@socketsecurity/cli-with-sentry 1.1.131 → 1.1.133

package/dist/cli.js

@@ -1752,6 +1752,7 @@ async function performReachabilityAnalysis(options) {
     packagePaths,
     reachabilityOptions,
     repoName,
+    resolvedPathsSidecar,
     spinner,
     target,
     uploadManifests = true
@@ -1840,25 +1841,18 @@ async function performReachabilityAnalysis(options) {
   spinner?.infoAndStop('Running reachability analysis with Coana...');
   const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
-  // Coana reads `--auto-manifest-config` from a JSON file, so write the resolved
-  // per-ecosystem build-tool config (mapped from socket.json) to a temp file and
-  // pass its absolute path. Cleaned up in the finally below.
-  let autoManifestConfigPath;
-  const {
-    autoManifestConfig
-  } = reachabilityOptions;
-  if (autoManifestConfig && !utils.isAutoManifestConfigEmpty(autoManifestConfig)) {
-    autoManifestConfigPath = path.join(os.tmpdir(), `socket-auto-manifest-config-${require$$0.randomUUID()}.json`);
-    await fs$1.promises.writeFile(autoManifestConfigPath, JSON.stringify(autoManifestConfig), 'utf8');
+  // Write the sidecar to a temp file for `--compute-artifacts-sidecar`; cleaned
+  // up in the finally below.
+  let sidecarPath;
+  if (resolvedPathsSidecar?.length) {
+    sidecarPath = path.join(os.tmpdir(), `socket-compute-artifacts-sidecar-${require$$0.randomUUID()}.json`);
+    await fs$1.promises.writeFile(sidecarPath, JSON.stringify(resolvedPathsSidecar), 'utf8');
   }
 
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), ...(tarHash ? ['--run-without-docker', '--manifests-tar-hash', tarHash] : []),
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []),
-  // Hand the per-ecosystem build-tool config (mapped from socket.json) to
-  // Coana's reach-time resolution, as a temp JSON file path.
-  ...(autoManifestConfigPath ? ['--auto-manifest-config', autoManifestConfigPath] : [])];
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
 
   // Build environment variables.
   const coanaEnv = {};
@@ -1915,10 +1909,10 @@ async function performReachabilityAnalysis(options) {
       }
     };
   } finally {
-    // The run no longer needs the temp config file; best-effort cleanup.
-    if (autoManifestConfigPath) {
+    // Best-effort cleanup of the temp sidecar.
+    if (sidecarPath) {
       try {
-        await fs$1.promises.unlink(autoManifestConfigPath);
+        await fs$1.promises.unlink(sidecarPath);
       } catch {
         // File may already be gone or unwritable.
       }
@@ -4282,102 +4276,1238 @@ async function extractBazelToMaven(opts) {
   }
 }
 
-// Delegates Socket facts generation for a JVM build tool to the Coana CLI's
-// `manifest <ecosystem>` command. The build-tool resolution scripts (the Gradle
-// init script and the sbt plugin) live in Coana now, so socket-cli no longer
-// runs them itself; it only asks Coana for the uploadable `.socket.facts.json`.
+// Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
+// phrasing, so most-specific-first substring checks classify reliably.
+function classifyGradleFailure(detail) {
+  const t = (detail || '').toLowerCase();
+  // Check before variant ambiguity.
+  if (t.includes('conflict on capability')) {
+    return 'capability-conflict';
+  }
+  // Zero compatible variants — the opposite of ambiguity below.
+  if (t.includes('no matching variant') || t.includes('no variants of')) {
+    return 'no-matching-variant';
+  }
+  if (t.includes('cannot choose between')) {
+    return 'variant-ambiguity';
+  }
+  if (t.includes('could not get') || t.includes('could not head') || t.includes('status code 401') || t.includes('status code 403') || t.includes('connection refused') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('certification path') || t.includes('peer not authenticated')) {
+    return 'repository-or-network';
+  }
+  if (t.includes('could not find')) {
+    return 'not-found';
+  }
+  return 'other';
+}
+
+// Every kind blocks except variant-ambiguity: the module demonstrably exists
+// and is almost always captured via another configuration, so it's benign for
+// the SBOM (non-blocking, count only). A module that resolves in NO config
+// surfaces as not-found / no-matching-variant, which stay blocking.
+const GRADLE_DIALECT = {
+  label: 'Gradle',
+  classify: classifyGradleFailure,
+  categories: [{
+    key: 'not-found',
+    header: () => `  Not found in any repository:`,
+    blocking: true
+  }, {
+    key: 'no-matching-variant',
+    header: n => `  No compatible variant — ${n} found the module but no variant matched the requested attributes:`,
+    blocking: true
+  }, {
+    key: 'capability-conflict',
+    header: n => `  Capability conflict — ${n} found two modules providing the same capability and cannot use both (add a capability-resolution or module-replacement rule):`,
+    showReason: true,
+    blocking: true
+  }, {
+    key: 'repository-or-network',
+    header: n => `  Repository or network error — ${n} could not reach or authenticate to a repository:`,
+    blocking: true
+  }, {
+    key: 'config-problem',
+    header: n => `  Resolver/configuration problem (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }, {
+    key: 'other',
+    header: n => `  Other resolution failures (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }, {
+    key: 'variant-ambiguity',
+    blocking: false,
+    notice: (n, depCount, configCount) => `Skipped ${depCount} dependency(ies) with ambiguous variant selection in ${configCount} configuration(s) — re-run with --verbose for ${n}'s messages.`
+  }]
+};
+
+// Ivy/sbt resolver: no attribute-based variants, so no variant categories
+// (Gradle-only). Ivy degrades transport failures to "not found".
+function classifyIvyFailure(detail) {
+  const t = (detail || '').toLowerCase();
+  if (t.includes('server access error') || t.includes('download failed') || t.includes('connection timed out') || t.includes('unauthorized') || t.includes('forbidden')) {
+    return 'repository-or-network';
+  }
+  if (t.includes('no resolver found') || t.includes('configuration not found') || t.includes('configuration not public')) {
+    return 'config-problem';
+  }
+  if (t.includes('not found') || t.includes('unresolved dependency')) {
+    return 'not-found';
+  }
+  return 'other';
+}
+
+// Every kind blocks; no non-blocking kind because Ivy has no variant ambiguity.
+const SBT_DIALECT = {
+  label: 'sbt',
+  classify: classifyIvyFailure,
+  categories: [{
+    key: 'not-found',
+    header: () => `  Not found in any repository:`,
+    blocking: true
+  }, {
+    key: 'repository-or-network',
+    header: n => `  Repository or network error — ${n} could not reach or authenticate to a repository:`,
+    blocking: true
+  }, {
+    key: 'config-problem',
+    header: n => `  Resolver/configuration problem (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }, {
+    key: 'other',
+    header: n => `  Other resolution failures (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }]
+};
+
+// Maven's resolver (Aether/maven-resolver): no attribute-based variants. Two
+// failure shapes (artifact-resolution miss with config = scope, dependency-graph
+// build failure with config = "graph") both classify off the root-cause message.
+function classifyMavenFailure(detail) {
+  const t = (detail || '').toLowerCase();
+  if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception')) {
+    return 'repository-or-network';
+  }
+  if (t.includes('could not find artifact') || t.includes('failure to find') || t.includes('could not resolve') || t.includes('no versions available') || t.includes('not found')) {
+    return 'not-found';
+  }
+  // POM exists but can't be read/parsed.
+  if (t.includes('failed to read artifact descriptor') || t.includes('invalid pom') || t.includes('could not parse pom')) {
+    return 'config-problem';
+  }
+  return 'other';
+}
+
+// Every kind blocks; no non-blocking kind because Maven has no variant ambiguity.
