@socketsecurity/cli-with-sentry 1.0.87 → 1.0.88

package/dist/cli.js

@@ -115,7 +115,7 @@ async function outputAnalytics(result, {
   if (outputKind === 'markdown') {
     const serialized = renderMarkdown(fdata, time, repo);
 
-    // TODO: do we want to write to file even if there was an error...?
+    // TODO: Do we want to write to file even if there was an error...?
     if (filePath) {
       try {
         await fs.writeFile(filePath, serialized, 'utf8');
@@ -176,8 +176,9 @@ function displayAnalyticsScreen(data) {
     maxHeight: 9,
     barBgColor: 'magenta'
   });
-  screen.append(bar); //must append before setting data
 
+  // Must append before setting data.
+  screen.append(bar);
   bar.setData({
     titles: Object.keys(data.top_five_alert_types),
     data: Object.values(data.top_five_alert_types)
@@ -404,55 +405,49 @@ async function run$P(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
-  const hasApiToken = utils.hasDefaultToken();
+  const dryRun = !!cli.flags['dryRun'];
   const noLegacy = !cli.flags['scope'] && !cli.flags['repo'] && !cli.flags['time'];
+  const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: scope === 'org' || !!repoName,
     message: 'When scope=repo, repo name should be the second argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: scope === 'org' || repoName !== '7' && repoName !== '30' && repoName !== '90',
     message: 'When scope is repo, the second arg should be repo, not time',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: time === '7' || time === '30' || time === '90',
     message: 'The time filter must either be 7, 30 or 90',
-    pass: 'ok',
     fail: 'invalid range set, see --help for command arg details.'
   }, {
     nook: true,
     test: !file || !!json || !!markdown,
     message: 'The `--file` flag is only valid when using `--json` or `--markdown`',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$M);
     return;
   }
@@ -830,7 +825,6 @@ async function run$O(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
@@ -838,47 +832,43 @@ async function run$O(argv, importMeta, {
     page,
     perPage
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['type'];
   let [typeFilter = ''] = cli.input;
   typeFilter = String(typeFilter);
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['type'];
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: /^[a-zA-Z]*$/.test(typeFilter),
     message: 'The filter must be an a-zA-Z string, it is an enum',
-    pass: 'ok',
     fail: 'it was given but not a-zA-Z'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$L);
     return;
   }
@@ -960,6 +950,23 @@ async function fetchSupportedScanFileNames(options) {
   });
 }
 
+/**
+ * Finalize a tier1 reachability scan.
+ *  - Associates the tier1 reachability scan metadata with the full scan.
+ *  - Sets the tier1 reachability scan to "finalized" state.
+ */
+async function finalizeTier1Scan(tier1_reachability_scan_id, report_run_id) {
+  // we do not use the SDK here because the tier1-reachability-scan/finalize is a hidden
+  // endpoint that is not part of the OpenAPI specification.
+  return await utils.sendApiRequest('tier1-reachability-scan/finalize', {
+    method: 'POST',
+    body: {
+      tier1_reachability_scan_id,
+      report_run_id
+    }
+  });
+}
+
 /**
  * This fetches all the relevant pieces of data to generate a report, given a
  * full scan ID.
@@ -1015,10 +1022,11 @@ async function fetchScanData(orgSlug, scanId, options) {
     const data = lines.map(line => {
       try {
         return JSON.parse(line);
-      } catch {
+      } catch (e) {
         ok = false;
-        require$$6.debugFn('error', 'fail: parse NDJSON');
+        require$$6.debugFn('error', 'caught: JSON.parse error');
         require$$6.debugDir('inspect', {
+          error: e,
           line
         });
         return;
@@ -1466,16 +1474,33 @@ async function handleScanReport({
   });
 }
 
-async function outputCreateNewScan(result, outputKind, interactive) {
+async function outputCreateNewScan(result, options) {
+  const {
+    interactive = false,
+    outputKind = 'text',
+    // Lazily access constants.spinner.
+    spinner = constants.spinner
+  } = {
+    __proto__: null,
+    ...options
+  };
   if (!result.ok) {
     process.exitCode = result.code ?? 1;
   }
+  const wasSpinning = !!spinner?.isSpinning;
+  spinner?.stop();
   if (outputKind === 'json') {
     logger.logger.log(utils.serializeResultJson(result));
+    if (wasSpinning) {
+      spinner.start();
+    }
     return;
   }
   if (!result.ok) {
     logger.logger.fail(utils.failMsgWithBadge(result.message, result.cause));
+    if (wasSpinning) {
+      spinner.start();
+    }
     return;
   }
   if (!result.data.id) {
@@ -1492,16 +1517,25 @@ async function outputCreateNewScan(result, outputKind, interactive) {
       logger.logger.log(`The server did not return a Scan ID while trying to create a new Scan. This could be an indication something went wrong.`);
     }
     logger.logger.log('');
+    if (wasSpinning) {
+      spinner.start();
+    }
     return;
   }
   const link = vendor.yoctocolorsCjsExports.underline(vendor.yoctocolorsCjsExports.cyan(`${result.data.html_report_url}`));
+  logger.logger.log('');
   logger.logger.log(`Available at: ${link}`);
   if (interactive && (await prompts.confirm({
     message: 'Would you like to open it in your browser?',
     default: false
+  }, {
+    spinner
   }))) {
     await vendor.open(`${result.data.html_report_url}`);
   }
+  if (wasSpinning) {
+    spinner.start();
+  }
 }
 
 // The point here is to attempt to detect the various supported manifest files
@@ -1555,7 +1589,7 @@ async function convertGradleToMaven({
   gradleOpts,
   verbose
 }) {
-  // TODO: impl json/md
+  // TODO: Implement json/md.
 
   // Note: use resolve because the bin could be an absolute path, away from cwd
   // TODO: what about $PATH resolved commands? (`gradlew` without dir prefix)
@@ -1664,7 +1698,7 @@ async function convertSbtToMaven({
   sbtOpts,
   verbose
 }) {
-  // TODO: impl json/md
+  // TODO: Implement json/md.
 
   // Lazily access constants.spinner.
   const {
@@ -1713,8 +1747,8 @@ async function convertSbtToMaven({
       return;
     }
     // Move the pom file to ...? initial cwd? loc will be an absolute path, or dump to stdout
-    // TODO: what to do with multiple output files? Do we want to dump them to stdout? Raw or with separators or ?
-    // TODO: maybe we can add an option to target a specific file to dump to stdout
+    // TODO: What do we do with multiple output files? Do we want to dump them to stdout? Raw or with separators or ?
+    // TODO: Maybe we can add an option to target a specific file to dump to stdout.
     if (out === '-' && poms.length === 1) {
       logger.logger.log('Result:\n```');
       logger.logger.log(await fs$2.safeReadFile(poms[0]));
@@ -1741,7 +1775,7 @@ async function convertSbtToMaven({
       // } else {
       //   logger.log('Moving output pom file')
       // }
-      // TODO: do we prefer fs-extra? renaming can be gnarly on windows and fs-extra's version is better
+      // TODO: Do we prefer fs-extra? Renaming can be gnarly on windows and fs-extra's version is better.
       // await renamep(loc, out)
       logger.logger.success(`Generated ${poms.length} pom files`);
       poms.forEach(fn => logger.logger.log('-', fn));
@@ -1947,7 +1981,7 @@ async function generateAutoManifest({
   outputKind,
   verbose
 }) {
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   if (verbose) {
     logger.logger.info('Using this socket.json for defaults:', sockJson);
   }
@@ -1965,9 +1999,9 @@ async function generateAutoManifest({
   if (!sockJson?.defaults?.manifest?.gradle?.disabled && detected.gradle) {
     logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...');
     await convertGradleToMaven({
-      // Note: `gradlew` is more likely to be resolved against cwd
-      // Note: .resolve() wont butcher an absolute path
-      // TODO: `gradlew` (or anything else given) may want to resolve against PATH
+      // Note: `gradlew` is more likely to be resolved against cwd.
+      // Note: .resolve() won't butcher an absolute path.
+      // TODO: `gradlew` (or anything else given) may want to resolve against PATH.
       bin: sockJson.defaults?.manifest?.gradle?.bin ? path.resolve(cwd, sockJson.defaults.manifest.gradle.bin) : path.join(cwd, 'gradlew'),
       cwd,
       verbose: Boolean(sockJson.defaults?.manifest?.gradle?.verbose),
@@ -1999,6 +2033,7 @@ async function handleCreateNewScan({
   outputKind,
   pendingHead,
   pullRequest,
+  reach,
   readOnly,
   repoName,
   report,
@@ -2007,7 +2042,7 @@ async function handleCreateNewScan({
 }) {
   if (autoManifest) {
     logger.logger.info('Auto-generating manifest files ...');
-    const sockJson = await utils.readOrDefaultSocketJson(cwd);
+    const sockJson = utils.readOrDefaultSocketJson(cwd);
     const detected = await detectManifestActions(sockJson, cwd);
     await generateAutoManifest({
       detected,
@@ -2019,7 +2054,10 @@ async function handleCreateNewScan({
   }
   const supportedFilesCResult = await fetchSupportedScanFileNames();
   if (!supportedFilesCResult.ok) {
-    await outputCreateNewScan(supportedFilesCResult, outputKind, interactive);
+    await outputCreateNewScan(supportedFilesCResult, {
+      interactive,
+      outputKind
+    });
     return;
   }
 
