@socketsecurity/cli-with-sentry 1.8.3 → 1.9.0

package/dist/cli.js

@@ -13,7 +13,7 @@ var flags = require('./flags.js');
 var env = require('../external/@socketsecurity/registry/lib/env');
 var path = require('node:path');
 var words = require('../external/@socketsecurity/registry/lib/words');
-var fs$1 = require('node:fs');
+var u = require('node:fs');
 var arrays = require('../external/@socketsecurity/registry/lib/arrays');
 var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var require$$0 = require('node:crypto');
@@ -21,7 +21,7 @@ var os = require('node:os');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var childProcess = require('node:child_process');
-var fs$2 = require('../external/@socketsecurity/registry/lib/fs');
+var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
 var objects = require('../external/@socketsecurity/registry/lib/objects');
@@ -1093,7 +1093,7 @@ async function fetchCreateOrgFullScan(packagePaths, orgSlug, config, options) {
   if (constants.default.ENV.SOCKET_CLI_DEBUG) {
     const fileInfo = await Promise.all(packagePaths.map(async p => {
       const absPath = path.resolve(process.cwd(), p);
-      const stat = await fs$1.promises.stat(absPath);
+      const stat = await u.promises.stat(absPath);
       return {
         path: absPath,
         size: stat.size
@@ -2000,7 +2000,7 @@ async function performReachabilityAnalysis(options) {
   let sidecarPath;
   if (reachabilityOptions.dynamicSbomInference || resolvedPathsSidecar && hasResolvedPathsSidecarEntries(resolvedPathsSidecar)) {
     sidecarPath = path.join(os.tmpdir(), `socket-compute-artifacts-sidecar-${require$$0.randomUUID()}.json`);
-    await fs$1.promises.writeFile(sidecarPath, JSON.stringify(resolvedPathsSidecar ?? {}), 'utf8');
+    await u.promises.writeFile(sidecarPath, JSON.stringify(resolvedPathsSidecar ?? {}), 'utf8');
   }
 
   // Build Coana arguments.
@@ -2030,7 +2030,7 @@ async function performReachabilityAnalysis(options) {
   const coanaStdio = outputKind === 'text' ? 'inherit' : ['inherit', 2, 'inherit'];
   try {
     // Run Coana with the manifests tar hash.
-    const coanaResult = await utils.spawnCoanaDlx(coanaArgs, orgSlug, {
+    const coanaResult = await utils.spawnCoana(coanaArgs, orgSlug, {
       coanaVersion: reachabilityOptions.reachVersion,
       cwd,
       env: coanaEnv,
@@ -2041,7 +2041,7 @@ async function performReachabilityAnalysis(options) {
       spinner.start();
     }
     if (!coanaResult.ok) {
-      const coanaVersion = reachabilityOptions.reachVersion || constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION;
+      const coanaVersion = reachabilityOptions.reachVersion || constants.COANA_CLI_VERSION;
       logger.logger.error(`Coana reachability analysis failed. Version: ${coanaVersion}, target: ${analysisTarget}, cwd: ${cwd}`);
       if (coanaResult.message) {
         logger.logger.error(`Details: ${coanaResult.message}`);
@@ -2069,7 +2069,7 @@ async function performReachabilityAnalysis(options) {
     // Best-effort cleanup of the temp sidecar.
     if (sidecarPath) {
       try {
-        await fs$1.promises.unlink(sidecarPath);
+        await u.promises.unlink(sidecarPath);
       } catch {
         // File may already be gone or unwritable.
       }
@@ -2138,7 +2138,7 @@ async function addCoveredBuildFiles(covered, buildRoot, projects) {
     return path.join(await utils.realpathOrResolved(path.dirname(resolved)), path.basename(resolved));
   }));
   for (const file of files) {
-    if (file.startsWith(`${realBuildRoot}${path.sep}`) && fs$1.existsSync(file)) {
+    if (file.startsWith(`${realBuildRoot}${path.sep}`) && u.existsSync(file)) {
       covered.add(file);
     }
   }
@@ -2317,14 +2317,14 @@ const ADDRESSED_BY_FILE = {
 // name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
 // and Gradle refuse such a directory themselves.
 function looksLikeSbtBuild(projectDir) {
-  return fs$1.existsSync(path.resolve(projectDir, 'build.sbt')) || fs$1.existsSync(path.resolve(projectDir, 'project'));
+  return u.existsSync(path.resolve(projectDir, 'build.sbt')) || u.existsSync(path.resolve(projectDir, 'project'));
 }
 function resolveBuildToolBin(tool, projectDir, bin) {
   if (bin) {
     return bin;
   }
   const wrapperName = BUILD_TOOL_WRAPPER[tool];
-  if (wrapperName && fs$1.existsSync(path.resolve(projectDir, wrapperName))) {
+  if (wrapperName && u.existsSync(path.resolve(projectDir, wrapperName))) {
     return `./${wrapperName}`;
   }
   return DEFAULT_BUILD_TOOL_BIN[tool];
@@ -2696,7 +2696,7 @@ function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'grad
 
