     logger3.debug("vulnAndFixVersionsArr", vulnAndFixVersionsArr);
     const versionToSha = {};
@@ -243298,7 +243376,7 @@ async function computeInterestingCommitURLs(text3, scmUrl) {
     const repo = scmUrl.split("/").slice(-2).join("/");
     const cmd = `gh search commits ${text3} --repo ${repo}`;
     logger3.debug(`Finding issue or PR url for text ${text3}`, cmd);
-    const { stdout } = await promisify(exec2)(cmd, { shell: "/bin/zsh" });
+    const { stdout } = await promisify(exec4)(cmd, { shell: "/bin/zsh" });
     return stdout.split("\n").filter((line) => line).map((line) => {
       const [repo2, sha] = line.split("	");
       return `https://www.github.com/${repo2}/commit/${sha}`;
@@ -243312,7 +243390,7 @@ async function computeInterestingIssueAndPRUrlsWithText(text3, scmUrl) {
   const repo = scmUrl.split("/").slice(-2).join("/");
   const cmd = `gh search issues ${text3} in:title,body,comment --repo ${repo} --include-prs`;
   console.log(`Finding issue or PR url for text ${text3}`, cmd);
-  const { stdout } = await promisify(exec2)(cmd, { shell: "/bin/zsh" });
+  const { stdout } = await promisify(exec4)(cmd, { shell: "/bin/zsh" });
   return stdout.split("\n").filter((line) => line).map((line) => {
     const [issueOrPr, repo2, id] = line.split("	");
     const issueOrPrUrlPart = issueOrPr === "issue" ? "issues" : "pull";
@@ -244541,7 +244619,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.12.94";
+var version2 = "14.12.96";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;
@@ -244938,8 +245016,8 @@ Subproject: ${subproject}`);
         ["heap", "-d"],
         ["virtual_memory", "-v"]
       ].map(async ([name, flag]) => {
-        const soft = await runCommandResolveStdOut(`ulimit -S ${flag}`);
-        const hard = await runCommandResolveStdOut(`ulimit -H ${flag}`);
+        const soft = await runCommandResolveStdOut2(`ulimit -S ${flag}`);
+        const hard = await runCommandResolveStdOut2(`ulimit -H ${flag}`);
         return [name, { soft, hard }];
       }));
       logger.info("ulimits: %O", Object.fromEntries(limits));
@@ -245319,8 +245397,8 @@ async function getGitDataToMetadataIfAvailable(rootWorkingDirectory) {
   const base = cmdt`git -c safe.directory=${rootWorkingDirectory} rev-parse`;
   try {
     return {
-      sha: await runCommandResolveStdOut([...base, "HEAD"], rootWorkingDirectory),
-      branchName: await runCommandResolveStdOut([...base, "--abbrev-ref", "HEAD"], rootWorkingDirectory)
+      sha: await runCommandResolveStdOut2([...base, "HEAD"], rootWorkingDirectory),
+      branchName: await runCommandResolveStdOut2([...base, "--abbrev-ref", "HEAD"], rootWorkingDirectory)
     };
   } catch (e) {
     logger.debug("Unable to get git data. Is the folder even in a git repository?", e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.94",
+  "version": "14.12.96",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -80579,6 +80579,49 @@ async function parseShellArgs(args) {
   );
 }
 
+// ../utils/src/command-utils-with-debug-logging.ts
+function formatCmd(cmd, dir) {
+  const cmdStr = typeof cmd === "string" ? cmd : cmd.join(" ");
+  return dir ? `${cmdStr} in ${dir}` : cmdStr;
+}
+async function execAndLogOnFailure2(cmd, dir, options, logLevel = "info") {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  const result = await execAndLogOnFailure(cmd, dir, options, logLevel);
+  if (result) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return true;
+  }
+  return result;
+}
+async function execNeverFail2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  const result = await execNeverFail(cmd, dir, options);
+  logger.debug(`Command ${formatCmd(cmd, dir)} finished ${result.error ? "with error" : "successfully"}`);
+  return result;
+}
+async function exec2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  try {
+    const result = await exec(cmd, dir, options);
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return result;
+  } catch (error) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished with error`);
