@socketsecurity/cli-with-sentry 1.6.0 → 1.6.2

package/dist/cli.js

@@ -1814,28 +1814,9 @@ function reachMemoryLimitToMb(value) {
   return match[2]?.toLowerCase() === 'gb' ? amount * 1024 : amount;
 }
 
-// No sources/targets here: those are local absolute paths, returned in-memory
-// as ResolvedArtifactPaths, never serialized into the SBOM.
-
-// Relative to the facts file's directory.
-
-// Resolved on-disk paths for a --with-files run, keyed by coordinate. `targets`
-// = classpath entries (jars / module output dirs); `sources` = module source
-// roots.
-
-function projectClasspathKey(project) {
-  return `${project.subprojectDir} ${project.namespace ?? ''}:${project.name}`;
-}
-
-// Coordinate-based (not `id`-based) so it also matches foreign SBOMs like
-// CycloneDX. Empty segments dropped.
-function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
-  return [groupId, artifactId, type, classifier, version].filter(Boolean).join(':');
-}
-
 // Frozen contract with `coana run --compute-artifacts-sidecar`; change only
 // in sync with the coana consumer. Keyed by the absolute path of the
-// `.socket.facts.json` file whose own projects[]/components[] these entries
+// `*.socket.facts.json` file whose own projects[]/components[] these entries
 // describe - the key IS the scope, so two independent reactors that happen to
 // emit the same purl identity (e.g. a shared internal module name) can never
 // collide: each is only ever looked up within its own key. No cross-reactor
@@ -1843,24 +1824,13 @@ function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
 // independent reactors is intentionally duplicated across all of their
 // components[].
 
-// `targets`/`sources` present (possibly `[]`) means resolution was attempted
-// for this coordinate - an empty array is a successful resolve that found
-// nothing (e.g. a pom/BOM with no artifact), not a failure. Both fields
-// omitted (undefined) means resolution couldn't even be attempted - the only
-// case here is a degenerate entry with no computable coordinate at all, since
-// every entry reaching this function already came from a resolved graph node
-// (an unresolved dependency lives in the resolution report, not here).
+// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact).
 function attachPaths(entry, artifactPaths) {
-  const coordKey = mavenCoordinateKey(entry.namespace, entry.name, entry.qualifiers?.['ext'], entry.qualifiers?.['classifier'], entry.version);
-  if (!coordKey) {
-    return {
-      ...entry
-    };
-  }
+  const paths = artifactPaths.pathsById.get(entry.id);
   return {
     ...entry,
-    targets: [...(artifactPaths.targetsByCoord.get(coordKey) ?? [])].sort(),
-    sources: [...(artifactPaths.sourcesByCoord.get(coordKey) ?? [])].sort()
+    targets: [...(paths?.targets ?? [])],
+    sources: [...(paths?.sources ?? [])]
   };
 }
 function purlSortKey(entry) {
@@ -1877,9 +1847,8 @@ function sortByPurl(entries) {
 // Emit an entry for every SBOM component AND every first-party project: a
 // top-level module is a project, not a dependency component, yet its source
 // roots are where reachability starts, so the sidecar must carry them.
-// A second call for the same factsFile (a dual-marker directory where two
-// build tools both target it) overwrites rather than merges, matching the
-// existing last-writer-wins convention for that case.
+// Every build writes its own facts file, so a key is accumulated once; a
+// repeated call for the same factsFile (the same build run again) overwrites.
 function accumulateSidecar(acc, facts, artifactPaths, factsFile,
 // Off when artifact paths were not resolved; entries then omit `targets` and `sources`.