 const PURL_TYPE_MAVEN = 'maven';
 function assembleFacts(parsed, opts = {}) {
-  const fileExists = opts.fileExists ?? fs$1.existsSync;
+  const fileExists = opts.fileExists ?? u.existsSync;
   const perRoot = buildPerRoot(parsed);
   const finalNodes = mergeById(perRoot);
   const graphs = buildSubprojectGraphs(perRoot);
@@ -3471,15 +3471,15 @@ async function runNeverThrow(bin, args, opts) {
   }
 }
 async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
-  const src = await fs$1.promises.readFile(manifestScriptsPath(sourceFilename), 'utf8');
+  const src = await u.promises.readFile(manifestScriptsPath(sourceFilename), 'utf8');
   const pluginsDir = path.join(globalBase, 'plugins');
-  await fs$1.promises.mkdir(pluginsDir, {
+  await u.promises.mkdir(pluginsDir, {
     recursive: true
   });
-  await fs$1.promises.writeFile(path.join(pluginsDir, destFilename), src);
+  await u.promises.writeFile(path.join(pluginsDir, destFilename), src);
 }
 async function assembleFromRecords(tool, out, recordsFile) {
-  const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
+  const text = u.existsSync(recordsFile) ? await u.promises.readFile(recordsFile, 'utf8') : '';
   const parsed = parseRecords(text);
   const factsFileName = socketFactsFileName(tool, parsed.entry || undefined);
   const {
@@ -3502,7 +3502,7 @@ async function assembleFromRecords(tool, out, recordsFile) {
 // Missing only in an unbuilt local checkout. Fail loudly: without the extension,
 // Maven silently emits an empty SBOM.
 function assertMavenExtensionBuilt(jarPath) {
-  if (fs$1.existsSync(jarPath)) {
+  if (u.existsSync(jarPath)) {
     return;
   }
   throw new Error(`Maven manifest extension jar not found at ${jarPath}. It is bundled in the published CLI; for local dev build it with: bash src/commands/manifest/scripts/maven-extension/build-jar.sh`);
@@ -3799,14 +3799,14 @@ async function runManifestFacts({
   // Not a name producers write, so a copy here is stale and would be uploaded
   // alongside the new file.
   const legacyFactsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
-  if (fs$1.existsSync(legacyFactsPath)) {
+  if (u.existsSync(legacyFactsPath)) {
     logger.logger.warn(`Found \`${legacyFactsPath}\`, which is uploaded alongside \`${factsFileName}\`. Delete it if an earlier \`socket manifest\` run left it behind.`);
   }
   const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   if (facts.metadata && socketCliVersion) {
     facts.metadata.socketCliVersion = socketCliVersion;
   }
-  await fs$1.promises.writeFile(factsPath, JSON.stringify(facts), 'utf8');
+  await u.promises.writeFile(factsPath, JSON.stringify(facts), 'utf8');
   if (sidecarAcc) {
     // Key by the symlink-resolved path so the sidecar's keys are comparable
     // regardless of which caller's cwd it was joined against (the recursive
@@ -4093,10 +4093,10 @@ async function runDynamicSbomInference({
 