+    throw error;
+  }
+}
+async function runCommandResolveStdOut2(cmd, dir, options) {
+  logger.debug(`Running command: ${formatCmd(cmd, dir)}`);
+  try {
+    const result = await runCommandResolveStdOut(cmd, dir, options);
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished successfully`);
+    return result;
+  } catch (error) {
+    logger.debug(`Command ${formatCmd(cmd, dir)} finished with error`);
+    throw error;
+  }
+}
+
 // ../utils/src/file-utils.ts
 var import_lodash3 = __toESM(require_lodash(), 1);
 var import_micromatch = __toESM(require_micromatch(), 1);
@@ -80677,28 +80720,24 @@ async function exists(path10, mode) {
 // ../utils/src/go-utils.ts
 var modWhyRegex = /^\(main module does not need to vendor (?:module|package) (\S+)\)$/gm;
 async function runGoModWhy(moduleMode, projectFolder, toCheck) {
-  logger.debug(`Running 'go mod why' in ${projectFolder} with ${moduleMode ? "module" : "package"} mode`);
-  const modWhyOutput = await runCommandResolveStdOut(
+  const modWhyOutput = await runCommandResolveStdOut2(
     // -vendor flag tells why to disregard imports in dependencies' tests
     ["go", ...`mod why${moduleMode ? " -m" : ""} -vendor`.split(" "), ...toCheck],
     projectFolder,
     { timeout: 30 * 60 * 1e3 }
     // 30 minutes
   );
-  logger.debug(`'go mod why' finished`);
   return Array.from(modWhyOutput.matchAll(modWhyRegex), ([, m]) => m);
 }
 var getIrrelevantModules = runGoModWhy.bind(null, true);
 var getIrrelevantPackages = runGoModWhy.bind(null, false);
 async function getModuleInfo(goModPath) {
   if (!goModPath.endsWith(".mod")) goModPath = join3(goModPath, "go.mod");
-  const stdout = await runCommandResolveStdOut(["go", "mod", "edit", "-json", goModPath]);
+  const stdout = await runCommandResolveStdOut2(["go", "mod", "edit", "-json", goModPath]);
   return JSON.parse(stdout);
 }
 async function runGoModTidy(moduleDir, { continueOnError = false } = {}) {
-  logger.debug(`Running 'go mod tidy' in ${moduleDir}`);
-  const { error } = await execNeverFail(["go", "mod", "tidy"], moduleDir, { timeout: 30 * 60 * 1e3 });
-  logger.debug(`'go mod tidy' finished`);
+  const { error } = await execNeverFail2(["go", "mod", "tidy"], moduleDir, { timeout: 30 * 60 * 1e3 });
   if (error) {
     const { Module, Go } = await getModuleInfo(moduleDir);
     logger.warn(
@@ -89804,6 +89843,31 @@ function evaluate(expression, project) {
 
 // dist/whole-program-code-aware-vulnerability-scanner/dotnet/dotnet-code-aware-vulnerability-scanner.js
 var { uniq: uniq2, uniqWith, isEqual } = import_lodash6.default;
+async function ensureDotnet6OrAbove() {
+  const result = await execNeverFail2(cmdt`dotnet --list-runtimes`);
+  if (result.error)
+    throw new Error(".NET runtime not found. Please install .NET 6 runtime or above.");
+  const runtimesOutput = result.stdout ?? "";
+  const runtimeLines = runtimesOutput.split("\n").map((line) => line.trim()).filter(Boolean);
+  const netCoreRuntimes = runtimeLines.filter((line) => line.startsWith("Microsoft.NETCore.App")).map((line) => {
+    const versionMatch = line.match(/Microsoft\.NETCore\.App\s+(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+    if (versionMatch) {
+      return {
+        major: parseInt(versionMatch[1], 10),
+        minor: versionMatch[2] ? parseInt(versionMatch[2], 10) : 0,
+        patch: versionMatch[3] ? parseInt(versionMatch[3], 10) : 0
+      };
+    }
+    return void 0;
+  }).filter((v) => v !== void 0);
+  if (netCoreRuntimes.length === 0)
+    throw new Error(".NET runtime not found. Please install .NET 6 runtime or above.");
+  const hasValidRuntime = netCoreRuntimes.some((version3) => version3.major >= 6);
+  if (!hasValidRuntime) {
+    const foundVersions = netCoreRuntimes.map((v) => `${v.major}.${v.minor}.${v.patch}`).join(", ");
+    throw new Error(`.NET runtime versions found: ${foundVersions}. None are supported. Please install .NET 6 runtime or above.`);
+  }
+}
 var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilityScanner {
   apps;
   deps;
@@ -89909,6 +89973,11 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
   }
   async runPhantomDependencyAnalysis() {
     return withTmpDirectory("dotnet-direct-dependency-analysis", async (tmpDir) => {
+      try {
+        await ensureDotnet6OrAbove();
+      } catch {
+        return void 0;
+      }
       const options = {
         apps: this.apps,
         deps: this.deps,
@@ -89918,7 +89987,7 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
       const outputFile = resolve8(tmpDir, "output.json");
       await writeFile3(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runDotnetDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --cocoa ${cocoaPath} --tree-sitter-c-sharp ${treeSitterCSharpPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runDotnetDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --cocoa ${cocoaPath} --tree-sitter-c-sharp ${treeSitterCSharpPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return void 0;
       const packageIds = JSON.parse(await readFile6(outputFile, "utf-8")).result;
@@ -89942,6 +90011,11 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
   async actuallyRunAnalysis(vulnerabilityAccessPaths, filteredDeps) {
     this.statusUpdater?.("Running analysis...");
     return withTmpDirectory("dotnet-run-analysis", async (tmpDir) => {
+      try {
+        await ensureDotnet6OrAbove();
+      } catch (e) {
+        return { type: "error", message: e.message };
+      }
       const options = {
         apps: this.apps,
         deps: filteredDeps ?? this.deps,
@@ -89952,7 +90026,7 @@ var DotnetCodeAwareVulnerabilityScanner = class _DotnetCodeAwareVulnerabilitySca
       const outputFile = resolve8(tmpDir, "output.json");
       await writeFile3(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runDotnetReachabilityAnalysis -i ${inputFile} -o ${outputFile} --cocoa ${cocoaPath} --tree-sitter-c-sharp ${treeSitterCSharpPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runDotnetReachabilityAnalysis -i ${inputFile} -o ${outputFile} --cocoa ${cocoaPath} --tree-sitter-c-sharp ${treeSitterCSharpPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return { type: "error", message: result.error.message ?? "unknown error" };
       const { success, error, analysisDiagnostics: diagnostics, vulnerablePaths, reachablePackageIds } = JSON.parse(await readFile6(outputFile, "utf-8")).result;
@@ -103749,6 +103823,21 @@ var treeSitterScalaPath = join13(COANA_REPOS_PATH(), "tree-sitter-scala");
 // dist/whole-program-code-aware-vulnerability-scanner/java/java-code-aware-vulnerability-scanner.js
 var import_picomatch2 = __toESM(require_picomatch4(), 1);
 var { uniq: uniq3, uniqWith: uniqWith2, isEqual: isEqual2 } = import_lodash8.default;
+async function ensureJdk8OrAbove() {
+  const javapResult = await execNeverFail2(cmdt`javap -version`);
+  if (javapResult.error)
+    throw new Error("JDK not found. Please install JDK 8 or above.");
+  const javapOutput = javapResult.stdout.trim() || "";
+  const versionMatch = javapOutput.match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!versionMatch)
+    throw new Error("Could not determine Java version. Please ensure JDK 8 or above is installed.");
+  const major = parseInt(versionMatch[1], 10);
+  const minor = versionMatch[2] ? parseInt(versionMatch[2], 10) : 0;
+  const isValid = major === 1 && minor >= 8 || major >= 8;
+  if (!isValid) {
+    throw new Error(`JDK version ${javapOutput} is not supported. Please install JDK 8 or above.`);
+  }
+}
 var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner {
   apps;
   deps;
@@ -103855,6 +103944,11 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
   }
   async runPhantomDependencyAnalysis() {
     return withTmpDirectory("java-direct-dependency-analysis", async (tmpDir) => {
+      try {
+        await ensureJdk8OrAbove();
+      } catch {
+        return void 0;
+      }
       const options = {
         apps: this.apps,
         deps: this.deps,
