@coana-tech/cli 14.9.30 → 14.9.32

package/cli.mjs

@@ -20127,7 +20127,7 @@ var require_lodash = __commonJS({
           });
           return result2;
         }
-        function mapValues(object, iteratee2) {
+        function mapValues2(object, iteratee2) {
           var result2 = {};
           iteratee2 = getIteratee(iteratee2, 3);
           baseForOwn(object, function(value, key, object2) {
@@ -20821,7 +20821,7 @@ var require_lodash = __commonJS({
         lodash16.keysIn = keysIn;
         lodash16.map = map2;
         lodash16.mapKeys = mapKeys;
-        lodash16.mapValues = mapValues;
+        lodash16.mapValues = mapValues2;
         lodash16.matches = matches;
         lodash16.matchesProperty = matchesProperty;
         lodash16.memoize = memoize4;
@@ -70978,7 +70978,7 @@ var require_lockfileFormatConverters = __commonJS({
         snapshots,
         packages,
         lockfileVersion: constants_1.LOCKFILE_VERSION,
-        importers: mapValues(lockfile.importers, convertProjectSnapshotToInlineSpecifiersFormat)
+        importers: mapValues2(lockfile.importers, convertProjectSnapshotToInlineSpecifiersFormat)
       };
       if (newLockfile.settings?.peersSuffixMaxLength === 1e3) {
         newLockfile.settings = (0, omit_1.default)(["peersSuffixMaxLength"], newLockfile.settings);
@@ -71107,7 +71107,7 @@ var require_lockfileFormatConverters = __commonJS({
       const { importers, ...rest } = convertFromLockfileFileMutable(lockfile);
       const newLockfile = {
         ...rest,
-        importers: mapValues(importers ?? {}, revertProjectSnapshot)
+        importers: mapValues2(importers ?? {}, revertProjectSnapshot)
       };
       return newLockfile;
     }
@@ -71210,7 +71210,7 @@ var require_lockfileFormatConverters = __commonJS({
       return {
         ...(0, omit_1.default)(["snapshots"], rest),
         packages,
-        importers: mapValues(importers ?? {}, revertProjectSnapshot)
+        importers: mapValues2(importers ?? {}, revertProjectSnapshot)
       };
     }
     exports2.convertLockfileV9ToLockfileObject = convertLockfileV9ToLockfileObject;
@@ -71227,7 +71227,7 @@ var require_lockfileFormatConverters = __commonJS({
       };
     }
     function convertResolvedDependenciesToInlineSpecifiersFormat(resolvedDependencies, { specifiers }) {
-      return mapValues(resolvedDependencies, (version3, depName) => ({
+      return mapValues2(resolvedDependencies, (version3, depName) => ({
         specifier: specifiers[depName],
         version: version3
       }));
@@ -71257,7 +71257,7 @@ var require_lockfileFormatConverters = __commonJS({
         optionalDependencies
       };
     }
-    function mapValues(obj, mapper) {
+    function mapValues2(obj, mapper) {
       const result = {};
       for (const [key, value] of Object.entries(obj)) {
         result[key] = mapper(value, key);
@@ -204801,7 +204801,7 @@ var OtherModulesCommunicator = class {
       workspacePaths
     );
   }
-  async runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, vulnerabilities, reachabilityAnalysisOptions, otherAnalysisOptions) {
+  async runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, ecosystem, vulnerabilities, reachabilityAnalysisOptions, otherAnalysisOptions) {
     const tmpDir = await this.getTmpDirForSubproject(subprojectPath);
     const inputFileName = `${v4_default()}-runReachabilityAnalysis-input.json`;
     const inputFileThisProcess = join15(tmpDir, inputFileName);
@@ -204817,7 +204817,7 @@ var OtherModulesCommunicator = class {
     );
     return this.runReachabilityAnalyzerCommandWithOutput(
       "runReachabilityAnalysis",
-      workspaceData.type,
+      ecosystem,
       subprojectPath,
       workspacePath,
       argt`-i ${inputFileOtherProcess}`,
@@ -206768,8 +206768,9 @@ function shouldIgnoreDir(dir) {
     "obj",
     ".yarn",
     // created by the yarn package manager
-    ".bingo"
+    ".bingo",
     // created by the Bingo package manager, which can be used with Go projects
+    "site-packages"
   ];
   return dirsToIgnore.includes(dir);
 }
@@ -221972,7 +221973,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.9.30";
+var version2 = "14.9.32";
 
 // ../../node_modules/.pnpm/axios@1.9.0/node_modules/axios/lib/helpers/bind.js
 function bind2(fn2, thisArg) {
@@ -225308,6 +225309,9 @@ function getAdvisoryEcosystemFromPurl(purl) {