@@ -2036,7 +2074,6 @@ async function handleCreateNewScan({
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: packagePaths.length > 0,
-    pass: 'ok',
     fail: 'found no eligible files to scan',
     message: 'TARGET (file/dir) must contain matching / supported file types for a scan'
   });
@@ -2051,7 +2088,37 @@ async function handleCreateNewScan({
     logger.logger.log('[ReadOnly] Bailing now');
     return;
   }
-  const fullScanCResult = await fetchCreateOrgFullScan(packagePaths, orgSlug, {
+  let scanPaths = packagePaths;
+  let tier1ReachabilityScanId;
+
+  // If reachability is enabled, perform reachability analysis.
+  if (reach.runReachabilityAnalysis) {
+    logger.logger.error('');
+    logger.logger.info('Starting reachability analysis...');
+    spinner.start();
+    const reachResult = await performReachabilityAnalysis$1({
+      packagePaths,
+      orgSlug,
+      cwd,
+      repoName,
+      branchName,
+      reachabilityOptions: reach
+    }, {
+      spinner
+    });
+    spinner.stop();
+    if (!reachResult.ok) {
+      await outputCreateNewScan(reachResult, {
+        interactive,
+        outputKind
+      });
+      return;
+    }
+    logger.logger.success('Reachability analysis completed successfully');
+    scanPaths = reachResult.data?.scanPaths || [];
+    tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
+  }
+  const fullScanCResult = await fetchCreateOrgFullScan(scanPaths, orgSlug, {
     commitHash,
     commitMessage,
     committers,
@@ -2064,7 +2131,10 @@ async function handleCreateNewScan({
     pendingHead,
     tmp
   });
-  if (fullScanCResult.ok && report) {
+  if (reach && tier1ReachabilityScanId && fullScanCResult.ok && fullScanCResult.data?.id) {
+    await finalizeTier1Scan(tier1ReachabilityScanId, fullScanCResult.data.id);
+  }
+  if (report && fullScanCResult.ok) {
     if (fullScanCResult.data?.id) {
       await handleScanReport({
         filePath: '-',
@@ -2082,11 +2152,98 @@ async function handleCreateNewScan({
         message: 'Missing Scan ID',
         cause: 'Server did not respond with a scan ID',
         data: fullScanCResult.data
-      }, outputKind, interactive);
+      }, {
+        interactive,
+        outputKind
+      });
     }
   } else {
-    await outputCreateNewScan(fullScanCResult, outputKind, interactive);
+    spinner.stop();
+    spinner.clear();
+    await outputCreateNewScan(fullScanCResult, {
+      interactive,
+      outputKind
+    });
+  }
+}
+async function performReachabilityAnalysis$1({
+  branchName,
+  cwd,
+  orgSlug,
+  packagePaths,
+  reachabilityOptions,
+  repoName
+}, options) {
+  const {
+    spinner
+  } = {
+    __proto__: null,
+    ...options
+  };
+
+  // Setup SDK for uploading manifests
+  const sockSdkCResult = await utils.setupSdk();
+  if (!sockSdkCResult.ok) {
+    return sockSdkCResult;
+  }
+  const sockSdk = sockSdkCResult.data;
+  const wasSpinning = !!spinner?.isSpinning;
+
+  // Upload manifests to get tar hash
+  spinner?.start('Uploading manifests for reachability analysis...');
+
+  // Exclude DOT_SOCKET_DOT_FACTS_JSON from previous runs.
+  const filteredPackagePaths = packagePaths.filter(p => !p.endsWith(constants.DOT_SOCKET_DOT_FACTS_JSON));
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, filteredPackagePaths), {
+    desc: 'upload manifests',
+    spinner
+  });
+  spinner?.stop();
+  if (!uploadCResult.ok) {
+    if (wasSpinning) {
+      spinner.start();
+    }
+    return uploadCResult;
+  }
+  const tarHash = uploadCResult.data?.tarHash;
+  if (!tarHash) {
+    if (wasSpinning) {
+      spinner.start();
+    }
+    return {
+      ok: false,
+      message: 'Failed to get manifest tar hash',
+      cause: 'Server did not return a tar hash for the uploaded manifests'
+    };
+  }
+  spinner?.start();
+  spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
+  spinner?.infoAndStop('Running reachability analysis with Coana...');
+
+  // Run Coana with the manifests tar hash.
+  const coanaResult = await utils.spawnCoana(['run', cwd, '--output-dir', cwd, '--socket-mode', constants.DOT_SOCKET_DOT_FACTS_JSON, '--disable-report-submission', ...(reachabilityOptions.reachAnalysisTimeout ? ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout.toString()] : []), ...(reachabilityOptions.reachAnalysisMemoryLimit ? ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit.toString()] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachContinueOnFailingProjects ? ['--ignore-failing-workspaces'] : []),
+  // empty reachEcosystems implies scan all ecosystems
+  ...(reachabilityOptions.reachEcosystems.length ? ['--ecosystems', utils.convertToCoanaEcosystems(reachabilityOptions.reachEcosystems).join(' ')] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', reachabilityOptions.reachExcludePaths.join(' ')] : []), '--manifests-tar-hash', tarHash], {
+    cwd,
+    env: {
+      ...process.env,
+      SOCKET_REPO_NAME: repoName,
+      SOCKET_BRANCH_NAME: branchName
+    },
+    spinner,
+    stdio: 'inherit'
+  });
+  if (wasSpinning) {
+    spinner.start();
   }
+  return coanaResult.ok ? {
+    ok: true,
+    data: {
+      // Use the DOT_SOCKET_DOT_FACTS_JSON file for the scan.
+      scanPaths: [constants.DOT_SOCKET_DOT_FACTS_JSON],
+      tier1ReachabilityScanId: utils.extractTier1ReachabilityScanId(constants.DOT_SOCKET_DOT_FACTS_JSON)
+    }
+  } : coanaResult;
 }
 
 async function handleCi(autoManifest) {
@@ -2117,6 +2274,15 @@ async function handleCi(autoManifest) {
     // When 'pendingHead' is true, it requires 'branchName' set and 'tmp' false.
     pendingHead: true,
     pullRequest: 0,
+    reach: {
+      runReachabilityAnalysis: false,
+      reachContinueOnFailingProjects: false,
+      reachDisableAnalytics: false,
+      reachAnalysisTimeout: 0,
+      reachAnalysisMemoryLimit: 0,
+      reachEcosystems: [],
+      reachExcludePaths: []
+    },
     repoName,
     readOnly: false,
     report: true,
@@ -2178,7 +2344,8 @@ async function run$N(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$K);
     return;
   }
@@ -2461,24 +2628,23 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [key = ''] = cli.input;
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: key !== 'test' && utils.isSupportedConfigKey(key),
     message: 'Config key should be the first arg',
-    pass: 'ok',
     fail: key ? 'invalid config key' : 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$J);
     return;
   }
@@ -2573,24 +2739,23 @@ async function run$L(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [key = ''] = cli.input;
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: key === 'test' || utils.isSupportedConfigKey(key),
     message: 'Config key should be the first arg',
-    pass: 'ok',
     fail: key ? 'invalid config key' : 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$I);
     return;
   }
@@ -2714,18 +2879,18 @@ async function run$K(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$H);
     return;
   }
@@ -2829,31 +2994,29 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [key = '', ...rest] = cli.input;
   const value = rest.join(' ');
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: key === 'test' || utils.isSupportedConfigKey(key),
     message: 'Config key should be the first arg',
-    pass: 'ok',
     fail: key ? 'invalid config key' : 'missing'
   }, {
     test: !!value,
     // This is a string, empty string is not ok
     message: 'Key value should be the remaining args (use `unset` to unset a value)',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$G);
     return;
   }
@@ -2951,24 +3114,23 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [key = ''] = cli.input;
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: key === 'test' || utils.isSupportedConfigKey(key),
     message: 'Config key should be the first arg',
-    pass: 'ok',
     fail: key ? 'invalid config key' : 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$F);
     return;
   }
@@ -4268,7 +4430,7 @@ async function install$1(pkgEnvDetails, options) {
   // default is "notice".
   // https://docs.npmjs.com/cli/v8/using-npm/config#loglevel
   ...(useDebug ? [] : ['--silent']), ...(extraArgs ?? [])];
-  const isSpinning = spinner?.isSpinning;
+  const wasSpinning = !!spinner?.isSpinning;
   spinner?.stop();
   const quotedCmd = `\`${pkgEnvDetails.agent} install ${args.join(' ')}\``;
   require$$6.debugFn('stdio', `spawn: ${quotedCmd}`);
@@ -4288,14 +4450,14 @@ async function install$1(pkgEnvDetails, options) {
   }
   const treeResult = await getActualTree(cwd);
   if (treeResult.actualTree) {
-    if (isSpinning) {
+    if (wasSpinning) {
       spinner.start();
     }
     return treeResult;
   }
   require$$6.debugFn('error', 'caught: await arb.loadActual() error');
   require$$6.debugDir('inspect', treeResult);
-  if (isSpinning) {
+  if (wasSpinning) {
     spinner.start();
   }
   return treeResult;
@@ -4446,7 +4608,7 @@ async function install(pkgEnvDetails, options) {
   // Enable a non-interactive pnpm install
   // https://github.com/pnpm/pnpm/issues/6778
   '--config.confirmModulesPurge=false', ...(extraArgs ?? [])];
-  const isSpinning = spinner?.isSpinning;
+  const wasSpinning = !!spinner?.isSpinning;
   spinner?.stop();
   const quotedCmd = `\`${pkgEnvDetails.agent} install ${args.join(' ')}\``;
   require$$6.debugFn('stdio', `spawn: ${quotedCmd}`);
@@ -4466,14 +4628,14 @@ async function install(pkgEnvDetails, options) {
   }
   const treeResult = await getActualTree(cwd);
   if (treeResult.actualTree) {
-    if (isSpinning) {
+    if (wasSpinning) {
       spinner.start();
     }
     return treeResult;
   }
   require$$6.debugFn('error', 'caught: await arb.loadActual() error');
   require$$6.debugDir('inspect', treeResult);
-  if (isSpinning) {
+  if (wasSpinning) {
     spinner.start();
   }
   return treeResult;
@@ -4832,7 +4994,7 @@ async function run$H(argv, importMeta, {
     importMeta,
     parentName
   });
-  const outputKind = utils.getOutputKind(cli.flags['json'], cli.flags['markdown']);
+  const dryRun = !!cli.flags['dryRun'];
   let rangeStyle = cli.flags['rangeStyle'];
   if (!rangeStyle) {
     rangeStyle = 'preserve';
@@ -4855,16 +5017,16 @@ async function run$H(argv, importMeta, {
     logger.logger.fail('No valid --purl values provided.');
     return;
   }
+  const outputKind = utils.getOutputKind(cli.flags['json'], cli.flags['markdown']);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: utils.RangeStyles.includes(rangeStyle),
     message: `Expecting range style of ${arrays.joinOr(utils.RangeStyles)}`,
-    pass: 'ok',
     fail: 'invalid'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_NOT_SAVING);
     return;
   }
@@ -5087,11 +5249,12 @@ async function run$G(argv, importMeta, {
     importMeta,
     parentName
   });
-  const targetName = cli.input[0] || 'socket';
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$E);
     return;
   }
+  const targetName = cli.input[0] || 'socket';
   await handleInstallCompletion(String(targetName));
 }
 
