@socketsecurity/cli-with-sentry 1.1.132 → 1.1.133

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.133](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.133) - 2026-07-01
+
+### Changed
+- Quieter `socket manifest gradle`, `sbt`, and `maven`: the build tool's output is now hidden behind a progress spinner and shown only if the build fails. Pass `--verbose` to stream it live.
+- `--auto-manifest` now fails fast: if a Gradle, sbt, or Maven build fails, the run stops instead of continuing with an incomplete SBOM.
+
 ## [1.1.132](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.132) - 2026-06-30
 
 ### Changed

package/dist/cli.js

@@ -5173,11 +5173,19 @@ async function runNeverThrow(bin, args, opts) {
       stderr: typeof result.stderr === 'string' ? result.stderr : ''
     };
   } catch (e) {
-    if (spawn.isSpawnError(e)) {
+    // A build tool that exits non-zero rejects with the spawn-result shape: a
+    // numeric exit `code` plus captured stdout/stderr. Return it so the caller
+    // can assemble failure records / surface the output. Anything else — e.g. a
+    // missing executable, whose `code` is a string like 'ENOENT' — propagates.
+    // This mirrors how utils/dlx.mts classifies spawn failures (a numeric `code`
+    // is a real process exit); the registry's isSpawnError is avoided here
+    // because it is currently broken and never matches.
+    if (e !== null && typeof e === 'object' && typeof e.code === 'number') {
+      const err = e;
       return {
-        code: e.code,
-        stdout: typeof e.stdout === 'string' ? e.stdout : '',
-        stderr: typeof e.stderr === 'string' ? e.stderr : ''
+        code: err.code,
+        stdout: typeof err.stdout === 'string' ? err.stdout : '',
+        stderr: typeof err.stderr === 'string' ? err.stderr : ''
       };
     }
     throw e;
@@ -5202,7 +5210,7 @@ async function writeSbtPlugin(globalBase) {
   });
   await fs$1.promises.writeFile(path.join(pluginsDir, SBT_PLUGIN_FILENAME), src);
 }
-async function assembleFromRecords(code, recordsFile) {
+async function assembleFromRecords(out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
   const {
     artifactPaths,
@@ -5210,10 +5218,12 @@ async function assembleFromRecords(code, recordsFile) {
     report
   } = assembleFacts(parseRecords(text));
   return {
-    code,
+    code: out.code,
     facts,
     report,
-    artifactPaths
+    artifactPaths,
+    stderr: out.stderr,
+    stdout: out.stdout
   };
 }
 
@@ -5263,7 +5273,7 @@ async function runGradle(opts) {
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
     const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), FACTS_TASK, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out.code, recordsFile);
+    return await assembleFromRecords(out, recordsFile);
   });
 }
 async function runSbt(opts) {
@@ -5280,7 +5290,7 @@ async function runSbt(opts) {
     const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
     const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', FACTS_TASK];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out.code, recordsFile);
+    return await assembleFromRecords(out, recordsFile);
   });
 }
 async function runMaven(opts) {
@@ -5294,7 +5304,7 @@ async function runMaven(opts) {
     const props = [`-Dmaven.ext.class.path=${jarPath}`, '-Dcoana.task=socket-facts', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
     const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out.code, recordsFile);
+    return await assembleFromRecords(out, recordsFile);
   });
 }
 
