@socketsecurity/cli-with-sentry 1.14.1 → 1.15.0

package/dist/cli.js

@@ -1194,132 +1194,60 @@ async function finalizeTier1Scan(tier1ReachabilityScanId, scanId) {
   });
 }
 
-/**
- * This fetches all the relevant pieces of data to generate a report, given a
- * full scan ID.
- */
+/** Fetch the scan data needed to generate a report. */
 async function fetchScanData(orgSlug, scanId, options) {
-  const {
-    includeLicensePolicy,
-    sdkOpts
-  } = {
-    __proto__: null,
-    ...options
-  };
-  const sockSdkCResult = await utils.setupSdk(sdkOpts);
-  if (!sockSdkCResult.ok) {
-    return sockSdkCResult;
-  }
-  const sockSdk = sockSdkCResult.data;
-  let policyStatus = 'requested...';
-  let scanStatus = 'requested...';
-  let finishedFetching = false;
   const {
     spinner
   } = constants.default;
-  function updateScan(status) {
-    scanStatus = status;
-    updateProgress();
-  }
-  function updatePolicy(status) {
-    policyStatus = status;
-    updateProgress();
-  }
-  function updateProgress() {
-    if (finishedFetching) {
-      spinner.stop();
-      logger.logger.info(`Scan result: ${scanStatus}. Security policy: ${policyStatus}.`);
-    } else {
-      spinner.start(`Scan result: ${scanStatus}. Security policy: ${policyStatus}.`);
-    }
-  }
-  async function fetchScanResult() {
-    const result = await utils.queryApiSafeText(`orgs/${orgSlug}/full-scans/${encodeURIComponent(scanId)}${includeLicensePolicy ? '?include_license_details=true' : ''}`);
-    updateScan(`response received`);
+  spinner.start('Scan result: requested...');
+  try {
+    const result = await utils.queryApiSafeText(`orgs/${orgSlug}/full-scans/${encodeURIComponent(scanId)}${options?.includeLicensePolicy ? '?include_license_details=true' : ''}`);
     if (!result.ok) {
+      spinner.stop();
+      logger.logger.info('Scan result: request failed.');
       return result;
     }
-    const ndJsonString = result.data;
-
-    // This is nd-json; each line is a json object.
-    const lines = ndJsonString.split('\n').filter(Boolean);
-    let ok = true;
-    const data = lines.map(line => {
+    const data = [];
+    for (const line of result.data.split('\n').filter(Boolean)) {
       try {
-        return JSON.parse(line);
-      } catch (e) {
-        ok = false;
+        data.push(JSON.parse(line));
+      } catch (error) {
         debug.debugFn('error', 'Failed to parse report data line as JSON');
         debug.debugDir('error', {
-          error: e,
+          error,
           line
         });
-        return;
+        spinner.stop();
+        logger.logger.info('Scan result: received invalid JSON response.');
+        return {
+          ok: false,
+          message: 'Invalid Socket API response',
+          cause: 'The Socket API responded with at least one line that was not valid JSON. Please report if this persists.'
+        };
       }
-    });
-    if (ok) {
-      updateScan('success');
-      return {
-        ok: true,
-        data
-      };
     }
-    updateScan('received invalid JSON response');
-    return {
-      ok: false,
-      message: 'Invalid Socket API response',
-      cause: 'The Socket API responded with at least one line that was not valid JSON. Please report if this persists.'
-    };
-  }
-  async function fetchSecurityPolicy() {
-    const result = await utils.handleApiCallNoSpinner(sockSdk.getOrgSecurityPolicy(orgSlug), 'GetOrgSecurityPolicy');
-    updatePolicy('received policy');
-    return result;
-  }
-  updateProgress();
-  const [scan, securityPolicy] = await Promise.all([fetchScanResult().catch(e => {
-    updateScan('failure; unknown blocking error occurred');
+    spinner.stop();
+    logger.logger.info('Scan result: success.');
     return {
-      ok: false,
-      message: 'Socket API error',
-      cause: utils.formatErrorWithDetail('Error requesting scan', e) || 'Error requesting scan: (no error message found)'
+      ok: true,
+      data: {
+        scan: data
+      }
     };
-  }), fetchSecurityPolicy().catch(e => {
-    updatePolicy('failure; unknown blocking error occurred');
+  } catch (error) {
+    spinner.stop();
+    logger.logger.info('Scan result: request failed.');
     return {
       ok: false,
       message: 'Socket API error',
-      cause: utils.formatErrorWithDetail('Error requesting policy', e) || 'Error requesting policy: (no error message found)'
+      cause: utils.formatErrorWithDetail('Error requesting scan', error) || 'Error requesting scan: (no error message found)'
     };
-  })]).finally(() => {
-    finishedFetching = true;
-    updateProgress();
-  });
-  if (!scan.ok) {
-    return scan;
   }
-  if (!securityPolicy.ok) {
-    return securityPolicy;
-  }
-  if (!Array.isArray(scan.data)) {
-    return {
-      ok: false,
-      message: 'Failed to fetch',
-      cause: 'Was unable to fetch scan result, bailing'
-    };
-  }
-  return {
-    ok: true,
-    data: {
-      scan: scan.data,
-      securityPolicy: securityPolicy.data
-    }
-  };
 }
 