+const MAVEN_DIALECT = {
+  label: 'Maven',
+  classify: classifyMavenFailure,
+  categories: [{
+    key: 'not-found',
+    header: () => `  Not found in any repository:`,
+    blocking: true
+  }, {
+    key: 'repository-or-network',
+    header: n => `  Repository or network error — ${n} could not reach or authenticate to a repository:`,
+    blocking: true
+  }, {
+    key: 'config-problem',
+    header: n => `  POM/descriptor problem (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }, {
+    key: 'other',
+    header: n => `  Other resolution failures (reason from ${n}):`,
+    showReason: true,
+    blocking: true
+  }]
+};
+
+// Recognized from the build tool's message; drives wording AND whether the kind
+// is blocking. An unrecognized message degrades to 'other' (blocking) — safe.
+
+// Per-resolver classify + render/score policy.
+
+const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15;
+const RESOLUTION_REPORT_CONFIG_LIMIT = 20;
+
+// Drop a bare "group:name" when a versioned "group:name:v" of the same module
+// is also present: the lenient resolver reports both forms for one failure.
+function dedupCoords(coords) {
+  const set = new Set(coords);
+  const versioned = new Set();
+  for (const c of set) {
+    const p = c.split(':');
+    if (p.length >= 3) {
+      versioned.add(`${p[0]}:${p[1]}`);
+    }
+  }
+  return [...set].filter(c => c.split(':').length >= 3 || !versioned.has(c)).sort();
+}
+function fmtList(list, limit) {
+  const shown = list.slice(0, limit).join(', ');
+  return list.length > limit ? `${shown} (+${list.length - limit} more)` : shown;
+}
+function firstLine(s) {
+  return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
+}
+
+// Severity is per-kind; the exit-code decision lives in the caller. We do NOT
+// cross-reference what resolved elsewhere: the failed selector carries no
+// classifier/type, so relating a failed and a succeeded dep is unsound.
+function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
+  const name = dialect.label;
+  const specOf = new Map(dialect.categories.map(c => [c.key, c]));
+  const isBlocking = cat => specOf.get(cat)?.blocking ?? true;
+
+  // Aggregate by (coord, category): one module can fail with different causes
+  // across configs. Keep first-seen detail, union the configs.
+
+  const byKey = new Map();
+  const keyOf = (coord, category) => `${coord} ${category}`;
+  for (const f of failures) {
+    const category = dialect.classify(f.detail);
+    const key = keyOf(f.coord, category);
+    let info = byKey.get(key);
+    if (!info) {
+      info = {
+        coord: f.coord,
+        category,
+        detail: f.detail,
+        configs: new Set()
+      };
+      byKey.set(key, info);
+    }
+    if (f.config) {
+      info.configs.add(f.config);
+    }
+  }
+  const allInfos = [...byKey.values()];
+  const blockingConfigs = new Set();
+  for (const info of allInfos) {
+    if (isBlocking(info.category)) {
+      for (const c of info.configs) {
+        blockingConfigs.add(c);
+      }
+    }
+  }
+  const blockingFailed = [...blockingConfigs].sort();
+  const succeeded = scannedConfigs.filter(c => !blockingConfigs.has(c)).sort();
+  const groups = dialect.categories.map(spec => ({
+    spec,
+    infos: dedupCoords(allInfos.filter(i => i.category === spec.key).map(i => i.coord)).map(c => byKey.get(keyOf(c, spec.key)))
+  })).filter(g => g.infos.length);
+  const blockingGroups = groups.filter(g => g.spec.blocking);
+  const nonBlockingGroups = groups.filter(g => !g.spec.blocking);
+  const blockingCount = blockingGroups.reduce((n, g) => n + g.infos.length, 0);
+  const hasBlockingFailures = blockingCount > 0;
+  const willFail = hasBlockingFailures && !opts.ignoreUnresolved;
+  const out = [];
+  if (hasBlockingFailures) {
+    out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies) in ${blockingFailed.length} configuration(s):` : `Could not resolve ${blockingCount} dependency(ies) in ${blockingFailed.length} configuration(s):`);
+    for (const {
+      infos,
+      spec
+    } of blockingGroups) {
+      out.push('');
+      out.push(spec.header ? spec.header(name) : '');
+      for (const info of infos.slice(0, RESOLUTION_REPORT_ARTIFACT_LIMIT)) {
+        const fl = firstLine(info.detail);
+        const reasonSuffix = spec.showReason && fl ? `  [${fl}]` : '';
+        out.push(`    - ${info.coord}${reasonSuffix}`);
+      }
+      if (infos.length > RESOLUTION_REPORT_ARTIFACT_LIMIT) {
+        out.push(`    … and ${infos.length - RESOLUTION_REPORT_ARTIFACT_LIMIT} more`);
+      }
+    }
+    out.push('');
+    if (succeeded.length) {
+      out.push(`Resolution succeeded in: ${fmtList(succeeded, RESOLUTION_REPORT_CONFIG_LIMIT)}`);
+    }
+    if (blockingFailed.length) {
+      out.push(`Resolution failed in: ${fmtList(blockingFailed, RESOLUTION_REPORT_CONFIG_LIMIT)}`);
+    }
+    if (willFail) {
+      out.push('');
+      out.push(`To proceed, re-run with either:`);
+      out.push(`    --ignore-unresolved`);
+      if (blockingFailed.length) {
+        out.push(`    --exclude-configs '${blockingFailed.join(',')}'`);
+      }
+    }
+    out.push('');
+    out.push(`Re-run with --verbose for ${name}'s full messages.`);
+  }
+  const notices = [];
+  for (const {
+    infos,
+    spec
+  } of nonBlockingGroups) {
+    if (!spec.notice) {
+      continue;
+    }
+    const configCount = new Set(infos.flatMap(i => [...i.configs])).size;
+    notices.push(spec.notice(name, infos.length, configCount));
+  }
+  const detailLines = [`${name}'s full message for each unresolved dependency:`];
+  for (const info of allInfos) {
+    detailLines.push('');
+    detailLines.push(`  ${info.coord}:`);
+    for (const line of (info.detail || '(no message)').split('\n')) {
+      detailLines.push(`    ${line}`);
+    }
+  }
+  return {
+    summary: out.join('\n'),
+    details: detailLines.join('\n'),
+    hasBlockingFailures,
+    nonBlockingNotice: notices.join('\n')
+  };
+}
+function dialectFor(tool) {
+  switch (tool) {
+    case 'gradle':
+      return GRADLE_DIALECT;
+    case 'sbt':
+      return SBT_DIALECT;
+    case 'maven':
+      return MAVEN_DIALECT;
+  }
+}
+function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'gradle', opts = {}) {
+  return renderResolutionReport(failures, scannedConfigs, dialectFor(tool), opts);
+}
+
+// No sources/targets here: those are local absolute paths, returned in-memory
+// as ResolvedArtifactPaths, never serialized into the SBOM.
+
+// Resolved on-disk paths for a --with-files run, keyed by coordinate. `targets`
+// = classpath entries (jars / module output dirs); `sources` = module source
+// roots.
+
+// Coordinate-based (not `id`-based) so it also matches foreign SBOMs like
+// CycloneDX. Empty segments dropped.