@@ -5363,11 +5373,19 @@ function serializeSidecar(acc) {
   return resolved;
 }
 
+// Last N non-empty lines of the captured build output, for diagnosing a crash
+// without forcing a --verbose rebuild.
+function tailBuildOutput(stdout, stderr) {
+  const combined = [stdout, stderr].map(s => s.trimEnd()).filter(Boolean).join('\n');
+  return combined.split('\n').slice(-40).join('\n');
+}
+
 // Runs the bundled build-tool resolution script for a JVM project and writes
 // `.socket.facts.json`. `withFiles` (reachability only) additionally folds
-// resolved artifact paths into `sidecarAcc`. A blocking resolution failure — or
-// a build that crashes without emitting any facts — throws unless
-// `ignoreUnresolved`.
+// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// a non-zero exit code and returns (matching the `--pom` generator) unless
+// `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
+// dependency — always fails.
 async function runManifestFacts({
   bin,
   buildOpts,
@@ -5382,19 +5400,53 @@ async function runManifestFacts({
 }) {
   const factsPath = path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
   logger.logger.log(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
-  const {
-    artifactPaths,
-    code,
-    facts,
-    report
-  } = await runManifestScript(ecosystem, {
+  const scriptOpts = {
     bin: bin || undefined,
     excludeConfigs: excludeConfigs || undefined,
     includeConfigs: includeConfigs || undefined,
     projectDir: cwd,
+    // Stream the build tool's output only when asked; otherwise capture it and
+    // show a spinner, surfacing the output only if the build crashes.
+    stdio: verbose ? 'inherit' : 'pipe',
     toolOpts: buildOpts,
     withFiles
-  });
+  };
+  const {
+    spinner
+  } = constants.default;
+  let result;
+  try {
+    if (verbose) {
+      logger.logger.info(`(Running ${ecosystem} with output streaming; this can take a while.)`);
+      result = await runManifestScript(ecosystem, scriptOpts);
+    } else {
+      logger.logger.info(`(No live output; pass --verbose to stream the ${ecosystem} build output.)`);
+      spinner.start(`Resolving ${ecosystem} dependencies ...`);
+      result = await runManifestScript(ecosystem, scriptOpts);
+      if (result.code === 0) {
+        spinner.successAndStop(`Resolved ${ecosystem} dependencies.`);
+      } else {
+        spinner.failAndStop(`${ecosystem} build exited with code ${result.code}.`);
+      }
+    }
+  } catch (e) {
+    // Only a spawn-level failure (e.g. the build tool missing from PATH) reaches
+    // here; runNeverThrow returns non-zero build exits rather than throwing.
+    if (!verbose) {
+      spinner.failAndStop(`Failed to run ${ecosystem}.`);
+    }
+    process.exitCode = 1;
+    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${e}` : ' (run with --verbose for details).'));
+    return;
+  }
+  const {
+    artifactPaths,
+    code,
+    facts,
+    report,
+    stderr,
+    stdout
+  } = result;
   const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
     ignoreUnresolved
   });
@@ -5402,10 +5454,12 @@ async function runManifestFacts({
     if (ignoreUnresolved) {
       logger.logger.warn(rendered.summary);
     } else {
+      process.exitCode = 1;
+      logger.logger.fail(rendered.summary);
       if (verbose && rendered.details) {
         logger.logger.log(rendered.details);
       }
-      throw new utils.InputError(rendered.summary);
+      return;
     }
   }
   if (rendered.nonBlockingNotice) {
@@ -5422,11 +5476,20 @@ async function runManifestFacts({
   // fail closed rather than silently dropping the ecosystem with an empty SBOM
   // (the empty-facts branch below would otherwise just log "nothing to upload").
   if (code !== 0 && !facts.components.length && !facts.projects?.length && !report.failures.length) {
-    const message = `The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts. Re-run with --verbose for the build tool's output.`;
-    if (!ignoreUnresolved) {
-      throw new utils.InputError(message);
+    if (!verbose) {
+      const tail = tailBuildOutput(stdout, stderr);
+      if (tail) {
+        logger.logger.group('Build output:');
+        logger.logger.error(tail);
+        logger.logger.groupEnd();
+      }
     }
-    logger.logger.warn(message);
+    // A crashed build is a process failure (missing JDK/build tool, unparseable
+    // project, OOM, plugin error), not an unresolved dependency, so it fails
+    // regardless of `ignoreUnresolved` — that flag only tolerates dependencies a
+    // successful run couldn't resolve.
+    process.exitCode = 1;
+    logger.logger.fail(`The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`);
     return;
   }
 