 // Note: The returned cResult will only be ok:false when the generation
 //       failed. It won't reflect the healthy state.
-function generateReport(scan, securityPolicy, {
+function generateReport(scan, {
   fold,
   orgSlug,
   reportLevel,
@@ -1341,7 +1269,7 @@ function generateReport(scan, securityPolicy, {
 
   // In the context of a report;
   // - the alert.severity is irrelevant
-  // - the securityPolicyDefault is irrelevant
+  // - policy defaults are irrelevant because the API resolves actions per alert
   // - the report defaults to healthy:true with no alerts
   // - the appearance of an alert will trigger the policy action;
   //   - error: healthy will end up as false, add alerts to report
@@ -1359,61 +1287,50 @@ function generateReport(scan, securityPolicy, {
 
   const violations = new Map();
   let healthy = true;
-  const securityRules = securityPolicy.securityPolicyRules;
-  if (securityRules) {
-    // Note: reportLevel: error > warn > monitor > ignore > defer
-    scan.forEach(artifact => {
-      const {
-        alerts,
-        name: pkgName = constants.UNKNOWN_VALUE,
-        type: ecosystem,
-        version = constants.UNKNOWN_VALUE
-      } = artifact;
-      alerts?.forEach(alert => {
-        const alertName = alert.type; // => policy[type]
-        const action = securityRules[alertName]?.action || '';
-        switch (action) {
-          case constants.default.REPORT_LEVEL_ERROR:
-            {
-              healthy = false;
-              if (!short) {
-                addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
-              }
-              break;
-            }
-          case constants.default.REPORT_LEVEL_WARN:
-            {
-              if (!short && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
-                addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
-              }
-              break;
+
+  // Note: reportLevel: error > warn > monitor > ignore > defer
+  scan.forEach(artifact => {
+    const {
+      alerts,
+      name: pkgName = constants.UNKNOWN_VALUE,
+      type: ecosystem,
+      version = constants.UNKNOWN_VALUE
+    } = artifact;
+    alerts?.forEach(alert => {
+      const action = alert.action;
+      switch (action) {
+        case constants.default.REPORT_LEVEL_ERROR:
+          {
+            healthy = false;
+            if (!short) {
+              addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
             }
-          case constants.default.REPORT_LEVEL_MONITOR:
-            {
-              if (!short && reportLevel !== constants.default.REPORT_LEVEL_WARN && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
-                addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
-              }
-              break;
+            break;
+          }
+        case constants.default.REPORT_LEVEL_WARN:
+          {
+            if (!short && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
+              addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
             }
-          case constants.default.REPORT_LEVEL_IGNORE:
-            {
-              if (!short && reportLevel !== constants.default.REPORT_LEVEL_MONITOR && reportLevel !== constants.default.REPORT_LEVEL_WARN && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
-                addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
-              }
-              break;
+            break;
+          }
+        case constants.default.REPORT_LEVEL_MONITOR:
+          {
+            if (!short && reportLevel !== constants.default.REPORT_LEVEL_WARN && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
+              addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
             }
-          case constants.default.REPORT_LEVEL_DEFER:
-            {
-              // Not sure but ignore for now. Defer to later ;)
-              if (!short && reportLevel === constants.default.REPORT_LEVEL_DEFER) {
-                addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
-              }
-              break;
+            break;
+          }
+        case constants.default.REPORT_LEVEL_IGNORE:
+          {
+            if (!short && reportLevel !== constants.default.REPORT_LEVEL_MONITOR && reportLevel !== constants.default.REPORT_LEVEL_WARN && reportLevel !== constants.default.REPORT_LEVEL_ERROR) {
+              addAlert(artifact, violations, fold, ecosystem, pkgName, version, alert, action);
             }
-        }
-      });
+            break;
+          }
+      }
     });
-  }
+  });
   spinner?.successAndStop(`Generated reported in ${Date.now() - now} ms`);
   if (short) {
     return {
@@ -1556,7 +1473,7 @@ async function outputScanReport(result, {
     logger.logger.fail(utils.failMsgWithBadge(result.message, result.cause));
     return;
   }
-  const scanReport = generateReport(result.data.scan, result.data.securityPolicy, {
+  const scanReport = generateReport(result.data.scan, {
     orgSlug,
     scanId,
     fold,
@@ -9652,6 +9569,11 @@ async function handleConfigSet({
     outputKind
   });
   const result = utils.updateConfigValue(key, value);
+  if (result.ok && !result.data && key === constants.CONFIG_KEY_API_TOKEN) {
+    // An explicit API-token update must take precedence over a saved OAuth
+    // session, which otherwise remains the active credential source.
+    utils.updateConfigValue(constants.CONFIG_KEY_AUTH_TYPE, 'api-token');
+  }
 
   // `config set` is a one-shot command: an in-memory-only change is a no-op
   // because the process exits before anything reads it. updateConfigValue only
@@ -12047,13 +11969,20 @@ async function run$M(argv, importMeta, {
 function applyLogin(apiToken, enforcedOrgs, apiBaseUrl, apiProxy) {
   utils.updateConfigValue(constants.CONFIG_KEY_ENFORCED_ORGS, enforcedOrgs);
   utils.updateConfigValue(constants.CONFIG_KEY_API_TOKEN, apiToken);
+  utils.updateConfigValue(constants.CONFIG_KEY_AUTH_TYPE, 'api-token');
   utils.updateConfigValue(constants.CONFIG_KEY_API_BASE_URL, apiBaseUrl);
   utils.updateConfigValue(constants.CONFIG_KEY_API_PROXY, apiProxy);
 }
 