@@ -5291,9 +5454,10 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
     };
   }
   if (wantToComplete) {
+    logger.logger.log('');
     logger.logger.log('Setting up tab completion...');
-    const result = await setupTabCompletion('socket');
-    if (result.ok) {
+    const setupCResult = await setupTabCompletion('socket');
+    if (setupCResult.ok) {
       logger.logger.success('Tab completion will be enabled after restarting your terminal');
     } else {
       logger.logger.fail('Failed to install tab completion script. Try `socket install completion` later.');
@@ -5363,15 +5527,16 @@ async function run$E(argv, importMeta, {
     importMeta,
     parentName
   });
-  const apiBaseUrl = cli.flags['apiBaseUrl'];
-  const apiProxy = cli.flags['apiProxy'];
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$D);
     return;
   }
   if (!vendor.isInteractiveExports()) {
     throw new utils.InputError('Cannot prompt for credentials in a non-interactive shell');
   }
+  const apiBaseUrl = cli.flags['apiBaseUrl'];
+  const apiProxy = cli.flags['apiProxy'];
   await attemptLogin(apiBaseUrl, apiProxy);
 }
 
@@ -5429,7 +5594,8 @@ async function run$D(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$C);
     return;
   }
@@ -5743,6 +5909,7 @@ async function run$C(argv, importMeta, {
     importMeta,
     parentName
   });
+  const dryRun = !!cli.flags['dryRun'];
 
   // TODO: Convert yargs to meow.
   const yargv = {
@@ -5769,7 +5936,7 @@ async function run$C(argv, importMeta, {
     logger.logger.fail(`Unknown ${words.pluralize('argument', unknownsCount)}: ${unknowns.join(', ')}`);
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$B);
     return;
   }
@@ -5840,17 +6007,19 @@ async function run$B(argv, importMeta, {
     importMeta,
     parentName
   });
+  // TODO: Implement json/md further.
   const {
     json,
     markdown,
     verbose: verboseFlag
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
+  const dryRun = !!cli.flags['dryRun'];
   const verbose = !!verboseFlag;
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
+  const outputKind = utils.getOutputKind(json, markdown);
   if (verbose) {
     logger.logger.group('- ', parentName, config$B.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
@@ -5859,12 +6028,12 @@ async function run$B(argv, importMeta, {
     logger.logger.log('- cwd:', cwd);
     logger.logger.groupEnd();
   }
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   const detected = await detectManifestActions(sockJson, cwd);
   require$$6.debugDir('inspect', {
     detected
   });
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$A);
     return;
   }
@@ -5957,6 +6126,12 @@ async function run$A(argv, importMeta, {
     json = false,
     markdown = false
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   let {
     file: filename,
     out,
@@ -5964,12 +6139,6 @@ async function run$A(argv, importMeta, {
     stdout,
     verbose
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown);
-  let [cwd = '.'] = cli.input;
-  // Note: path.resolve vs .join:
-  // If given path is absolute then cwd should not affect it.
-  cwd = path.resolve(process.cwd(), cwd);
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
 
   // Set defaults for any flag/arg that is not given. Check socket.json first.
   if (stdin === undefined && sockJson.defaults?.manifest?.conda?.stdin !== undefined) {
@@ -6014,24 +6183,23 @@ async function run$A(argv, importMeta, {
     logger.logger.log('- output:', out);
     logger.logger.groupEnd();
   }
+  const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'Can only accept one DIR (make sure to escape spaces!)',
-    pass: 'ok',
     fail: `received ${cli.input.length}`
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
   logger.logger.warn('Warning: This will approximate your Conda dependencies using PyPI. We do not yet officially support Conda. Use at your own risk.');
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$z);
     return;
   }
@@ -6117,18 +6285,21 @@ async function run$z(argv, importMeta, {
     json = false,
     markdown = false
   } = cli.flags;
-  let {
-    bin,
-    gradleOpts,
-    verbose
-  } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
+  const dryRun = !!cli.flags['dryRun'];
+
+  // TODO: Implement json/md further.
+  const outputKind = utils.getOutputKind(json, markdown);
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   require$$6.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
+  let {
+    bin,
+    gradleOpts,
+    verbose
+  } = cli.flags;
 
   // Set defaults for any flag/arg that is not given. Check socket.json first.
   if (!bin) {
@@ -6163,7 +6334,7 @@ async function run$z(argv, importMeta, {
     logger.logger.groupEnd();
   }
 
-  // TODO: I'm not sure it's feasible to parse source file from stdin. We could
+  // TODO: We're not sure it's feasible to parse source file from stdin. We could
   //       try, store contents in a file in some folder, target that folder... what
   //       would the file name be?
 
@@ -6171,7 +6342,6 @@ async function run$z(argv, importMeta, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'Can only accept one DIR (make sure to escape spaces!)',
-    pass: 'ok',
     fail: 'received ' + cli.input.length
   });
   if (!wasValidInput) {
@@ -6183,7 +6353,7 @@ async function run$z(argv, importMeta, {
     logger.logger.info('- gradle bin:', bin);
     logger.logger.groupEnd();
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$y);
     return;
   }
@@ -6199,7 +6369,7 @@ const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$x
 } = constants;
 
-// TODO: we may want to dedupe some pieces for all gradle languages. I think it
+// TODO: We may want to dedupe some pieces for all gradle languages. I think it
 //       makes sense to have separate commands for them and I think it makes
 //       sense for the help panels to note the requested language, rather than
 //       `socket manifest kotlin` to print help screens with `gradle` as the
@@ -6274,18 +6444,21 @@ async function run$y(argv, importMeta, {
     json = false,
     markdown = false
   } = cli.flags;
-  let {
-    bin,
-    gradleOpts,
-    verbose
-  } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
+  const dryRun = !!cli.flags['dryRun'];
+
+  // TODO: Implement json/md further.
+  const outputKind = utils.getOutputKind(json, markdown);
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   require$$6.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
+  let {
+    bin,
+    gradleOpts,
+    verbose
+  } = cli.flags;
 
   // Set defaults for any flag/arg that is not given. Check socket.json first.
   if (!bin) {
@@ -6320,7 +6493,7 @@ async function run$y(argv, importMeta, {
     logger.logger.groupEnd();
   }
 
-  // TODO: I'm not sure it's feasible to parse source file from stdin. We could
+  // TODO: We're not sure it's feasible to parse source file from stdin. We could
   //       try, store contents in a file in some folder, target that folder... what
   //       would the file name be?
 