 withPaths = true) {
@@ -1890,7 +1859,7 @@ withPaths = true) {
     components: facts.components.map(paths),
     projects: (facts.projects ?? []).map(proj => ({
       ...paths(proj),
-      classpath: [...(artifactPaths.classpathByProject.get(projectClasspathKey(proj)) ?? [])]
+      classpath: [...(artifactPaths.classpathByProject.get(proj.id) ?? [])]
     }))
   });
 }
@@ -2693,13 +2662,9 @@ function assembleFacts(parsed, opts = {}) {
   const {
     directByRoot,
     finalNodes
-  } = mergeByCoordinate(perRoot);
+  } = mergeById(perRoot);
   const tool = parsed.tool || 'gradle';
-  const projectsByGav = new Map();
-  for (const p of parsed.projects.values()) {
-    projectsByGav.set(gav(p.group, p.name, p.version), p);
-  }
-  const components = buildComponents(finalNodes, projectsByGav, buildManifestFilesByCoord(parsed, directByRoot, perRoot));
+  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot));
   const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
@@ -2720,35 +2685,50 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], projectsByGav, perRoot, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
   };
 }
-function gav(group, name, version) {
-  return `${group}:${name}:${version}`;
+
+// A node resolving to a build project takes that project's id, so projects
+// sharing a coordinate stay apart and the project's variants collapse into it.
+function componentId(coordId, project) {
+  return project || coordId;
 }
 function buildPerRoot(parsed) {
   const out = new Map();
   for (const [rootId, r] of parsed.roots) {
-    const childrenByParent = new Map();
+    const idOf = coordId => componentId(coordId, r.nodes.get(coordId)?.project ?? '');
+    const nodes = new Map();
+    for (const [coordId, n] of r.nodes) {
+      const id = idOf(coordId);
+      let node = nodes.get(id);
+      if (!node) {
+        node = {
+          coord: n.project ? {
+            ...n.coord,
+            classifier: '',
+            ext: ''
+          } : n.coord,
+          children: [],
+          direct: false,
+          project: n.project,
+          targets: []
+        };
+        nodes.set(id, node);
+      }
+      node.direct ||= n.direct;
+      node.targets.push(...n.targets);
+    }
     for (const [p, c] of r.edges) {
       if (!r.nodes.has(p) || !r.nodes.has(c)) {
         continue;
       }
-      let set = childrenByParent.get(p);
-      if (!set) {
-        set = new Set();
-        childrenByParent.set(p, set);
+      const parentId = idOf(p);
+      const childId = idOf(c);
+      const parent = nodes.get(parentId);
+      if (childId !== parentId && !parent.children.includes(childId)) {
+        parent.children.push(childId);
       }
-      set.add(c);
-    }
-    const nodes = new Map();
-    for (const [coordId, n] of r.nodes) {
-      nodes.set(coordId, {
-        coord: n.coord,
-        children: [...(childrenByParent.get(coordId) ?? [])],
-        direct: n.direct,
-        targets: n.targets
-      });
     }
     out.set(rootId, {
       projectKey: r.projectKey,
@@ -2759,10 +2739,10 @@ function buildPerRoot(parsed) {
   return out;
 }
 
-// Components are merged by coordinate across every resolution root; which
-// coordinates belong to which subproject is kept separately (classpathByProject)
-// for reachability, which needs each subproject's exact classpath.
-function mergeByCoordinate(perRoot) {
+// Components are merged by id across every resolution root; which ids belong
+// to which subproject is kept separately (classpathByProject) for
+// reachability, which needs each subproject's exact classpath.
+function mergeById(perRoot) {
   const finalNodes = new Map();
   const directByRoot = new Map();
   for (const [rootId, {
@@ -2777,6 +2757,7 @@ function mergeByCoordinate(perRoot) {
           children: new Set(),
           prod: false,
           direct: false,
+          project: node.project,
           targets: new Set()
         };
         finalNodes.set(coordId, fn);
@@ -2808,18 +2789,23 @@ function mergeByCoordinate(perRoot) {
     directByRoot
   };
 }
-function buildManifestFilesByCoord(parsed, directByRoot, perRoot) {
+function buildManifestFilesById(parsed, directByRoot, perRoot) {
   const buildFilesByCoord = new Map();
   for (const [rootId, ids] of directByRoot) {
-    const projectKey = perRoot.get(rootId)?.projectKey ?? '';
-    const buildFiles = parsed.projects.get(projectKey)?.buildFiles ?? [];
+    const root = perRoot.get(rootId);
+    const project = parsed.projects.get(root?.projectKey ?? '');
     for (const id of ids) {
       let set = buildFilesByCoord.get(id);
       if (!set) {
         set = new Set();
         buildFilesByCoord.set(id, set);
       }
-      for (const f of buildFiles) {
+      const coord = root?.nodes.get(id)?.coord;
+      // Without a known declaring script, the project's build file, even one
+      // absent on disk: its presence marks the dependency direct here.