-async function attemptLogin(apiBaseUrl, apiProxy) {
+async function attemptLogin(apiBaseUrl, apiProxy, apiTokenMode = false) {
+  if (!apiTokenMode) {
+    return await attemptOAuthLogin(apiBaseUrl, apiProxy);
+  }
+  return await attemptApiTokenLogin(apiBaseUrl, apiProxy);
+}
+async function attemptApiTokenLogin(apiBaseUrl, apiProxy) {
   apiBaseUrl ??= utils.getConfigValueOrUndef(constants.CONFIG_KEY_API_BASE_URL) ?? undefined;
-  apiProxy ??= utils.getConfigValueOrUndef(constants.CONFIG_KEY_API_PROXY) ?? undefined;
+  apiProxy ||= utils.getDefaultProxyUrl();
   const apiTokenInput = await prompts.password({
     message: `Enter your ${utils.socketDocsLink('/docs/api-keys', 'Socket.dev API token')} (leave blank to use a limited public token)`
   });
@@ -12171,6 +12100,18 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
   const previousPersistedToken = utils.getConfigValueOrUndef(constants.CONFIG_KEY_API_TOKEN);
   try {
     applyLogin(apiToken, enforcedOrgs, apiBaseUrl, apiProxy);
+    if (constants.default.socketAppDataPath && !utils.isConfigFromFlag()) {
+      try {
+        const result = await utils.logoutOAuth(constants.default.socketAppDataPath, {
+          apiProxy
+        });
+        if (result.warning) {
+          logger.logger.warn(result.warning);
+        }
+      } catch {
+        logger.logger.warn('The previous browser sign-in could not be removed.');
+      }
+    }
     logger.logger.success(`API credentials ${previousPersistedToken === apiToken ? 'refreshed' : previousPersistedToken ? 'updated' : 'set'}`);
     if (utils.isConfigFromFlag()) {
       logger.logger.log('');
@@ -12178,12 +12119,103 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
     }
   } catch {
     process.exitCode = 1;
-    logger.logger.fail(`API login failed`);
+    logger.logger.fail('API login failed');
+  }
+}
+async function attemptOAuthLogin(apiBaseUrl, apiProxy) {
+  if (utils.isConfigFromFlag()) {
+    throw new Error('Browser sign-in cannot be saved while --config or SOCKET_CLI_CONFIG is active. Remove the config override and run `socket login` again.');
+  }
+  const configuredBaseUrl = apiBaseUrl || utils.getDefaultApiBaseUrl();
+  if (configuredBaseUrl) {
+    let configuredOrigin;
+    try {
+      configuredOrigin = new URL(configuredBaseUrl).origin;
+    } catch {
+      throw new Error('The configured Socket API URL is invalid for OAuth.');
+    }
+    if (configuredOrigin !== utils.OAUTH_ISSUER) {
+      throw new Error('Browser sign-in is only available with Socket’s trusted API URL. Use `socket login --api-token --api-base-url <url>` for a custom API URL.');
+    }
+  }
+  const existingToken = utils.getConfigValueOrUndef(constants.CONFIG_KEY_API_TOKEN);
+  const activeAuthType = utils.getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE);
+  if (existingToken && activeAuthType !== 'oauth') {