 // Conda reads both spellings of the environment file.
 function findCondaFile(cwd) {
-  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YML))) {
+  if (u.existsSync(path.join(cwd, constants.ENVIRONMENT_YML))) {
     return constants.ENVIRONMENT_YML;
   }
-  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YAML))) {
+  if (u.existsSync(path.join(cwd, constants.ENVIRONMENT_YAML))) {
     return constants.ENVIRONMENT_YAML;
   }
   return '';
@@ -4118,21 +4118,21 @@ sockJson, cwd = process.cwd()) {
   };
   if (sockJson?.defaults?.manifest?.bazel?.disabled) {
     debug.debugLog('notice', `[DEBUG] - bazel auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'MODULE.bazel')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE.bazel'))) {
+  } else if (u.existsSync(path.join(cwd, 'MODULE.bazel')) || u.existsSync(path.join(cwd, 'WORKSPACE')) || u.existsSync(path.join(cwd, 'WORKSPACE.bazel'))) {
     debug.debugLog('notice', '[DEBUG] - Detected a Bazel workspace');
     output.bazel = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.sbt?.disabled) {
     debug.debugLog('notice', `[DEBUG] - sbt auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'build.sbt'))) {
+  } else if (u.existsSync(path.join(cwd, 'build.sbt'))) {
     debug.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
     output.sbt = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.gradle?.disabled) {
     debug.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'build.gradle')) || fs$1.existsSync(path.join(cwd, 'build.gradle.kts')) || fs$1.existsSync(path.join(cwd, 'settings.gradle')) || fs$1.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
+  } else if (u.existsSync(path.join(cwd, 'build.gradle')) || u.existsSync(path.join(cwd, 'build.gradle.kts')) || u.existsSync(path.join(cwd, 'settings.gradle')) || u.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
     // Detect by build descriptor, not the `gradlew` wrapper (a project can build via
     // `gradle` on PATH). `settings.gradle(.kts)` covers Kotlin-DSL roots with no root build script.
     debug.debugLog('notice', '[DEBUG] - Detected a gradle build file');
@@ -4141,7 +4141,7 @@ sockJson, cwd = process.cwd()) {
   }
   if (sockJson?.defaults?.manifest?.maven?.disabled) {
     debug.debugLog('notice', `[DEBUG] - maven auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'pom.xml'))) {
+  } else if (u.existsSync(path.join(cwd, 'pom.xml'))) {
     debug.debugLog('notice', '[DEBUG] - Detected a Maven pom.xml build file');
     output.maven = true;
     output.count += 1;
@@ -4171,7 +4171,7 @@ sockJson, cwd = process.cwd()) {
  */
 async function resolveBazelBinary(explicit) {
   if (explicit) {
-    if (!fs$1.existsSync(explicit)) {
+    if (!u.existsSync(explicit)) {
       throw new utils.InputError(`--bazel path does not exist: ${explicit}. Install bazelisk or bazel, or pass an existing path via --bazel.`);
     }
     return explicit;
@@ -4998,9 +4998,9 @@ function validateOutputBase(outputBase, cwd) {
     throw new utils.InputError(`--bazel-output-base must not contain '..' segments: ${outputBase}`);
   }
   const resolved = path.resolve(cwd, outputBase);
-  if (fs$1.existsSync(resolved)) {
+  if (u.existsSync(resolved)) {
     try {
-      fs$1.accessSync(resolved, fs$1.constants.W_OK);
+      u.accessSync(resolved, u.constants.W_OK);
     } catch {
       throw new utils.InputError(`--bazel-output-base is not writable: ${resolved}`);
     }
@@ -5008,7 +5008,7 @@ function validateOutputBase(outputBase, cwd) {
   }
   // Path does not exist yet — try to create it so bazel can populate it.
   try {
-    fs$1.mkdirSync(resolved, {
+    u.mkdirSync(resolved, {
       recursive: true
     });
   } catch (e) {
@@ -5053,14 +5053,14 @@ async function provisionPythonShim() {
     throw new utils.InputError('Neither `python` nor `python3` found on PATH. Older versions of ' + 'rules_jvm_external require a `python` interpreter for repository ' + 'rules. Install Python 3 and ensure it is on PATH, then retry.');
   }
   const shimDir = path.join(os.tmpdir(), SHIM_SUBDIR);
-  fs$1.mkdirSync(shimDir, {
+  u.mkdirSync(shimDir, {
     recursive: true
   });
   const linkPath = path.join(shimDir, 'python');
   // Replace the symlink defensively in case python3's resolved path moved.
-  if (fs$1.existsSync(linkPath)) {
+  if (u.existsSync(linkPath)) {
     try {
-      fs$1.unlinkSync(linkPath);
+      u.unlinkSync(linkPath);
     } catch {
       // Tolerate races; the next symlinkSync may still succeed.
     }
@@ -5070,9 +5070,9 @@ async function provisionPythonShim() {
   // unlinkSync and symlinkSync. Tolerate EEXIST when the link is back: the
   // other process won the race and left a usable shim in place.
   try {
-    fs$1.symlinkSync(python3OnPath, linkPath);
+    u.symlinkSync(python3OnPath, linkPath);
   } catch (e) {
-    if (e.code === 'EEXIST' && fs$1.existsSync(linkPath)) ; else {
+    if (e.code === 'EEXIST' && u.existsSync(linkPath)) ; else {
       throw e;
     }
   }
@@ -5355,8 +5355,8 @@ async function probeCandidate(repoName, probe, verbose) {
 // legacy WORKSPACE (WORKSPACE or WORKSPACE.bazel), or both (migration).
 // Throws InputError when neither marker file is present.
 function detectWorkspaceMode(cwd) {
-  const moduleBazel = fs$1.existsSync(path.join(cwd, 'MODULE.bazel'));
-  const workspaceFile = fs$1.existsSync(path.join(cwd, 'WORKSPACE')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE.bazel'));
+  const moduleBazel = u.existsSync(path.join(cwd, 'MODULE.bazel'));
+  const workspaceFile = u.existsSync(path.join(cwd, 'WORKSPACE')) || u.existsSync(path.join(cwd, 'WORKSPACE.bazel'));
   if (!moduleBazel && !workspaceFile) {
     throw new utils.InputError(`No Bazel workspace found at ${cwd} (looked for MODULE.bazel, WORKSPACE, WORKSPACE.bazel).`);
   }
@@ -5448,7 +5448,7 @@ function findWorkspaceRoots(opts) {
     dirsVisited += 1;
     let entries;
     try {
-      entries = fs$1.readdirSync(dir, {
+      entries = u.readdirSync(dir, {
         withFileTypes: true
       });
     } catch {
@@ -5745,7 +5745,7 @@ function committedLockfileCovers(args) {
   }
   let entries;
   try {
-    entries = fs$1.readdirSync(workspaceRootResolved, {
+    entries = u.readdirSync(workspaceRootResolved, {
       withFileTypes: true
     });
   } catch {
@@ -5784,10 +5784,10 @@ async function writeCompletenessSummary(args) {
     workspaces: workspaceOutcomes
   };
   try {
-    fs$1.mkdirSync(manifestDir, {
+    u.mkdirSync(manifestDir, {
       recursive: true
     });
-    await fs$1.promises.writeFile(path.join(manifestDir, COMPLETENESS_SUMMARY_FILE_NAME), JSON.stringify(summary, null, 2), 'utf8');
+    await u.promises.writeFile(path.join(manifestDir, COMPLETENESS_SUMMARY_FILE_NAME), JSON.stringify(summary, null, 2), 'utf8');
   } catch (e) {
     if (verbose) {
       logger.logger.log(`[VERBOSE] completeness summary not written (${utils.getErrorCause(e)}); the run result still carries the signal`);
@@ -5826,11 +5826,11 @@ async function writeHubManifest(args) {
   }
   const fileName = hubManifestFileName(repoName);
   const hubDir = relPath ? path.join(manifestDir, relPath) : manifestDir;
-  fs$1.mkdirSync(hubDir, {
+  u.mkdirSync(hubDir, {
     recursive: true
   });
   const manifestPath = path.join(hubDir, fileName);
-  await fs$1.promises.writeFile(manifestPath, JSON.stringify(json, null, 2), 'utf8');
+  await u.promises.writeFile(manifestPath, JSON.stringify(json, null, 2), 'utf8');
   return {
     artifactCount,
     droppedArtifacts,
@@ -5957,7 +5957,7 @@ async function reapBazelServer(bin, outputUserRoot, verbose) {
 }
 async function removeTempdir(dir, verbose) {
   try {
-    await fs$1.promises.rm(dir, {
+    await u.promises.rm(dir, {
       recursive: true,
       force: true
     });
@@ -5969,7 +5969,7 @@ async function removeTempdir(dir, verbose) {
   }
 }
 function makeOutputUserRoot() {
-  return fs$1.mkdtempSync(path.join(os.tmpdir(), 'socket-bazel-'));
+  return u.mkdtempSync(path.join(os.tmpdir(), 'socket-bazel-'));
 }
 