   const [purlSceme, rest] = purl.split(":");
   if (purlSceme !== "pkg") throw Error(`Upsupported purl scheme: ${purlSceme}`);
   const [purlType] = rest.split("/");
+  return getAdvisoryEcosystemFromPurlType(purlType);
+}
+function getAdvisoryEcosystemFromPurlType(purlType) {
   switch (purlType) {
     case "npm" /* NPM */:
       return "NPM";
@@ -225362,8 +225366,21 @@ function getNamespaceAndName(ecosystem, packageName) {
   }
   return { namespace: namespace2, name };
 }
+function getNameFromNamespaceAndName(purlType, namespace2, name) {
+  if (!name) return "";
+  switch (purlType) {
+    case "npm" /* NPM */:
+      return namespace2 ? `${namespace2}/${name}` : name;
+    case "maven" /* MAVEN */:
+      return namespace2 ? `${namespace2}:${name}` : name;
+    case "pypi" /* PYPI */:
+      return name;
+    default:
+      return name;
+  }
+}
 
-// dist/internal/socket-mode-helpers.js
+// dist/internal/socket-mode-helpers-coana-dependency-trees.js
 var ROOT_IDENTIFIER = "ROOT";
 async function scanForVulnerabilitiesSocketMode(dependencyTree) {
   if (!dependencyTree.ecosystem)
@@ -225441,7 +225458,7 @@ async function scanForVulnerabilitiesSocketMode(dependencyTree) {
           name: dependencyTreeNode.packageName,
           dependency: dependencyTreeNode.packageName,
           vulnChainDetails: computeVulnChainDetails(dependencyTree, dependencyIdentifier, parentsMap),
-          vulnerabilityAccessPaths: vulnerability.reachabilityData?.pattern,
+          vulnerabilityAccessPaths: vulnerability.reachabilityData?.pattern ?? null,
           ecosystem: dependencyTree.ecosystem
         });
       }
@@ -225489,7 +225506,7 @@ function transformToVulnChainNode(dependencyTree) {
   };
 }
 
-// dist/internal/socket-report.js
+// dist/internal/socket-report-coana-dependency-tree.js
 var MAX_STACKS_TO_SEND = 10;
 function toSocketFacts(report, dependencyTrees, subPjToWsPathToDirectDependencies) {
   const components = [];
@@ -225629,8 +225646,195 @@ function toSocketReachabilitySchema(vulnerability) {
   throw new Error("Unknown codeAwareScanResult type");
 }
 
+// dist/internal/socket-mode-helpers-socket-dependency-trees.js
+import { dirname as dirname7 } from "path";
+var filesToDefineWorkspace = ["package.json"];
+function inferWorkspaceFromManifestPath(manifestPath) {
+  const dir = dirname7(manifestPath);
+  return dir === "" ? "." : dir;
+}
+async function fetchArtifactsFromSocket(manifestsTarHash) {
+  console.log("Fetching artifacts from Socket backend using manifests tar hash", manifestsTarHash);
+  let socketBaseUrl = process.env.SOCKET_CLI_API_BASE_URL ?? "https://api.socket.dev/v0/";
+  if (!socketBaseUrl.endsWith("/"))
+    socketBaseUrl += "/";
+  try {
+    const url3 = `${socketBaseUrl}orgs/${process.env.SOCKET_ORG_SLUG}/compute-artifacts?tarHash=${manifestsTarHash}`;
+    const responseData = (await axios_default2.post(url3, {}, {
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Authorization: `Basic ${btoa(`${process.env.SOCKET_CLI_API_TOKEN}:`)}`
+      }
+    })).data;
+    let artifacts;
+    if (typeof responseData === "object") {
+      artifacts = [responseData];
+    } else if (typeof responseData === "string") {
+      artifacts = JSON.parse(`[${responseData.trim().replace(/\n/g, ",")}]`);
+    } else {
+      throw new Error(`Unexpected response type from Socket API: ${typeof responseData}`);
+    }
+    const ecosystemToWorkspaceToAnalysisData = {};
+    const ecosystemToWorkspaceToVulnerabilities = {};
+    for (const artifact of artifacts) {
+      const ecosystem = getAdvisoryEcosystemFromPurlType(artifact.type);
+      if (!ecosystem)
+        continue;
+      const workspaces = /* @__PURE__ */ new Set();
+      if (artifact.manifestFiles) {
+        for (const manifestRef of artifact.manifestFiles) {
+          if (manifestRef.file.endsWith("package.json")) {
+            workspaces.add(inferWorkspaceFromManifestPath(manifestRef.file));
+          }
+        }
+      }
+      if (!artifact.direct && artifact.toplevelAncestors) {
+        for (const ancestorId of artifact.toplevelAncestors) {
+          const ancestor = artifacts.find((a4) => a4.id === ancestorId);
+          if (ancestor && ancestor.manifestFiles) {
+            for (const manifestRef of ancestor.manifestFiles) {
