@socketsecurity/cli-with-sentry 1.10.0 → 1.11.0

package/dist/cli.js

@@ -1824,12 +1824,16 @@ function reachMemoryLimitToMb(value) {
 // independent reactors is intentionally duplicated across all of their
 // components[].
 
-// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact).
+// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact); no
+// `targets` means the artifact did not resolve.
 function attachPaths(entry, artifactPaths) {
   const paths = artifactPaths.pathsById.get(entry.id);
+  const targets = paths ? paths.targets : [];
   return {
     ...entry,
-    targets: [...(paths?.targets ?? [])],
+    ...(targets ? {
+      targets: [...targets]
+    } : {}),
     sources: [...(paths?.sources ?? [])]
   };
 }
@@ -2006,7 +2010,7 @@ async function performReachabilityAnalysis(options) {
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), '--run-without-docker', '--manifests-tar-hash', tarHash,
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachAdvisories.length ? ['--ghsas', ...reachabilityOptions.reachAdvisories] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
   // sidecarPath is always set above when this is true - Coana rejects this
   // flag without one.
   ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-socket-facts'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
@@ -2351,9 +2355,17 @@ function classifyGradleFailure(detail) {
   if (t.includes('no matching variant') || t.includes('no variants of') || t.includes('unable to find a matching variant') || t.includes('no compatible variant')) {
     return 'no-matching-variant';
   }
-  if (t.includes('cannot choose between')) {
+  // The artifact-level form: several transforms produce the requested variant
+  // ("transformation chains" from Gradle 8.12, "transforms" before it).
+  if (t.includes('cannot choose between') || t.includes('found multiple transformation chains') || t.includes('found multiple transforms that can produce a variant')) {
     return 'variant-ambiguity';
   }
+  // One line per problem of the artifact; a checksum missing from the
+  // metadata is no evidence against it, unlike any other problem.
+  const problems = t.split('\n').filter(l => l.startsWith('on artifact '));
+  if (problems.length && problems.every(l => l.endsWith(': checksum is missing from verification metadata.'))) {
+    return 'checksum-missing';
+  }
   if (t.includes('could not get') || t.includes('could not head') || t.includes('status code 401') || t.includes('status code 403') || t.includes('connection refused') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('certification path') || t.includes('peer not authenticated')) {
     return 'repository-or-network';
   }
@@ -2365,8 +2377,9 @@ function classifyGradleFailure(detail) {
 
 // Every kind blocks except variant-ambiguity: the module demonstrably exists
 // and is almost always captured via another configuration, so it's benign for
-// the SBOM (non-blocking, count only). A module that resolves in NO config
-// surfaces as not-found / no-matching-variant, which stay blocking.
+// the SBOM (non-blocking, count only). The renderer blocks it anyway when the
+// module resolved in no configuration of its project. Nor does checksum-missing:
+// teams often record checksums only for what their own tasks resolve.
 const GRADLE_DIALECT = {
   label: 'Gradle',
   classify: classifyGradleFailure,
@@ -2399,8 +2412,13 @@ const GRADLE_DIALECT = {
     blocking: true
   }, {
     key: 'variant-ambiguity',
+    header: n => `  Ambiguous variant — ${n} could not choose a variant, and the module resolved in no other configuration:`,
     blocking: false,
     notice: (n, depCount, configCount) => `Skipped ${depCount} dependency(ies) with ambiguous variant selection in ${configCount} configuration(s) — re-run with --verbose for ${n}'s messages.`
+  }, {
+    key: 'checksum-missing',
+    blocking: false,
+    notice: (n, depCount, configCount) => `Left ${depCount} dependency(ies) uninstalled in ${configCount} configuration(s): ${n}'s verification metadata has no checksum for their artifacts — re-run with --verbose for ${n}'s messages.`
   }]
 };
 