+    const choice = await prompts.select({
+      message: 'An API token is already saved. Keep using it or switch to read-only browser sign-in?',
+      choices: [{
+        name: 'Keep the saved API token',
+        value: 'keep'
+      }, {
+        name: 'Switch to browser sign-in (read-only)',
+        value: 'oauth'
+      }]
+    });
+    if (choice === undefined) {
+      logger.logger.fail('Canceled by user');
+      return {
+        ok: false,
+        message: 'Canceled',
+        cause: 'Canceled by user'
+      };
+    }
+    if (choice === 'keep') {
+      logger.logger.success('Kept the saved API token login');
+      return {
+        ok: true
+      };
+    }
+  }
+  apiProxy ||= utils.getDefaultProxyUrl();
+  const result = await utils.beginOAuthLogin({
+    apiProxy,
+    openBrowser: true,
+    onAuthorizationUrl(url) {
+      logger.logger.log('Open this URL in your browser to sign in:');
+      logger.logger.log(url);
+    }
+  });
+  const baseUrl = new URL('/v0/', result.apiOrigin).href;
+  const sdkResult = await utils.setupSdk({
+    apiBaseUrl: baseUrl,
+    apiProxy,
+    apiToken: result.accessToken
+  });
+  if (!sdkResult.ok) {
+    process.exitCode = 1;
+    logger.logger.fail(utils.failMsgWithBadge(sdkResult.message, sdkResult.cause));
+    return;
+  }
+  const orgsResult = await utils.fetchOrganization({
+    description: 'browser sign-in validation',
+    sdk: sdkResult.data
+  });
+  if (!orgsResult.ok) {
+    process.exitCode = 1;
+    logger.logger.fail(utils.failMsgWithBadge(orgsResult.message, orgsResult.cause));
+    return;
+  }
+  const orgSlugs = utils.getOrgSlugs(orgsResult.data.organizations);
+  if (orgSlugs.length === 0) {
+    process.exitCode = 1;
+    logger.logger.fail('Browser sign-in succeeded, but no accessible organization was returned. Check your organization membership and try again; existing credentials were kept.');
+    return;
+  }
+  await utils.saveOAuthCredentials(constants.default.socketAppDataPath, result);
+  utils.updateConfigValue(constants.CONFIG_KEY_API_TOKEN, null);
+  utils.updateConfigValue(constants.CONFIG_KEY_DEFAULT_ORG, orgSlugs[0]);
+  utils.updateConfigValue(constants.CONFIG_KEY_API_BASE_URL, null);
+  utils.updateConfigValue(constants.CONFIG_KEY_API_PROXY, apiProxy);
+  utils.updateConfigValue(constants.CONFIG_KEY_AUTH_TYPE, 'oauth');
+  logger.logger.success(`Browser sign-in saved for ${arrays.joinAnd(orgSlugs)}`);
+  logger.logger.warn('This sign-in is read-only and supports package, alert, and threat-feed queries. Write and scan commands require API-token credentials; use `socket login --api-token` or SOCKET_CLI_API_TOKEN.');
+  if (constants.default.ENV.SOCKET_CLI_API_TOKEN) {
+    logger.logger.warn('SOCKET_CLI_API_TOKEN remains active and takes precedence over browser sign-in for this session.');
   }
 }
 