+              if (filesToDefineWorkspace.some((file) => manifestRef.file.endsWith(file))) {
+                workspaces.add(inferWorkspaceFromManifestPath(manifestRef.file));
+              }
+            }
+          }
+        }
+      }
+      if (workspaces.size === 0) {
+        workspaces.add(".");
+      }
+      for (const workspace of workspaces) {
+        if (!ecosystemToWorkspaceToAnalysisData[ecosystem]) {
+          ecosystemToWorkspaceToAnalysisData[ecosystem] = {};
+        }
+        if (!ecosystemToWorkspaceToAnalysisData[ecosystem][workspace]) {
+          ecosystemToWorkspaceToAnalysisData[ecosystem][workspace] = {
+            type: "socket",
+            data: []
+          };
+        }
+        const workspaceData = ecosystemToWorkspaceToAnalysisData[ecosystem][workspace];
+        if (workspaceData.type === "socket") {
+          workspaceData.data.push(artifact);
+        }
+        if (artifact.vulnerabilities && artifact.vulnerabilities.length > 0) {
+          for (const vuln of artifact.vulnerabilities) {
+            const vulnerability = {
+              url: vuln.ghsaId,
+              purlType: artifact.type,
+              range: vuln.range,
+              name: artifact.name ?? "",
+              dependency: artifact.name ?? "",
+              vulnChainDetails: computeVulnChainDetails2(artifacts, artifact.id),
+              vulnerabilityAccessPaths: vuln.reachabilityData?.pattern ?? null,
+              ecosystem,
+              artifactId: artifact.id
+            };
+            ((ecosystemToWorkspaceToVulnerabilities[ecosystem] ??= {})[workspace] ??= []).push(vulnerability);
+          }
+        }
+      }
+    }
+    return {
+      artifacts,
+      ecosystemToWorkspaceToAnalysisData,
+      ecosystemToWorkspaceToVulnerabilities
+    };
+  } catch (error) {
+    logger.error("Failed to fetch artifacts from Socket backend", error);
+    throw error;
+  }
+}
+function computeVulnChainDetails2(artifacts, vulnerableArtifactId) {
+  const artifactMap = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts) {
+    artifactMap.set(artifact.id, artifact);
+  }
+  const parentsMap = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts) {
+    if (artifact.dependencies) {
+      for (const depId of artifact.dependencies) {
+        if (!parentsMap.has(depId)) {
+          parentsMap.set(depId, []);
+        }
+        parentsMap.get(depId).push(artifact.id);
+      }
+    }
+  }
+  const res = {
+    packageName: "root",
+    version: "0.0.0",
+    children: [],
+    transitiveDependencies: {}
+  };
+  function addNode(currentId, childId, visited) {
+    if (visited.has(currentId))
+      return;
+    const currentArtifact = artifactMap.get(currentId);
+    if (!currentArtifact)
+      return;
+    const parents2 = parentsMap.get(currentId);
+    const newCurrentNode = {
+      packageName: getNameFromNamespaceAndName(currentArtifact.type, currentArtifact.namespace, currentArtifact.name),
+      version: currentArtifact.version ?? void 0,
+      children: []
+    };
+    res.transitiveDependencies[currentId] = newCurrentNode;
+    if (childId && !newCurrentNode.children.includes(childId)) {
+      newCurrentNode.children.push(childId);
+    }
+    if (currentId === vulnerableArtifactId) {
+      newCurrentNode.vulnerable = true;
+    }
+    if (currentArtifact.direct) {
+      if (!res.children.includes(currentId)) {
+        res.children.push(currentId);
+      }
+    }
+    visited.add(currentId);
+    if (parents2) {
+      for (const parentId of parents2) {
+        addNode(parentId, currentId, visited);
+      }
+    }
+  }
+  addNode(vulnerableArtifactId, void 0, /* @__PURE__ */ new Set());
+  return res;
+}
+
+// dist/internal/socket-report-socket-dependency-tree.js
+function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities) {
+  const artifactIdToArtifact = Object.fromEntries(artifacts.map((artifact) => [artifact.id, artifact]));
+  for (const vulnerability of vulnerabilities) {
+    const component = artifactIdToArtifact[vulnerability.artifactId];
+    if (!component) {
+      throw new Error(`Component not found for vulnerability ${vulnerability.purl}`);
+    }
+    if (!component.reachability) {
+      component.reachability = [];
+    }
+    let reachabilityForGHSA = component.reachability?.find((r2) => r2.ghsa_id === vulnerability.vulnerabilityUrl.replace("https://github.com/advisories/", ""));