@@ -2450,14 +2468,24 @@ const SBT_DIALECT = {
 // classify off the root-cause message.
 function classifyMavenFailure(detail) {
   const t = (detail || '').toLowerCase();
-  if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception')) {
+  if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception') ||
+  // Maven 3.8.1+ blocks plain-HTTP repositories behind its
+  // maven-default-http-blocker mirror.
+  t.includes('blocked mirror for repositories') ||
+  // Offline (-o): no repository was asked, so the artifact may well exist.
+  t.includes('in offline mode')) {
     return 'repository-or-network';
   }
-  if (t.includes('could not find artifact') || t.includes('failure to find') || t.includes('could not resolve') || t.includes('no versions available') || t.includes('not found')) {
+  if (t.includes('could not find artifact') || t.includes('failure to find') || t.includes('could not resolve') || t.includes('no versions available') || t.includes('not found') ||
+  // maven-resolver's remote repository filters (prefixes, groupId): the
+  // repository is known not to serve that path or group.
+  t.includes('not allowed from')) {
     return 'not-found';
   }
   // POM exists but can't be read/parsed.
-  if (t.includes('failed to read artifact descriptor') || t.includes('invalid pom') || t.includes('could not parse pom')) {
+  if (t.includes('failed to read artifact descriptor') || t.includes('invalid pom') || t.includes('could not parse pom') ||
+  // Maven's warning for a POM its descriptor policy tolerated as invalid.
+  t.includes('is invalid, transitive dependencies')) {
     return 'config-problem';
   }
   return 'other';
@@ -2488,6 +2516,14 @@ const MAVEN_DIALECT = {
   }]
 };
 
+// A resolution that threw without naming a dependency: one configuration, or
+// with an empty `config` the whole project.
+
+// A module (`group:name`, from any longer coordinate) within one project.
+function moduleKey(project, coord) {
+  return `${project}\t${coord.split(':').slice(0, 2).join(':')}`;
+}
+
 // Recognized from the build tool's message; drives wording AND whether the kind
 // is blocking. An unrecognized message degrades to 'other' (blocking) — safe.
 
@@ -2497,6 +2533,7 @@ const MAVEN_DIALECT = {
 // names something they can actually set.
 
 const DSI_SETUP_COMMAND = 'socket manifest setup --dynamic-sbom-inference';
+const REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG = '--reach-continue-on-install-errors';
 
 // The single-build manifest commands take every option as a flag.
 const FLAG_HINTS = {
@@ -2508,17 +2545,19 @@ const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15;
 const RESOLUTION_REPORT_CONFIG_LIMIT = 20;
 
 // Drop a bare "group:name" when a versioned "group:name:v" of the same module
-// is also present: the lenient resolver reports both forms for one failure.
-function dedupCoords(coords) {
-  const set = new Set(coords);
+// failed in the same projects: the lenient resolver reports both forms for one
+// failure.
+function dedupInfos(infos) {
   const versioned = new Set();
-  for (const c of set) {
-    const p = c.split(':');
+  for (const i of infos) {
+    const p = i.coord.split(':');
     if (p.length >= 3) {
-      versioned.add(`${p[0]}:${p[1]}`);
+      for (const project of i.projects) {
+        versioned.add(moduleKey(project, i.coord));
+      }
     }
   }
-  return [...set].filter(c => c.split(':').length >= 3 || !versioned.has(c)).sort();
+  return infos.filter(i => i.coord.split(':').length >= 3 || ![...i.projects].every(p => versioned.has(moduleKey(p, i.coord)))).sort((a, b) => a.coord < b.coord ? -1 : a.coord > b.coord ? 1 : 0);
 }
 function firstLine(s) {
   return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
@@ -2537,6 +2576,13 @@ function inProjects(projects) {
   const list = [...(typeof projects === 'string' ? [projects] : projects)].filter(Boolean).sort().map(p => `\`${p}\``);
   return list.length ? ` (in ${fmtList(list, 3)})` : '';
 }
+function installErrorsHint(hints, ignored) {
+  const flag = hints.continueOnInstallErrorsFlag;
+  if (!flag) {
+    return [];
+  }
+  return [ignored ? `Reachability analysis cannot install the ignored dependencies; pass ${flag} unless you already do.` : `If you ignore unresolved dependencies, also pass ${flag}: reachability analysis cannot install them.`];
+}
 
 // `excludableConfigs` is empty when excluding configurations cannot clear
 // every blocking failure.
@@ -2557,9 +2603,8 @@ function proceedHint(hints, tool, excludableConfigs) {
   return ['To proceed, either:', ...asFlags.map(o => `    re-run with ${flagText(...o)}`), ...inSocketJson.map(([option, value]) => `    set defaults.manifest.${tool}.${option} to ${JSON.stringify(value)} in ${hints.socketJson} (${setup})`)];
 }
 