+function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
+  return [groupId, artifactId, type, classifier, version].filter(Boolean).join(':');
+}
+
+const PURL_TYPE_MAVEN = 'maven';
+function assembleFacts(parsed, opts = {}) {
+  const fileExists = opts.fileExists ?? fs$1.existsSync;
+  const perRoot = buildPerRoot(parsed);
+  const {
+    directByRoot,
+    finalNodes
+  } = mergePathSensitive(perRoot);
+  const tool = parsed.tool || 'gradle';
+  const components = buildComponents(finalNodes);
+  const projects = opts.emitProjects === false ? [] : buildProjects(parsed, finalNodes, directByRoot, perRoot);
+  const metadata = {
+    format: 'socket-facts-sbom',
+    tool,
+    toolVersion: parsed.toolVersion,
+    ...(parsed.javaVersion ? {
+      javaVersion: parsed.javaVersion
+    } : {})
+  };
+  const facts = projects.length ? {
+    metadata,
+    projects,
+    components
+  } : {
+    metadata,
+    components
+  };
+  return {
+    facts,
+    report: buildReport(parsed),
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], fileExists)
+  };
+}
+function gav(group, name, version) {
+  return `${group}:${name}:${version}`;
+}
+function shortHash(s) {
+  return require$$0.createHash('sha256').update(s, 'utf8').digest('hex').slice(0, 12);
+}
+function buildPerRoot(parsed) {
+  const out = new Map();
+  for (const [rootId, r] of parsed.roots) {
+    const childrenByParent = new Map();
+    for (const [p, c] of r.edges) {
+      if (!r.nodes.has(p) || !r.nodes.has(c)) {
+        continue;
+      }
+      let set = childrenByParent.get(p);
+      if (!set) {
+        set = new Set();
+        childrenByParent.set(p, set);
+      }
+      set.add(c);
+    }
+    const nodes = new Map();
+    for (const [coordId, n] of r.nodes) {
+      nodes.set(coordId, {
+        coord: n.coord,
+        children: [...(childrenByParent.get(coordId) ?? [])].sort(),
+        direct: n.direct,
+        targets: n.targets
+      });
+    }
+    out.set(rootId, {
+      projectKey: r.projectKey,
+      prod: r.prod,
+      nodes
+    });
+  }
+  return out;
+}
+
+// A coordinate with identical subtrees everywhere collapses to one node (id =
+// coordId); divergent subtrees each get a content-addressed id
+// (`<coordId>#<subtree-hash>`) so per-subproject overrides stay distinct.
+function mergePathSensitive(perRoot) {
+  const memo = new Map();
+  const nodesOf = rootId => perRoot.get(rootId)?.nodes;
+  function computeSig(rootId, coordId, onPath) {
+    const memoKey = rootId + ' ' + coordId;
+    const cached = memo.get(memoKey);
+    if (cached !== undefined) {
+      return cached;
+    }
+    if (onPath.has(coordId)) {
+      // Cycle: back-edge as leaf.
+      return coordId;
+    }
+    const node = nodesOf(rootId)?.get(coordId);
+    if (!node) {
+      return coordId;
+    }
+    onPath.add(coordId);
+    const childSigs = node.children.map(c => computeSig(rootId, c, onPath));
+    onPath.delete(coordId);
+    // Digest, not the raw string: caching expanded subtree strings OOMs on
+    // reconverging DAGs; a fixed-size digest keeps the pass O(V+E).
+    const sig = coordId + '{' + childSigs.join(',') + '}';
+    const digest = require$$0.createHash('sha256').update(sig, 'utf8').digest('hex').slice(0, 16);
+    memo.set(memoKey, digest);
+    return digest;
+  }
+
+  // Sorted iteration keeps cyclic-graph signatures stable run-to-run.
+  const sigsByCoord = new Map();
+  for (const rootId of [...perRoot.keys()].sort()) {
+    const nodes = perRoot.get(rootId).nodes;
+    for (const coordId of [...nodes.keys()].sort()) {
+      const sig = computeSig(rootId, coordId, new Set());
+      let set = sigsByCoord.get(coordId);
+      if (!set) {
+        set = new Set();
+        sigsByCoord.set(coordId, set);
+      }
+      set.add(sig);
+    }
+  }
+  const divergent = coordId => (sigsByCoord.get(coordId)?.size ?? 0) > 1;
+  const emittedIdMemo = new Map();
+  const emittedIdFor = (rootId, coordId) => {
+    const k = rootId + ' ' + coordId;
+    let v = emittedIdMemo.get(k);
+    if (v === undefined) {
+      v = divergent(coordId) ? coordId + '#' + shortHash(computeSig(rootId, coordId, new Set())) : coordId;
+      emittedIdMemo.set(k, v);
+    }
+    return v;
+  };
+  const finalNodes = new Map();
+  const directByRoot = new Map();
+  for (const [rootId, {
+    nodes,
+    prod
+  }] of perRoot) {
+    for (const [coordId, node] of nodes) {
+      const eid = emittedIdFor(rootId, coordId);
+      let fn = finalNodes.get(eid);
+      if (!fn) {
+        fn = {
+          coord: node.coord,
+          children: new Set(),
+          prod: false,
+          direct: false,
+          targets: new Set()
+        };
+        finalNodes.set(eid, fn);
+      }
+      if (prod) {
+        fn.prod = true;
+      }
+      if (node.direct) {
+        fn.direct = true;
+      }
+      for (const c of node.children) {
+        fn.children.add(emittedIdFor(rootId, c));
+      }
+      for (const t of node.targets) {
+        fn.targets.add(t);
+      }
+      if (node.direct) {
+        let d = directByRoot.get(rootId);
+        if (!d) {
+          d = new Set();
+          directByRoot.set(rootId, d);
+        }
+        d.add(eid);
+      }
+    }
+  }
+  return {
+    finalNodes,
+    directByRoot
+  };
+}
+function buildComponents(finalNodes) {
+  return [...finalNodes.keys()].sort().map(id => {
+    const fn = finalNodes.get(id);
+    const c = fn.coord;
+    const qualifiers = {
+      __proto__: null
+    };
+    if (c.classifier) {
+      qualifiers['classifier'] = c.classifier;
+    }
+    if (c.ext) {
+      qualifiers['ext'] = c.ext;
+    }
+    const comp = {
+      type: PURL_TYPE_MAVEN,
+      namespace: c.group,
+      name: c.name,
+      ...(c.version ? {
+        version: c.version
+      } : {}),
+      ...(Object.keys(qualifiers).length ? {
+        qualifiers
+      } : {}),
+      id
+    };
+    if (fn.direct) {
+      comp.direct = true;
+    }
+    if (!fn.prod) {
+      comp.dev = true;
+    }
+    if (fn.children.size) {
+      comp.dependencies = [...fn.children].sort();
+    }
+    return comp;
+  });
+}
+function buildProjects(parsed, finalNodes, directByRoot, perRoot) {
+  const idsByGav = new Map();
+  for (const [id, fn] of finalNodes) {
+    const key = gav(fn.coord.group, fn.coord.name, fn.coord.version ?? '');
+    let set = idsByGav.get(key);
+    if (!set) {
+      set = new Set();
+      idsByGav.set(key, set);
+    }
+    set.add(id);
+  }
+  const directByProject = new Map();
+  for (const [rootId, ids] of directByRoot) {
+    const pk = perRoot.get(rootId)?.projectKey ?? '';
+    let set = directByProject.get(pk);
+    if (!set) {
+      set = new Set();
+      directByProject.set(pk, set);
+    }
+    for (const id of ids) {
+      set.add(id);
+    }
+  }
+  const projects = [...parsed.projects.values()].map(p => {
+    const entry = {
+      type: PURL_TYPE_MAVEN,
+      namespace: p.group,
+      name: p.name,
+      ...(p.version ? {
+        version: p.version
+      } : {}),
+      subprojectDir: p.dir,
+      dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort(),
+      resolvedAs: [...(idsByGav.get(gav(p.group, p.name, p.version)) ?? [])].sort()
+    };
+    return entry;
+  });
+  projects.sort((a, b) => {
+    const ka = `${a.subprojectDir} ${a.namespace}:${a.name}`;
+    const kb = `${b.subprojectDir} ${b.namespace}:${b.name}`;
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+  return projects;
+}
+function unionInto(map, key, add) {
+  if (!add.length) {
+    return;
+  }
+  const acc = map.get(key);
+  if (acc) {
+    for (const f of add) {
+      if (!acc.includes(f)) {
+        acc.push(f);
+      }
+    }
+  } else {
+    map.set(key, [...add]);
+  }
+}
+function buildArtifactPaths(finalNodes, projects, fileExists) {
+  const projectsByGav = new Map();
+  for (const p of projects) {
+    projectsByGav.set(gav(p.group, p.name, p.version), {
+      sources: p.sources,
+      targets: p.targets
+    });
+  }
+  const targetsByCoord = new Map();
+  const targetsByGav = new Map();
+  const sourcesByCoord = new Map();
+  const coords = new Set();
+  for (const fn of finalNodes.values()) {
+    const c = fn.coord;
+    const coordKey = mavenCoordinateKey(c.group, c.name, c.ext, c.classifier, c.version);
+    if (!coordKey) {
+      continue;
+    }
+    coords.add(coordKey);
+    const pi = projectsByGav.get(gav(c.group, c.name, c.version ?? ''));
+    const sources = (pi?.sources ?? []).filter(fileExists);
+    const targets = [...new Set([...fn.targets, ...(pi?.targets ?? [])])].filter(fileExists).sort();
+    if (sources.length) {
+      sourcesByCoord.set(coordKey, sources);
+    }
+    if (!targets.length) {
+      continue;
+    }
+    targetsByCoord.set(coordKey, targets);
+    const gavKey = mavenCoordinateKey(c.group, c.name, undefined, undefined, c.version);
+    if (gavKey) {
+      const acc = targetsByGav.get(gavKey);
+      if (acc) {
+        for (const f of targets) {
+          if (!acc.includes(f)) {
+            acc.push(f);
+          }
+        }
+      } else {
+        targetsByGav.set(gavKey, [...targets]);
+      }
+    }
+  }
+  // A top-level module is a `project` but usually not a dependency node, so its
+  // source roots (where reachability starts) are missed by the node loop above;
+  // emit first-party module paths here.