 const CMD_NAME$r = 'login';
-const description$x = 'Setup Socket CLI with an API token and defaults';
+const description$x = 'Sign in to Socket and configure the CLI';
 const hidden$r = false;
 const cmdLogin = {
   description: description$x,
@@ -12199,10 +12231,15 @@ async function run$L(argv, importMeta, {
     hidden: hidden$r,
     flags: {
       ...flags.commonFlags,
+      apiToken: {
+        type: 'boolean',
+        default: false,
+        description: 'Use masked API-token login for scans and write commands'
+      },
       apiBaseUrl: {
         type: 'string',
         default: '',
-        description: 'API server to connect to for login'
+        description: 'API server for API-token login'
       },
       apiProxy: {
         type: 'string',
@@ -12217,13 +12254,16 @@ async function run$L(argv, importMeta, {
     API Token Requirements
       ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$r}`)}
 
-    Logs into the Socket API by prompting for an API token
+    By default, opens a browser for read-only package, alert, and threat-feed
+    access. Use --api-token for scans and write operations. A sign-in URL is
+    printed so you can open it manually if the browser does not launch.
 
     Options
       ${utils.getFlagListOutput(config.flags)}
 
     Examples
       $ ${command}
+      $ ${command} --api-token
       $ ${command} --api-proxy=http://localhost:1234
   `
   };
@@ -12238,33 +12278,53 @@ async function run$L(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const apiTokenMode = !!cli.flags['apiToken'];
   if (!vendor.isInteractiveExports()) {
-    throw new utils.InputError('Cannot prompt for credentials in a non-interactive shell. Use SOCKET_CLI_API_TOKEN environment variable instead');
+    throw new utils.InputError('Login requires an interactive terminal. Set SOCKET_CLI_API_TOKEN for automation.');
   }
   const {
     apiBaseUrl,
     apiProxy
   } = cli.flags;
-  await attemptLogin(apiBaseUrl, apiProxy);
+  await attemptLogin(apiBaseUrl, apiProxy, apiTokenMode);
 }
 
 function applyLogout() {
   utils.updateConfigValue(constants.CONFIG_KEY_API_TOKEN, null);
+  utils.updateConfigValue(constants.CONFIG_KEY_AUTH_TYPE, null);
   utils.updateConfigValue(constants.CONFIG_KEY_API_BASE_URL, null);
   utils.updateConfigValue(constants.CONFIG_KEY_API_PROXY, null);
   utils.updateConfigValue(constants.CONFIG_KEY_ENFORCED_ORGS, null);
 }
 