-// Severity is per-kind; the exit-code decision lives in the caller. We do NOT
-// cross-reference what resolved elsewhere: the failed selector carries no
-// classifier/type, so relating a failed and a succeeded dep is unsound.
+// What resolved elsewhere is consulted only by module (group:name): a failed
+// selector carries no classifier/type to relate it to one artifact.
 function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
   const dialect = dialectFor(tool);
   const name = dialect.label;
@@ -2569,19 +2614,27 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
   const specOf = new Map(dialect.categories.map(c => [c.key, c]));
   const isBlocking = cat => specOf.get(cat)?.blocking ?? true;
 
-  // Aggregate by (coord, category): one module can fail with different causes
-  // across configs. Keep first-seen detail, union the configs and projects.
+  // A non-blocking kind is only benign when its module resolved anyway: one
+  // that resolved in no configuration of its project is missing from that
+  // project's SBOM.
+  const resolved = opts.resolvedModules;
+  const isFailureBlocking = (category, f) => isBlocking(category) || !!resolved && !resolved.has(moduleKey(f.project, f.coord));
+
+  // Aggregate by (coord, category, blocking): one module can fail with
+  // different causes across configs, and block in only some projects. Keep
+  // first-seen detail, union the configs and projects.
 
   const byKey = new Map();
-  const keyOf = (coord, category) => `${coord} ${category}`;
   for (const f of failures) {
     const category = dialect.classify(f.detail);
-    const key = keyOf(f.coord, category);
+    const blocking = isFailureBlocking(category, f);
+    const key = `${f.coord} ${category} ${blocking}`;
     let info = byKey.get(key);
     if (!info) {
       info = {
         coord: f.coord,
         category,
+        blocking,
         detail: f.detail,
         configs: new Set(),
         projects: new Set(),
@@ -2599,6 +2652,7 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
     }
   }
   const allInfos = [...byKey.values()];
+  const isInfoBlocking = info => info.blocking;
 
   // A whole-config throw is classified by the same cause rules as a per-dep
   // failure: ambiguity stays lenient, every other cause is fail-closed.
@@ -2616,7 +2670,7 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
   const blockingUnscannableProjects = blockingUnscannable.filter(u => !u.config);
   const perDepBlockingConfigs = new Set();
   for (const info of allInfos) {
-    if (isBlocking(info.category)) {
+    if (isInfoBlocking(info)) {
       for (const c of info.configs) {
         perDepBlockingConfigs.add(c);
       }
@@ -2626,15 +2680,21 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
   const blockingFailed = [...blockingConfigs].sort();
   // A blocking failure outside any configuration leaves every configuration of
   // its project incomplete, so none can be reported as succeeded.
-  const hasBlockingConfiglessFailure = blockingUnscannableProjects.length > 0 || allInfos.some(i => i.configless && isBlocking(i.category));
+  const hasBlockingConfiglessFailure = blockingUnscannableProjects.length > 0 || allInfos.some(i => i.configless && isInfoBlocking(i));
   // An un-scannable config was attempted but resolved nothing, so it didn't succeed.
   const succeeded = hasBlockingConfiglessFailure ? [] : scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
   const groups = dialect.categories.map(spec => ({
     spec,
-    infos: dedupCoords(allInfos.filter(i => i.category === spec.key).map(i => i.coord)).map(c => byKey.get(keyOf(c, spec.key)))
+    infos: dedupInfos(allInfos.filter(i => i.category === spec.key))
+  }));
+  const blockingGroups = groups.map(g => ({
+    ...g,
+    infos: g.infos.filter(isInfoBlocking)
+  })).filter(g => g.infos.length);
+  const nonBlockingGroups = groups.map(g => ({
+    ...g,
+    infos: g.infos.filter(i => !isInfoBlocking(i))
   })).filter(g => g.infos.length);
-  const blockingGroups = groups.filter(g => g.spec.blocking);
-  const nonBlockingGroups = groups.filter(g => !g.spec.blocking);
   const blockingCount = blockingGroups.reduce((n, g) => n + g.infos.length, 0);
   const hasBlockingFailures = blockingCount > 0 || blockingUnscannable.length > 0;
   const willFail = hasBlockingFailures && !opts.ignoreUnresolved;
@@ -2690,7 +2750,9 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
     }
     if (willFail) {
       out.push('');
-      out.push(...proceedHint(hints, tool, hasBlockingConfiglessFailure ? [] : blockingFailed));
+      out.push(...proceedHint(hints, tool, hasBlockingConfiglessFailure ? [] : blockingFailed), ...installErrorsHint(hints, false));
+    } else if (hints.continueOnInstallErrorsFlag) {
+      out.push('', ...installErrorsHint(hints, true));
     }
     out.push('');
     out.push(hints.flags.has('verbose') ? `Re-run with --verbose for ${name}'s full messages.` : `For ${name}'s full messages, ${verboseHint(hints, tool)}.`);
@@ -2706,8 +2768,8 @@ function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
     const configCount = new Set(infos.flatMap(i => [...i.configs])).size;
     notices.push(spec.notice(name, infos.length, configCount));
   }
-  // A config-level throw whose cause classifies as variant ambiguity is surfaced, not failed —
-  // matching the deliberately-lenient per-dep variant-ambiguity policy.
+  // A config-level throw whose cause classifies as variant ambiguity is surfaced, not failed: many
+  // configurations are marked resolvable yet too underspecified to resolve.
   if (nonBlockingUnscannable.length) {
     const n = new Set(nonBlockingUnscannable.map(u => u.config)).size;
     notices.push(hints.flags.has('verbose') ? `Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.` : `Could not scan ${n} configuration(s); for ${name}'s messages, ${verboseHint(hints, tool)}.`);
@@ -2787,7 +2849,7 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], graphs, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], [...parsed.excludedProjects.values()], graphs, fileExists)
   };
 }
 