+  for (const p of projects) {
+    const coordKey = mavenCoordinateKey(p.group, p.name, undefined, undefined, p.version);
+    if (!coordKey) {
+      continue;
+    }
+    coords.add(coordKey);
+    unionInto(sourcesByCoord, coordKey, p.sources.filter(fileExists));
+    const targets = p.targets.filter(fileExists);
+    unionInto(targetsByCoord, coordKey, targets);
+    unionInto(targetsByGav, coordKey, targets);
+  }
+  return {
+    targetsByCoord,
+    targetsByGav,
+    sourcesByCoord,
+    coords
+  };
+}
+function buildReport(parsed) {
+  const seen = new Set();
+  const failures = parsed.failures.filter(f => {
+    const key = `${f.coord}|${f.detail}|${f.config}`;
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  });
+  return {
+    failures,
+    scannedConfigs: parsed.scannedConfigs
+  };
+}
+
+// PATH fallback when no `bin` and no project wrapper.
+const DEFAULT_BUILD_TOOL_BIN = {
+  __proto__: null,
+  gradle: 'gradle',
+  maven: 'mvn',
+  sbt: 'sbt'
+};
+
+// Project-local wrapper, preferred because it pins the expected build-tool
+// version. sbt has no wrapper convention. POSIX names only (no win32 target).
+const BUILD_TOOL_WRAPPER = {
+  __proto__: null,
+  gradle: 'gradlew',
+  maven: 'mvnw'
+};
+function resolveBuildToolBin(tool, projectDir, bin) {
+  if (bin) {
+    return bin;
+  }
+  const wrapperName = BUILD_TOOL_WRAPPER[tool];
+  if (wrapperName && fs$1.existsSync(path.resolve(projectDir, wrapperName))) {
+    return `./${wrapperName}`;
+  }
+  return DEFAULT_BUILD_TOOL_BIN[tool];
+}
+
+// Line-protocol the build-tool scripts emit to a records file (NOT stdout — sbt
+// prints unsilenceable resolution noise there). One record per line, fields
+// backslash-escaped (\\, \t, \n, \r) so a value can't break framing:
 //
-// The resolved artifact-paths sidecar is intentionally NOT requested here: it
-// only matters for reachability analysis, which is internal to Coana, so Coana
-// emits it itself when it runs reachability. `socket manifest` only needs the
-// facts file.
+//   <tag>\t<field>\t<field>...
 //
-// `spawnCoanaDlx` resolves the Coana CLI via dlx (or a local build when
-// `SOCKET_CLI_COANA_LOCAL_PATH` is set). `bin` (the gradle/maven/sbt executable)
-// is always resolved by the caller to a concrete default (`<cwd>/gradlew`, or
-// `mvn`/`sbt` on PATH) before we get here, so it is forwarded verbatim; the
-// empty guard below is just a cheap safeguard against passing `--bin ''`.
-async function runCoanaManifestFacts({
+//   meta        tool  toolVersion  javaVersion
+//   project     projectKey  group  name  version  dir
+//   projectSrc  projectKey  path                         (--with-files only)
+//   projectTgt  projectKey  path                         (--with-files only)
+//   root        rootId  projectKey  config  prod(0|1)
+//   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)
+//   edge        rootId  parentCoordId  childCoordId
+//   file        rootId  coordId  path                    (--with-files only)
+//   scanned     config
+//   failure     coord  detail  config
+//
+// A `root` is one (subproject, configuration) resolution root; `coordId` is the
+// coordinate key (`group:name:ext:classifier:version`, empty segments dropped),
+// used opaquely as the per-root node key. Unknown tags are ignored.
+
+function unescapeField(s) {
+  if (!s.includes('\\')) {
+    return s;
+  }
+  let out = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const c = s[i];
+    if (c === '\\' && i + 1 < s.length) {
+      const n = s[++i];
+      out += n === 't' ? '\t' : n === 'n' ? '\n' : n === 'r' ? '\r' : n;
+    } else {
+      out += c;
+    }
+  }
+  return out;
+}
+function bool(s) {
+  return s === '1' || s === 'true';
+}
+function parseRecords(text) {
+  const result = {
+    tool: '',
+    toolVersion: '',
+    javaVersion: '',
+    projects: new Map(),
+    roots: new Map(),
+    scannedConfigs: [],
+    failures: []
+  };
+  const scanned = new Set();
+  const root = id => {
+    let r = result.roots.get(id);
+    if (!r) {
+      r = {
+        rootId: id,
+        projectKey: '',
+        config: '',
+        prod: false,
+        nodes: new Map(),
+        edges: []
+      };
+      result.roots.set(id, r);
+    }
+    return r;
+  };
+  const project = key => {
+    let p = result.projects.get(key);
+    if (!p) {
+      p = {
+        projectKey: key,
+        group: '',
+        name: '',
+        version: '',
+        dir: '',
+        sources: [],
+        targets: []
+      };
+      result.projects.set(key, p);
+    }
+    return p;
+  };
+  for (const rawLine of text.split('\n')) {
+    if (!rawLine) {
+      continue;
+    }
+    const f = rawLine.split('\t').map(unescapeField);
+    switch (f[0]) {
+      case 'meta':
+        result.tool = f[1] ?? '';
+        result.toolVersion = f[2] ?? '';
+        result.javaVersion = f[3] ?? '';
+        break;
+      case 'project':
+        {
+          const p = project(f[1] ?? '');
+          p.group = f[2] ?? '';
+          p.name = f[3] ?? '';
+          p.version = f[4] ?? '';
+          p.dir = f[5] ?? '';
+          break;
+        }
+      case 'projectSrc':
+        if (f[2]) {
+          project(f[1] ?? '').sources.push(f[2]);
+        }
+        break;
+      case 'projectTgt':
+        if (f[2]) {
+          project(f[1] ?? '').targets.push(f[2]);
+        }
+        break;
+      case 'root':
+        {
+          const r = root(f[1] ?? '');
+          r.projectKey = f[2] ?? '';
+          r.config = f[3] ?? '';
+          r.prod = bool(f[4]);
+          break;
+        }
+      case 'node':
+        {
+          const r = root(f[1] ?? '');
+          const coordId = f[2] ?? '';
+          r.nodes.set(coordId, {
+            coordId,
+            coord: {
+              group: f[3] ?? '',
+              name: f[4] ?? '',
+              version: f[5] ?? '',
+              ext: f[6] ?? '',
+              classifier: f[7] ?? ''
+            },
+            direct: bool(f[8]),
+            targets: []
+          });
+          break;
+        }
+      case 'edge':
+        {
+          const parent = f[2] ?? '';
+          const child = f[3] ?? '';
+          if (parent !== child) {
+            root(f[1] ?? '').edges.push([parent, child]);
+          }
+          break;
+        }
+      case 'file':
+        {
+          const node = root(f[1] ?? '').nodes.get(f[2] ?? '');
+          if (node && f[3]) {
+            node.targets.push(f[3]);
+          }
+          break;
+        }
+      case 'scanned':
+        if (f[1]) {
+          scanned.add(f[1]);
+        }
+        break;
+      case 'failure':
+        if (f[1]) {
+          result.failures.push({
+            coord: f[1],
+            detail: f[2] ?? '',
+            config: f[3] ?? ''
+          });
+        }
+        break;
+    }
+  }
+  result.scannedConfigs = [...scanned].sort();
+  return result;
+}
+
+const FACTS_TASK = 'socketFacts';
+const SBT_PLUGIN_FILENAME = 'SocketFactsPlugin.scala';
+
+// Bundled emitter assets, copied into dist by the rollup build.