@@ -6022,12 +6085,22 @@ function parseBuildToolOpts(opts) {
   return tokens;
 }
 
+// Under --auto-manifest, a manifest generator that failed — raising the exit
+// code above the value captured before it ran — aborts the whole run: a partial
+// or empty SBOM silently under-reports dependencies. The generator has already
+// logged the specifics. A tolerated resolution failure (ignoreUnresolved) warns
+// without touching the exit code, so it passes through here and the run
+// continues.
+function abortManifestRunIfFailed(ecosystem, beforeExitCode) {
+  if (process.exitCode && process.exitCode !== beforeExitCode) {
+    throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
+  }
+}
 async function generateAutoManifest({
   computeArtifactsSidecar,
   cwd,
   detected,
   outputKind,
-  reachContinueOnInstallErrors,
   verbose
 }) {
   const sockJson = utils.readOrDefaultSocketJson(cwd);
@@ -6035,8 +6108,6 @@ async function generateAutoManifest({
 
   // Resolved paths across all JVM roots, serialized to one sidecar at the end.
   const sidecarAcc = computeArtifactsSidecar ? new Map() : undefined;
-  // Reachability: the install-error gate decides abort; manifest path: socket.json.
-  const resolveIgnoreUnresolved = configured => computeArtifactsSidecar ? configured || Boolean(reachContinueOnInstallErrors) : configured;
   if (verbose) {
     logger.logger.info(`Using this ${constants.SOCKET_JSON} for defaults:`, sockJson);
   }
@@ -6055,20 +6126,24 @@ async function generateAutoManifest({
     // `defaults.manifest.sbt.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.sbt?.facts !== false) {
       logger.logger.log('Detected a Scala sbt build, generating Socket facts...');
+      const beforeExitCode = process.exitCode;
       await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
-        ignoreUnresolved: resolveIgnoreUnresolved(Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved)),
+        ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
+      abortManifestRunIfFailed('sbt', beforeExitCode);
     } else {
       logger.logger.log('Detected a Scala sbt build, generating pom files with sbt...');
+      const beforeExitCode = process.exitCode;
       await convertSbtToMaven({
         ...sbtArgs,
         out: sockJson.defaults?.manifest?.sbt?.outfile ?? './pom.xml'
       });
+      abortManifestRunIfFailed('sbt', beforeExitCode);
     }
   }
   if (!sockJson?.defaults?.manifest?.gradle?.disabled && detected.gradle) {
@@ -6083,33 +6158,39 @@ async function generateAutoManifest({
     // `defaults.manifest.gradle.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.gradle?.facts !== false) {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), generating Socket facts...');
+      const beforeExitCode = process.exitCode;
       await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs: sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
-        ignoreUnresolved: resolveIgnoreUnresolved(Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved)),
+        ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
+      abortManifestRunIfFailed('gradle', beforeExitCode);
     } else {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...');
+      const beforeExitCode = process.exitCode;
       await convertGradleToMaven(gradleArgs);
+      abortManifestRunIfFailed('gradle', beforeExitCode);
     }
   }
   if (!sockJson?.defaults?.manifest?.maven?.disabled && detected.maven) {
     logger.logger.log('Detected a Maven pom.xml build, generating Socket facts...');
+    const beforeExitCode = process.exitCode;
     await convertMavenToFacts({
       // Configured bin wins; else prefer ./mvnw, else mvn on PATH.
       bin: sockJson.defaults?.manifest?.maven?.bin ?? resolveBuildToolBin('maven', cwd),
       cwd,
       excludeConfigs: sockJson.defaults?.manifest?.maven?.excludeConfigs ?? '',
-      ignoreUnresolved: resolveIgnoreUnresolved(Boolean(sockJson.defaults?.manifest?.maven?.ignoreUnresolved)),
+      ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.maven?.ignoreUnresolved),
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts),
       sidecarAcc,
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar
     });
+    abortManifestRunIfFailed('maven', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
     logger.logger.log('Detected an environment.yml file, running default Conda generator...');
@@ -6238,7 +6319,6 @@ async function handleCreateNewScan({
       cwd,
       detected,
       outputKind,
-      reachContinueOnInstallErrors: reach.reachContinueOnInstallErrors,
       verbose: false
     });
     resolvedPathsSidecar = autoManifestResult.resolvedPathsSidecar;
@@ -21750,5 +21830,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=bf57bd7a-dcc7-46d5-8b2d-9709236ff012
+//# debugId=124ab184-9379-4139-921b-7d32dd1456f3
 //# sourceMappingURL=cli.js.map