@@ -2814,11 +2876,13 @@ function buildPerRoot(parsed) {
           children: [],
           direct: false,
           project: n.project,
-          targets: []
+          targets: [],
+          unfetched: false
         };
         nodes.set(id, node);
       }
       node.direct ||= n.direct;
+      node.unfetched ||= n.unfetched;
       node.targets.push(...n.targets);
     }
     for (const [p, c] of r.edges) {
@@ -2858,7 +2922,7 @@ function mergeById(perRoot) {
           prod: false,
           direct: false,
           project: node.project,
-          targets: new Set()
+          resolutions: []
         };
         finalNodes.set(coordId, fn);
       }
@@ -2868,8 +2932,11 @@ function mergeById(perRoot) {
       if (node.direct) {
         fn.direct = true;
       }
-      for (const t of node.targets) {
-        fn.targets.add(t);
+      if (node.unfetched || node.targets.length) {
+        fn.resolutions.push({
+          targets: node.targets,
+          unfetched: node.unfetched
+        });
       }
     }
   }
@@ -3090,19 +3157,34 @@ function byProject(projects, graphs, ids) {
     return [p.projectKey, g ? [...ids(g)].sort() : []];
   }));
 }
-function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
+function buildArtifactPaths(finalNodes, projects, excludedProjects, graphs, fileExists) {
   const pathsById = new Map();
+  // Every root that fetched an artifact lists its file, so check each path once.
+  const existing = new Map();
+  const exists = p => {
+    let e = existing.get(p);
+    if (e === undefined) {
+      e = fileExists(p);
+      existing.set(p, e);
+    }
+    return e;
+  };
   for (const [id, fn] of finalNodes) {
     if (!fn.project) {
-      pathsById.set(id, {
+      // Only a root that fetched every file of the artifact, all still on
+      // disk, resolved it: a partial list would claim it resolved whole.
+      const complete = fn.resolutions.filter(r => !r.unfetched && r.targets.every(exists));
+      pathsById.set(id, fn.resolutions.length && !complete.length ? {
+        sources: []
+      } : {
         sources: [],
-        targets: [...fn.targets].filter(fileExists).sort()
+        targets: [...new Set(complete.flatMap(r => r.targets))].sort()
       });
     }
   }
   // A project's own component shares its id, so this also covers dependency
   // edges onto a sibling project.
-  for (const p of projects) {
+  for (const p of [...projects, ...excludedProjects]) {
     pathsById.set(p.projectKey, {
       sources: [...new Set(p.sources)].filter(fileExists).sort(),
       targets: [...new Set(p.targets)].filter(fileExists).sort()
@@ -3133,8 +3215,17 @@ function buildReport(parsed) {
     seenUnscannable.add(key);
     return true;
   });
+  const resolvedModules = new Set();
+  if (failures.length) {
+    for (const r of parsed.roots.values()) {
+      for (const n of r.nodes.values()) {
+        resolvedModules.add(moduleKey(r.projectKey, `${n.coord.group}:${n.coord.name}`));
+      }
+    }
+  }
   return {
     failures,
+    resolvedModules,
     scannedConfigs: parsed.scannedConfigs,
     unscannable
   };
@@ -3288,12 +3379,14 @@ function serializeExcludePathPatterns(paths) {
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
 //   projectBuild  projectKey  path                     (build-root-relative; may be absent on disk)
+//   excludedProject  projectKey                          (--with-files only; paths without a project)
 //   root        rootId  projectKey  config  prod(0|1)
 //   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
 //   file        rootId  coordId  path                    (--with-files only)
+//   unfetched   rootId  coordId                          (--with-files only; requested artifact not fetched)
 //   scanned     config
-//   failure     coord  detail  config  projectKey   (config empty: no configuration)
+//   failure     coord  detail  config  projectKey   (config empty: not placeable in one)
 //   unscannable config  detail  projectKey          (config empty: whole project)
 //
 // `projectKey` is the tool's unique project identity (Maven: GAV; Gradle:
@@ -3330,12 +3423,14 @@ function parseRecords(text) {
     buildRoot: '',
     entry: '',
     projects: new Map(),
+    excludedProjects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
     failures: [],
     unscannable: []
   };
   const scanned = new Set();
+  const excluded = new Set();
   const root = id => {
     let r = result.roots.get(id);
     if (!r) {
@@ -3404,6 +3499,9 @@ function parseRecords(text) {
           project(f[1] ?? '').targets.push(f[2]);
         }
         break;
+      case 'excludedProject':
+        excluded.add(f[1] ?? '');
+        break;
       case 'projectBuild':
         if (f[2]) {
           project(f[1] ?? '').buildFiles.push(f[2]);
@@ -3432,7 +3530,8 @@ function parseRecords(text) {
             },
             direct: bool(f[8]),
             project: f[9] ?? '',
-            targets: []
+            targets: [],
+            unfetched: false
           });
           break;
         }
@@ -3445,6 +3544,14 @@ function parseRecords(text) {
           }
           break;
         }
+      case 'unfetched':
+        {
+          const node = root(f[1] ?? '').nodes.get(f[2] ?? '');
+          if (node) {
+            node.unfetched = true;
+          }
+          break;
+        }
       case 'file':
         {
           const node = root(f[1] ?? '').nodes.get(f[2] ?? '');