@@ -6328,7 +6501,6 @@ async function run$y(argv, importMeta, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'Can only accept one DIR (make sure to escape spaces!)',
-    pass: 'ok',
     fail: 'received ' + cli.input.length
   });
   if (!wasValidInput) {
@@ -6340,7 +6512,7 @@ async function run$y(argv, importMeta, {
     logger.logger.info('- gradle bin:', bin);
     logger.logger.groupEnd();
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$x);
     return;
   }
@@ -6438,6 +6610,16 @@ async function run$x(argv, importMeta, {
     json = false,
     markdown = false
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+
+  // TODO: Implement json/md further.
+  const outputKind = utils.getOutputKind(json, markdown);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
+  require$$6.debugFn('inspect', 'override: socket.json sbt', sockJson?.defaults?.manifest?.sbt);
   let {
     bin,
     out,
@@ -6445,13 +6627,6 @@ async function run$x(argv, importMeta, {
     stdout,
     verbose
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
-  let [cwd = '.'] = cli.input;
-  // Note: path.resolve vs .join:
-  // If given path is absolute then cwd should not affect it.
-  cwd = path.resolve(process.cwd(), cwd);
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
-  require$$6.debugFn('inspect', 'override: socket.json sbt', sockJson?.defaults?.manifest?.sbt);
 
   // Set defaults for any flag/arg that is not given. Check socket.json first.
   if (!bin) {
@@ -6498,7 +6673,7 @@ async function run$x(argv, importMeta, {
     logger.logger.groupEnd();
   }
 
-  // TODO: I'm not sure it's feasible to parse source file from stdin. We could
+  // TODO: We're not sure it's feasible to parse source file from stdin. We could
   //       try, store contents in a file in some folder, target that folder... what
   //       would the file name be?
 
@@ -6506,7 +6681,6 @@ async function run$x(argv, importMeta, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'Can only accept one DIR (make sure to escape spaces!)',
-    pass: 'ok',
     fail: 'received ' + cli.input.length
   });
   if (!wasValidInput) {
@@ -6519,7 +6693,7 @@ async function run$x(argv, importMeta, {
     logger.logger.log('- out:', out);
     logger.logger.groupEnd();
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$w);
     return;
   }
@@ -6616,12 +6790,12 @@ async function setupManifestConfig(cwd, defaultOnReadError = false) {
     description: 'Exit setup'
   });
 
-  // TODO: use detected to list those first
+  // TODO: Use detected to list those first.
   const targetEco = await prompts.select({
-    message: 'Select eco system manifest generator to configure',
+    message: 'Select ecosystem manifest generator to configure',
     choices
   });
-  const sockJsonCResult = await utils.readSocketJson(cwd, defaultOnReadError);
+  const sockJsonCResult = utils.readSocketJsonSync(cwd, defaultOnReadError);
   if (!sockJsonCResult.ok) {
     return sockJsonCResult;
   }
@@ -6999,11 +7173,12 @@ async function run$w(argv, importMeta, {
   const {
     defaultOnReadError = false
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$v);
     return;
   }
@@ -7092,7 +7267,8 @@ async function run$u(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$u);
     return;
   }
@@ -7145,7 +7321,8 @@ async function run$t(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$t);
     return;
   }
@@ -7197,7 +7374,8 @@ async function run$s(argv, importMeta, {
     markdown,
     throw: justThrow
   } = cli.flags;
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$s);
     return;
   }
@@ -7874,11 +8052,8 @@ async function updateLockfile(pkgEnvDetails, options) {
     __proto__: null,
     ...options
   };
-  const isSpinning = !!spinner?.isSpinning;
-  if (!isSpinning) {
-    spinner?.start();
-  }
-  spinner?.setText(`Updating ${pkgEnvDetails.lockName}...`);
+  const wasSpinning = !!spinner?.isSpinning;
+  spinner?.start(`Updating ${pkgEnvDetails.lockName}...`);
   try {
     await utils.runAgentInstall(pkgEnvDetails, {
       spinner
@@ -7893,16 +8068,18 @@ async function updateLockfile(pkgEnvDetails, options) {
     require$$6.debugDir('inspect', {
       error: e
     });
+    if (wasSpinning) {
+      spinner.start();
+    }
     return {
       ok: false,
       message: 'Update failed',
       cause: utils.cmdPrefixMessage(cmdName, `${pkgEnvDetails.agent} install failed to update ${pkgEnvDetails.lockName}`)
     };
   }
-  if (isSpinning) {
-    spinner?.start();
-  } else {
-    spinner?.stop();
+  spinner?.stop();
+  if (wasSpinning) {
+    spinner.start();
   }
   return {
     ok: true,
@@ -8074,23 +8251,22 @@ async function run$r(argv, importMeta, {
     importMeta,
     parentName
   });
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
+    logger.logger.log(DRY_RUN_BAILING_NOW$r);
+    return;
+  }
   const {
     json,
-    markdown
-  } = cli.flags;
-  const {
+    markdown,
     pin,
     prod
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown);
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$r);
-    return;
-  }
+  const outputKind = utils.getOutputKind(json, markdown);
   await handleOptimize({
     cwd,
     pin: Boolean(pin),
@@ -8259,25 +8435,24 @@ async function run$q(argv, importMeta, {
     markdown,
     offset
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$q);
     return;
   }
@@ -8392,32 +8567,30 @@ async function run$p(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$p);
     return;
   }
@@ -8529,32 +8702,30 @@ async function run$o(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$o);
     return;
   }
@@ -8661,25 +8832,24 @@ async function run$n(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$n);
     return;
   }
@@ -8793,27 +8963,26 @@ async function run$m(argv, importMeta, {
     importMeta,
     parentName
   });
-  const hasApiToken = utils.hasDefaultToken();
+  const dryRun = !!cli.flags['dryRun'];
   const json = Boolean(cli.flags['json']);
   const markdown = Boolean(cli.flags['markdown']);
+  const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$m);
     return;
   }
@@ -9142,6 +9311,7 @@ async function run$l(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [ecosystem = '', purl] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
@@ -9152,30 +9322,26 @@ async function run$l(argv, importMeta, {
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: valid,
     message: 'First parameter must be an ecosystem or the whole purl',
-    pass: 'ok',
     fail: 'bad'
   }, {
     test: purls.length === 1,
     message: 'Expecting at least one package',
-    pass: 'ok',
     fail: purls.length === 0 ? 'missing' : 'too many'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$l);
     return;
   }
@@ -9195,7 +9361,7 @@ async function fetchPurlsShallowScore(purls, options) {
   }
   const sockSdk = sockSdkCResult.data;
   logger.logger.info(`Requesting shallow score data for ${purls.length} package urls (purl): ${purls.join(', ')}`);
-  const result = await utils.handleApiCall(sockSdk.batchPackageFetch({
+  const batchPackageCResult = await utils.handleApiCall(sockSdk.batchPackageFetch({
     components: purls.map(purl => ({
       purl
     }))
@@ -9204,14 +9370,15 @@ async function fetchPurlsShallowScore(purls, options) {
   }), {
     desc: 'looking up package'
   });
-  if (!result.ok) {
-    return result;
+  if (!batchPackageCResult.ok) {
+    return batchPackageCResult;
   }
 
-  // TODO: seems like there's a bug in the typing since we absolutely have to return the .data here
+  // TODO: Seems like there's a bug in the typing since we absolutely have to
+  // return the .data here.
   return {
     ok: true,
-    data: result.data
+    data: batchPackageCResult.data
   };
 }
 
@@ -9510,8 +9677,9 @@ async function run$k(argv, importMeta, {
     json,
     markdown
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown);
+  const dryRun = !!cli.flags['dryRun'];
   const [ecosystem = '', ...pkgs] = cli.input;
+  const outputKind = utils.getOutputKind(json, markdown);
   const {
     purls,
     valid
@@ -9519,24 +9687,21 @@ async function run$k(argv, importMeta, {
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: valid,
     message: 'First parameter should be an ecosystem or all args must be purls',
-    pass: 'ok',
     fail: 'bad'
   }, {
     test: purls.length > 0,
     message: 'Expecting at least one package',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$k);
     return;
   }
@@ -9629,7 +9794,8 @@ async function run$j(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$j);
     return;
   }
@@ -9693,7 +9859,8 @@ async function run$i(argv, importMeta, {
     importMeta,
     parentName
   });
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$i);
     return;
   }
@@ -9841,40 +10008,36 @@ async function run$h(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['repoName'];
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     test: !!repoName,
     message: 'Repository name as first argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
@@ -9980,40 +10143,36 @@ async function run$g(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown);
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['repoName'];
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
+  const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: !!repoName,
     message: 'Repository name as first argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
@@ -10061,13 +10220,9 @@ async function fetchListAllRepos(orgSlug, options) {
       desc: 'list of repositories'
     });
     if (!orgRepoListCResult.ok) {
-      require$$6.debugFn('error', 'fail: fetch repo');
-      require$$6.debugDir('inspect', {
-        orgRepoListCResult
-      });
       return orgRepoListCResult;
     }
-    orgRepoListCResult.data.results.forEach(row => rows.push(row));
+    rows.push(...orgRepoListCResult.data.results);
     nextPage = orgRepoListCResult.data.nextPage ?? -1;
   }
   return {
@@ -10281,44 +10436,40 @@ async function run$f(argv, importMeta, {
   const {
     all,
     direction = 'desc',
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     nook: true,
     test: direction === 'asc' || direction === 'desc',
     message: 'The --direction value must be "asc" or "desc"',
-    pass: 'ok',
     fail: 'unexpected value'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$f);
     return;
   }
@@ -10477,45 +10628,41 @@ async function run$e(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['repoName'];
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: !!repoName,
     message: 'Repository name as first argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$e);
     return;
   }
@@ -10642,51 +10789,46 @@ async function run$d(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['repoName'];
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: !!repoName,
     message: 'Repository name as first argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$d);
     return;
   }
@@ -10714,6 +10856,38 @@ const cmdRepository = {
   }
 };
 