-function attemptLogout() {
+async function attemptLogout() {
+  let warning;
   try {
-    applyLogout();
+    const directory = constants.default.socketAppDataPath;
+    try {
+      if (directory && !utils.isConfigFromFlag()) {
+        const result = await utils.logoutOAuth(directory, {
+          apiProxy: utils.getDefaultProxyUrl()
+        });
+        warning = result.warning;
+      }
+    } finally {
+      applyLogout();
+    }
     logger.logger.success('Successfully logged out');
+    if (warning) {
+      logger.logger.warn(`Local sign-out completed. ${warning}`);
+    }
+    if (constants.default.ENV.SOCKET_CLI_API_TOKEN) {
+      logger.logger.warn('SOCKET_CLI_API_TOKEN remains active and takes precedence until it is unset.');
+    }
     if (utils.isConfigFromFlag()) {
       logger.logger.log('');
       logger.logger.warn('Note: config is in read-only mode, at least one key was overridden through flag/env, so the logout was not persisted!');
     }
-  } catch {
+  } catch (error) {
     logger.logger.fail('Failed to complete logout steps');
+    logger.logger.warn(utils.getErrorCause(error));
   }
 }
 
@@ -12304,7 +12364,7 @@ async function run$K(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
-  attemptLogout();
+  await attemptLogout();
 }
 
 const {
@@ -12705,6 +12765,90 @@ async function run$J(argv, importMeta, context) {
   await spawnPromise;
 }
 
+function canonicalizeForContainment(filePath) {
+  let existingPath = path.resolve(filePath);
+  const missingSegments = [];
+  while (!u.existsSync(existingPath)) {
+    const parent = path.dirname(existingPath);
+    if (parent === existingPath) {
+      break;
+    }
+    missingSegments.unshift(path.basename(existingPath));
+    existingPath = parent;
+  }
+  return path.join(u.realpathSync(existingPath), ...missingSegments);
+}
+function readSetting(cliValue, socketJsonValue, flag, trustSocketJson, refusedFields, socketJsonDefaults) {
+  if (typeof cliValue === 'string' && cliValue.length > 0) {
+    return cliValue;
+  }
+  if (typeof socketJsonValue !== 'string' || socketJsonValue.length === 0) {
+    return undefined;
+  }
+  if (!trustSocketJson) {
+    refusedFields.push(flag);
+    return undefined;
+  }
+  socketJsonDefaults.push({
+    flag,
+    value: socketJsonValue
+  });
+  return socketJsonValue;
+}
+function resolveBazelManifestSettings({
+  cli,
+  cwd,
+  socketJson,
+  trustSocketJson
+}) {
+  const config = socketJson.defaults?.manifest?.bazel ?? {};
+  const refusedFields = [];
+  const socketJsonDefaults = [];
+  const bazel = readSetting(cli.bazel, config.bazel ?? config.bin, '--bazel', trustSocketJson, refusedFields, socketJsonDefaults);
+  const bazelFlags = readSetting(cli.bazelFlags, config.bazelFlags, '--bazel-flags', trustSocketJson, refusedFields, socketJsonDefaults);
+  const bazelOutputBase = readSetting(cli.bazelOutputBase, config.bazelOutputBase, '--bazel-output-base', trustSocketJson, refusedFields, socketJsonDefaults);
+  const bazelRc = readSetting(cli.bazelRc, config.bazelRc, '--bazel-rc', trustSocketJson, refusedFields, socketJsonDefaults);