@@ -103864,7 +103958,7 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
       const outputFile = resolve9(tmpDir, "output.json");
       await writeFile4(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runJvmDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --javap-service ${javapServicePath} --tree-sitter-java ${treeSitterJavaPath} --tree-sitter-kotlin ${treeSitterKotlinPath} --tree-sitter-scala ${treeSitterScalaPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runJvmDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --javap-service ${javapServicePath} --tree-sitter-java ${treeSitterJavaPath} --tree-sitter-kotlin ${treeSitterKotlinPath} --tree-sitter-scala ${treeSitterScalaPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return void 0;
       const packageIds = JSON.parse(await readFile7(outputFile, "utf-8")).result;
@@ -103888,6 +103982,11 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
   async actuallyRunAnalysis(vulnerabilityAccessPaths, filteredDeps) {
     this.statusUpdater?.("Running analysis...");
     return withTmpDirectory("java-run-analysis", async (tmpDir) => {
+      try {
+        await ensureJdk8OrAbove();
+      } catch (e) {
+        return { type: "error", message: e.message };
+      }
       const options = {
         apps: this.apps,
         deps: filteredDeps ?? this.deps,
@@ -103898,7 +103997,7 @@ var JavaCodeAwareVulnerabilityScanner = class _JavaCodeAwareVulnerabilityScanner
       const outputFile = resolve9(tmpDir, "output.json");
       await writeFile4(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runJvmReachabilityAnalysis -i ${inputFile} -o ${outputFile} --javap-service ${javapServicePath} --tree-sitter-java ${treeSitterJavaPath} --tree-sitter-kotlin ${treeSitterKotlinPath} --tree-sitter-scala ${treeSitterScalaPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runJvmReachabilityAnalysis -i ${inputFile} -o ${outputFile} --javap-service ${javapServicePath} --tree-sitter-java ${treeSitterJavaPath} --tree-sitter-kotlin ${treeSitterKotlinPath} --tree-sitter-scala ${treeSitterScalaPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return { type: "error", message: result.error.message ?? "unknown error" };
       const { success, error, analysisDiagnostics: diagnostics, vulnerablePaths, reachablePackageIds } = JSON.parse(await readFile7(outputFile, "utf-8")).result;
@@ -104018,7 +104117,7 @@ async function convertSocketArtifacts2(rootDir, artifacts, tmpDir) {
     if (mavenInstalled && pomFile) {
       try {
         const dependencyGetCmd = cmdt`mvn -f=${basename6(resolve9(rootDir, pomFile))} dependency:get -DgroupId=${groupId} -DartifactId=${artifactId} -Dpackaging=${type} -Dclassifier${classifier} -Dversion=${version3} -Dtransitive=false`;
-        await execNeverFail(dependencyGetCmd, dirname6(resolve9(rootDir, pomFile)));
+        await execNeverFail2(dependencyGetCmd, dirname6(resolve9(rootDir, pomFile)));
         const mavenArtifact = getPathToArtifact(mavenLocalRepo, groupId, artifactId, type, classifier, version3);
         if (existsSync8(mavenArtifact))
           return mavenArtifact;
@@ -109287,7 +109386,7 @@ async function downloadDependenciesToDir(dependenciesToInstall, tmpDir) {
       do {
         failed = false;
         try {
-          const stdout = await runCommandResolveStdOut(cmdt`npm pack --json ${chunk2.map((dep) => {
+          const stdout = await runCommandResolveStdOut2(cmdt`npm pack --json ${chunk2.map((dep) => {
             if (dep.resolutionString)
               return dep.resolutionString;
             return `${dep.name}@${dep.version}`;
@@ -109706,7 +109805,7 @@ async function runJellyAnalysis(mainProjectRoot, projectRoot, jellyOptions, reac
       `;
     if (PRINT_JELLY_COMMAND)
       logger.info("Jelly command:", jellyCmd.join(" "));
-    await runCommandResolveStdOut(
+    await runCommandResolveStdOut2(
       jellyCmd,
       void 0,
       // If it is an experimental run, make sure to crash the process if Jelly takes more than 50% longer than the timeout.