+      const declared = coord && project?.declaredIn.get(`${coord.group}:${coord.name}`);
+      const files = declared ?? [...(project?.buildFiles ?? []), ...(project?.missingBuildFiles ?? [])];
+      for (const f of files) {
         set.add(f);
       }
     }
@@ -2831,7 +2817,7 @@ function buildManifestFilesByCoord(parsed, directByRoot, perRoot) {
     file
   }))]));
 }
-function buildComponents(finalNodes, projectsByGav, manifestFilesByCoord) {
+function buildComponents(finalNodes, manifestFilesById) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2862,13 +2848,13 @@ function buildComponents(finalNodes, projectsByGav, manifestFilesByCoord) {
     if (!fn.prod) {
       comp.dev = true;
     }
-    if (projectsByGav.has(gav(c.group, c.name, c.version ?? ''))) {
+    if (fn.project) {
       comp.firstParty = true;
     }
     if (fn.children.size) {
       comp.dependencies = [...fn.children].sort();
     }
-    const manifestFiles = manifestFilesByCoord.get(id);
+    const manifestFiles = manifestFilesById.get(id);
     if (manifestFiles) {
       comp.manifestFiles = manifestFiles;
     }
@@ -2890,6 +2876,7 @@ function buildProjects(parsed, directByRoot, perRoot) {
   }
   const projects = [...parsed.projects.values()].map(p => {
     const entry = {
+      id: p.projectKey,
       type: PURL_TYPE_MAVEN,
       namespace: p.group,
       name: p.name,
@@ -2899,6 +2886,15 @@ function buildProjects(parsed, directByRoot, perRoot) {
       subprojectDir: p.dir,
       dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort()
     };
+    // A project without a build file of its own is defined by the scripts
+    // declaring its dependencies, e.g. the root build script.
+    const declared = [...new Set([...p.declaredIn.values()].flat())];
+    const files = p.buildFiles.length ? p.buildFiles : declared.length ? declared : p.missingBuildFiles;
+    if (files.length) {
+      entry.manifestFiles = [...files].sort().map(file => ({
+        file
+      }));
+    }
     return entry;
   });
   projects.sort((a, b) => {
@@ -2908,21 +2904,6 @@ function buildProjects(parsed, directByRoot, perRoot) {
   });
   return projects;
 }
-function unionInto(map, key, add) {
-  if (!add.length) {
-    return;
-  }
-  const acc = map.get(key);
-  if (acc) {
-    for (const f of add) {
-      if (!acc.includes(f)) {
-        acc.push(f);
-      }
-    }
-  } else {
-    map.set(key, [...add]);
-  }
-}
 function buildClasspathByProject(projects, perRoot) {
   const idsByProjectKey = new Map();
   for (const {
@@ -2940,11 +2921,7 @@ function buildClasspathByProject(projects, perRoot) {
   }
   const classpathByProject = new Map();
   for (const p of projects) {
-    const key = projectClasspathKey({
-      name: p.name,
-      namespace: p.group,
-      subprojectDir: p.dir
-    });
+    const key = p.projectKey;
     let set = classpathByProject.get(key);
     if (!set) {
       set = new Set();
@@ -2959,61 +2936,26 @@ function buildClasspathByProject(projects, perRoot) {
     1: ids
   }) => [key, [...ids].sort()]));
 }
-function buildArtifactPaths(finalNodes, projects, projectsByGav, perRoot, fileExists) {
-  const targetsByCoord = new Map();
-  const targetsByGav = new Map();
-  const sourcesByCoord = new Map();
-  const coords = new Set();
-  for (const fn of finalNodes.values()) {
-    const c = fn.coord;
-    const coordKey = mavenCoordinateKey(c.group, c.name, c.ext, c.classifier, c.version);
-    if (!coordKey) {
-      continue;
-    }
-    coords.add(coordKey);