 // Construct the BazelQueryOptions shape used for a single workspace's
@@ -6015,7 +6015,7 @@ async function extractBazelToMaven(opts) {
   logger.logger.group('bazel2maven:');
   logger.logger.info(`- src dir: \`${cwd}\``);
   logger.logger.info(`- out dir: \`${out}\``);
-  if (!fs$1.existsSync(cwd)) {
+  if (!u.existsSync(cwd)) {
     logger.logger.warn(`Warning: cwd does not exist: ${cwd}`);
   }
   logger.logger.groupEnd();
@@ -6563,8 +6563,8 @@ async function convertGradleToMaven({
   // Note: use resolve because the bin could be an absolute path, away from cwd
   // TODO: what about $PATH resolved commands? (`gradlew` without dir prefix)
   const rBin = path.resolve(cwd, bin);
-  const binExists = fs$1.existsSync(rBin);
-  const cwdExists = fs$1.existsSync(cwd);
+  const binExists = u.existsSync(rBin);
+  const cwdExists = u.existsSync(cwd);
   logger.logger.group('gradle2maven:');
   logger.logger.info(`- executing: \`${rBin}\``);
   if (!binExists) {
@@ -6752,7 +6752,7 @@ async function convertSbtToMaven({
     // TODO: Maybe we can add an option to target a specific file to dump to stdout.
     if (out === '-' && poms.length === 1) {
       logger.logger.log('Result:\n```');
-      logger.logger.log(await fs$2.safeReadFile(poms[0]));
+      logger.logger.log(await fs$1.safeReadFile(poms[0]));
       logger.logger.log('```');
       logger.logger.success(`OK`);
     } else if (out === '-') {
@@ -6791,11 +6791,11 @@ async function convertSbtToMaven({
         }
         try {
           // eslint-disable-next-line no-await-in-loop
-          await fs$1.promises.mkdir(path.dirname(destPath), {
+          await u.promises.mkdir(path.dirname(destPath), {
             recursive: true
           });
           // eslint-disable-next-line no-await-in-loop
-          await fs$1.promises.copyFile(pomPath, destPath);
+          await u.promises.copyFile(pomPath, destPath);
           copied.push(destPath);
         } catch (e) {
           logger.logger.warn(`Failed to copy \`${pomPath}\` to \`${destPath}\`: ${utils.getErrorCause(e)}`);
@@ -6869,14 +6869,14 @@ async function convertCondaToRequirements(filename, cwd, verbose) {
     if (verbose) {
       logger.logger.info(`[VERBOSE] target: ${filepath}`);
     }
-    if (!fs$1.existsSync(filepath)) {
+    if (!u.existsSync(filepath)) {
       return {
         ok: false,
         message: 'Manifest Generation Failed',
         cause: `The file was not found at ${filepath}`
       };
     }
-    content = fs$1.readFileSync(filepath, 'utf8');
+    content = u.readFileSync(filepath, 'utf8');
     if (!content) {
       return {
         ok: false,
@@ -6960,7 +6960,7 @@ async function outputRequirements(result, outputKind, out) {
     if (out === '-') {
       logger.logger.log(json);
     } else {
-      fs$1.writeFileSync(out, json, 'utf8');
+      u.writeFileSync(out, json, 'utf8');
     }
     return;
   }
@@ -6978,7 +6978,7 @@ async function outputRequirements(result, outputKind, out) {
     if (out === '-') {
       logger.logger.log(md);
     } else {
-      fs$1.writeFileSync(out, md, 'utf8');
+      u.writeFileSync(out, md, 'utf8');
     }
     return;
   }
@@ -6986,7 +6986,7 @@ async function outputRequirements(result, outputKind, out) {
     logger.logger.log(result.data.pip);
     logger.logger.log('');
   } else {
-    fs$1.writeFileSync(out, result.data.pip, 'utf8');
+    u.writeFileSync(out, result.data.pip, 'utf8');
   }
 }
 
@@ -8982,7 +8982,7 @@ async function generateSocketFactsForFix({
 async function readStructuredDiscoveryResult(outputFile, silence) {
   let raw;
   try {
-    raw = await fs$1.promises.readFile(outputFile, 'utf8');
+    raw = await u.promises.readFile(outputFile, 'utf8');
   } catch {
     return {
       ok: false,
@@ -9051,15 +9051,14 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
   // filteredArtifactCount }) via --output-file (available since coana 15.9.7,
   // older than the pinned @coana-tech/cli version).
   const outputFile = path.join(os.tmpdir(), `socket-fix-discovery-${Date.now()}.json`);
-  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, '--output-file', outputFile, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags], orgSlug, {
+  const foundCResult = await utils.spawnCoana(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, '--output-file', outputFile, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags], orgSlug, {
     cwd,
     spinner: silence ? undefined : spinner,
-    coanaVersion: options?.coanaVersion
-  }, {
+    coanaVersion: options?.coanaVersion,
     stdio: 'pipe'
   });
   if (!foundCResult.ok) {
-    await fs$1.promises.rm(outputFile, {
+    await u.promises.rm(outputFile, {
       force: true
     }).catch(() => {});
     return foundCResult;
@@ -9067,7 +9066,7 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
   try {
     return await readStructuredDiscoveryResult(outputFile, silence);
   } finally {
-    await fs$1.promises.rm(outputFile, {
+    await u.promises.rm(outputFile, {
       force: true
     }).catch(() => {});
   }
@@ -9091,13 +9090,14 @@ function selectFixedFiles(before, after, writtenFiles, scanBaseNames) {
   return [...after.modified.filter(isFromFix), ...after.untracked.filter(relPath => isFromFix(relPath) && (!!writtenFiles?.has(relPath) || scanBaseNames.has(path.basename(relPath))))];
 }
 function readWrittenFiles(outputFile) {
-  const result = fs$2.readJsonSync(outputFile, {
+  const result = fs$1.readJsonSync(outputFile, {
     throws: false
   });
   const files = result?.modifiedFiles;
   return Array.isArray(files) && files.every(f => typeof f === 'string') ? new Set(files) : undefined;
 }
 // Coana exits with this code after writing an --output-file that lists computed fixes it left unapplied.
+// Local mode exits with it too, so automation can tell unapplied fixes from a failed run.
 const COANA_FIXES_NOT_APPLIED_EXIT_CODE = 5;
 function isFixesNotAppliedExit(result) {
   return !result.ok && result.data?.code === COANA_FIXES_NOT_APPLIED_EXIT_CODE;
@@ -9300,7 +9300,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         coanaVersion,
         cwd,
         spinner: silence ? undefined : spinner,
@@ -9314,7 +9314,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       }
 
       // Read the temporary file to get the actual fixes result.
-      const fixesResultJson = fs$2.readJsonSync(tmpFile, {
+      const fixesResultJson = fs$1.readJsonSync(tmpFile, {
         throws: false
       });
 
@@ -9323,14 +9323,15 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
         if (!silence) {
           logger.logger.info(`Copying fixes result to ${outputFile}`);
         }
-        const tmpContent = await fs$1.promises.readFile(tmpFile, 'utf8');
-        await fs$1.promises.writeFile(outputFile, tmpContent, 'utf8');
+        const tmpContent = await u.promises.readFile(tmpFile, 'utf8');
+        await u.promises.writeFile(outputFile, tmpContent, 'utf8');
       }
       const ghsaDetails = fixesResultJson ? [fixesResultJson] : [];
       const notApplied = readNotAppliedFixes(fixesResultJson);
       if (!fixCResult.ok || notApplied.length) {
         return {
           ok: false,
+          code: COANA_FIXES_NOT_APPLIED_EXIT_CODE,
           message: fixesResultJson?.type === 'no-fixes-applied' ? 'No computed fixes were applied' : 'Some computed fixes were not applied',
           cause: formatNotAppliedFixes(notApplied),
           data: {
@@ -9349,7 +9350,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     } finally {
       // Clean up the temporary file.
       try {
-        await fs$1.promises.unlink(tmpFile);
+        await u.promises.unlink(tmpFile);
       } catch {
         // Ignore cleanup errors.
       }
@@ -9444,7 +9445,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
 