@@ -3479,6 +3586,13 @@ function parseRecords(text) {
         break;
     }
   }
+  for (const key of excluded) {
+    const p = result.projects.get(key);
+    if (p) {
+      result.projects.delete(key);
+      result.excludedProjects.set(key, p);
+    }
+  }
   result.scannedConfigs = [...scanned].sort();
   return result;
 }
@@ -3630,7 +3744,10 @@ async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
     const bin = resolveBuildToolBin('gradle', opts.projectDir, opts.bin);
     // Disable the configuration cache: the init script's legacy
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
-    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
+    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false',
+    // Names each artifact's own verification problem, so a checksum missing
+    // from the metadata can be told apart from a mismatch.
+    '-Porg.gradle.dependency.verification.console=verbose', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
     return await assembleFromRecords('gradle', out, recordsFile);
   });
@@ -3644,6 +3761,11 @@ async function enumerateGradleWorkspaces(opts) {
 async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFilename, task) {
   await writeSbtPlugin(globalBase, pluginSourceFilename, pluginDestFilename);
   const recordsFile = path.join(globalBase, 'records.tsv');
+  // The global base is shared across sbt roots: a build that dies before
+  // writing must not be read as the previous root's records.
+  await u.promises.rm(recordsFile, {
+    force: true
+  });
   const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
   // Fresh per-run global base (not ~/.sbt): sbt executes everything under
   // plugins/, so a shared path is a code-injection surface. BSP off for this
@@ -3805,6 +3927,7 @@ async function runManifestFacts({
   const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
     hints,
     ignoreUnresolved,
+    resolvedModules: report.resolvedModules,
     unscannable: report.unscannable
   });
   if (rendered.hasBlockingFailures) {
@@ -3993,6 +4116,7 @@ async function runEcosystemCandidates({
         excludeConfigs,
         excludePaths: excludePathsForRoot,
         hints: {
+          continueOnInstallErrorsFlag: withFiles ? REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG : undefined,
           flags: optionFlags,
           setupCommand: DSI_SETUP_COMMAND,
           socketJson: displayPath(path.join(dir, constants.SOCKET_JSON))
@@ -4088,10 +4212,10 @@ async function generateRecursiveManifests({
   // A shared global base across every sbt root in this run lets sbt's own
   // Scala-toolchain cache under <base>/boot survive between invocations
   // instead of being reprovisioned per root (the plugin file is rewritten and
-  // records.tsv is fully overwritten - not appended - on every invocation, so
-  // reuse is safe). A caller-supplied sbtTmpDir is reused as-is (the caller
-  // owns its lifetime); otherwise one is allocated and cleaned up here, but
-  // only when there's an sbt root to benefit from sharing it at all.
+  // records.tsv is removed before every invocation, so reuse is safe). A
+  // caller-supplied sbtTmpDir is reused as-is (the caller owns its lifetime);
+  // otherwise one is allocated and cleaned up here, but only when there's an
+  // sbt root to benefit from sharing it at all.
   const outcomes = sbtTmpDir ? await runAll(sbtTmpDir) : candidatesByTool.get('sbt')?.length ? await utils.withTmpDir('socket-sbt-facts-shared-', runAll) : await runAll(undefined);
   if (verbose) {
     logger.logger.info(`Discovered ${outcomes.length} build-tool candidate(s).`);
@@ -6564,7 +6688,7 @@ async function convertGradleToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: gradleOpts,
     cwd,
@@ -6597,7 +6721,7 @@ async function convertMavenToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: mavenOpts,
     cwd,
@@ -6632,7 +6756,7 @@ async function convertSbtToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: sbtOpts,
     cwd,
@@ -7109,12 +7233,14 @@ const AUTO_MANIFEST_HINTS = {
   setupCommand: 'socket manifest setup',
   socketJson: constants.SOCKET_JSON
 };
-// Under --auto-manifest, a manifest generator that failed — raising the exit
-// code above the value captured before it ran — aborts the whole run: a partial
-// or empty SBOM silently under-reports dependencies. The generator has already
-// logged the specifics. A tolerated resolution failure (ignoreUnresolved) warns
-// without touching the exit code, so it passes through here and the run
-// continues.
+// A failed generator aborts --auto-manifest: a partial SBOM silently
+// under-reports dependencies. Facts generators return null on failure; the
+// others only change the exit code.
+function abortFactsRunIfFailed(ecosystem, outcome) {
+  if (outcome === null) {
+    throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
+  }
+}
 function abortManifestRunIfFailed(ecosystem, beforeExitCode) {
   if (process.exitCode && process.exitCode !== beforeExitCode) {
     throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
@@ -7131,6 +7257,10 @@ async function generateAutoManifest({
 }) {
   const sockJson = utils.readOrDefaultSocketJson(cwd);
   const generatedFiles = [];
+  const hints = computeArtifactsSidecar ? {
+    ...AUTO_MANIFEST_HINTS,
+    continueOnInstallErrorsFlag: REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG
+  } : AUTO_MANIFEST_HINTS;
 