+const reachabilityFlags = {
+  reachAnalysisMemoryLimit: {
+    type: 'number',
+    default: 8192,
+    description: 'The maximum memory in MB to use for the reachability analysis. The default is 8192MB.'
+  },
+  reachAnalysisTimeout: {
+    type: 'number',
+    default: 0,
+    description: 'Set timeout for the reachability analysis. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
+  },
+  reachContinueOnFailingProjects: {
+    type: 'boolean',
+    description: 'Continue reachability analysis even when some projects/workspaces fail. Default is to crash the CLI at the first failing project/workspace.'
+  },
+  reachDisableAnalytics: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
+  },
+  reachEcosystems: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.'
+  },
+  reachExcludePaths: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
+  }
+};
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -10737,92 +10911,101 @@ const {
   SOCKET_DEFAULT_BRANCH: SOCKET_DEFAULT_BRANCH$1,
   SOCKET_DEFAULT_REPOSITORY: SOCKET_DEFAULT_REPOSITORY$1
 } = constants;
+const generalFlags$1 = {
+  ...flags.commonFlags,
+  ...flags.outputFlags,
+  autoManifest: {
+    type: 'boolean',
+    description: 'Run `socket manifest auto` before collecting manifest files. This is necessary for languages like Scala, Gradle, and Kotlin, See `socket manifest auto --help`.'
+  },
+  branch: {
+    type: 'string',
+    shortFlag: 'b',
+    description: 'Branch name'
+  },
+  commitHash: {
+    type: 'string',
+    shortFlag: 'ch',
+    default: '',
+    description: 'Commit hash'
+  },
+  commitMessage: {
+    type: 'string',
+    shortFlag: 'm',
+    default: '',
+    description: 'Commit message'
+  },
+  committers: {
+    type: 'string',
+    shortFlag: 'c',
+    default: '',
+    description: 'Committers'
+  },
+  cwd: {
+    type: 'string',
+    description: 'working directory, defaults to process.cwd()'
+  },
+  defaultBranch: {
+    type: 'boolean',
+    default: false,
+    description: 'Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch.'
+  },
+  interactive: {
+    type: 'boolean',
+    default: true,
+    description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+  },
+  pullRequest: {
+    type: 'number',
+    shortFlag: 'pr',
+    description: 'Commit hash'
+  },
+  org: {
+    type: 'string',
+    description: 'Force override the organization slug, overrides the default org from config'
+  },
+  reach: {
+    type: 'boolean',
+    default: false,
+    description: 'Run tier 1 full application reachability analysis'
+  },
+  readOnly: {
+    type: 'boolean',
+    default: false,
+    description: 'Similar to --dry-run except it can read from remote, stops before it would create an actual report'
+  },
+  repo: {
+    type: 'string',
+    shortFlag: 'r',
+    description: 'Repository name'
+  },
+  report: {
+    type: 'boolean',
+    description: 'Wait for the scan creation to complete, then basically run `socket scan report` on it'
+  },
+  setAsAlertsPage: {
+    type: 'boolean',
+    default: true,
+    aliases: ['pendingHead'],
+    description: 'When true and if this is the "default branch" then this Scan will be the one reflected on your alerts page. See help for details. Defaults to true.'
+  },
+  tmp: {
+    type: 'boolean',
+    shortFlag: 't',
+    default: false,
+    description: 'Set the visibility (true/false) of the scan in your dashboard.'
+  }
+};
 const config$c = {
   commandName: 'create',
   description: 'Create a new Socket scan and report',
   hidden: false,
   flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    autoManifest: {
-      type: 'boolean',
-      description: 'Run `socket manifest auto` before collecting manifest files. This is necessary for languages like Scala, Gradle, and Kotlin, See `socket manifest auto --help`.'
-    },
-    branch: {
-      type: 'string',
-      shortFlag: 'b',
-      description: 'Branch name'
-    },
-    commitMessage: {
-      type: 'string',
-      shortFlag: 'm',
-      default: '',
-      description: 'Commit message'
-    },
-    commitHash: {
-      type: 'string',
-      shortFlag: 'ch',
-      default: '',
-      description: 'Commit hash'
-    },
-    committers: {
-      type: 'string',
-      shortFlag: 'c',
-      default: '',
-      description: 'Committers'
-    },
-    cwd: {
-      type: 'string',
-      description: 'working directory, defaults to process.cwd()'
-    },
-    defaultBranch: {
-      type: 'boolean',
-      default: false,
-      description: 'Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch.'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    pullRequest: {
-      type: 'number',
-      shortFlag: 'pr',
-      description: 'Commit hash'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    readOnly: {
-      type: 'boolean',
-      default: false,
-      description: 'Similar to --dry-run except it can read from remote, stops before it would create an actual report'
-    },
-    repo: {
-      type: 'string',
-      shortFlag: 'r',
-      description: 'Repository name'
-    },
-    report: {
-      type: 'boolean',
-      description: 'Wait for the scan creation to complete, then basically run `socket scan report` on it'
-    },
-    setAsAlertsPage: {
-      type: 'boolean',
-      default: true,
-      aliases: ['pendingHead'],
-      description: 'When true and if this is the "default branch" then this Scan will be the one reflected on your alerts page. See help for details. Defaults to true.'
-    },
-    tmp: {
-      type: 'boolean',
-      shortFlag: 't',
-      default: false,
-      description: 'Set the visibility (true/false) of the scan in your dashboard.'
-    }
+    ...generalFlags$1,
+    ...reachabilityFlags
   },
-  // TODO: your project's "socket.yml" file's "projectIgnorePaths"
-  help: (command, config) => `
+  // TODO: Your project's "socket.yml" file's "projectIgnorePaths".
+  help: command => `
     Usage
       $ ${command} [options] [TARGET...]
 
@@ -10831,7 +11014,10 @@ const config$c = {
       - Permissions: full-scans:create
 
     Options
-      ${utils.getFlagListOutput(config.flags)}
+      ${utils.getFlagListOutput(generalFlags$1)}
+
+    Reachability Options (when --reach is used)
+      ${utils.getFlagListOutput(reachabilityFlags)}
 
     Uploads the specified dependency manifest files for Go, Gradle, JavaScript,
     Kotlin, Python, and Scala. Files like "package.json" and "requirements.txt".
@@ -10889,16 +11075,35 @@ async function run$c(argv, importMeta, {
     committers,
     cwd: cwdOverride,
     defaultBranch,
-    dryRun = false,
     interactive = true,
     json,
     markdown,
     org: orgFlag,
     pullRequest,
+    reach,
+    reachAnalysisMemoryLimit,
+    reachAnalysisTimeout,
+    reachContinueOnFailingProjects,
+    reachDisableAnalytics,
     readOnly,
     setAsAlertsPage: pendingHeadFlag,
     tmp
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+
+  // Process comma-separated values for isMultiple flags.
+  const reachEcosystemsRaw = utils.cmdFlagValueToArray(cli.flags['reachEcosystems']);
+  const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
+
+  // Validate ecosystem values.
+  const reachEcosystems = [];
+  const validEcosystems = utils.getEcosystemChoicesForMeow();
+  for (const ecosystem of reachEcosystemsRaw) {
+    if (!validEcosystems.includes(ecosystem)) {
+      throw new Error(`Invalid ecosystem: "${ecosystem}". Valid values are: ${arrays.joinAnd(validEcosystems)}`);
+    }
+    reachEcosystems.push(ecosystem);
+  }
   let {
     autoManifest,
     branch: branchName,
@@ -10906,13 +11111,11 @@ async function run$c(argv, importMeta, {
     report
   } = cli.flags;
   let [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
-  const cwd = cwdOverride && cwdOverride !== 'process.cwd()' ? path.resolve(process.cwd(), String(cwdOverride)) : process.cwd();
-
-  // Accept zero or more paths. Default to cwd() if none given.
-  let targets = cli.input || [cwd];
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  const processCwd = process.cwd();
+  const cwd = cwdOverride && cwdOverride !== processCwd ? path.resolve(processCwd, String(cwdOverride)) : processCwd;
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
 
-  // Note: This needs meow booleanDefault=undefined
+  // Note: This needs meow booleanDefault=undefined.
   if (typeof autoManifest !== 'boolean') {
     if (sockJson.defaults?.scan?.create?.autoManifest !== undefined) {
       autoManifest = sockJson.defaults.scan.create.autoManifest;
@@ -10946,21 +11149,24 @@ async function run$c(argv, importMeta, {
     }
   }
 
-  // We're going to need an api token to suggest data because those suggestions
-  // must come from data we already know. Don't error on missing api token yet.
-  // If the api-token is not set, ignore it for the sake of suggestions.
-  const hasApiToken = utils.hasDefaultToken();
-  const outputKind = utils.getOutputKind(json, markdown);
-  const pendingHead = tmp ? false : pendingHeadFlag;
-
   // If we updated any inputs then we should print the command line to repeat
   // the command without requiring user input, as a suggestion.
   let updatedInput = false;
+
+  // Accept zero or more paths. Default to cwd() if none given.
+  let targets = cli.input || [cwd];
   if (!targets.length && !dryRun && interactive) {
     targets = await suggestTarget();
     updatedInput = true;
   }
 