+function manifestScriptsPath(...parts) {
+  return path.join(constants.default.distPath, 'manifest-scripts', ...parts);
+}
+
+// Don't throw on a non-zero exit: the script emits failure records, so a usable
+// records file still exists. A non-exit spawn error (e.g. missing executable)
+// propagates.
+async function runNeverThrow(bin, args, opts) {
+  try {
+    const result = await spawn.spawn(bin, args, {
+      cwd: opts.projectDir,
+      stdio: opts.stdio ?? 'inherit',
+      ...(opts.env ? {
+        env: opts.env
+      } : {}),
+      ...(opts.signal ? {
+        signal: opts.signal
+      } : {})
+    });
+    return {
+      code: result.code,
+      stdout: typeof result.stdout === 'string' ? result.stdout : '',
+      stderr: typeof result.stderr === 'string' ? result.stderr : ''
+    };
+  } catch (e) {
+    // A build tool that exits non-zero rejects with the spawn-result shape: a
+    // numeric exit `code` plus captured stdout/stderr. Return it so the caller
+    // can assemble failure records / surface the output. Anything else — e.g. a
+    // missing executable, whose `code` is a string like 'ENOENT' — propagates.
+    // This mirrors how utils/dlx.mts classifies spawn failures (a numeric `code`
+    // is a real process exit); the registry's isSpawnError is avoided here
+    // because it is currently broken and never matches.
+    if (e !== null && typeof e === 'object' && typeof e.code === 'number') {
+      const err = e;
+      return {
+        code: err.code,
+        stdout: typeof err.stdout === 'string' ? err.stdout : '',
+        stderr: typeof err.stderr === 'string' ? err.stderr : ''
+      };
+    }
+    throw e;
+  }
+}
+async function withTmpDir(prefix, fn) {
+  const tmpDir = await fs$1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
+  try {
+    return await fn(tmpDir);
+  } finally {
+    await fs$1.promises.rm(tmpDir, {
+      recursive: true,
+      force: true
+    }).catch(() => {});
+  }
+}
+async function writeSbtPlugin(globalBase) {
+  const src = await fs$1.promises.readFile(manifestScriptsPath('socket-facts.plugin.scala'), 'utf8');
+  const pluginsDir = path.join(globalBase, 'plugins');
+  await fs$1.promises.mkdir(pluginsDir, {
+    recursive: true
+  });
+  await fs$1.promises.writeFile(path.join(pluginsDir, SBT_PLUGIN_FILENAME), src);
+}
+async function assembleFromRecords(out, recordsFile) {
+  const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
+  const {
+    artifactPaths,
+    facts,
+    report
+  } = assembleFacts(parseRecords(text));
+  return {
+    code: out.code,
+    facts,
+    report,
+    artifactPaths,
+    stderr: out.stderr,
+    stdout: out.stdout
+  };
+}
+
+// Missing only in an unbuilt local checkout. Fail loudly: without the extension,
+// Maven silently emits an empty SBOM.
+function assertMavenExtensionBuilt(jarPath) {
+  if (fs$1.existsSync(jarPath)) {
+    return;
+  }
+  throw new Error(`Maven manifest extension jar not found at ${jarPath}. It is bundled in the published CLI; for local dev build it with: bash src/commands/manifest/scripts/maven-extension/build-jar.sh`);
+}
+
+// Runs the build-tool script (which emits a records file) and assembles it.
+// Writes no files; the caller persists facts or consumes artifactPaths.
+async function runManifestScript(tool, opts) {
+  switch (tool) {
+    case 'gradle':
+      return await runGradle(opts);
+    case 'sbt':
+      return await runSbt(opts);
+    case 'maven':
+      return await runMaven(opts);
+  }
+}
+function commonProps(opts, prefix) {
+  const props = [];
+  if (opts.withFiles) {
+    props.push(`${prefix}socket.withFiles=true`);
+  }
+  if (opts.populateFilesFor) {
+    props.push(`${prefix}socket.populateFilesFor=${opts.populateFilesFor}`);
+  }
+  if (opts.includeConfigs) {
+    props.push(`${prefix}socket.includeConfigs=${opts.includeConfigs}`);
+  }
+  if (opts.excludeConfigs) {
+    props.push(`${prefix}socket.excludeConfigs=${opts.excludeConfigs}`);
+  }
+  return props;
+}
+async function runGradle(opts) {
+  const initScript = manifestScriptsPath('socket-facts.init.gradle');
+  return await withTmpDir('socket-gradle-facts-', async tmp => {
+    const recordsFile = path.join(tmp, 'records.tsv');
+    const bin = resolveBuildToolBin('gradle', opts.projectDir, opts.bin);
+    // Disable the configuration cache: the init script's legacy
+    // resolvedConfiguration API and shared accumulator aren't cache-safe.
+    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), FACTS_TASK, '--no-daemon', '--console=plain'];
+    const out = await runNeverThrow(bin, args, opts);
+    return await assembleFromRecords(out, recordsFile);
+  });
+}
+async function runSbt(opts) {
+  return await withTmpDir('socket-sbt-facts-', async globalBase => {
+    await writeSbtPlugin(globalBase);
+    const recordsFile = path.join(globalBase, 'records.tsv');
+    const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
+    // Fresh per-run global base (not ~/.sbt): sbt executes everything under
+    // plugins/, so a shared path is a code-injection surface. BSP off for this run.
+    const props = [`-Dsbt.global.base=${globalBase}`, '-Dsbt.server.autostart=false', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
+    // sbt's launcher doesn't always honor JAVA_HOME; never override a
+    // caller-supplied --java-home.
+    const javaHome = opts.env?.['JAVA_HOME'] ?? process.env['JAVA_HOME'];
+    const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
+    const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', FACTS_TASK];
+    const out = await runNeverThrow(bin, args, opts);
+    return await assembleFromRecords(out, recordsFile);
+  });
+}
+async function runMaven(opts) {
+  const jarPath = manifestScriptsPath('maven-extension', 'coana-maven-extension.jar');
+  assertMavenExtensionBuilt(jarPath);
+  return await withTmpDir('socket-maven-facts-', async tmp => {
+    const recordsFile = path.join(tmp, 'records.tsv');
+    const bin = resolveBuildToolBin('maven', opts.projectDir, opts.bin);
+    // `validate` is the cheapest phase that triggers the afterSessionEnd
+    // extension; no compile needed (analysis uses configured paths, not classes).