-    const pi = projectsByGav.get(gav(c.group, c.name, c.version ?? ''));
-    const sources = (pi?.sources ?? []).filter(fileExists).sort();
-    const targets = [...new Set(pi ? pi.targets : fn.targets)].filter(fileExists).sort();
-    if (sources.length) {
-      sourcesByCoord.set(coordKey, sources);
-    }
-    if (!targets.length) {
-      continue;
-    }
-    targetsByCoord.set(coordKey, targets);
-    const gavKey = mavenCoordinateKey(c.group, c.name, undefined, undefined, c.version);
-    if (gavKey) {
-      const acc = targetsByGav.get(gavKey);
-      if (acc) {
-        for (const f of targets) {
-          if (!acc.includes(f)) {
-            acc.push(f);
-          }
-        }
-      } else {
-        targetsByGav.set(gavKey, [...targets]);
-      }
+function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
+  const pathsById = new Map();
+  for (const [id, fn] of finalNodes) {
+    if (!fn.project) {
+      pathsById.set(id, {
+        sources: [],
+        targets: [...fn.targets].filter(fileExists).sort()
+      });
     }
   }
-  // A top-level module is a `project` but usually not a dependency node, so its
-  // source roots (where reachability starts) are missed by the node loop above;
-  // emit first-party module paths here.
+  // A project's own component shares its id, so this also covers dependency
+  // edges onto a sibling project.
   for (const p of projects) {
-    const coordKey = mavenCoordinateKey(p.group, p.name, undefined, undefined, p.version);
-    if (!coordKey) {
-      continue;
-    }
-    coords.add(coordKey);
-    unionInto(sourcesByCoord, coordKey, p.sources.filter(fileExists));
-    const targets = p.targets.filter(fileExists);
-    unionInto(targetsByCoord, coordKey, targets);
-    unionInto(targetsByGav, coordKey, targets);
+    pathsById.set(p.projectKey, {
+      sources: [...new Set(p.sources)].filter(fileExists).sort(),
+      targets: [...new Set(p.targets)].filter(fileExists).sort()
+    });
   }
   return {
-    targetsByCoord,
-    targetsByGav,
-    sourcesByCoord,
-    coords,
+    pathsById,
     classpathByProject: buildClasspathByProject(projects, perRoot)
   };
 }
@@ -3185,18 +3127,23 @@ function serializeExcludePathPatterns(paths) {
 //   <tag>\t<field>\t<field>...
 //
 //   meta        tool  toolVersion  javaVersion
+//   buildRoot   path                                     (absolute; the facts file's directory)
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
-//   projectBuild  projectKey  path                       (build-root-relative)
+//   projectBuild  projectKey  path  [missing]            (build-root-relative; `missing`: configured, absent on disk)
+//   declared    projectKey  group  name  path            (script declaring the dependency; build-root-relative)
 //   root        rootId  projectKey  config  prod(0|1)
-//   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)
+//   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
 //   file        rootId  coordId  path                    (--with-files only)
 //   scanned     config
 //   failure     coord  detail  config
 //   unscannable config  detail
 //
+// `projectKey` is the tool's unique project identity (Maven: GAV; Gradle:
+// project path; sbt: project id), emitted as the project id; a `node` whose
+// `project` names one resolves to that build project.
 // A `root` is one (subproject, configuration) resolution root; `coordId` is the
 // coordinate key (`group:name:ext:classifier:version`, empty segments dropped),
 // used opaquely as the per-root node key. Unknown tags are ignored.