+  // We're going to need an api token to suggest data because those suggestions
+  // must come from data we already know. Don't error on missing api token yet.
+  // If the api-token is not set, ignore it for the sake of suggestions.
+  const hasApiToken = utils.hasDefaultToken();
+  const outputKind = utils.getOutputKind(json, markdown);
+  const pendingHead = tmp ? false : pendingHeadFlag;
+
   // If the current cwd is unknown and is used as a repo slug anyways, we will
   // first need to register the slug before we can use it.
   // Only do suggestions with an apiToken and when not in dryRun mode
@@ -10972,7 +11178,10 @@ async function run$c(argv, importMeta, {
           ok: false,
           message: 'Canceled by user',
           cause: 'Org selector was canceled by user'
-        }, outputKind, false);
+        }, {
+          interactive: false,
+          outputKind
+        });
         return;
       }
       if (suggestion) {
@@ -10987,9 +11196,9 @@ async function run$c(argv, importMeta, {
   }
   if (updatedInput && orgSlug && targets.length) {
     logger.logger.info('Note: You can invoke this command next time to skip the interactive questions:');
-    logger.logger.info('```');
-    logger.logger.info(`    socket scan create [other flags...] ${orgSlug} ${targets.join(' ')}`);
-    logger.logger.info('```');
+    logger.logger.error('```');
+    logger.logger.error(`    socket scan create [other flags...] ${orgSlug} ${targets.join(' ')}`);
+    logger.logger.error('```');
     logger.logger.error('');
     logger.logger.info('You can also run `socket scan setup` to persist these flag defaults to a socket.json file.');
     logger.logger.error('');
@@ -10998,43 +11207,65 @@ async function run$c(argv, importMeta, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: !!targets.length,
     message: 'At least one TARGET (e.g. `.` or `./package.json`)',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'This command requires an API token for access',
-    pass: 'ok',
-    fail: 'missing (try `socket login`)'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     nook: true,
     test: !pendingHead || !!branchName,
     message: 'When --pendingHead is set, --branch is mandatory',
-    pass: 'ok',
     fail: 'missing branch name'
   }, {
     nook: true,
     test: !defaultBranch || !!branchName,
     message: 'When --defaultBranch is set, --branch is mandatory',
-    pass: 'ok',
     fail: 'missing branch name'
+  }, {
+    nook: true,
+    test: reach || reachDisableAnalytics === reachabilityFlags['reachDisableAnalytics']?.default,
+    message: 'The --reachDisableAnalytics flag requires --reach to be set',
+    fail: 'missing --reach flag'
+  }, {
+    nook: true,
+    test: reach || reachAnalysisMemoryLimit === reachabilityFlags['reachAnalysisMemoryLimit']?.default,
+    message: 'The --reachAnalysisMemoryLimit flag requires --reach to be set',
+    fail: 'missing --reach flag'
+  }, {
+    nook: true,
+    test: reach || reachAnalysisTimeout === reachabilityFlags['reachAnalysisTimeout']?.default,
+    message: 'The --reachAnalysisTimeout flag requires --reach to be set',
+    fail: 'missing --reach flag'
+  }, {
+    nook: true,
+    test: reach || !reachEcosystems.length,
+    message: 'The --reachEcosystems flag requires --reach to be set',
+    fail: 'missing --reach flag'
+  }, {
+    nook: true,
+    test: reach || !reachContinueOnFailingProjects,
+    message: 'The --reachContinueOnFailingProjects flag requires --reach to be set',
+    fail: 'missing --reach flag'
+  }, {
+    nook: true,
+    test: reach || !reachExcludePaths.length,
+    message: 'The --reachExcludePaths flag requires --reach to be set',
+    fail: 'missing --reach flag'
   });
   if (!wasValidInput) {
     return;
   }
-
-  // Note exiting earlier to skirt a hidden auth requirement
   if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$c);
     return;
@@ -11052,6 +11283,15 @@ async function run$c(argv, importMeta, {
     outputKind,
     pendingHead: Boolean(pendingHead),
     pullRequest: Number(pullRequest),
+    reach: {
+      runReachabilityAnalysis: Boolean(reach),
+      reachContinueOnFailingProjects: Boolean(reachContinueOnFailingProjects),
+      reachDisableAnalytics: Boolean(reachDisableAnalytics),
+      reachAnalysisTimeout: Number(reachAnalysisTimeout),
+      reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
+      reachEcosystems,
+      reachExcludePaths
+    },
     readOnly: Boolean(readOnly),
     repoName,
     report,
@@ -11148,38 +11388,35 @@ async function run$b(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [scanId = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug, defaultOrgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug, defaultOrgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: !!defaultOrgSlug,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     test: !!scanId,
     message: 'Scan ID to delete',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$b);
     return;
   }
@@ -11449,14 +11686,13 @@ async function run$a(argv, importMeta, {
   });
   const {
     depth,
-    dryRun,
     file,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
-  const hasApiToken = utils.hasDefaultToken();
+  const dryRun = !!cli.flags['dryRun'];
   let [id1 = '', id2 = ''] = cli.input;
   // Support dropping in full socket urls to an sbom.
   if (id1.startsWith(SOCKET_SBOM_URL_PREFIX)) {
@@ -11465,36 +11701,33 @@ async function run$a(argv, importMeta, {
   if (id2.startsWith(SOCKET_SBOM_URL_PREFIX)) {
     id2 = id2.slice(SOCKET_SBOM_URL_PREFIX_LENGTH);
   }
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const hasApiToken = utils.hasDefaultToken();
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: !!(id1 && id2),
     message: 'Specify two Scan IDs.\nA Scan ID looks like `aaa0aa0a-aaaa-0000-0a0a-0000000a00a0`.',
-    pass: 'ok',
     fail: !id1 && !id2 ? 'missing both Scan IDs' : !id2 ? 'missing second Scan ID' : 'missing first Scan ID' // Not sure how this can happen but ok.
   }, {
     test: !!orgSlug,
     nook: true,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$a);
     return;
   }
@@ -11692,6 +11925,15 @@ async function scanOneRepo(repoSlug, {
     outputKind,
     pendingHead: true,
     pullRequest: 0,
+    reach: {
+      runReachabilityAnalysis: false,
+      reachContinueOnFailingProjects: false,
+      reachDisableAnalytics: false,
+      reachAnalysisTimeout: 0,
+      reachAnalysisMemoryLimit: 0,
+      reachEcosystems: [],
+      reachExcludePaths: []
+    },
     readOnly: false,
     repoName: repoSlug,
     report: false,
@@ -12170,11 +12412,11 @@ const config$9 = {
     ...flags.outputFlags,
     all: {
       type: 'boolean',
-      description: 'Apply for all known repos reported by the Socket API. Supersedes `repos`.'
+      description: 'Apply for all known repositories reported by the Socket API. Supersedes `repos`.'
     },
     githubToken: {
       type: 'string',
-      description: '(required) GitHub token for authentication (or set GITHUB_TOKEN as an environment variable)'
+      description: 'Required GitHub token for authentication.\nMay set environment variable GITHUB_TOKEN or SOCKET_CLI_GITHUB_TOKEN instead.'
     },
     githubApiUrl: {
       type: 'string',
@@ -12241,7 +12483,6 @@ async function run$9(argv, importMeta, {
     parentName
   });
   const {
-    dryRun = false,
     // Lazily access constants.ENV.SOCKET_CLI_GITHUB_TOKEN.
     githubToken = constants.ENV.SOCKET_CLI_GITHUB_TOKEN,
     interactive = true,
@@ -12249,23 +12490,19 @@ async function run$9(argv, importMeta, {
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   let {
     all,
     githubApiUrl,
     orgGithub,
     repos
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown);
   let [cwd = '.'] = cli.input;
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  let [orgSlug, defaultOrgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
-  if (!defaultOrgSlug) {
-    // Tmp. just for TS. will drop this later.
-    defaultOrgSlug = '';
-  }
-  const sockJson = await utils.readOrDefaultSocketJson(cwd);
+  let [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
   if (all === undefined) {
     if (sockJson.defaults?.scan?.github?.all !== undefined) {
       all = sockJson.defaults?.scan?.github?.all;
@@ -12296,12 +12533,14 @@ async function run$9(argv, importMeta, {
     }
   }
 
+  // We will also be needing that GitHub token.
+  const hasGithubApiToken = !!githubToken;
+
   // We're going to need an api token to suggest data because those suggestions
   // must come from data we already know. Don't error on missing api token yet.
   // If the api-token is not set, ignore it for the sake of suggestions.
   const hasSocketApiToken = utils.hasDefaultToken();
-  // We will also be needing that GitHub token.
-  const hasGithubApiToken = !!githubToken;
+  const outputKind = utils.getOutputKind(json, markdown);
 