   // Resolved paths across all JVM roots, serialized to one sidecar at the end.
   const sidecarAcc = computeArtifactsSidecar ? new Map() : undefined;
@@ -7152,20 +7282,19 @@ async function generateAutoManifest({
     // `defaults.manifest.sbt.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.sbt?.facts !== false) {
       logger.logger.log('Detected a Scala sbt build, generating Socket facts...');
-      const beforeExitCode = process.exitCode;
-      await convertSbtToFacts({
+      const outcome = await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.sbt?.javaHome ?? undefined,
-        hints: AUTO_MANIFEST_HINTS,
+        hints,
         sidecarAcc,
         tmpDir,
         withFiles: computeArtifactsSidecar
       });
-      abortManifestRunIfFailed('sbt', beforeExitCode);
+      abortFactsRunIfFailed('sbt', outcome);
     } else {
       logger.logger.log('Detected a Scala sbt build, generating pom files with sbt...');
       const beforeExitCode = process.exitCode;
@@ -7188,19 +7317,18 @@ async function generateAutoManifest({
     // `defaults.manifest.gradle.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.gradle?.facts !== false) {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), generating Socket facts...');
-      const beforeExitCode = process.exitCode;
-      await convertGradleToFacts({
+      const outcome = await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs: sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined,
-        hints: AUTO_MANIFEST_HINTS,
+        hints,
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
-      abortManifestRunIfFailed('gradle', beforeExitCode);
+      abortFactsRunIfFailed('gradle', outcome);
     } else {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...');
       const beforeExitCode = process.exitCode;
@@ -7210,8 +7338,7 @@ async function generateAutoManifest({
   }
   if (!sockJson?.defaults?.manifest?.maven?.disabled && detected.maven) {
     logger.logger.log('Detected a Maven pom.xml build, generating Socket facts...');
-    const beforeExitCode = process.exitCode;
-    await convertMavenToFacts({
+    const outcome = await convertMavenToFacts({
       // Configured bin wins; else prefer ./mvnw, else mvn on PATH.
       bin: sockJson.defaults?.manifest?.maven?.bin ?? resolveBuildToolBin('maven', cwd),
       cwd,
@@ -7221,12 +7348,12 @@ async function generateAutoManifest({
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       javaHome: sockJson.defaults?.manifest?.maven?.javaHome ?? undefined,
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts ?? undefined),
-      hints: AUTO_MANIFEST_HINTS,
+      hints,
       sidecarAcc,
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar
     });
-    abortManifestRunIfFailed('maven', beforeExitCode);
+    abortFactsRunIfFailed('maven', outcome);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
     const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
@@ -7522,17 +7649,13 @@ async function createNewScan({
         logger.logger.success('Reachability analysis completed successfully');
         reachabilityReport = reachResult.data?.reachabilityReport;
 