     // Apply fix for single GHSA ID.
     // eslint-disable-next-line no-await-in-loop
-    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    const fixCResult = await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
       coanaVersion,
       cwd,
       spinner: silence ? undefined : spinner,
@@ -9452,7 +9453,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     });
     if (isFixesNotAppliedExit(fixCResult)) {
       if (!silence) {
-        logger.logger.warn(`Not every fix for ${ghsaId} was applied:\n${formatNotAppliedFixes(readNotAppliedFixes(fs$2.readJsonSync(tmpFile, {
+        logger.logger.warn(`Not every fix for ${ghsaId} was applied:\n${formatNotAppliedFixes(readNotAppliedFixes(fs$1.readJsonSync(tmpFile, {
           throws: false
         })))}`);
       }
@@ -9463,7 +9464,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       // Clean up temp file on failure.
       try {
         // eslint-disable-next-line no-await-in-loop
-        await fs$1.promises.unlink(tmpFile);
+        await u.promises.unlink(tmpFile);
       } catch {
         // Ignore cleanup errors.
       }
@@ -9477,7 +9478,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       // Clean up temp file before continuing.
       try {
         // eslint-disable-next-line no-await-in-loop
-        await fs$1.promises.unlink(tmpFile);
+        await u.promises.unlink(tmpFile);
       } catch {
         // Ignore cleanup errors.
       }
@@ -9568,7 +9569,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
         const prRef = `PR #${data.number}`;
 
         // Read the fix result JSON and merge with PR data.
-        const fixResultJson = fs$2.readJsonSync(tmpFile, {
+        const fixResultJson = fs$1.readJsonSync(tmpFile, {
           throws: false
         });
         if (fixResultJson && typeof fixResultJson === 'object') {
@@ -9663,7 +9664,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       // Clean up temp file.
       try {
         // eslint-disable-next-line no-await-in-loop
-        await fs$1.promises.unlink(tmpFile);
+        await u.promises.unlink(tmpFile);
       } catch {
         // Ignore cleanup errors.
       }
@@ -9878,7 +9879,7 @@ const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: generate
 const reachabilityFlags = {
   reachVersion: {
     type: 'string',
-    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
+    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.COANA_CLI_VERSION}.`
   },
   reachAnalysisMemoryLimit: {
     type: 'string',
@@ -10014,7 +10015,7 @@ const generalFlags$2 = {
   },
   fixVersion: {
     type: 'string',
-    description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
+    description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${constants.COANA_CLI_VERSION}.`
   },
   applyFixes: {
     aliases: ['onlyCompute'],
@@ -10340,7 +10341,7 @@ async function run$N(argv, importMeta, {
   cwd = path.resolve(process.cwd(), cwd);
 
   // Validate the target directory exists.
-  if (!fs$1.existsSync(cwd)) {
+  if (!u.existsSync(cwd)) {
     logger.logger.fail(`Target directory does not exist: ${cwd}`);
     process.exitCode = 1;
     return;
@@ -10449,9 +10450,9 @@ async function setupTabCompletion(targetName) {
   // Target dir is something like ~/.local/share/socket/settings/completion (linux)
   const targetDir = path.dirname(targetPath);
   debug.debugFn('notice', 'target: path + dir', targetPath, targetDir);
-  if (!fs$1.existsSync(targetDir)) {
+  if (!u.existsSync(targetDir)) {
     debug.debugFn('notice', 'create: target dir');
-    fs$1.mkdirSync(targetDir, {
+    u.mkdirSync(targetDir, {
       recursive: true
     });
   }
@@ -10460,11 +10461,11 @@ async function setupTabCompletion(targetName) {
 
   // Add to ~/.bashrc if not already there
   const bashrcPath = constants.default.homePath ? path.join(constants.default.homePath, '.bashrc') : '';
-  const foundBashrc = Boolean(bashrcPath && fs$1.existsSync(bashrcPath));
+  const foundBashrc = Boolean(bashrcPath && u.existsSync(bashrcPath));
   if (foundBashrc) {
-    const content = fs$1.readFileSync(bashrcPath, 'utf8');
+    const content = u.readFileSync(bashrcPath, 'utf8');
     if (!content.includes(sourcingCommand)) {
-      fs$1.appendFileSync(bashrcPath, toAddToBashrc);
+      u.appendFileSync(bashrcPath, toAddToBashrc);
       bashrcUpdated = true;
     }
   }
@@ -10485,7 +10486,7 @@ async function setupTabCompletion(targetName) {
 function getTabCompletionScriptRaw() {
   const sourceDir = path.dirname(require$$0$1.fileURLToPath((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href))));
   const sourcePath = path.join(sourceDir, 'socket-completion.bash');
-  if (!fs$1.existsSync(sourcePath)) {
+  if (!u.existsSync(sourcePath)) {
     return {
       ok: false,
       message: 'Source not found.',
@@ -10494,7 +10495,7 @@ function getTabCompletionScriptRaw() {
   }
   return {
     ok: true,
-    data: fs$1.readFileSync(sourcePath, 'utf8')
+    data: u.readFileSync(sourcePath, 'utf8')
   };
 }
 function updateInstalledTabCompletionScript(targetPath) {
@@ -10505,7 +10506,7 @@ function updateInstalledTabCompletionScript(targetPath) {
 