   // If the current cwd is unknown and is used as a repo slug anyways, we will
   // first need to register the slug before we can use it.
@@ -12326,18 +12565,15 @@ async function run$9(argv, importMeta, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasSocketApiToken,
-    message: 'This command requires an Socket API token for access',
-    pass: 'ok',
-    fail: 'missing (try `socket login`)'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     test: hasGithubApiToken,
     message: 'This command requires a GitHub API token for access',
-    pass: 'ok',
     fail: 'missing'
   });
   if (!wasValidInput) {
@@ -12395,9 +12631,9 @@ async function fetchOrgFullScanList(config, options) {
     } : {}),
     sort,
     direction,
-    per_page: String(perPage),
+    from: from_time,
     page: String(page),
-    from: from_time
+    per_page: String(perPage)
   }), {
     desc: 'list of scans'
   });
@@ -12570,53 +12806,48 @@ async function run$8(argv, importMeta, {
   });
   const {
     branch: branchFlag,
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+  const noLegacy = !cli.flags['repo'];
   const [repo = '', branchArg = ''] = cli.input;
   const branch = String(branchFlag || branchArg || '');
   const hasApiToken = utils.hasDefaultToken();
-  const noLegacy = !cli.flags['repo'];
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: noLegacy,
     message: 'Legacy flags are no longer supported. See v1 migration guide.',
-    pass: 'ok',
     fail: `received legacy flags`
   }, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'dot is an invalid org, most likely you forgot the org name here?'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     nook: true,
     test: !branchFlag || !branchArg,
     message: 'You should not set --branch and also give a second arg for branch name',
-    pass: 'ok',
     fail: 'received flag and second arg'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$8);
     return;
   }
@@ -12735,51 +12966,53 @@ async function run$7(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [scanId = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: orgSlug === '.' ? 'dot is an invalid org, most likely you forgot the org name here?' : 'missing'
   }, {
     test: !!scanId,
     message: 'Scan ID to inspect as argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$7);
     return;
   }
   await handleOrgScanMetadata(orgSlug, scanId, outputKind);
 }
 
-async function outputScanReach(result, outputKind) {
+const {
+  DOT_SOCKET_DOT_FACTS_JSON
+} = constants;
+async function outputScanReach(result, {
+  cwd,
+  outputKind
+}) {
   if (!result.ok) {
     process.exitCode = result.code ?? 1;
   }
@@ -12792,51 +13025,209 @@ async function outputScanReach(result, outputKind) {
     return;
   }
   logger.logger.log('');
-  logger.logger.success('Finished!');
+  logger.logger.success('Reachability analysis completed successfully!');
+  logger.logger.info(`Reachability report has been written to: ${path.join(cwd, DOT_SOCKET_DOT_FACTS_JSON)}`);
+}
+
+async function performReachabilityAnalysis({
+  branchName,
+  cwd,
+  orgSlug,
+  packagePaths,
+  reachabilityOptions,
+  repoName,
+  uploadManifests = true
+}, options) {
+  const {
+    spinner
+  } = {
+    __proto__: null,
+    ...options
+  };
+  let tarHash;
+  if (uploadManifests && orgSlug && packagePaths) {
+    // Setup SDK for uploading manifests
+    const sockSdkCResult = await utils.setupSdk();
+    if (!sockSdkCResult.ok) {
+      return sockSdkCResult;
+    }
+    const sockSdk = sockSdkCResult.data;
+    const wasSpinning = !!spinner?.isSpinning;
+
+    // Upload manifests to get tar hash
+    spinner?.start('Uploading manifests for reachability analysis...');
+
+    // Exclude DOT_SOCKET_DOT_FACTS_JSON if it was created in previous runs.
+    const filteredPackagePaths = packagePaths.filter(p => !p.endsWith(constants.DOT_SOCKET_DOT_FACTS_JSON));
+    const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, filteredPackagePaths), {
+      desc: 'upload manifests',
+      spinner
+    });
+    spinner?.stop();
+    if (!uploadCResult.ok) {
+      if (wasSpinning) {
+        spinner.start();
+      }
+      return uploadCResult;
+    }
+    tarHash = uploadCResult.data?.tarHash;
+    if (!tarHash) {
+      if (wasSpinning) {
+        spinner.start();
+      }
+      return {
+        ok: false,
+        message: 'Failed to get manifest tar hash',
+        cause: 'Server did not return a tar hash for the uploaded manifests'
+      };
+    }
+    spinner?.start();
+    spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
+    spinner?.infoAndStop('Running reachability analysis with Coana...');
+  } else {
+    const wasSpinning = !!spinner?.isSpinning;
+    spinner?.start('Running reachability analysis with Coana...');
+    if (!wasSpinning) {
+      spinner?.stop();
+    }
+  }
+
+  // Build Coana arguments
+  const coanaArgs = ['run', cwd, '--output-dir', cwd, '--socket-mode', constants.DOT_SOCKET_DOT_FACTS_JSON, '--disable-report-submission', ...(reachabilityOptions.reachAnalysisTimeout ? ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout.toString()] : []), ...(reachabilityOptions.reachAnalysisMemoryLimit ? ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit.toString()] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachContinueOnFailingProjects ? ['--ignore-failing-workspaces'] : []),
+  // empty reachEcosystems implies scan all ecosystems
+  ...(reachabilityOptions.reachEcosystems.length ? ['--ecosystems', ...utils.convertToCoanaEcosystems(reachabilityOptions.reachEcosystems)] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', reachabilityOptions.reachExcludePaths.join(' ')] : []), ...(tarHash ? ['--manifests-tar-hash', tarHash, '--run-without-docker'] : [])];
+
+  // Build environment variables
+  const env = {
+    ...process.env
+  };
+  if (repoName) {
+    env['SOCKET_REPO_NAME'] = repoName;
+  }
+  if (branchName) {
+    env['SOCKET_BRANCH_NAME'] = branchName;
+  }
+
+  // Run Coana with the manifests tar hash.
+  const coanaResult = await utils.spawnCoana(coanaArgs, {
+    cwd,
+    env,
+    spinner,
+    stdio: 'inherit'
+  });
+  const wasSpinning = !!spinner?.isSpinning;
+  if (wasSpinning) {
+    spinner.start();
+  }
+  return coanaResult.ok ? {
+    ok: true,
+    data: {
+      // Use the DOT_SOCKET_DOT_FACTS_JSON file for the scan.
+      scanPaths: [constants.DOT_SOCKET_DOT_FACTS_JSON],
+      tier1ReachabilityScanId: utils.extractTier1ReachabilityScanId(constants.DOT_SOCKET_DOT_FACTS_JSON)
+    }
+  } : coanaResult;
 }
 
-const {
-  DOT_SOCKET_DOT_FACTS_JSON
-} = constants;
 async function handleScanReach({
   cwd,
+  interactive: _interactive,
+  orgSlug,
   outputKind,
-  unknownFlags
+  reachabilityOptions,
+  targets
 }) {
+  // Get supported file names
+  const supportedFilesCResult = await fetchSupportedScanFileNames();
+  if (!supportedFilesCResult.ok) {
+    await outputScanReach(supportedFilesCResult, {
+      cwd,
+      outputKind
+    });
+    return;
+  }
+
   // Lazily access constants.spinner.
   const {
     spinner
   } = constants;
-  spinner.start('Running reachability scan...');
-  const result = await utils.spawnCoana(['run', cwd, '--output-dir', cwd, '--socket-mode', DOT_SOCKET_DOT_FACTS_JSON, '--disable-report-submission', ...unknownFlags], {
+  spinner.start('Searching for local manifest files to include in reachability analysis...');
+  const supportedFiles = supportedFilesCResult.data;
+  const packagePaths = await utils.getPackageFilesForScan(targets, supportedFiles, {
+    cwd
+  });
+  spinner.stop();
+  const wasValidInput = utils.checkCommandInput(outputKind, {
+    nook: true,
+    test: packagePaths.length > 0,
+    fail: 'found no eligible files to analyze',
+    message: 'TARGET (file/dir) must contain matching / supported file types for reachability analysis'
+  });
+  if (!wasValidInput) {
+    return;
+  }
+  logger.logger.success(`Found ${packagePaths.length} local ${words.pluralize('file', packagePaths.length)}`);
+  spinner.start('Running reachability analysis...');
+  const result = await performReachabilityAnalysis({
     cwd,
+    orgSlug,
+    packagePaths,
+    reachabilityOptions,
+    uploadManifests: true
+  }, {
     spinner
   });
   spinner.stop();
-  await outputScanReach(result, outputKind);
+  await outputScanReach(result, {
+    cwd,
+    outputKind
+  });
 }
 
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$6
 } = constants;
+const generalFlags = {
+  ...flags.commonFlags,
+  ...flags.outputFlags,
+  cwd: {
+    type: 'string',
+    description: 'working directory, defaults to process.cwd()'
+  },
+  org: {
+    type: 'string',
+    description: 'Force override the organization slug, overrides the default org from config'
+  }
+};
 const config$6 = {
   commandName: 'reach',
   description: 'Compute tier 1 reachability',
   hidden: true,
   flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags
+    ...generalFlags,
+    ...reachabilityFlags
   },
-  help: (command, config) => `
+  help: command => `
     Usage
       $ ${command} [options] [CWD=.]
 
     Options
-      ${utils.getFlagListOutput(config.flags)}
+      ${utils.getFlagListOutput(generalFlags)}
+
+    Reachability Options
+      ${utils.getFlagListOutput(reachabilityFlags)}
+
+    Runs the Socket reachability analysis without creating a scan in Socket.
+    The output is written to .socket.facts.json in the current working directory.
+
+    Note: Manifest files are uploaded to Socket's backend services because the
+    reachability analysis requires creating a Software Bill of Materials (SBOM)
+    from these files before the analysis can run.
 