+    const props = [`-Dmaven.ext.class.path=${jarPath}`, '-Dcoana.task=socket-facts', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
+    const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
+    const out = await runNeverThrow(bin, args, opts);
+    return await assembleFromRecords(out, recordsFile);
+  });
+}
+
+// Frozen contract with `coana run --compute-artifacts-sidecar`; change only in
+// sync with the coana consumer. Per coordinate: targets/sources present →
+// resolved (coana uses the paths); both empty → resolved with no artifact
+// (pom/BOM), not a failure; absent → coana degrades that vuln to precomputed.
+
+// Bare array, no schema version: socket-cli pins the coana version, so producer
+// and consumer never drift.
+
+// Keyed by full coordinate; unions paths so multiple build roots merge into one.
+
+function pushUnique(into, from) {
+  for (const f of from) {
+    if (!into.includes(f)) {
+      into.push(f);
+    }
+  }
+}
+function addEntry(acc, artifactPaths, group, name, version, ext, classifier) {
+  const coordKey = mavenCoordinateKey(group, name, ext || undefined, classifier ?? undefined, version || undefined);
+  if (!coordKey) {
+    return;
+  }
+  let entry = acc.get(coordKey);
+  if (!entry) {
+    entry = {
+      group,
+      name,
+      version,
+      ext,
+      classifier,
+      targets: [],
+      sources: []
+    };
+    acc.set(coordKey, entry);
+  }
+  pushUnique(entry.targets, artifactPaths.targetsByCoord.get(coordKey) ?? []);
+  pushUnique(entry.sources, artifactPaths.sourcesByCoord.get(coordKey) ?? []);
+}
+
+// Emit an entry for every SBOM component AND every first-party project: a
+// top-level module is a project, not a dependency component, yet its source
+// roots are where reachability starts, so the sidecar must carry them.
+function accumulateSidecar(acc, facts, artifactPaths) {
+  for (const comp of facts.components) {
+    addEntry(acc, artifactPaths, comp.namespace ?? '', comp.name, comp.version ?? '', comp.qualifiers?.['ext'] ?? '', comp.qualifiers?.['classifier'] ?? null);
+  }
+  // First-party modules have no ext/classifier.
+  for (const proj of facts.projects ?? []) {
+    addEntry(acc, artifactPaths, proj.namespace ?? '', proj.name, proj.version ?? '', '', null);
+  }
+}
+function serializeSidecar(acc) {
+  const resolved = [...acc.values()];
+  for (const entry of resolved) {
+    entry.targets.sort();
+    entry.sources.sort();
+  }
+  resolved.sort((a, b) => {
+    const ka = `${a.group}:${a.name}:${a.ext}:${a.classifier ?? ''}:${a.version}`;
+    const kb = `${b.group}:${b.name}:${b.ext}:${b.classifier ?? ''}:${b.version}`;
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+  return resolved;
+}
+
+// Last N non-empty lines of the captured build output, for diagnosing a crash
+// without forcing a --verbose rebuild.
+function tailBuildOutput(stdout, stderr) {
+  const combined = [stdout, stderr].map(s => s.trimEnd()).filter(Boolean).join('\n');
+  return combined.split('\n').slice(-40).join('\n');
+}
+
+// Runs the bundled build-tool resolution script for a JVM project and writes
+// `.socket.facts.json`. `withFiles` (reachability only) additionally folds
+// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// a non-zero exit code and returns (matching the `--pom` generator) unless
+// `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
+// dependency — always fails.
+async function runManifestFacts({
   bin,
   buildOpts,
-  buildOptsFlag,
   cwd,
   ecosystem,
   excludeConfigs,
   ignoreUnresolved,
   includeConfigs,
-  verbose
+  sidecarAcc,
+  verbose,
+  withFiles
 }) {
-  // Pin the facts output location explicitly rather than relying on Coana's
-  // "project root" default. `factsPath` is then the single source of truth for
-  // both what we tell Coana to write and what we verify exists below, so the
-  // two can't drift apart if Coana's default ever changes. This is deliberately
-  // NOT user-configurable: Socket facts always land in the project root so that
-  // `socket scan create <project>` finds them (see cmd-manifest-scala.mts, which
-  // rejects --out/--stdout in facts mode).
-  const factsDir = cwd;
-  const factsFile = constants.default.DOT_SOCKET_DOT_FACTS_JSON;
-  const factsPath = path.join(factsDir, factsFile);
-  // `coana manifest <ecosystem> <path>` emits `.socket.facts.json` by default;
-  // there is no `--facts` flag (the artifact-paths sidecar is reachability-
-  // internal and not requested here).
-  const coanaArgs = ['manifest', ecosystem, cwd, '--output-dir', factsDir, '--output-file', factsFile];
-  if (bin) {
-    coanaArgs.push('--bin', bin);
-  }
-  if (includeConfigs) {
-    coanaArgs.push('--include-configs', includeConfigs);
-  }
-  if (excludeConfigs) {
-    coanaArgs.push('--exclude-configs', excludeConfigs);
-  }
-  if (ignoreUnresolved) {
-    coanaArgs.push('--ignore-unresolved');
+  const factsPath = path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  logger.logger.log(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
+  const scriptOpts = {
+    bin: bin || undefined,
+    excludeConfigs: excludeConfigs || undefined,
+    includeConfigs: includeConfigs || undefined,
+    projectDir: cwd,
+    // Stream the build tool's output only when asked; otherwise capture it and
+    // show a spinner, surfacing the output only if the build crashes.
+    stdio: verbose ? 'inherit' : 'pipe',
+    toolOpts: buildOpts,
+    withFiles
+  };
+  const {
+    spinner
+  } = constants.default;
+  let result;
+  try {
+    if (verbose) {
+      logger.logger.info(`(Running ${ecosystem} with output streaming; this can take a while.)`);
+      result = await runManifestScript(ecosystem, scriptOpts);
+    } else {
+      logger.logger.info(`(No live output; pass --verbose to stream the ${ecosystem} build output.)`);
+      spinner.start(`Resolving ${ecosystem} dependencies ...`);
+      result = await runManifestScript(ecosystem, scriptOpts);
+      if (result.code === 0) {
+        spinner.successAndStop(`Resolved ${ecosystem} dependencies.`);
+      } else {
+        spinner.failAndStop(`${ecosystem} build exited with code ${result.code}.`);
+      }
+    }
+  } catch (e) {
+    // Only a spawn-level failure (e.g. the build tool missing from PATH) reaches
+    // here; runNeverThrow returns non-zero build exits rather than throwing.
+    if (!verbose) {
+      spinner.failAndStop(`Failed to run ${ecosystem}.`);
+    }
+    process.exitCode = 1;
+    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${e}` : ' (run with --verbose for details).'));
+    return;
   }
-  if (verbose) {
-    coanaArgs.push('--debug');
+  const {
+    artifactPaths,
+    code,
+    facts,
+    report,
+    stderr,
+    stdout
+  } = result;
+  const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
+    ignoreUnresolved
+  });
+  if (rendered.hasBlockingFailures) {
+    if (ignoreUnresolved) {
+      logger.logger.warn(rendered.summary);
+    } else {
+      process.exitCode = 1;
+      logger.logger.fail(rendered.summary);
+      if (verbose && rendered.details) {
+        logger.logger.log(rendered.details);
+      }
+      return;
+    }
   }
-  // `--gradle-opts` / `--sbt-opts` are variadic on the Coana side; keep them
-  // last so the pass-through values don't swallow any following flags.
-  if (buildOpts.length) {
-    coanaArgs.push(buildOptsFlag, ...buildOpts);
+  if (rendered.nonBlockingNotice) {
+    logger.logger.info(rendered.nonBlockingNotice);
   }
-  logger.logger.log(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
-  if (verbose) {
-    logger.logger.log('[VERBOSE] coana args:', coanaArgs);
+  if (verbose && rendered.details) {
+    logger.logger.log(rendered.details);
   }
 
-  // Stream Coana's output so the user sees build-tool progress and Coana's own
-  // "Socket facts file written to: ..." line.