   // When installing set the current package.json version.
   // Later, we can call _socket_completion_version to get the installed version.
-  fs$1.writeFileSync(targetPath, content.data.replaceAll('%SOCKET_VERSION_TOKEN%', constants.default.ENV.INLINED_SOCKET_CLI_VERSION_HASH), 'utf8');
+  u.writeFileSync(targetPath, content.data.replaceAll('%SOCKET_VERSION_TOKEN%', constants.default.ENV.INLINED_SOCKET_CLI_VERSION_HASH), 'utf8');
   return {
     ok: true,
     data: undefined
@@ -10600,19 +10601,19 @@ async function outputCmdJson(cwd) {
   logger.logger.info('Target cwd:', constants.default.ENV.VITEST ? constants.REDACTED : utils.tildify(cwd));
   const sockJsonPath = path.join(cwd, constants.SOCKET_JSON);
   const tildeSockJsonPath = constants.default.ENV.VITEST ? constants.REDACTED : utils.tildify(sockJsonPath);
-  if (!fs$1.existsSync(sockJsonPath)) {
+  if (!u.existsSync(sockJsonPath)) {
     logger.logger.fail(`Not found: ${tildeSockJsonPath}`);
     process.exitCode = 1;
     return;
   }
-  if (!fs$2.safeStatsSync(sockJsonPath)?.isFile()) {
+  if (!fs$1.safeStatsSync(sockJsonPath)?.isFile()) {
     logger.logger.fail(`This is not a regular file (maybe a directory?): ${tildeSockJsonPath}`);
     process.exitCode = 1;
     return;
   }
   logger.logger.success(`This is the contents of ${tildeSockJsonPath}:`);
   logger.logger.error('');
-  const data = fs$2.safeReadFileSync(sockJsonPath);
+  const data = fs$1.safeReadFileSync(sockJsonPath);
   logger.logger.log(data);
 }
 
@@ -11016,13 +11017,13 @@ async function runCdxgen(argvObj) {
       try {
         // TODO: Consider using trash instead of rmSync for safer deletion.
         // This removes the temporary package-lock.json we created for cdxgen.
-        fs$1.rmSync(`./${PACKAGE_LOCK_JSON}`);
+        u.rmSync(`./${PACKAGE_LOCK_JSON}`);
       } catch {}
     }
     const outputPath = argvMutable['output'];
     if (outputPath) {
       const fullOutputPath = path.join(process.cwd(), outputPath);
-      if (fs$1.existsSync(fullOutputPath)) {
+      if (u.existsSync(fullOutputPath)) {
         logger.logger.log(vendor.yoctocolorsCjsExports.cyanBright(`${outputPath} created!`));
       }
     }
@@ -11461,15 +11462,15 @@ function parseBazelModPipExtensionCandidates(stdout, verbose) {
 // Reads file contents, refusing files that exceed MAX_WORKSPACE_FILE_BYTES.
 // Returns null when the file is missing, oversized, or unreadable.
 function safeReadFile(file) {
-  if (!fs$1.existsSync(file)) {
+  if (!u.existsSync(file)) {
     return null;
   }
   try {
-    const stat = fs$1.statSync(file);
+    const stat = u.statSync(file);
     if (stat.size > MAX_WORKSPACE_FILE_BYTES) {
       return null;
     }
-    return fs$1.readFileSync(file, 'utf8');
+    return u.readFileSync(file, 'utf8');
   } catch {
     return null;
   }
@@ -11483,13 +11484,13 @@ function listLegacyStarlarkFiles(cwd) {
   const candidates = ['WORKSPACE', 'WORKSPACE.bazel'];
   for (const c of candidates) {
     const p = path.join(cwd, c);
-    if (fs$1.existsSync(p)) {
+    if (u.existsSync(p)) {
       files.push(p);
     }
   }
   // Top-level .bzl files only.
   try {
-    for (const entry of fs$1.readdirSync(cwd)) {
+    for (const entry of u.readdirSync(cwd)) {
       if (entry.endsWith('.bzl')) {
         files.push(path.join(cwd, entry));
       }
@@ -11884,16 +11885,16 @@ function readRequirementsLockFile(resolvedPath) {
   if (!resolvedPath) {
     return undefined;
   }
-  if (!fs$1.existsSync(resolvedPath)) {
+  if (!u.existsSync(resolvedPath)) {
     return undefined;
   }
   let text;
   try {
-    const stat = fs$1.statSync(resolvedPath);
+    const stat = u.statSync(resolvedPath);
     if (stat.size > MAX_REQUIREMENTS_FILE_BYTES) {
       return undefined;
     }
-    text = fs$1.readFileSync(resolvedPath, 'utf8');
+    text = u.readFileSync(resolvedPath, 'utf8');
   } catch {
     return undefined;
   }
@@ -12026,7 +12027,7 @@ async function extractBazelToPypi(opts) {
   logger.logger.group('bazel2pypi:');
   logger.logger.info(`- src dir: \`${cwd}\``);
   logger.logger.info(`- out dir: \`${out}\``);
-  if (!fs$1.existsSync(cwd)) {
+  if (!u.existsSync(cwd)) {
     logger.logger.warn(`Warning: cwd does not exist: ${cwd}`);
   }
   logger.logger.groupEnd();
@@ -12164,11 +12165,11 @@ async function extractBazelToPypi(opts) {
     const lines = sorted.map(p => `${p.name}==${p.version}\n`);
     const layout = opts.outLayout ?? 'standalone';
     const manifestDir = layout === 'flat' ? path.join(out, '.socket-auto-manifest') : out;
-    fs$1.mkdirSync(manifestDir, {
+    u.mkdirSync(manifestDir, {
       recursive: true
     });
     const manifestPath = path.join(manifestDir, 'requirements.txt');
-    await fs$1.promises.writeFile(manifestPath, lines.join(''), 'utf8');
+    await u.promises.writeFile(manifestPath, lines.join(''), 'utf8');
     if (verbose) {
       logger.logger.log('[VERBOSE] outputs:', {
         artifactCount: allLines.length,
@@ -14069,7 +14070,7 @@ async function setupManifestConfig(cwd, defaultOnReadError = false) {
   //   - record them to the socket.yml (or socket-cli.yml ? or just socket.json ?)
 