     Examples
       $ ${command}
       $ ${command} ./proj
+      $ ${command} ./proj --reach-ecosystems npm,pypi
   `
 };
 const cmdScanReach = {
@@ -12854,12 +13245,55 @@ async function run$6(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
+    cwd: cwdOverride,
+    interactive = true,
     json,
-    markdown
+    markdown,
+    org: orgFlag,
+    reachAnalysisMemoryLimit,
+    reachAnalysisTimeout,
+    reachContinueOnFailingProjects,
+    reachDisableAnalytics
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+
+  // Process comma-separated values for isMultiple flags.
+  const reachEcosystemsRaw = utils.cmdFlagValueToArray(cli.flags['reachEcosystems']);
+  const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
+
+  // Validate ecosystem values.
+  const reachEcosystems = [];
+  const validEcosystems = utils.getEcosystemChoicesForMeow();
+  for (const ecosystem of reachEcosystemsRaw) {
+    if (!validEcosystems.includes(ecosystem)) {
+      throw new Error(`Invalid ecosystem: "${ecosystem}". Valid values are: ${arrays.joinAnd(validEcosystems)}`);
+    }
+    reachEcosystems.push(ecosystem);
+  }
+  const processCwd = process.cwd();
+  const cwd = cwdOverride && cwdOverride !== processCwd ? path.resolve(processCwd, String(cwdOverride)) : processCwd;
+
+  // Accept zero or more paths. Default to cwd() if none given.
+  let targets = cli.input || [cwd];
+
+  // Use suggestTarget if no targets specified and in interactive mode
+  if (!targets.length && !dryRun && interactive) {
+    targets = await suggestTarget();
+  }
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
+  const hasApiToken = utils.hasDefaultToken();
   const outputKind = utils.getOutputKind(json, markdown);
-  const wasValidInput = utils.checkCommandInput(outputKind);
+  const wasValidInput = utils.checkCommandInput(outputKind, {
+    nook: true,
+    test: !!orgSlug,
+    message: 'Org name by default setting, --org, or auto-discovered',
+    fail: 'missing'
+  }, {
+    nook: true,
+    test: hasApiToken,
+    message: 'This command requires an API token for access',
+    fail: 'try `socket login`'
+  });
   if (!wasValidInput) {
     return;
   }
@@ -12867,17 +13301,20 @@ async function run$6(argv, importMeta, {
     logger.logger.log(DRY_RUN_BAILING_NOW$6);
     return;
   }
-  const {
-    unknownFlags
-  } = cli;
-  let [cwd = '.'] = cli.input;
-  // Note: path.resolve vs .join:
-  // If given path is absolute then cwd should not affect it.
-  cwd = path.resolve(process.cwd(), cwd);
   await handleScanReach({
     cwd,
+    orgSlug,
     outputKind,
-    unknownFlags
+    targets,
+    interactive,
+    reachabilityOptions: {
+      reachContinueOnFailingProjects: Boolean(reachContinueOnFailingProjects),
+      reachDisableAnalytics: Boolean(reachDisableAnalytics),
+      reachAnalysisTimeout: Number(reachAnalysisTimeout),
+      reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
+      reachEcosystems,
+      reachExcludePaths
+    }
   });
 }
 
@@ -12977,7 +13414,6 @@ async function run$5(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     fold = 'none',
     interactive,
     json,
@@ -12986,38 +13422,35 @@ async function run$5(argv, importMeta, {
     org: orgFlag,
     reportLevel = 'warn'
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [scanId = '', file = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'dot is an invalid org, most likely you forgot the org name here?'
   }, {
     test: !!scanId,
     message: 'Scan ID to report on',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$5);
     return;
   }
@@ -13069,7 +13502,7 @@ async function setupScanConfig(cwd, defaultOnReadError = false) {
   logger.logger.log('');
   logger.logger.log('Note: For details on a flag you can run `socket <cmd> --help`');
   logger.logger.log('');
-  const sockJsonCResult = await utils.readSocketJson(cwd, defaultOnReadError);
+  const sockJsonCResult = utils.readSocketJsonSync(cwd, defaultOnReadError);
   if (!sockJsonCResult.ok) {
     return sockJsonCResult;
   }
@@ -13387,6 +13820,11 @@ async function run$4(argv, importMeta, {
     importMeta,
     parentName
   });
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
+    logger.logger.log(DRY_RUN_BAILING_NOW$4);
+    return;
+  }
   const {
     defaultOnReadError = false
   } = cli.flags;
@@ -13394,10 +13832,6 @@ async function run$4(argv, importMeta, {
   // Note: path.resolve vs .join:
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
-  if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$4);
-    return;
-  }
   await handleScanConfig(cwd, Boolean(defaultOnReadError));
 }
 
@@ -13414,10 +13848,11 @@ async function fetchScan(orgSlug, scanId) {
   const data = lines.map(line => {
     try {
       return JSON.parse(line);
-    } catch {
+    } catch (e) {
       ok = false;
-      require$$6.debugFn('error', 'fail: parse NDJSON');
+      require$$6.debugFn('error', 'caught: JSON.parse error');
       require$$6.debugDir('inspect', {
+        error: e,
         line
       });
       return null;
@@ -13593,51 +14028,46 @@ async function run$3(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     interactive,
     json,
     markdown,
     org: orgFlag,
     stream
   } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
   const [scanId = '', file = ''] = cli.input;
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'dot is an invalid org, most likely you forgot the org name here?'
   }, {
     test: !!scanId,
     message: 'Scan ID to view',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The `--json` and `--markdown` flags can not be used at the same time',
-    pass: 'ok',
     fail: 'bad'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   }, {
     nook: true,
     test: !stream || !!json,
     message: 'You can only use --stream when using --json',
-    pass: 'ok',
     fail: 'Either remove --stream or add --json'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$3);
     return;
   }
@@ -13752,8 +14182,8 @@ async function outputThreatFeed(result, outputKind) {
       fg: 'cyan'
     },
     columnWidth: [10, 30, 20, 18, 15, 200],
-    // TODO: the truncation doesn't seem to work too well yet but when we add
-    //       `pad` alignment fails, when we extend columnSpacing alignment fails
+    // TODO: The truncation doesn't seem to work too well yet but when we add
+    //       `pad` alignment fails, when we extend columnSpacing alignment fails.
     columnSpacing: 1,
     truncate: '_'
   });
@@ -13996,7 +14426,6 @@ async function run$2(argv, importMeta, {
     parentName
   });
   const {
-    dryRun,
     eco,
     interactive,
     json,
@@ -14043,32 +14472,30 @@ async function run$2(argv, importMeta, {
   if (argSet.size) {
     logger.logger.info(`Warning: ignoring these excessive args: ${Array.from(argSet).join(', ')}`);
   }
+  const dryRun = !!cli.flags['dryRun'];
   const hasApiToken = utils.hasDefaultToken();
-  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, !!dryRun);
+  const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), !!interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
     message: 'Org name by default setting, --org, or auto-discovered',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !json || !markdown,
     message: 'The json and markdown flags cannot be both set, pick one',
-    pass: 'ok',
     fail: 'omit one'
   }, {
     nook: true,
     test: hasApiToken,
-    message: 'You need to be logged in to use this command. See `socket login`.',
-    pass: 'ok',
-    fail: 'missing Socket API token'
+    message: 'This command requires a Socket API token for access',
+    fail: 'try `socket login`'
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$2);
     return;
   }
@@ -14218,11 +14645,12 @@ async function run$1(argv, importMeta, {
     importMeta,
     parentName
   });
-  const targetName = cli.input[0] || 'socket';
-  if (cli.flags['dryRun']) {
+  const dryRun = !!cli.flags['dryRun'];
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW$1);
     return;
   }
+  const targetName = cli.input[0] || 'socket';
   await handleUninstallCompletion(String(targetName));
 }
 
@@ -14310,7 +14738,7 @@ Do you want to install "safe npm" (this will create an alias to the socket-npm c
       }
     }
   } catch (e) {
-    require$$6.debugFn('error', 'fail: setup tab completion');
+    require$$6.debugFn('error', 'caught: tab completion setup error');
     require$$6.debugDir('inspect', {
       error: e
     });
@@ -14423,12 +14851,13 @@ async function run(argv, importMeta, {
     importMeta,
     parentName
   });
+
+  // TODO: Implement json/md further.
   const {
     json,
     markdown
   } = cli.flags;
-  const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
-
+  const dryRun = !!cli.flags['dryRun'];
   let enable = false;
   let disable = false;
   const [arg] = cli.input;
@@ -14439,22 +14868,21 @@ async function run(argv, importMeta, {
     enable = false;
     disable = true;
   }
+  const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: enable || disable,
     message: 'Must specify "on" or "off" argument',
-    pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'expecting exactly one argument',
-    pass: 'ok',
     fail: `got multiple`
   });
   if (!wasValidInput) {
     return;
   }
-  if (cli.flags['dryRun']) {
+  if (dryRun) {
     logger.logger.log(DRY_RUN_BAILING_NOW);
     return;
   }
@@ -14668,5 +15096,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=75f08195-c836-4616-95b6-9e8b367baf91
+//# debugId=aed06780-1ffd-47d9-9ca4-b54afdc8b762
 //# sourceMappingURL=cli.js.map