@@ -109750,7 +109849,7 @@ async function runJellyPhantomDependencyAnalysis(projectRoot, options) {
     const jellyCmd = cmdt`node --max-old-space-size=${options.memoryLimitInMB}
       ${jellyExecutable} --basedir ${projectRoot} --modules-only --ignore-dependencies
         --reachable-json ${reachablePackagesFile} ${projectRoot}`;
-    await runCommandResolveStdOut(jellyCmd);
+    await runCommandResolveStdOut2(jellyCmd);
     return JSON.parse(await readFile8(reachablePackagesFile, "utf-8")).packages;
   } finally {
     await rm2(tmpFolder, { recursive: true });
@@ -109764,7 +109863,7 @@ async function runJellyImportReachabilityAnalysis(baseDir, projectDir, options)
     const jellyCmd = cmdt`node --max-old-space-size=${options.memoryLimitInMB}
       ${jellyExecutable} --basedir ${baseDir} --modules-only
         --reachable-json ${reachableModulesFile} ${projectDir}`;
-    await runCommandResolveStdOut(jellyCmd);
+    await runCommandResolveStdOut2(jellyCmd);
     return JSON.parse(await readFile8(reachableModulesFile, "utf-8"));
   } finally {
     await rm2(tmpFolder, { recursive: true });
@@ -109903,7 +110002,7 @@ var JSCodeAwareVulnerabilityScanner = class _JSCodeAwareVulnerabilityScanner {
     const tmpDir = mkdtempSync(join16(tmpdir2(), "run-on-dependency-chain"));
     const packageJsonFileLoc = join16(tmpDir, "package.json");
     await writeFile6(packageJsonFileLoc, JSON.stringify(packageJSONContent));
-    await exec("npm install -f --ignore-scripts", tmpDir);
+    await exec2("npm install -f --ignore-scripts", tmpDir);
     const restWithoutLast = rest.slice(0, -1);
     const projectDir = join16(tmpDir, "node_modules", first2.packageName);
     const scanner = new _JSCodeAwareVulnerabilityScanner(tmpDir, projectDir, reachabilityAnalysisOptions);
@@ -110019,7 +110118,7 @@ var GoCodeAwareVulnerabilityScanner = class {
         throw new Error(`goana binary '${binaryName}' not found`);
       await pipeline(createReadStream(binaryPath), zlib2.createGunzip(), createWriteStream2(join17(tmpDir, "goana"), { mode: 493 }));
       const vulnAccPaths = uniq5(vulns.flatMap((v) => v.vulnerabilityAccessPaths));
-      const { error, stderr } = await execNeverFail(cmdt`${join17(tmpDir, "goana")}
+      const { error, stderr } = await execNeverFail2(cmdt`${join17(tmpDir, "goana")}
           -output-vulnerabilities ${vulnsOutputFile}
           -output-diagnostics ${diagnosticsOutputFile}
           -output-reached-modules ${reachedModulesOutputFile}
@@ -110064,7 +110163,7 @@ ${stderr}`);
           const i3 = path10.lastIndexOf("/");
           return i3 === -1 ? { type: "golang" /* GOLANG */, name: path10, version: version3 } : { type: "golang" /* GOLANG */, namespace: path10.slice(0, i3), name: path10.slice(i3 + 1), version: version3 };
         }),
-        computeDetectedOccurrences: detectedOccurrencesFromAPMatches(result.matches, await runCommandResolveStdOut("go env GOMODCACHE") + sep2)
+        computeDetectedOccurrences: detectedOccurrencesFromAPMatches(result.matches, await runCommandResolveStdOut2("go env GOMODCACHE") + sep2)
       };
     } finally {
       await rm4(tmpDir, { recursive: true, force: true });
@@ -110072,18 +110171,18 @@ ${stderr}`);
   }
   static async runOnDependencyChain([first2, ...rest], vuln, options = {}) {
     assert4(first2.version);
-    const { Dir, GoMod } = JSON.parse(await runCommandResolveStdOut(cmdt`go mod download -json ${first2.packageName}@v${first2.version}`));
+    const { Dir, GoMod } = JSON.parse(await runCommandResolveStdOut2(cmdt`go mod download -json ${first2.packageName}@v${first2.version}`));
     const projectDir = await createTmpDirectory("go-run-on-dependency-chain-");
     try {
       await cp4(Dir, projectDir, { recursive: true });
       const projGoMod = resolve14(projectDir, "go.mod");
       if (!existsSync10(projGoMod))
         await cp4(GoMod, projGoMod);
-      await exec(cmdt`chmod --recursive +w ${projectDir}`);
+      await exec2(cmdt`chmod --recursive +w ${projectDir}`);
       await runGoModTidy(projectDir);
       if (rest.length) {
         const replacements = rest.map((dep) => `-replace=${dep.packageName}=${dep.packageName}@v${dep.version}`);
-        await exec(cmdt`go mod edit ${replacements}`, projectDir);
+        await exec2(cmdt`go mod edit ${replacements}`, projectDir);
         await runGoModTidy(projectDir);
       }
       const heuristic = GoanaHeuristics.NO_TESTS;
@@ -110116,7 +110215,7 @@ ${stderr}`);
           const { Module: { Path: Path2 } } = await getModuleInfo(dep);
           return `-replace=${Path2}=${dep}`;
         }));
-        await exec(cmdt`go mod edit ${replacements}`, projectDir);
+        await exec2(cmdt`go mod edit ${replacements}`, projectDir);
         await runGoModTidy(projectDir);
       }
       const heuristic = GoanaHeuristics.NO_TESTS;
@@ -110426,7 +110525,7 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
       const outputFile = resolve15(tmpDir, "output.json");
       await writeFile7(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runRustDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --tree-sitter-rust ${treeSitterRustPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runRustDirectDependencyAnalysis -i ${inputFile} -o ${outputFile} --tree-sitter-rust ${treeSitterRustPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return void 0;