   const jsonPath = path.join(cwd, constants.SOCKET_JSON);
-  if (fs$1.existsSync(jsonPath)) {
+  if (u.existsSync(jsonPath)) {
     logger.logger.info(`Found ${constants.SOCKET_JSON} at ${jsonPath}`);
   } else {
     logger.logger.info(`No ${constants.SOCKET_JSON} found at ${cwd}, will generate a new one`);
@@ -15249,7 +15250,7 @@ async function askYesNo(message) {
 // normal, not an abort.
 async function setupRecursiveRootDefaults(cwd, defaultOnReadError, ecosystems, ecosystemsAtCwd) {
   const jsonPath = path.join(cwd, constants.SOCKET_JSON);
-  if (fs$1.existsSync(jsonPath)) {
+  if (u.existsSync(jsonPath)) {
     logger.logger.info(`Found ${constants.SOCKET_JSON} at ${jsonPath}`);
   } else {
     logger.logger.info(`No ${constants.SOCKET_JSON} found at ${cwd}, will generate a new one`);
@@ -18404,7 +18405,7 @@ function resolveSocketPatchBin() {
   let dir = __dirname;
   for (let i = 0; i < 10; i += 1) {
     const candidate = path.join(dir, 'node_modules', '.bin', 'socket-patch');
-    if (fs$1.existsSync(candidate)) {
+    if (u.existsSync(candidate)) {
       return candidate;
     }
     const parent = path.dirname(dir);
@@ -19758,7 +19759,7 @@ async function generateUvMemberSboms(memberDirs) {
   const files = [];
   const removeFilesSync = () => {
     for (const file of files) {
-      fs$1.rmSync(file, {
+      u.rmSync(file, {
         force: true
       });
     }
@@ -19774,7 +19775,7 @@ async function generateUvMemberSboms(memberDirs) {
     for (const signal of CLEANUP_SIGNALS) {
       process.removeListener(signal, removeFilesSync);
     }
-    await Promise.all(files.map(file => fs$1.promises.rm(file, {
+    await Promise.all(files.map(file => u.promises.rm(file, {
       force: true
     })));
   };
@@ -19784,7 +19785,7 @@ async function generateUvMemberSboms(memberDirs) {
       // and the reachability target line up with the member directory.
       const filename = path.join(memberDirs[i], UV_SBOM_FILENAME);
       // eslint-disable-next-line no-await-in-loop
-      await fs$1.promises.writeFile(filename, JSON.stringify(sboms[i]), {
+      await u.promises.writeFile(filename, JSON.stringify(sboms[i]), {
         flag: 'wx'
       });
       files.push(filename);
@@ -19803,13 +19804,13 @@ function resolveUvMemberDirs(targets, cwd) {
   for (const target of targets) {
     const memberDir = path.resolve(cwd, target);
     const relativeDir = path.relative(cwd, memberDir);
-    if (relativeDir === '..' || relativeDir.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDir) || !fs$2.isDirSync(memberDir)) {
+    if (relativeDir === '..' || relativeDir.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDir) || !fs$1.isDirSync(memberDir)) {
       throw new utils.InputError(`--uv-members requires every TARGET to be a directory inside --cwd, but got ${target}`);
     }
-    if (!fs$1.existsSync(path.join(memberDir, 'pyproject.toml'))) {
+    if (!u.existsSync(path.join(memberDir, 'pyproject.toml'))) {
       throw new utils.InputError(`--uv-members requires a pyproject.toml in every TARGET, but ${target} has none`);
     }
-    if (fs$1.existsSync(path.join(memberDir, UV_SBOM_FILENAME))) {
+    if (u.existsSync(path.join(memberDir, UV_SBOM_FILENAME))) {
       throw new utils.InputError(`${path.join(target, UV_SBOM_FILENAME)} already exists. Remove it and run the scan again.`);
     }
     memberDirs.add(memberDir);
@@ -19862,9 +19863,9 @@ async function validateReachabilityTarget(targets, cwd) {
   // Check if target is inside cwd.
   const relativePath = path.relative(absoluteCwd, targetPath);
   result.isInsideCwd = !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
-  result.targetExists = fs$1.existsSync(targetPath);
+  result.targetExists = u.existsSync(targetPath);
   if (result.targetExists) {
-    const targetStat = await fs$1.promises.stat(targetPath);
+    const targetStat = await u.promises.stat(targetPath);
     result.isDirectory = targetStat.isDirectory();
   }
   return result;
@@ -19988,7 +19989,7 @@ const generalFlags$1 = {
 };
 function hasSocketFactsFileIn(dir) {
   try {
-    return fs$1.readdirSync(dir).some(utils.isSocketFactsFile);
+    return u.readdirSync(dir).some(utils.isSocketFactsFile);
   } catch {
     return false;
   }
@@ -20560,7 +20561,7 @@ async function handleJson(data, file, dashboardMessage) {
   const json = utils.serializeResultJson(data);
   if (file && file !== '-') {
     logger.logger.log(`Writing json to \`${file}\``);
-    fs$1.writeFile(file, json, err => {
+    u.writeFile(file, json, err => {
       if (err) {
         logger.logger.fail(`Writing to \`${file}\` failed...`);
         logger.logger.error(err);
@@ -21016,7 +21017,7 @@ async function scanOneRepo(repoSlug, {
       }
     };
   }
-  const tmpDir = fs$1.mkdtempSync(path.join(os.tmpdir(), repoSlug));
+  const tmpDir = u.mkdtempSync(path.join(os.tmpdir(), repoSlug));
   debug.debugFn('notice', 'init: temp dir for scan root', tmpDir);
   const downloadResult = await testAndDownloadManifestFiles({
     files,
@@ -21291,12 +21292,12 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
     // Make sure the dir exists. It may be nested and we need to construct that
     // before starting the download.
     const dir = path.dirname(localPath);
-    if (!fs$1.existsSync(dir)) {
-      fs$1.mkdirSync(dir, {
+    if (!u.existsSync(dir)) {
+      u.mkdirSync(dir, {
         recursive: true
       });
     }
-    const fileStream = fs$1.createWriteStream(localPath);
+    const fileStream = u.createWriteStream(localPath);
 
     // Using stream.pipeline for better error handling and cleanup
 
@@ -21315,11 +21316,11 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
     debug.debugDir('error', e);
 
     // If an error occurs and fileStream was created, attempt to clean up.
-    if (fs$1.existsSync(localPath)) {
+    if (u.existsSync(localPath)) {
       // Check if fileStream was even opened before trying to delete
       // This check might be too simplistic depending on when error occurs
       try {
-        await fs$1.promises.unlink(localPath);
+        await u.promises.unlink(localPath);
       } catch (e) {
         logger.logger.fail(utils.formatErrorWithDetail(`Error deleting partial file ${localPath}`, e));
       }
@@ -22762,7 +22763,7 @@ async function outputScanConfigResult(result) {
 
 async function setupScanConfig(cwd, defaultOnReadError = false) {
   const jsonPath = path.join(cwd, constants.SOCKET_JSON);
-  if (fs$1.existsSync(jsonPath)) {
+  if (u.existsSync(jsonPath)) {
     logger.logger.info(`Found ${constants.SOCKET_JSON} at ${jsonPath}`);
   } else {
     logger.logger.info(`No ${constants.SOCKET_JSON} found at ${cwd}, will generate a new one`);
@@ -23868,15 +23869,15 @@ async function teardownTabCompletion(targetName) {
 