+    if (!reachabilityForGHSA) {
+      reachabilityForGHSA = {
+        ghsa_id: vulnerability.vulnerabilityUrl.replace("https://github.com/advisories/", ""),
+        reachability: []
+      };
+      component.reachability.push(reachabilityForGHSA);
+    }
+    reachabilityForGHSA.reachability.push({
+      ...toSocketReachabilitySchema(vulnerability),
+      workspacePath: vulnerability.workspacePath,
+      subprojectPath: vulnerability.subprojectPath
+    });
+  }
+  return {
+    components: artifacts
+  };
+}
+
 // dist/cli-core.js
-var { omit, partition, pick } = import_lodash15.default;
+var { mapValues, omit, partition, pick } = import_lodash15.default;
 var CliCore = class {
   options;
   spinner;
@@ -225710,6 +225914,9 @@ var CliCore = class {
           throw new Error(`Invalid ecosystem: ${ecosystem}.`);
         }
       });
+    if (this.options.manifestsTarHash && !this.options.socketMode) {
+      throw new Error("The --manifests-tar-hash option is only supported when using --socket-mode");
+    }
   }
   async main() {
     this.coanaLogPath = join20(await createTmpDirectory("coana-cli-"), "coana-log.txt");
@@ -225721,24 +225928,58 @@ var CliCore = class {
       logger.error(e.message);
       process.exit(1);
     }
+    const otherModulesCommunicator = new OtherModulesCommunicator(this.rootWorkingDirectory, {
+      runWithoutDocker: this.options.runWithoutDocker,
+      debug: this.options.debug,
+      silent: this.options.silent,
+      coanaLogPath: this.coanaLogPath,
+      reportId: this.reportId,
+      socketMode: !!this.options.socketMode
+    }, this.apiKey);
     this.spinner.start();
     try {
+      if (this.options.manifestsTarHash) {
+        await this.computeAndOutputReportSocketMode(otherModulesCommunicator);
+        this.spinner.stop();
+        return;
+      }
       if (this.shareWithDashboard && this.apiKey.type === "present") {
         const gitData = await getGitDataToMetadataIfAvailable(this.rootWorkingDirectory);
         this.reportId = await createReport(this.options.repoUrl, this.options.projectName, version2, gitData?.sha, gitData?.branchName, omit(this.options, "apiKey", "print-report", "repoUrl", "projectName", "writeReportToFile"), this.apiKey, this.options.runEnv);
       }
-      const { report, subPjToWsPathToDirectDependencies } = await this.computeReport();
+      const { report, subPjToWsPathToDirectDependencies } = await this.computeReport(otherModulesCommunicator);
       logger.info("Report computed successfully");
       await this.outputAndShareReport(report, subPjToWsPathToDirectDependencies);
       this.spinner.stop();
       return report;
     } catch (e) {
       await this.spinner.fail();
-      logger.error("CLI failed with error:", e.message);
+      logger.error("CLI failed with error:", e);
       await this.shareErrorLogWithDashboard(e, true);
       process.exit(1);
     }
   }
+  async computeAndOutputReportSocketMode(otherModulesCommunicator) {
+    logger.info("Fetching artifacts from Socket backend");
+    const { artifacts, ecosystemToWorkspaceToAnalysisData, ecosystemToWorkspaceToVulnerabilities } = await fetchArtifactsFromSocket(this.options.manifestsTarHash);
+    const vulnsWithResults = [];
+    for (const [ecosystem, workspaceToAnalysisData] of Object.entries(ecosystemToWorkspaceToAnalysisData)) {
+      vulnsWithResults.push(...Object.values(await this.runReachabilityAnalysisForWorkspaces(
+        workspaceToAnalysisData,
+        ecosystemToWorkspaceToVulnerabilities[ecosystem] ?? {},
+        {},
+        // We do not need the direct dependencies for socket mode
+        otherModulesCommunicator,
+        ".",
+        ecosystem,
+        true
+      )).flat());
+    }
+    const socketReport = toSocketFactsSocketDependencyTree(artifacts, vulnsWithResults);
+    const outputFile = resolve24(this.options.socketMode);
+    await writeFile8(outputFile, JSON.stringify(socketReport, null, 2));
+    logger.info(kleur_default.green(`Socket report written to: ${outputFile}`));
+  }
   async getLogContent() {
     await logger.finish();
     let logContent;
@@ -225800,15 +226041,7 @@ var CliCore = class {
       logger.info(JSON.stringify(omit(report, "dependencyTrees"), null, 2));
     }
   }