       const packageIds = JSON.parse(await readFile10(outputFile, "utf-8")).result;
@@ -110461,7 +110560,7 @@ var RustCodeAwareVulnerabilityScanner = class _RustCodeAwareVulnerabilityScanner
       const outputFile = resolve15(tmpDir, "output.json");
       await writeFile7(inputFile, JSON.stringify(options));
       const timeoutMs = this.timeoutInSeconds ? Math.max(this.timeoutInSeconds * 1.5, this.timeoutInSeconds + 30) * 1e3 : 750 * 1e3;
-      const result = await execNeverFail(cmdt`node ${classGraphAnalysisCliPath} runRustReachabilityAnalysis -i ${inputFile} -o ${outputFile} --tree-sitter-rust ${treeSitterRustPath}`, void 0, { timeout: timeoutMs });
+      const result = await execNeverFail2(cmdt`node ${classGraphAnalysisCliPath} runRustReachabilityAnalysis -i ${inputFile} -o ${outputFile} --tree-sitter-rust ${treeSitterRustPath}`, void 0, { timeout: timeoutMs });
       if (result.error)
         return { type: "error", message: result.error.message ?? "unknown error" };
       const { success, error, analysisDiagnostics: diagnostics, vulnerablePaths, reachablePackageIds } = JSON.parse(await readFile10(outputFile, "utf-8")).result;
@@ -110596,7 +110695,7 @@ async function extractCargoCrate(crateFilePath, packageName, version3, tmpDir) {
     }
   }
   try {
-    await execAndLogOnFailure(["tar", "-xzf", crateFilePath], tmpDir);
+    await execAndLogOnFailure2(["tar", "-xzf", crateFilePath], tmpDir);
     const cargoTomlPath = resolve15(packageDir, "Cargo.toml");
     const depCrateInfo = await getCrateInfo(cargoTomlPath);
     return [depCrateInfo.lib];
@@ -110876,7 +110975,7 @@ async function runWithJSHeuristics(cb) {
   return result;
 }
 async function getCurrentCommitHash(project) {
-  return (await runCommandResolveStdOut("git rev-parse HEAD", resolve16(COANA_REPOS_PATH(), project))).trim();
+  return (await runCommandResolveStdOut2("git rev-parse HEAD", resolve16(COANA_REPOS_PATH(), project))).trim();
 }
 function detectedOccurrencesFromAPMatches(matches, pathPrefixToRemove) {
   for (const match2 of Object.values(matches))
@@ -110999,7 +111098,7 @@ ${vulnAccPaths.join("\n")}`);
       logger.debug(`With args: ${mambaladeArgs.slice(1).join(" ")}`);
     }
     try {
-      const { stderr } = await exec(mambaladeArgs, this.projectDir, { stdin: memlimitWrapper });
+      const { stderr } = await exec2(mambaladeArgs, this.projectDir, { stdin: memlimitWrapper });
       logger.debug("Done running mambalade");
       const errors = stderr.split("\n").filter((line) => line.startsWith("ERROR:") && !/^ERROR: Excluded distribution/.test(line));
       if (errors.length > 0)
@@ -111123,7 +111222,7 @@ ${msg}`;
             const candidate = findBestWheel(packageName, version3, meta);
             if (candidate) {
               const filename = candidate.url.split("/").at(-1);
-              if (await downloadFile(candidate.url, join19(tmpDir, filename)) && await execAndLogOnFailure(["unzip", filename], tmpDir, void 0, "debug"))
+              if (await downloadFile(candidate.url, join19(tmpDir, filename)) && await execAndLogOnFailure2(["unzip", filename], tmpDir, void 0, "debug"))
                 return;
             }
             await execUvPipInstall(cmdt`uv pip install --python-platform ${uvPythonPlatform} --target ${tmpDir} --no-deps ${packageName}==${version3}`);
@@ -111177,7 +111276,7 @@ ${msg}`;
     const tmpDir = await createTmpDirectory("coana-python-analysis-venv");
     const virtualEnvFolder = join19(tmpDir, ".venv");
     const pythonExecutable = await this.vm.getPythonExecutableForWorkspace(this.projectDir, false);
-    await exec(cmdt`uv venv --python ${pythonExecutable} .venv`, tmpDir);
+    await exec2(cmdt`uv venv --python ${pythonExecutable} .venv`, tmpDir);
     logger.debug("Virtual environment created at", virtualEnvFolder);
     const installStats = {
       installedUsingOnlyBinary: [],
@@ -111210,7 +111309,7 @@ ${msg}`;
         if (!candidate)
           return true;
         const filename = candidate.url.split("/").at(-1);
-        if (await downloadFile(candidate.url, join19(tmpDir, filename)) && await execAndLogOnFailure(cmdt`${uvTool(pythonExecutable)} --from installer==0.7.0 python -m installer
+        if (await downloadFile(candidate.url, join19(tmpDir, filename)) && await execAndLogOnFailure2(cmdt`${uvTool(pythonExecutable)} --from installer==0.7.0 python -m installer
                 --no-compile-bytecode --prefix .venv ${filename}`, tmpDir, void 0, "debug")) {
           installStats.installedUsingSpecializedInstallCommand.push(packageName);
           return false;
@@ -111228,7 +111327,7 @@ ${msg}`;
         let success = await execUvPipInstallAndLogOnFailure([...uvInstallBase, "--no-deps", "--no-binary", packageName, requirementToInstall], void 0, void 0, "debug");
         if (!success) {
           await installPipDeps();
-          success = await execAndLogOnFailure(
+          success = await execAndLogOnFailure2(
             // Disable cache directory to prevent concurrent modifications when analyzing multiple Python projects in parallel.