-        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
-        // (appended below) supersedes every facts file.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(p => !utils.isReachabilityReportPath(p, {
+        // Upload Coana's inputs next to its report: depscan drops the report's
+        // components without public metadata, such as private libraries.
+        const pathsForScan = (reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths).filter(p => !utils.isReachabilityReportPath(p, {
           cwd,
           outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON
-        })) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
-
-        // Append coana's reachability report, but not twice: a pre-generated facts
-        // input can resolve to the same path coana wrote its report to.
-        const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
-        scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
+        }));
+        scanPaths = [...pathsForScan, ...(reachabilityReport ? [reachabilityReport] : [])];
         tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
       }
     }
@@ -7683,6 +7806,7 @@ async function handleCi(autoManifest) {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -9811,8 +9935,6 @@ async function outputFixResult(result, outputKind) {
   logger.logger.success('Finished!');
 }
 
-const GHSA_FORMAT_REGEXP = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/;
-const CVE_FORMAT_REGEXP = /^CVE-\d{4}-\d{4,}$/;
 /**
  * Converts mixed CVE/GHSA/PURL IDs to GHSA IDs only.
  * Filters out invalid IDs and logs conversion results.
@@ -9828,51 +9950,12 @@ async function convertIdsToGhsas(ids, options) {
   debug.debugDir('inspect', {
     ids
   });
-  const validGhsas = [];
-  const errors = [];
-  for (const id of ids) {
-    const trimmedId = id.trim();
-    if (trimmedId.startsWith('GHSA-')) {
-      // Already a GHSA ID, validate format
-      if (GHSA_FORMAT_REGEXP.test(trimmedId)) {
-        validGhsas.push(trimmedId);
-      } else {
-        errors.push(`Invalid GHSA format: ${trimmedId}`);
-      }
-    } else if (trimmedId.startsWith('CVE-')) {
-      // Convert CVE to GHSA
-      if (!CVE_FORMAT_REGEXP.test(trimmedId)) {
-        errors.push(`Invalid CVE format: ${trimmedId}`);
-        continue;
-      }
-
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertCveToGhsa(trimmedId);
-      if (conversionResult.ok) {
-        validGhsas.push(conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message}`);
-      }
-    } else if (trimmedId.startsWith('pkg:')) {
-      // Convert PURL to GHSAs.
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertPurlToGhsas(trimmedId);
-      if (conversionResult.ok && conversionResult.data.length) {
-        validGhsas.push(...conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data.length} GHSA(s): ${arrays.joinAnd(conversionResult.data)}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message || 'No GHSAs found'}`);
-      }
-    } else {
-      // Neither CVE, GHSA, nor PURL, skip
-      errors.push(`Unsupported ID format (expected CVE, GHSA, or PURL): ${trimmedId}`);
-    }
-  }
+  const {
+    errors,
+    ghsas: validGhsas
+  } = await utils.resolveAdvisoryIds(ids, {
+    silence
+  });
   if (errors.length) {
     if (!silence) {
       logger.logger.warn(`Skipped ${errors.length} invalid IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
@@ -9989,6 +10072,11 @@ const reachabilityFlags = {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.COANA_CLI_VERSION}.`
   },
+  reachAdvisories: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of advisories to run reachability analysis for, as GHSA or CVE IDs, either as a comma separated value or as multiple flags. CVE IDs are converted to GHSA IDs through the GitHub API. Vulnerabilities from other advisories get unknown reachability. Defaults to all advisories.'
+  },
   reachAnalysisMemoryLimit: {
     type: 'string',
     default: '8192',
@@ -10097,7 +10185,7 @@ const excludePathsFlag$1 = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
-    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.'
   }
 };
 