-  async computeReport() {
-    const otherModulesCommunicator = new OtherModulesCommunicator(this.rootWorkingDirectory, {
-      runWithoutDocker: this.options.runWithoutDocker,
-      debug: this.options.debug,
-      silent: this.options.silent,
-      coanaLogPath: this.coanaLogPath,
-      reportId: this.reportId,
-      socketMode: !!this.options.socketMode
-    }, this.apiKey);
+  async computeReport(otherModulesCommunicator) {
     const startTime = (/* @__PURE__ */ new Date()).toISOString();
     this.sendProgress("CREATE_PROJECT_MANAGER", true);
     const manager = await ProjectManager.create(this.rootWorkingDirectory, otherModulesCommunicator, this.options.ecosystems, this.options.includeDirs, this.options.excludeDirs, this.options.changedFiles);
@@ -225936,93 +226169,95 @@ var CliCore = class {
   }
   async runOnSubproject(otherModulesCommunicator, subProjAndWsPath, reachabilitySupported) {
     try {
-      let pruneVulnerablePathsToShortestPathsOnly2 = function(ecosystem2, workspaceToAugmentedVulnerabilities2) {
-        const vulnerabilityToWorkspaceToCodeAwareScanSuccess = {};
-        for (const [workspacePath, augmentedVulnerabilities] of Object.entries(workspaceToAugmentedVulnerabilities2)) {
-          augmentedVulnerabilities.forEach((augmentedVulnerability) => {
-            const url3 = augmentedVulnerability.url;
-            const results = augmentedVulnerability.results;
-            if (results.type === "success") {
-              (vulnerabilityToWorkspaceToCodeAwareScanSuccess[url3] ??= {})[workspacePath] = results;
-            }
-          });
-        }
-        const serialize3 = (t4) => `${t4.package}#${t4.class}`.toLowerCase();
-        for (const workspaceToCodeAwareScanSuccess of Object.values(vulnerabilityToWorkspaceToCodeAwareScanSuccess)) {
-          const trie = mkTrie();
-          for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
-            const stacks = Array.isArray(codeAwareScanSuccess.detectedOccurrences) ? codeAwareScanSuccess.detectedOccurrences.flatMap((occ) => occ.affectedAppCodePoints) : codeAwareScanSuccess.detectedOccurrences.stacks;
-            stacks.forEach((stack2) => {
-              addPathToTrie(trie, stack2.map(serialize3));
-            });
-          }
-          for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
-            const detectedOccurrences = codeAwareScanSuccess.detectedOccurrences;
-            detectedOccurrences.stacks = detectedOccurrences.stacks.filter((stack2) => isShortestPath(trie, stack2.map(serialize3)));
-            if (detectedOccurrences.stacks.length === 0)
-              detectedOccurrences.affectedPackages = [];
-            detectedOccurrences.affectedPackages = detectedOccurrences.affectedPackages.filter((affectedPackage) => {
-              if (affectedPackage === ROOT_NODE_STR || affectedPackage === "UNKNOWN")
-                return true;
-              const [packageName, version3] = affectedPackage.split("@");
-              return detectedOccurrences.stacks.some((stack2) => stack2.some((stackElm) => {
-                if (ecosystem2 === "MAVEN") {
-                  const [groupId, artifactId, ...rest] = stackElm.package.split(":");
-                  const expectedPackageName = `${groupId}:${artifactId}`;
-                  const expectedVersion = rest[rest.length - 1];
-                  return expectedPackageName === packageName && expectedVersion === version3;
-                }
-                if (ecosystem2 === "NUGET") {
-                  const [expectedPackageName, expectedVersion] = stackElm.package.split("/");
-                  return expectedPackageName === packageName && expectedVersion === version3;
-                }
-                return true;
-              }));
-            });
-          }
-        }
-      };
-      var pruneVulnerablePathsToShortestPathsOnly = pruneVulnerablePathsToShortestPathsOnly2;
       const { ecosystem, subprojectPath, workspacePaths } = subProjAndWsPath;
       const { projectInfo, workspaceToVulnerabilities } = await this.getDependencyTreeAndVulnerabilities(otherModulesCommunicator, subProjAndWsPath);
-      const workspaceToAugmentedVulnerabilities = Object.fromEntries(await asyncMap(workspacePaths, async (workspacePath) => {
-        const dataForAnalysis = projectInfo[workspacePath].dataForAnalysis;