-  const result = await utils.spawnCoanaDlx(coanaArgs, undefined, {
-    cwd
-  }, {
-    stdio: 'inherit'
-  });
-  if (!result.ok) {
+  // A non-zero build exit with no usable output (no graph, no first-party
+  // modules, no failure records) means the build died before the socketFacts
+  // task emitted anything — a script/plugin compile error, OOM, or an unchecked
+  // exception in the extension. The build tool's own exit is the only signal, so
+  // fail closed rather than silently dropping the ecosystem with an empty SBOM
+  // (the empty-facts branch below would otherwise just log "nothing to upload").
+  if (code !== 0 && !facts.components.length && !facts.projects?.length && !report.failures.length) {
+    if (!verbose) {
+      const tail = tailBuildOutput(stdout, stderr);
+      if (tail) {
+        logger.logger.group('Build output:');
+        logger.logger.error(tail);
+        logger.logger.groupEnd();
+      }
+    }
+    // A crashed build is a process failure (missing JDK/build tool, unparseable
+    // project, OOM, plugin error), not an unresolved dependency, so it fails
+    // regardless of `ignoreUnresolved` — that flag only tolerates dependencies a
+    // successful run couldn't resolve.
     process.exitCode = 1;
-    logger.logger.fail(result.message || 'Coana failed to generate Socket facts');
+    logger.logger.fail(`The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`);
     return;
   }
-  // A zero exit code doesn't guarantee a facts file was written: Coana skips
-  // emitting it when there are no resolvable dependencies (e.g. with
-  // --ignore-unresolved). We pinned the output to `factsPath` above, so confirm
-  // it exists before claiming success; otherwise the "next step: socket scan
-  // create" line would mislead.
-  if (!fs$1.existsSync(factsPath)) {
-    logger.logger.warn(`Coana completed but wrote no ${factsFile} (no resolvable dependencies?); nothing to upload.`);
+
+  // Nothing resolved at all — no dependencies and no first-party modules. A
+  // project with only first-party modules (empty components, non-empty projects)
+  // still has source roots reachability needs, so it must be written.
+  if (!facts.components.length && !facts.projects?.length) {
+    logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
+  await fs$1.promises.writeFile(factsPath, JSON.stringify(facts, null, 2), 'utf8');
+  if (withFiles && sidecarAcc) {
+    accumulateSidecar(sidecarAcc, facts, artifactPaths);
+  }
   logger.logger.success('Generated Socket facts');
-  logger.logger.log('');
-  logger.logger.log('Next step is to generate a Scan by running the `socket scan create` command on the same directory.');
 }
 
-// Generates a `.socket.facts.json` for a Gradle project by delegating to the
-// Coana CLI's `manifest gradle` command (which owns the Gradle init script that
-// resolves the dependency graph). socket-cli no longer runs gradle itself; an
-// explicit `bin` is forwarded as `--bin`, otherwise Coana defaults to
-// `./gradlew`.
+// Generates `.socket.facts.json` for a Gradle project via the bundled init script.
 async function convertGradleToFacts({
   bin,
   cwd,
@@ -4385,26 +5515,25 @@ async function convertGradleToFacts({
   gradleOpts,
   ignoreUnresolved,
   includeConfigs,
-  verbose
+  sidecarAcc,
+  verbose,
+  withFiles
 }) {
-  await runCoanaManifestFacts({
+  await runManifestFacts({
     bin,
     buildOpts: gradleOpts,
-    buildOptsFlag: '--gradle-opts',
     cwd,
     ecosystem: 'gradle',
     excludeConfigs,
     ignoreUnresolved,
     includeConfigs,
-    verbose
+    sidecarAcc,
+    verbose,
+    withFiles
   });
 }
 
-// Generates a `.socket.facts.json` for a Maven project by delegating to the
-// Coana CLI's `manifest maven` command (which owns the Maven plugin that
-// resolves the dependency graph). socket-cli no longer runs maven itself; an
-// explicit `bin` is forwarded as `--bin`, otherwise Coana defaults to `mvn` on
-// PATH.
+// Generates `.socket.facts.json` for a Maven project via the bundled extension.
 async function convertMavenToFacts({
   bin,
   cwd,
@@ -4412,28 +5541,27 @@ async function convertMavenToFacts({
   ignoreUnresolved,
   includeConfigs,
   mavenOpts,
-  verbose
+  sidecarAcc,
+  verbose,
+  withFiles
 }) {
-  await runCoanaManifestFacts({
+  await runManifestFacts({
     bin,
     buildOpts: mavenOpts,
-    buildOptsFlag: '--maven-opts',
     cwd,
     ecosystem: 'maven',
     excludeConfigs,
     ignoreUnresolved,
     includeConfigs,
-    verbose
+    sidecarAcc,
+    verbose,
+    withFiles
   });
 }
 
-// Generates a `.socket.facts.json` for an sbt project by delegating to the
-// Coana CLI's `manifest sbt` command (which owns the sbt plugin that resolves
-// the dependency graph). socket-cli no longer runs sbt itself; an explicit
-// `bin` is forwarded as `--bin`, otherwise Coana defaults to `sbt` on PATH.
-// JDK-compatibility guidance (sbt 0.13/early 1.x cannot run on modern JDKs) is
-// handled by Coana; pass a compatible JDK via `--sbt-opts "--java-home <path>"`
-// or `JAVA_HOME`.
+// Generates `.socket.facts.json` for an sbt project via the bundled sbt plugin.
+// sbt 0.13/early 1.x can't run on modern JDKs — pass a compatible JDK via
+// `--sbt-opts "--java-home <path>"` or `JAVA_HOME`.
 async function convertSbtToFacts({
   bin,
   cwd,
@@ -4441,18 +5569,21 @@ async function convertSbtToFacts({
   ignoreUnresolved,
   includeConfigs,
   sbtOpts,
-  verbose
+  sidecarAcc,
+  verbose,
+  withFiles
 }) {
-  await runCoanaManifestFacts({
+  await runManifestFacts({
     bin,
     buildOpts: sbtOpts,
-    buildOptsFlag: '--sbt-opts',
     cwd,
     ecosystem: 'sbt',
     excludeConfigs,
     ignoreUnresolved,
     includeConfigs,
-    verbose
+    sidecarAcc,
+    verbose,
+    withFiles
   });
 }
 
@@ -4954,7 +6085,19 @@ function parseBuildToolOpts(opts) {
   return tokens;
 }
 
+// Under --auto-manifest, a manifest generator that failed — raising the exit
+// code above the value captured before it ran — aborts the whole run: a partial
+// or empty SBOM silently under-reports dependencies. The generator has already
+// logged the specifics. A tolerated resolution failure (ignoreUnresolved) warns
+// without touching the exit code, so it passes through here and the run
+// continues.
+function abortManifestRunIfFailed(ecosystem, beforeExitCode) {
+  if (process.exitCode && process.exitCode !== beforeExitCode) {
+    throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
+  }
+}
 async function generateAutoManifest({
+  computeArtifactsSidecar,
   cwd,
   detected,
   outputKind,
@@ -4962,6 +6105,9 @@ async function generateAutoManifest({
 }) {
   const sockJson = utils.readOrDefaultSocketJson(cwd);
   const generatedFiles = [];
+
+  // Resolved paths across all JVM roots, serialized to one sidecar at the end.