@@ -3225,6 +3172,7 @@ function parseRecords(text) {
     tool: '',
     toolVersion: '',
     javaVersion: '',
+    buildRoot: '',
     projects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
@@ -3258,7 +3206,9 @@ function parseRecords(text) {
         dir: '',
         sources: [],
         targets: [],
-        buildFiles: []
+        buildFiles: [],
+        missingBuildFiles: [],
+        declaredIn: new Map()
       };
       result.projects.set(key, p);
     }
@@ -3275,6 +3225,9 @@ function parseRecords(text) {
         result.toolVersion = f[2] ?? '';
         result.javaVersion = f[3] ?? '';
         break;
+      case 'buildRoot':
+        result.buildRoot = f[1] ?? '';
+        break;
       case 'project':
         {
           const p = project(f[1] ?? '');
@@ -3296,7 +3249,17 @@ function parseRecords(text) {
         break;
       case 'projectBuild':
         if (f[2]) {
-          project(f[1] ?? '').buildFiles.push(f[2]);
+          const p = project(f[1] ?? '');
+          (f[3] === 'missing' ? p.missingBuildFiles : p.buildFiles).push(f[2]);
+        }
+        break;
+      case 'declared':
+        if (f[4]) {
+          const {
+            declaredIn
+          } = project(f[1] ?? '');
+          const ga = `${f[2] ?? ''}:${f[3] ?? ''}`;
+          declaredIn.set(ga, [...(declaredIn.get(ga) ?? []), f[4]]);
         }
         break;
       case 'root':
@@ -3321,6 +3284,7 @@ function parseRecords(text) {
               classifier: f[7] ?? ''
             },
             direct: bool(f[8]),
+            project: f[9] ?? '',
             targets: []
           });
           break;
@@ -3430,12 +3394,14 @@ async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
 }
 async function assembleFromRecords(out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
+  const parsed = parseRecords(text);
   const {
     artifactPaths,
     facts,
     report
-  } = assembleFacts(parseRecords(text));
+  } = assembleFacts(parsed);
   return {
+    buildRoot: parsed.buildRoot || undefined,
     code: out.code,
     facts,
     report,
@@ -3606,7 +3572,6 @@ async function runManifestFacts({
   verbose,
   withFiles
 }) {
-  const factsPath = path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
   let resolvedJavaHome;
   if (javaHome) {
     const expanded = expandEnvVarRefs(javaHome);
@@ -3671,6 +3636,7 @@ async function runManifestFacts({
   }
   const {
     artifactPaths,
+    buildRoot,
     code,
     facts,
     report,
@@ -3731,6 +3697,14 @@ async function runManifestFacts({
     logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
+  if (!buildRoot) {
+    process.exitCode = 1;
+    logger.logger.fail(`The ${ecosystem} build did not report its root directory, so its Socket facts file cannot be placed.`);
+    return null;
+  }
+  // Every path in the facts is relative to the build root, which `-f`/`-p`
+  // can move away from cwd.
+  const factsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
   const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   if (facts.metadata && socketCliVersion) {
     facts.metadata.socketCliVersion = socketCliVersion;
@@ -3876,8 +3850,11 @@ async function runEcosystemCandidates({
         continue;
       }
       covered.add(dir);
+      // `-f`/`-p` can root the reactor away from `dir`.
+      // eslint-disable-next-line no-await-in-loop
+      const buildRoot = await utils.realpathOrResolved(path.dirname(result.factsPath));
       // eslint-disable-next-line no-await-in-loop
-      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => utils.realpathOrResolved(path.resolve(dir, project.subprojectDir))));
+      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => utils.realpathOrResolved(path.resolve(buildRoot, project.subprojectDir))));
       for (const subprojectDir of resolvedSubprojectDirs) {
         // Only a genuinely nested member (a descendant of this reactor's own
         // directory) has no independent existence worth its own standalone
@@ -3890,7 +3867,7 @@ async function runEcosystemCandidates({
         // meaningful data point, not a redundant one. Never suppress its own
         // build-root invocation, regardless of which reactor(s) also
         // incorporate it or the order candidates happen to be discovered in.