-        const vulnerabilities = workspaceToVulnerabilities[workspacePath];
-        const augmentedVulnerabilities = reachabilitySupported ? await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, vulnerabilities) : vulnerabilities.map((v) => ({
-          ...v,
-          results: {
-            type: "otherError",
-            message: `Reachability analysis for languages using ${ecosystem} not supported yet`
-          }
-        }));
-        return [workspacePath, augmentedVulnerabilities];
-      }));
-      if (ecosystem === "MAVEN" || ecosystem === "NUGET" || ecosystem === "RUST") {
-        pruneVulnerablePathsToShortestPathsOnly2(ecosystem, workspaceToAugmentedVulnerabilities);
-      }
+      const workspacePathToDataForAnalysis = Object.fromEntries(Object.entries(projectInfo).map(([workspacePath, projectInfo2]) => [workspacePath, projectInfo2.dataForAnalysis]));
+      const workspaceToAugmentedVulnerabilities = await this.runReachabilityAnalysisForWorkspaces(workspacePathToDataForAnalysis, workspaceToVulnerabilities, Object.fromEntries(workspacePaths.map((wsPath) => [wsPath, projectInfo[wsPath].dataForAnalysis.directDependenciesMap ?? {}])), otherModulesCommunicator, subprojectPath, ecosystem, reachabilitySupported);
       return workspacePaths.map((workspacePath) => {
-        const codeAwareScanResultsForAllPackages = [];
-        codeAwareScanResultsForAllPackages.push(...this.transformToReportVulnerabilities(workspaceToAugmentedVulnerabilities[workspacePath], projectInfo[workspacePath].directDependenciesMap ?? {}, subprojectPath, workspacePath, this.rootWorkingDirectory));
         return {
           subprojectPath: relative10(this.rootWorkingDirectory, subprojectPath) || ".",
           workspacePath,
-          directDependencies: projectInfo[workspacePath].directDependenciesMap ?? {},
-          vulnerabilities: codeAwareScanResultsForAllPackages,
-          dependencyTree: projectInfo[workspacePath].dataForAnalysis.dependencyTree
+          directDependencies: projectInfo[workspacePath].dataForAnalysis.directDependenciesMap ?? {},
+          vulnerabilities: workspaceToAugmentedVulnerabilities[workspacePath],
+          dependencyTree: projectInfo[workspacePath].dataForAnalysis.data.dependencyTree
         };
       });
     } finally {
       this.sendProgress("RUN_ON_SUBPROJECT", false, subProjAndWsPath.subprojectPath);
     }
   }
-  async runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, workspaceData, vulnerabilities) {
+  async runReachabilityAnalysisForWorkspaces(workspacePathToDataForAnalysis, workspaceToVulnerabilities, workspaceToDirectDependencies, otherModulesCommunicator, subprojectPath, ecosystem, reachabilitySupported) {
+    const workspaceToAugmentedVulnerabilities = Object.fromEntries(await asyncMap(Object.keys(workspacePathToDataForAnalysis), async (workspacePath) => {
+      const dataForAnalysis = workspacePathToDataForAnalysis[workspacePath];
+      const vulnerabilities = workspaceToVulnerabilities[workspacePath];
+      const augmentedVulnerabilities = reachabilitySupported ? await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilities) : vulnerabilities.map((v) => ({
+        ...v,
+        results: {
+          type: "otherError",
+          message: `Reachability analysis for languages using ${ecosystem} not supported yet`
+        }
+      }));
+      return [workspacePath, augmentedVulnerabilities];
+    }));
+    if (ecosystem === "MAVEN" || ecosystem === "NUGET" || ecosystem === "RUST") {
+      pruneVulnerablePathsToShortestPathsOnly(ecosystem, workspaceToAugmentedVulnerabilities);
+    }
+    return mapValues(workspaceToAugmentedVulnerabilities, (augmentedVulnerabilities, workspacePath) => this.transformToReportVulnerabilities(augmentedVulnerabilities, workspaceToDirectDependencies[workspacePath] ?? {}, subprojectPath, workspacePath, this.rootWorkingDirectory));
+    function pruneVulnerablePathsToShortestPathsOnly(ecosystem2, workspaceToAugmentedVulnerabilities2) {
+      const vulnerabilityToWorkspaceToCodeAwareScanSuccess = {};
+      for (const [workspacePath, augmentedVulnerabilities] of Object.entries(workspaceToAugmentedVulnerabilities2)) {
+        augmentedVulnerabilities.forEach((augmentedVulnerability) => {
+          const url3 = augmentedVulnerability.url;