+  const sidecarAcc = computeArtifactsSidecar ? new Map() : undefined;
   if (verbose) {
     logger.logger.info(`Using this ${constants.SOCKET_JSON} for defaults:`, sockJson);
   }
@@ -4980,26 +6126,30 @@ async function generateAutoManifest({
     // `defaults.manifest.sbt.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.sbt?.facts !== false) {
       logger.logger.log('Detected a Scala sbt build, generating Socket facts...');
+      const beforeExitCode = process.exitCode;
       await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
-        includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? ''
+        includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
+        sidecarAcc,
+        withFiles: computeArtifactsSidecar
       });
+      abortManifestRunIfFailed('sbt', beforeExitCode);
     } else {
       logger.logger.log('Detected a Scala sbt build, generating pom files with sbt...');
+      const beforeExitCode = process.exitCode;
       await convertSbtToMaven({
         ...sbtArgs,
         out: sockJson.defaults?.manifest?.sbt?.outfile ?? './pom.xml'
       });
+      abortManifestRunIfFailed('sbt', beforeExitCode);
     }
   }
   if (!sockJson?.defaults?.manifest?.gradle?.disabled && detected.gradle) {
     const gradleArgs = {
-      // Note: `gradlew` is more likely to be resolved against cwd.
-      // Note: .resolve() won't butcher an absolute path.
-      // TODO: `gradlew` (or anything else given) may want to resolve against PATH.
-      bin: sockJson.defaults?.manifest?.gradle?.bin ? path.resolve(cwd, sockJson.defaults.manifest.gradle.bin) : path.join(cwd, 'gradlew'),
+      // Configured bin wins; else prefer ./gradlew, else gradle on PATH.
+      bin: sockJson.defaults?.manifest?.gradle?.bin ? path.resolve(cwd, sockJson.defaults.manifest.gradle.bin) : resolveBuildToolBin('gradle', cwd),
       cwd,
       verbose: Boolean(sockJson.defaults?.manifest?.gradle?.verbose),
       gradleOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.gradle?.gradleOpts)
@@ -5008,29 +6158,39 @@ async function generateAutoManifest({
     // `defaults.manifest.gradle.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.gradle?.facts !== false) {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), generating Socket facts...');
+      const beforeExitCode = process.exitCode;
       await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs: sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
-        includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? ''
+        includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
+        sidecarAcc,
+        withFiles: computeArtifactsSidecar
       });
+      abortManifestRunIfFailed('gradle', beforeExitCode);
     } else {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...');
+      const beforeExitCode = process.exitCode;
       await convertGradleToMaven(gradleArgs);
+      abortManifestRunIfFailed('gradle', beforeExitCode);
     }
   }
   if (!sockJson?.defaults?.manifest?.maven?.disabled && detected.maven) {
     logger.logger.log('Detected a Maven pom.xml build, generating Socket facts...');
+    const beforeExitCode = process.exitCode;
     await convertMavenToFacts({
-      // Note: `mvn` is more likely to be resolved against PATH env.
-      bin: sockJson.defaults?.manifest?.maven?.bin ?? 'mvn',
+      // Configured bin wins; else prefer ./mvnw, else mvn on PATH.
+      bin: sockJson.defaults?.manifest?.maven?.bin ?? resolveBuildToolBin('maven', cwd),
       cwd,
       excludeConfigs: sockJson.defaults?.manifest?.maven?.excludeConfigs ?? '',
       ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.maven?.ignoreUnresolved),
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts),
-      verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose)
+      sidecarAcc,
+      verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
+      withFiles: computeArtifactsSidecar
     });
+    abortManifestRunIfFailed('maven', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
     logger.logger.log('Detected an environment.yml file, running default Conda generator...');
@@ -5079,7 +6239,8 @@ async function generateAutoManifest({
     }
   }
   return {
-    generatedFiles
+    generatedFiles,
+    resolvedPathsSidecar: sidecarAcc && sidecarAcc.size ? serializeSidecar(sidecarAcc) : undefined
   };
 }
 
@@ -5142,6 +6303,9 @@ async function handleCreateNewScan({
     tmp,
     workspace
   });
+
+  // Sidecar forwarded to reachability; populated only when reach runs.
+  let resolvedPathsSidecar;
   if (autoManifest) {
     logger.logger.info('Auto-generating manifest files ...');
     require$$9.debugFn('notice', 'Auto-manifest mode enabled');
@@ -5151,11 +6315,13 @@ async function handleCreateNewScan({
       detected
     });
     const autoManifestResult = await generateAutoManifest({
-      detected,
+      computeArtifactsSidecar: reach.runReachabilityAnalysis,
       cwd,
+      detected,
       outputKind,
       verbose: false
     });
+    resolvedPathsSidecar = autoManifestResult.resolvedPathsSidecar;
     if (autoManifestResult.generatedFiles.length) {
       scanTargets = Array.from(new Set([...targets, ...autoManifestResult.generatedFiles]));
     }
@@ -5239,6 +6405,7 @@ async function handleCreateNewScan({
       packagePaths,
       reachabilityOptions: mergedReachabilityOptions,
       repoName,
+      resolvedPathsSidecar,
       spinner,
       target: targets[0]
     });
@@ -10313,7 +11480,7 @@ const config$c = {
     ...flags.commonFlags,
     bin: {
       type: 'string',
-      description: 'Location of gradlew binary to use, default: CWD/gradlew'
+      description: 'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH'
     },
     facts: {
       type: 'boolean',
@@ -10424,7 +11591,8 @@ async function run$D(argv, importMeta, {
       bin = sockJson.defaults?.manifest?.gradle?.bin;
       logger.logger.info(`Using default --bin from ${constants.SOCKET_JSON}:`, bin);
     } else {
-      bin = path.join(cwd, 'gradlew');
+      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
+      bin = resolveBuildToolBin('gradle', cwd);
     }
   }
   if (!gradleOpts) {
@@ -10558,7 +11726,7 @@ const config$b = {
     ...flags.commonFlags,
     bin: {
       type: 'string',
-      description: 'Location of gradlew binary to use, default: CWD/gradlew'
+      description: 'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH'
     },
     facts: {
       type: 'boolean',
@@ -10669,7 +11837,8 @@ async function run$C(argv, importMeta, {
       bin = sockJson.defaults?.manifest?.gradle?.bin;
       logger.logger.info(`Using default --bin from ${constants.SOCKET_JSON}:`, bin);
     } else {
-      bin = path.join(cwd, 'gradlew');
+      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
+      bin = resolveBuildToolBin('gradle', cwd);
     }
   }
   if (!gradleOpts) {
@@ -10796,7 +11965,7 @@ const config$a = {
     ...flags.commonFlags,
     bin: {
       type: 'string',
-      description: 'Location of the maven binary to use, default: mvn on PATH'
+      description: 'Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH'
     },
     includeConfigs: {
       type: 'string',
@@ -10890,7 +12059,8 @@ async function run$B(argv, importMeta, {
       bin = sockJson.defaults?.manifest?.maven?.bin;
       logger.logger.info(`Using default --bin from ${constants.SOCKET_JSON}:`, bin);
     } else {
-      bin = 'mvn';
+      // Prefer the project's ./mvnw wrapper, else `mvn` on PATH.
+      bin = resolveBuildToolBin('maven', cwd);
     }
   }
   if (!mavenOpts) {
@@ -16596,13 +17766,6 @@ async function run$d(argv, importMeta, {
     pendingHead: Boolean(pendingHead),
     pullRequest: Number(pullRequest),
     reach: {
-      // Build-tool config for the reach-time resolution, mapped from socket.json
-      // (per-ecosystem). Best-effort on plain --reach; under --auto-manifest the
-      // config carries top-level failOnBuildToolError=true (fail-closed). Only
-      // built when reachability runs.
-      autoManifestConfig: reach ? utils.buildAutoManifestConfig(sockJson, {
-        autoManifest: Boolean(autoManifest)
-      }) : undefined,
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
@@ -20667,5 +21830,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=6c799c7a-7beb-4a6d-a648-0638ba473165
+//# debugId=124ab184-9379-4139-921b-7d32dd1456f3
 //# sourceMappingURL=cli.js.map