             // --isolated is used to ignore environment variables and prevents the user's pip.conf from being used.
             cmdt`.venv/bin/python -m pip
@@ -111298,7 +111397,7 @@ for metadata_file in pathlib.Path("lib").glob(
 
 json.dump(result, sys.stdout)
 `;
-  return Object.fromEntries(JSON.parse(await runCommandResolveStdOut([systemPython(), "-SIc", prog], venvDir)).map(([name2, version3, distInfoDir]) => [normalizePackageName(name2), { version: version3, distInfoDir }]));
+  return Object.fromEntries(JSON.parse(await runCommandResolveStdOut2([systemPython(), "-SIc", prog], venvDir)).map(([name2, version3, distInfoDir]) => [normalizePackageName(name2), { version: version3, distInfoDir }]));
 }
 function transformSourceLocations2(appPath, fileMappings, detectedOccurrences) {
   const entries = [...fileMappings.entries()];
@@ -111320,10 +111419,10 @@ function transformSourceLocations2(appPath, fileMappings, detectedOccurrences) {
 async function getPythonRequest() {
   for (const impl of ["pypy", "cpython"]) {
     const req = `${impl}>=3.11`;
-    let { stdout, error } = await execNeverFail(cmdt`uv python find --no-project --python-preference=system ${req}`);
+    let { stdout, error } = await execNeverFail2(cmdt`uv python find --no-project --python-preference=system ${req}`);
     if (!error)
       return stdout.trim();
-    ({ error } = await execNeverFail(cmdt`uv python install ${req}`));
+    ({ error } = await execNeverFail2(cmdt`uv python install ${req}`));
     if (!error)
       return req;
   }
@@ -111331,7 +111430,7 @@ async function getPythonRequest() {
   for (const cmd of ["pypy3", "python3"]) {
     const version3 = await getPythonVersion(cmd).catch(() => void 0);
     if (version3 && (0, import_semver3.satisfies)(version3, pythonVersionRequired))
-      return runCommandResolveStdOut(`which ${cmd}`);
+      return runCommandResolveStdOut2(`which ${cmd}`);
   }
   throw new Error(`No Python ${pythonVersionRequired} interpreter found`);
 }
@@ -111340,7 +111439,7 @@ async function setupMambalade() {
   logger.debug("Creating Mambalade virtual environment");
   const python = await getPythonRequest();
   logger.debug(`Using Python interpreter: ${python}`);
-  await exec(cmdt`uv venv --python=${python} ${venvDir}`);
+  await exec2(cmdt`uv venv --python=${python} ${venvDir}`);
   const mambaladeWheelsPath = join19(COANA_REPOS_PATH(), "mambalade", "dist");
   const mambaladeWheels = (await readdir4(mambaladeWheelsPath)).filter((f2) => f2.endsWith(".whl")).map((f2) => join19(mambaladeWheelsPath, f2));
   if (!mambaladeWheels.length)
@@ -111350,7 +111449,7 @@ async function setupMambalade() {
   logger.debug("Mambalade virtual environment setup complete");
   return venvDir;
 }
-var hasUv = once3(async () => !(await execNeverFail("which uv")).error);
+var hasUv = once3(async () => !(await execNeverFail2("which uv")).error);
 function isSSLCertificateError(errorMessage) {
   return errorMessage.includes("invalid peer certificate") || errorMessage.includes("UnknownIssuer") || errorMessage.includes("certificate verify failed") || errorMessage.includes("SSL") || errorMessage.includes("TLS");
 }
@@ -111364,35 +111463,35 @@ function addNativeTlsFlag(args) {
 }
 async function execUvPipInstall(args, cwd) {
   try {
-    return await exec(args, cwd);
+    return await exec2(args, cwd);
   } catch (e) {
     const errorMessage = e?.stderr ?? e?.message ?? "";
     if (isSSLCertificateError(errorMessage)) {