-        if (subprojectDir.startsWith(`${dir}${path.sep}`)) {
+        if (subprojectDir === buildRoot || subprojectDir.startsWith(`${buildRoot}${path.sep}`)) {
           covered.add(subprojectDir);
         }
       }
@@ -3905,7 +3882,7 @@ async function runEcosystemCandidates({
   return outcomes;
 }
 
-// Generates one .socket.facts.json per independent gradle/sbt/maven build
+// Generates one Socket facts file per independent gradle/sbt/maven build
 // root under `cwd`. Coverage is tracked per ecosystem via the facts SBOM's
 // own projects[].subprojectDir, not by pruning the whole discovered subtree,
 // so an unrelated nested project a reactor doesn't declare still gets its
@@ -7231,7 +7208,7 @@ async function createNewScan({
         });
         if (reach.dynamicSbomInference) {
           // Already generated recursively above; resolving cwd's own build
-          // root a second time would race on the same .socket.facts.json.
+          // root a second time would race on the same facts file.
           detected.gradle = false;
           detected.sbt = false;
           detected.maven = false;
@@ -7366,11 +7343,11 @@ async function createNewScan({
         reachabilityReport = reachResult.data?.reachabilityReport;
 
         // When using only pre-generated SBOMs, build the scan from those inputs —
-        // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
-        // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
-        // stray `.socket.facts.json`; coana's fresh reachability report (appended
-        // below) is the authoritative facts file for the scan.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+        // CycloneDX, SPDX, and Socket facts — matching Coana's
+        // `--use-only-pregenerated-sboms` selection. Otherwise drop every facts
+        // file; coana's fresh reachability report (appended below) is the
+        // authoritative facts file for the scan.
+        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
 
         // Append coana's reachability report, but not twice: a pre-generated facts
         // input can resolve to the same path coana wrote its report to.
@@ -9006,9 +8983,6 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
     }).catch(() => {});
   }
 }
-function isFactsFile(filepath) {
-  return path.basename(filepath).toLowerCase() === constants.DOT_SOCKET_DOT_FACTS_JSON;
-}
 async function gitWorkingTreeChanges(cwd) {
   const {
     0: modifiedCResult,
@@ -9034,6 +9008,18 @@ function readWrittenFiles(outputFile) {
   const files = result?.modifiedFiles;
   return Array.isArray(files) && files.every(f => typeof f === 'string') ? new Set(files) : undefined;
 }
+// Coana exits with this code after writing an --output-file that lists computed fixes it left unapplied.
+const COANA_FIXES_NOT_APPLIED_EXIT_CODE = 5;
+function isFixesNotAppliedExit(result) {
+  return !result.ok && result.data?.code === COANA_FIXES_NOT_APPLIED_EXIT_CODE;
+}
+function readNotAppliedFixes(fixesResultJson) {
+  const notApplied = fixesResultJson?.notApplied;
+  return Array.isArray(notApplied) ? notApplied : [];
+}
+function formatNotAppliedFixes(notApplied) {
+  return notApplied.map(f => `  ${f.ghsa}: ${f.purl} -> ${f.fixedVersion}: ${f.reason}`).join('\n');
+}
 async function coanaFix(fixConfig) {
   if (!fixConfig.dynamicSbomInference) {
     return await coanaFixWithFacts(fixConfig, undefined);
@@ -9117,16 +9103,15 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     cwd
   });
   const scanFilepaths = await findScanFilepaths();
-  // Fail if any .socket.facts.json files are present in the scan folder.
-  // These are analysis artifacts and must be removed before re-running fix.
-  const factsFiles = scanFilepaths.filter(isFactsFile);
+  // Facts files are analysis artifacts and must be removed before re-running fix.
+  const factsFiles = scanFilepaths.filter(utils.isSocketFactsFile);
   if (factsFiles.length) {
     if (!silence) {
       spinner?.stop();
     }
     return {
       ok: false,
-      message: `Found ${constants.DOT_SOCKET_DOT_FACTS_JSON} in manifest files`,
+      message: 'Found Socket facts files in manifest files',
       cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
     };
   }
@@ -9143,7 +9128,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       });
     } catch (e) {
       // A failed build root aborts inference after others wrote their facts.