+          const results = augmentedVulnerability.results;
+          if (results.type === "success") {
+            (vulnerabilityToWorkspaceToCodeAwareScanSuccess[url3] ??= {})[workspacePath] = results;
+          }
+        });
+      }
+      const serialize3 = (t4) => `${t4.package}#${t4.class}`.toLowerCase();
+      for (const workspaceToCodeAwareScanSuccess of Object.values(vulnerabilityToWorkspaceToCodeAwareScanSuccess)) {
+        const trie = mkTrie();
+        for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
+          const stacks = Array.isArray(codeAwareScanSuccess.detectedOccurrences) ? codeAwareScanSuccess.detectedOccurrences.flatMap((occ) => occ.affectedAppCodePoints) : codeAwareScanSuccess.detectedOccurrences.stacks;
+          stacks.forEach((stack2) => {
+            addPathToTrie(trie, stack2.map(serialize3));
+          });
+        }
+        for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
+          const detectedOccurrences = codeAwareScanSuccess.detectedOccurrences;
+          detectedOccurrences.stacks = detectedOccurrences.stacks.filter((stack2) => isShortestPath(trie, stack2.map(serialize3)));
+          if (detectedOccurrences.stacks.length === 0)
+            detectedOccurrences.affectedPackages = [];
+          detectedOccurrences.affectedPackages = detectedOccurrences.affectedPackages.filter((affectedPackage) => {
+            if (affectedPackage === ROOT_NODE_STR || affectedPackage === "UNKNOWN")
+              return true;
+            const [packageName, version3] = affectedPackage.split("@");
+            return detectedOccurrences.stacks.some((stack2) => stack2.some((stackElm) => {
+              if (ecosystem2 === "MAVEN") {
+                const [groupId, artifactId, ...rest] = stackElm.package.split(":");
+                const expectedPackageName = `${groupId}:${artifactId}`;
+                const expectedVersion = rest[rest.length - 1];
+                return expectedPackageName === packageName && expectedVersion === version3;
+              }
+              if (ecosystem2 === "NUGET") {
+                const [expectedPackageName, expectedVersion] = stackElm.package.split("/");
+                return expectedPackageName === packageName && expectedVersion === version3;
+              }
+              return true;
+            }));
+          });
+        }
+      }
+    }
+  }
+  async runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, workspaceData, ecosystem, vulnerabilities) {
     const [vulnsWithActualAPIPatterns, result] = partition(vulnerabilities, (v) => Array.isArray(v.vulnerabilityAccessPaths));
     for (const v of result)
       v.results = typeof v.vulnerabilityAccessPaths === "string" ? { type: "noAnalysisCheck", message: v.vulnerabilityAccessPaths } : { type: "missingVulnerabilityPattern" };
     if (!vulnsWithActualAPIPatterns.length)
       return result;
     this.sendProgress("REACHABILITY_ANALYSIS", true, subprojectPath, workspacePath);
-    result.push(...await otherModulesCommunicator.runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, vulnerabilities, {
+    result.push(...await otherModulesCommunicator.runReachabilityAnalysis(subprojectPath, workspacePath, workspaceData, ecosystem, vulnerabilities, {
       timeoutInSeconds: this.analysisTimeoutInSeconds,
       memoryLimitInMB: this.analysisMemoryLimitInMb,
       printLogFile: this.options.printAnalysisLogFile,
@@ -226074,7 +226309,8 @@ var CliCore = class {
         dependencyType,
         reachability,
         purl: v.purl,
-        purlType: v.purlType
+        purlType: v.purlType,
+        artifactId: v.artifactId
       };
     });
   }
@@ -226087,7 +226323,7 @@ var CliCore = class {
     this.sendProgress("PREPARE_PROJECT_AND_GET_PROJECT_DATA", false, subprojectPath);
     const workspaceToPlainDependencyTree = Object.fromEntries(workspacePaths.map((workspacePath) => [
       workspacePath,
-      toPlainDependencyTree(projectInfo[workspacePath].dataForAnalysis.dependencyTree)
+      toPlainDependencyTree(projectInfo[workspacePath].dataForAnalysis.data.dependencyTree)
     ]));
     const dependencyTrees = workspacePaths.map((workspacePath) => ({
       treeType: "v1",
@@ -226096,17 +226332,24 @@ var CliCore = class {
       workspacePath,
       subprojectPath: relative10(rootWorkingDirectory, subprojectPath) || "."