   // Remove from ~/.bashrc if found
   const bashrc = constants.default.homePath ? path.join(constants.default.homePath, '.bashrc') : '';
-  if (bashrc && fs$1.existsSync(bashrc)) {
-    const content = fs$1.readFileSync(bashrc, 'utf8');
+  if (bashrc && u.existsSync(bashrc)) {
+    const content = u.readFileSync(bashrc, 'utf8');
     if (content.includes(toAddToBashrc)) {
       const newContent = content
       // Try to remove the whole thing with comment first
       .replaceAll(toAddToBashrc, '')
       // Comment may have been edited away, try to remove the command at least
       .replaceAll(sourcingCommand, '').replaceAll(completionCommand, '');
-      fs$1.writeFileSync(bashrc, newContent, 'utf8');
+      u.writeFileSync(bashrc, newContent, 'utf8');
       return {
         ok: true,
         data: {
@@ -23989,7 +23990,7 @@ const cmdUninstall = {
 };
 
 function addSocketWrapper(file) {
-  return fs$1.appendFile(file, 'alias npm="socket npm"\nalias npx="socket npx"\n', err => {
+  return u.appendFile(file, 'alias npm="socket npm"\nalias npx="socket npx"\n', err => {
     if (err) {
       return new Error(`There was an error setting up the alias: ${err}`);
     }
@@ -24006,7 +24007,7 @@ function addSocketWrapper(file) {
 }
 
 function checkSocketWrapperSetup(file) {
-  const fileContent = fs$1.readFileSync(file, 'utf8');
+  const fileContent = u.readFileSync(file, 'utf8');
   const linesWithSocketAlias = fileContent.split('\n').filter(l => l === 'alias npm="socket npm"' || l === 'alias npx="socket npx"');
   if (linesWithSocketAlias.length) {
     logger.logger.log(`The Socket npm/npx wrapper is set up in your bash profile (${file}).`);
@@ -24025,7 +24026,7 @@ async function postinstallWrapper() {
     bashRcPath,
     zshRcPath
   } = constants.default;
-  const socketWrapperEnabled = fs$1.existsSync(bashRcPath) && checkSocketWrapperSetup(bashRcPath) || fs$1.existsSync(zshRcPath) && checkSocketWrapperSetup(zshRcPath);
+  const socketWrapperEnabled = u.existsSync(bashRcPath) && checkSocketWrapperSetup(bashRcPath) || u.existsSync(zshRcPath) && checkSocketWrapperSetup(zshRcPath);
   if (!socketWrapperEnabled) {
     await setupShadowNpm(`
 The Socket CLI is now successfully installed! 🎉
@@ -24041,7 +24042,7 @@ Do you want to install the Socket npm wrapper (this will create an alias to the
   try {
     const details = utils.getBashrcDetails(''); // Note: command is not relevant, we just want the config path
     if (details.ok) {
-      if (fs$1.existsSync(details.data.targetPath)) {
+      if (u.existsSync(details.data.targetPath)) {
         // Replace the file with the one from this installation
         const result = updateInstalledTabCompletionScript(details.data.targetPath);
         if (result.ok) {
@@ -24080,10 +24081,10 @@ async function setupShadowNpm(query) {
       zshRcPath
     } = constants.default;
     try {
-      if (fs$1.existsSync(bashRcPath)) {
+      if (u.existsSync(bashRcPath)) {
         addSocketWrapper(bashRcPath);
       }
-      if (fs$1.existsSync(zshRcPath)) {
+      if (u.existsSync(zshRcPath)) {
         addSocketWrapper(zshRcPath);
       }
     } catch (e) {
@@ -24095,7 +24096,7 @@ async function setupShadowNpm(query) {
 function removeSocketWrapper(filepath) {
   let content;
   try {
-    content = fs$1.readFileSync(filepath, 'utf8');
+    content = u.readFileSync(filepath, 'utf8');
   } catch (e) {
     logger.logger.fail(`There was an error removing the alias${e ? ':' : '.'}`);
     if (e) {
@@ -24106,7 +24107,7 @@ function removeSocketWrapper(filepath) {
   const linesWithoutSocketAlias = content.split('\n').filter(l => l !== 'alias npm="socket npm"' && l !== 'alias npx="socket npx"');
   const updatedContent = linesWithoutSocketAlias.join('\n');
   try {
-    fs$1.writeFileSync(filepath, updatedContent, 'utf8');
+    u.writeFileSync(filepath, updatedContent, 'utf8');
   } catch (e) {
     if (e) {
       logger.logger.error(e);
@@ -24200,21 +24201,21 @@ async function run$1(argv, importMeta, {
     zshRcPath
   } = constants.default;
   if (enable) {
-    if (fs$1.existsSync(bashRcPath) && !checkSocketWrapperSetup(bashRcPath)) {
+    if (u.existsSync(bashRcPath) && !checkSocketWrapperSetup(bashRcPath)) {
       addSocketWrapper(bashRcPath);
     }
-    if (fs$1.existsSync(zshRcPath) && !checkSocketWrapperSetup(zshRcPath)) {
+    if (u.existsSync(zshRcPath) && !checkSocketWrapperSetup(zshRcPath)) {
       addSocketWrapper(zshRcPath);
     }
   } else {
-    if (fs$1.existsSync(bashRcPath)) {
+    if (u.existsSync(bashRcPath)) {
       removeSocketWrapper(bashRcPath);
     }
-    if (fs$1.existsSync(zshRcPath)) {
+    if (u.existsSync(zshRcPath)) {
       removeSocketWrapper(zshRcPath);
     }
   }
-  if (!fs$1.existsSync(bashRcPath) && !fs$1.existsSync(zshRcPath)) {
+  if (!u.existsSync(bashRcPath) && !u.existsSync(zshRcPath)) {
     logger.logger.fail('There was an issue setting up the alias in your bash profile');
   }
 }
@@ -24538,5 +24539,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=22616eb7-71e2-4c79-9e60-bfde9a2cdb49
+//# debugId=c715fb1e-bcb7-40c4-b394-2bc4db5e64a
 //# sourceMappingURL=cli.js.map