+  if (refusedFields.length > 0) {
+    return {
+      ok: false,
+      message: `Refused bazel settings chosen by ${constants.SOCKET_JSON}`,
+      cause: [`${constants.SOCKET_JSON} in ${cwd} sets ${refusedFields.join(', ')}.`, 'Saw repository-supplied bazel execution settings, wanted none.', 'These values choose the Bazel executable and its options, and the scanned repository controls its own socket.json.', 'Fix: pass --bazel, --bazel-flags, --bazel-rc, or --bazel-output-base on the command line, or re-run with --trust-socket-json.'].join('\n')
+    };
+  }
+  const cliOut = typeof cli.out === 'string' ? cli.out : undefined;
+  const socketJsonOut = config.out;
+  const outFromSocketJson = !cliOut && typeof socketJsonOut === 'string';
+  const outValue = cliOut ?? socketJsonOut;
+  const resolvedOut = outValue ? path.resolve(cwd, outValue) : path.join(cwd, '.socket', 'bazel-manifests');
+  const canonicalCwd = canonicalizeForContainment(cwd);
+  const canonicalOut = canonicalizeForContainment(resolvedOut);
+  const relativeOut = path.relative(canonicalCwd, canonicalOut);
+  if (outFromSocketJson && !trustSocketJson && (relativeOut === '..' || relativeOut.startsWith(`..${path.sep}`) || path.isAbsolute(relativeOut))) {
+    return {
+      ok: false,
+      message: `Refused a bazel output path chosen by ${constants.SOCKET_JSON}`,
+      cause: [`${constants.SOCKET_JSON} in ${cwd} sets defaults.manifest.bazel.out.`, `Saw \`${socketJsonOut}\` (resolves to ${resolvedOut}), wanted a path inside ${cwd}.`, 'The CLI writes generated manifests there, so a scanned repository must not choose an output path outside the project.', `Fix: pass --out=${socketJsonOut} if you trust this path, or re-run with --trust-socket-json to honor the setting.`].join('\n')
+    };
+  }
+  if (outFromSocketJson) {
+    socketJsonDefaults.push({
+      flag: '--out',
+      value: resolvedOut
+    });
+  }
+  return {
+    ok: true,
+    data: {
+      bazel,
+      bazelFlags: bazelFlags ?? '',
+      bazelOutputBase,
+      bazelRc,
+      out: resolvedOut,
+      socketJsonDefaults
+    }
+  };
+}
+
 // Result shape returned by `validatePypiHub`. Kept local to the PyPI module
 // since validation here is hub-alias-marker based (different from the
 // Maven-side tri-state classifier).
@@ -13714,6 +13858,11 @@ const config$h = {
       type: 'number',
       description: 'Per-hub bazel cquery timeout in milliseconds; default: 120000'
     },
+    trustSocketJson: {
+      type: 'boolean',
+      default: false,
+      description: `Run Bazel settings declared in ${constants.SOCKET_JSON}. Off by default because the scanned repository controls that file.`
+    },
     verbose: {
       type: 'boolean',
       description: 'Emit bounded Bazel diagnostics with argv, duration, exit status, and output sizes'
@@ -13735,6 +13884,11 @@ const config$h = {
     --ecosystem may be repeated to select which ecosystems to extract.
     When omitted, Maven is generated by default. PyPI is explicit opt-in.
 