-      const partial = (await findScanFilepaths()).filter(isFactsFile);
+      const partial = (await findScanFilepaths()).filter(utils.isSocketFactsFile);
       await Promise.all(partial.map(p => fs$1.promises.rm(p, {
         force: true
       })));
@@ -9250,7 +9235,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       if (!silence) {
         spinner?.stop();
       }
-      if (!fixCResult.ok) {
+      if (!fixCResult.ok && !isFixesNotAppliedExit(fixCResult)) {
         return fixCResult;
       }
 
@@ -9267,11 +9252,24 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
         const tmpContent = await fs$1.promises.readFile(tmpFile, 'utf8');
         await fs$1.promises.writeFile(outputFile, tmpContent, 'utf8');
       }
+      const ghsaDetails = fixesResultJson ? [fixesResultJson] : [];
+      const notApplied = readNotAppliedFixes(fixesResultJson);
+      if (!fixCResult.ok || notApplied.length) {
+        return {
+          ok: false,
+          message: fixesResultJson?.type === 'no-fixes-applied' ? 'No computed fixes were applied' : 'Some computed fixes were not applied',
+          cause: formatNotAppliedFixes(notApplied),
+          data: {
+            fixedAll: false,
+            ghsaDetails
+          }
+        };
+      }
       return {
         ok: true,
         data: {
           fixedAll: true,
-          ghsaDetails: fixesResultJson ? [fixesResultJson] : []
+          ghsaDetails
         }
       };
     } finally {
@@ -9378,7 +9376,13 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       spinner: silence ? undefined : spinner,
       stdio: silence ? 'pipe' : 'inherit'
     });
-    if (!fixCResult.ok) {
+    if (isFixesNotAppliedExit(fixCResult)) {
+      if (!silence) {
+        logger.logger.warn(`Not every fix for ${ghsaId} was applied:\n${formatNotAppliedFixes(readNotAppliedFixes(fs$2.readJsonSync(tmpFile, {
+          throws: false
+        })))}`);
+      }
+    } else if (!fixCResult.ok) {
       if (!silence) {
         logger.logger.error(`Update failed for ${ghsaId}: ${utils.getErrorCause(fixCResult)}`);
       }
@@ -19922,6 +19926,13 @@ const generalFlags$1 = {
     description: 'Scan each TARGET directory as a uv project, using the versions pinned in its uv.lock or its workspace root uv.lock. Uploads a CycloneDX dependency graph per TARGET in place of manifest discovery, including all extras and dependency groups. Requires uv on PATH.'
   }
 };
+function hasSocketFactsFileIn(dir) {
+  try {
+    return fs$1.readdirSync(dir).some(utils.isSocketFactsFile);
+  } catch {
+    return false;
+  }
+}
 const cmdScanCreate = {
   description: description$c,
   hidden: hidden$a,
@@ -20143,12 +20154,12 @@ async function run$d(argv, importMeta, {
     }
   }
   const detected = await detectManifestActions(sockJson, cwd);
-  // Suppress the --auto-manifest suggestion when a `.socket.facts.json` is
+  // Suppress the --auto-manifest suggestion when a Socket facts file is
   // already present at cwd. That file is the output of `socket manifest auto`
   // (and `--facts` mode of the per-ecosystem manifest commands), so suggesting
   // to regenerate it would be misleading; the manifest data is already there
   // and will be picked up by the scan.
-  const hasFactsFile = fs$1.existsSync(path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON));
+  const hasFactsFile = hasSocketFactsFileIn(cwd);
   if (detected.count > 0 && !autoManifest && !dynamicSbomInference && !uvMembers && !hasFactsFile) {
     logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --auto-manifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
   }
@@ -24467,5 +24478,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=b7761d71-38de-4772-91bc-d1db319250b4
+//# debugId=40113ed0-ae58-43eb-a197-d1810801160e
 //# sourceMappingURL=cli.js.map