     }));
-    if (this.options.socketMode)
-      this.reportDependencyTrees = dependencyTrees;
+    if (this.options.socketMode) {
+      this.reportDependencyTrees = workspacePaths.map((workspacePath) => ({
+        treeType: "v1",
+        dependencyTree: projectInfo[workspacePath].dataForAnalysis.data.dependencyTree,
+        ecosystem: projectInfo[workspacePath].dataForAnalysis.data.dependencyTree.ecosystem ?? "NPM",
+        workspacePath,
+        subprojectPath: relative10(rootWorkingDirectory, subprojectPath) || "."
+      }));
+    }
     if (this.shareWithDashboard)
       sendDependencyTreesToDashboard(dependencyTrees, this.reportId, this.apiKey);
     const workspaceToVulnerabilities = Object.fromEntries(await asyncMap(workspacePaths, async (workspacePath, idx) => this.spinner.wrap(`Scanning for vulnerabilities: (${subProjAndWsPath.packageManagerName}) (${idx + 1}/${workspacePaths.length}) ${workspacePath}`, async () => {
-      const dependencyTree = projectInfo[workspacePath].dataForAnalysis.dependencyTree;
+      const dependencyTree = projectInfo[workspacePath].dataForAnalysis.data.dependencyTree;
       this.sendProgress("SCAN_FOR_VULNERABILITIES", true, subprojectPath, workspacePath);
       try {
         return [
           workspacePath,
-          this.options.socketMode ? await scanForVulnerabilitiesSocketMode(projectInfo[workspacePath].dataForAnalysis.dependencyTree) : (await scanForVulnerabilities(dependencyTree, this.options.offlineDatabase, this.apiKey, Number(this.options.timeout))).vulnerabilities
+          this.options.socketMode ? await scanForVulnerabilitiesSocketMode(projectInfo[workspacePath].dataForAnalysis.data.dependencyTree) : (await scanForVulnerabilities(dependencyTree, this.options.offlineDatabase, this.apiKey, Number(this.options.timeout))).vulnerabilities
         ];
       } catch (e) {
         logger.error(`Scanning for vulnerabilities failed for subproject ${subprojectPath} in workspace ${workspacePath}`);
@@ -226290,7 +226533,7 @@ async function computeInputForComputingFixes(path2, options) {
   }
   const cliCore = new CliCore(path2, { ...defaultCliOptions, socketMode: "true" });
   const results = await asyncMap(supportedSubprojects, async (subproject) => cliCore.getDependencyTreeAndVulnerabilities(otherModulesCommunicator, subproject));
-  const { artifacts, purlToIndex } = computeSBOMTaskArtifacts(results.flatMap((r2) => Object.values(r2.projectInfo).map((info) => info.dataForAnalysis.dependencyTree)));
+  const { artifacts, purlToIndex } = computeSBOMTaskArtifacts(results.flatMap((r2) => Object.values(r2.projectInfo).map((info) => info.dataForAnalysis.data.dependencyTree)));
   const vulnerableArtifactIdsPerVulnerability = computeVulnerableArtifactIdsPerVulnerability(results.flatMap((r2) => Object.values(r2.workspaceToVulnerabilities).flat()), purlToIndex);
   return { artifacts, vulnerableArtifactIdsPerVulnerability };
 }
@@ -226375,7 +226618,7 @@ async function useSocketComputeFixEndpoint(artifacts, vulnerableArtifactIdsForGh
 // dist/index.js
 var program2 = new Command();
 var run2 = new Command();
-run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <dirs...>", "globs for directories to include from the detection of subprojects (space-separated). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <dirs...>", "globs for directories to exclude from the detection of subprojects (space-separated). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze. Currently NPM, PIP, MAVEN and GO are supported. Default is all supported ecosystems.", (ecosystems) => ecosystems.split(" ").map((e) => e.toUpperCase())).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).version(version2).configureHelp({ sortOptions: true }).action(async (path2, options) => {
+run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <dirs...>", "globs for directories to include from the detection of subprojects (space-separated). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <dirs...>", "globs for directories to exclude from the detection of subprojects (space-separated). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze. Currently NPM, PIP, MAVEN and GO are supported. Default is all supported ecosystems.", (ecosystems) => ecosystems.split(" ").map((e) => e.toUpperCase())).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).version(version2).configureHelp({ sortOptions: true }).action(async (path2, options) => {
   process.env.DOCKER_IMAGE_TAG ??= version2;
   await new CliCore(path2, options).main();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.9.30",
+  "version": "14.9.32",
   "description": "Coana CLI",
   "type": "module",
   "bin": {