+    A ${constants.SOCKET_JSON} that sets \`bazel\`/\`bin\`, \`bazelFlags\`, \`bazelRc\`, or
+    \`bazelOutputBase\`, or an \`out\` outside the project, is refused unless
+    you pass --trust-socket-json. Pass the matching command-line flags to
+    override these defaults without trusting ${constants.SOCKET_JSON}.
+
     Note: this command generates dependency manifests for Bazel workspaces.
     It does not run reachability analysis.
 
@@ -13898,53 +14052,48 @@ async function run$I(argv, importMeta, {
     verbose
   } = cli.flags;
   let perRepoTimeout = cli.flags['perRepoTimeout'];
-
-  // Set defaults for any flag/arg that is not given. Check socket.json first.
-  if (bazel) {
-    bazel = path.resolve(process.cwd(), String(bazel));
-  } else {
-    const defaultBazel = sockJson.defaults?.manifest?.bazel?.bazel ?? sockJson.defaults?.manifest?.bazel?.bin;
-    if (defaultBazel) {
-      bazel = defaultBazel;
-      logger.logger.info(`Using default --bazel from ${constants.SOCKET_JSON}:`, bazel);
-    }
-    // Otherwise leave undefined; resolveBazelBinary performs the PATH
-    // lookup for bazelisk/bazel.
-  }
-  if (!bazelFlags) {
-    if (sockJson.defaults?.manifest?.bazel?.bazelFlags) {
-      bazelFlags = sockJson.defaults?.manifest?.bazel?.bazelFlags;
-      logger.logger.info(`Using default --bazel-flags from ${constants.SOCKET_JSON}:`, bazelFlags);
+  const settings = resolveBazelManifestSettings({
+    cli: {
+      bazel,
+      bazelFlags,
+      bazelOutputBase,
+      bazelRc,
+      out
+    },
+    cwd,
+    socketJson: sockJson,
+    trustSocketJson: Boolean(cli.flags['trustSocketJson'])
+  });
+  if (!settings.ok) {
+    process.exitCode = 1;
+    if (outputKind === 'json') {
+      logger.logger.log(utils.serializeResultJson(settings));
     } else {
-      bazelFlags = '';
-    }
-  }
-  if (!bazelOutputBase) {
-    if (sockJson.defaults?.manifest?.bazel?.bazelOutputBase) {
-      bazelOutputBase = sockJson.defaults?.manifest?.bazel?.bazelOutputBase;
-      logger.logger.info(`Using default --bazel-output-base from ${constants.SOCKET_JSON}:`, bazelOutputBase);
+      logger.logger.fail(utils.failMsgWithBadge(settings.message, settings.cause));
     }
+    return;
   }
-  if (!bazelRc) {
-    if (sockJson.defaults?.manifest?.bazel?.bazelRc) {
-      bazelRc = sockJson.defaults?.manifest?.bazel?.bazelRc;
-      logger.logger.info(`Using default --bazel-rc from ${constants.SOCKET_JSON}:`, bazelRc);
-    }
+  for (const {
+    flag,
+    value
+  } of settings.data.socketJsonDefaults) {
+    logger.logger.info(`Using default ${flag} from ${constants.SOCKET_JSON}:`, value);
   }
-  if (!out) {
-    if (sockJson.defaults?.manifest?.bazel?.out) {
-      out = sockJson.defaults?.manifest?.bazel?.out;
-      logger.logger.info(`Using default --out from ${constants.SOCKET_JSON}:`, out);
-    } else {
-      out = path.join(cwd, '.socket', 'bazel-manifests');
-    }
+  bazel = settings.data.bazel;
+  bazelFlags = settings.data.bazelFlags;
+  bazelOutputBase = settings.data.bazelOutputBase;
+  bazelRc = settings.data.bazelRc;
+  out = settings.data.out;
+
+  // Set defaults for any flag/arg that is not given. Check socket.json first.
+  if (bazel && cli.flags['bazel']) {
+    bazel = path.resolve(process.cwd(), String(bazel));
   }
+  bazelFlags ??= '';
   if (verbose === undefined) {
+    verbose = sockJson.defaults?.manifest?.bazel?.verbose ?? false;
     if (sockJson.defaults?.manifest?.bazel?.verbose !== undefined) {
-      verbose = sockJson.defaults?.manifest?.bazel?.verbose;
       logger.logger.info(`Using default --verbose from ${constants.SOCKET_JSON}:`, verbose);
-    } else {
-      verbose = false;
     }
   }
   if (perRepoTimeout === undefined) {
@@ -25599,7 +25748,7 @@ function addSocketWrapper(file) {
       return new Error(`There was an error setting up the alias: ${err}`);
     }
     logger.logger.success(`The alias was added to ${file}. Running 'npm install' will now be wrapped in Socket's "safe npm" 🎉`);
-    logger.logger.log(`  If you want to disable it at any time, run \`socket wrapper --disable\``);
+    logger.logger.log(`  If you want to disable it at any time, run \`socket wrapper off\``);
     logger.logger.log('');
     logger.logger.info(`This will only be active in new terminal sessions going forward.`);
     logger.logger.log(`  You will need to restart your terminal or run this command to activate the alias in the current session:`);
@@ -26143,5 +26292,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=e8c87646-0d74-4bcc-9e38-e86a951f03ae
+//# debugId=f0475874-f135-4a6b-aa96-64e325d96f5f
 //# sourceMappingURL=cli.js.map