@@ -12742,7 +12830,7 @@ const excludePathsFlag = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
-    description: 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+    description: 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.'
   }
 };
 
@@ -19935,6 +20023,37 @@ function resolveUvMemberDirs(targets, cwd) {
   return Array.from(memberDirs);
 }
 
+// GitHub publishes GHSA IDs with a lowercase body and CVE IDs uppercase.
+function normalizeAdvisoryId(id) {
+  const trimmed = id.trim();
+  return /^ghsa-/i.test(trimmed) ? `GHSA-${trimmed.slice(5).toLowerCase()}` : trimmed.toUpperCase();
+}
+
+/**
+ * Resolves the --reach-advisories IDs to GHSA IDs, converting CVE IDs through
+ * the GitHub API. Any ID that cannot be resolved fails the command, since
+ * dropping it would leave that advisory without reachability analysis.
+ */
+async function resolveReachAdvisories(ids) {
+  const normalizedIds = arrays.arrayUnique(ids.map(normalizeAdvisoryId));
+  // Checked up front so PURLs never reach resolveAdvisoryIds and a typo fails
+  // before any GitHub lookup.
+  const invalidIds = normalizedIds.filter(id => !utils.GHSA_FORMAT_REGEXP.test(id) && !utils.CVE_FORMAT_REGEXP.test(id));
+  if (invalidIds.length) {
+    throw new utils.InputError(`Invalid --reach-advisories IDs: ${invalidIds.join(', ')}. Use GHSA IDs (GHSA-xxxx-xxxx-xxxx) or CVE IDs (CVE-YYYY-NNNN).`);
+  }
+  const {
+    errors,
+    ghsas
+  } = await utils.resolveAdvisoryIds(normalizedIds, {
+    silence: true
+  });
+  if (errors.length) {
+    throw new utils.InputError(`Could not resolve --reach-advisories IDs to GHSA IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+  }
+  return arrays.arrayUnique(ghsas);
+}
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -20364,8 +20483,10 @@ async function run$d(argv, importMeta, {
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
 
   // Validation helpers for better readability.
+  const hasReachAdvisories = reachAdvisoriesRaw.length > 0;
   const hasReachEcosystems = reachEcosystems.length > 0;
   const hasReachExcludePaths = reachExcludePaths.length > 0;
 
@@ -20383,7 +20504,7 @@ async function run$d(argv, importMeta, {
   // added flags require --reach automatically instead of relying on a
   // hand-maintained list. Deprecated no-ops are excluded on purpose.
   const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(([name, flag]) => flag.type === 'boolean' && !DEPRECATED_NO_OP_REACH_FLAGS.has(name) && cli.flags[name] !== flag.default);
-  const isUsingAnyReachabilityFlags = hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
+  const isUsingAnyReachabilityFlags = hasReachAdvisories || hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
 
   // Validate target constraints when --reach is enabled.
   const reachTargetValidation = reach ? await validateReachabilityTarget(targets, cwd) : {
@@ -20460,6 +20581,7 @@ async function run$d(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleCreateNewScan({
     autoManifest: Boolean(autoManifest),
     branchName: branchName,
@@ -20477,6 +20599,7 @@ async function run$d(argv, importMeta, {
     reach: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -21195,6 +21318,7 @@ async function scanOneRepo(repoSlug, {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -22623,6 +22747,7 @@ async function run$7(argv, importMeta, {
 
   // Process comma-separated values for isMultiple flags.
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
   const reachEcosystemsRaw = utils.cmdFlagValueToArray(cli.flags['reachEcosystems']);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
   assertValidExcludePaths(excludePaths);
@@ -22695,6 +22820,7 @@ async function run$7(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleScanReach({
     cwd,
     interactive,
@@ -22704,6 +22830,7 @@ async function run$7(argv, importMeta, {
     reachabilityOptions: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -24668,5 +24795,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=ccb7632d-f5e4-4589-8d85-1814c416c744
+//# debugId=5d7a85dd-501f-4419-b550-bef90180bd6a
 //# sourceMappingURL=cli.js.map