       logger.debug("SSL certificate error detected, retrying with --native-tls flag");
-      return await exec(addNativeTlsFlag(args), cwd);
+      return await exec2(addNativeTlsFlag(args), cwd);
     }
     throw e;
   }
 }
 async function execUvPipInstallNeverFail(args, cwd) {
-  const result = await execNeverFail(args, cwd);
+  const result = await execNeverFail2(args, cwd);
   if (result.error) {
     const errorMessage = result.stderr ?? result.error?.message ?? "";
     if (isSSLCertificateError(errorMessage)) {
       logger.debug("SSL certificate error detected, retrying with --native-tls flag");
-      return await execNeverFail(addNativeTlsFlag(args), cwd);
+      return await execNeverFail2(addNativeTlsFlag(args), cwd);
     }
   }
   return result;
 }
 async function execUvPipInstallAndLogOnFailure(args, cwd, options, logLevel = "info") {
-  let success = await execAndLogOnFailure(args, cwd, options, logLevel);
+  let success = await execAndLogOnFailure2(args, cwd, options, logLevel);
   if (!success) {
-    const result = await execNeverFail(args, cwd, options);
+    const result = await execNeverFail2(args, cwd, options);
     const errorMessage = result.stderr ?? result.error?.message ?? "";
     if (isSSLCertificateError(errorMessage)) {
       logger.debug("SSL certificate error detected, retrying with --native-tls flag");
-      success = await execAndLogOnFailure(addNativeTlsFlag(args), cwd, options, logLevel);
+      success = await execAndLogOnFailure2(addNativeTlsFlag(args), cwd, options, logLevel);
     }
   }
   return success;
@@ -111469,7 +111568,7 @@ print('\\n'.join(i for i in imports if i.partition('.')[0] not in sys.stdlib_mod
 async function processProject(projectDir) {
   const files = await findFilesToAnalyze(projectDir);
   return uniq8((await asyncMap(files, async (file) => {
-    const { stdout, error } = await execNeverFail([systemPython(), "-SIc", extractImportsProg, file], projectDir);
+    const { stdout, error } = await execNeverFail2([systemPython(), "-SIc", extractImportsProg, file], projectDir);
     if (error) {
       logger.warn("Error extracting imports from '%s': %s", file, error);
       return [];
@@ -115560,7 +115659,7 @@ var RubyCodeAwareVulnerabilityScanner = class {
         logger.info("Ruby analysis command:", cmd.join(" "));
       try {
         this.numberAnalysesRun++;
-        await exec(cmd, this.projectDir);
+        await exec2(cmd, this.projectDir);
         const result = JSON.parse(await readFile12(vulnsOutputFile, "utf-8"));
         const relativeLoadPathsToPackageNames = new Map([...loadPathsToPackageNames.entries()].map(([k, v]) => [join20("vendor", relative8(this.vendorDir, k)), v]));
         const { timedOut, ...diagnostics } = JSON.parse(await readFile12(diagnosticsOutputFile, "utf-8"));
@@ -115667,8 +115766,8 @@ async function downloadAndExtractGem(gemName, version3, vendorDir) {
     await pipeline2(response.body, createWriteStream3(tempGemFile));
     await mkdir8(gemDir, { recursive: true });
     logger.debug(`Extracting gem ${gemName}@${version3}`);
-    await exec(["tar", "-xf", tempGemFile, "data.tar.gz"], gemDir);
-    await exec(["tar", "-xzf", "data.tar.gz"], gemDir);
+    await exec2(["tar", "-xf", tempGemFile, "data.tar.gz"], gemDir);
+    await exec2(["tar", "-xzf", "data.tar.gz"], gemDir);
     await rm7(join20(gemDir, "data.tar.gz"));
     const hasValidStructure = [`${gemName}.gemspec`, "Rakefile", "lib"].some((f2) => existsSync14(join20(gemDir, f2)));
     if (!hasValidStructure)