@socketsecurity/cli-with-sentry 1.8.4 → 1.9.0

package/dist/utils.js

@@ -17,17 +17,19 @@ var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var env = require('../external/@socketsecurity/registry/lib/env');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
-var fs = require('node:fs');
-var fs$2 = require('node:fs/promises');
+var require$$0 = require('node:crypto');
+var require$$1$1 = require('node:stream');
 var require$$9 = require('node:stream/promises');
+var u = require('node:fs');
+var fs$1 = require('node:fs/promises');
 var require$$11 = require('node:zlib');
-var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
-var require$$1 = require('node:module');
-var os = require('node:os');
+var fs = require('../external/@socketsecurity/registry/lib/fs');
 var url = require('../external/@socketsecurity/registry/lib/url');
+var require$$1 = require('node:module');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
+var os = require('node:os');
 var process$1 = require('node:process');
 var require$$7 = require('node:timers/promises');
 var promises = require('../external/@socketsecurity/registry/lib/promises');
@@ -39,7 +41,6 @@ var streams = require('../external/@socketsecurity/registry/lib/streams');
 var require$$10 = require('node:util');
 var require$$12 = require('node:http');
 var node_tls = require('node:tls');
-var require$$0 = require('node:crypto');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 /**
@@ -297,7 +298,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      await fs.promises.writeFile(filepath, content);
+      await u.promises.writeFile(filepath, content);
       if (process.platform === 'win32') {
         // eslint-disable-next-line no-await-in-loop
         await require$$7.setTimeout(50);
@@ -306,7 +307,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
         while (accessRetries < maxAccessRetries) {
           try {
             // eslint-disable-next-line no-await-in-loop
-            await fs.promises.access(filepath);
+            await u.promises.access(filepath);
             // eslint-disable-next-line no-await-in-loop
             await require$$7.setTimeout(10);
             break;
@@ -347,7 +348,7 @@ async function readFile(filepath) {
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      return await fs.promises.readFile(filepath, 'utf8');
+      return await u.promises.readFile(filepath, 'utf8');
     } catch (err) {
       const isLastAttempt = attempt === maxRetries;
       const isEnoent = err instanceof Error && 'code' in err && err.code === 'ENOENT';
@@ -636,7 +637,7 @@ function getConfigValues() {
     } = constants.default;
     if (socketAppDataPath) {
       const configFilePath = path.join(socketAppDataPath, 'config.json');
-      const raw = fs$1.safeReadFileSync(configFilePath);
+      const raw = fs.safeReadFileSync(configFilePath);
       if (raw) {
         try {
           Object.assign(_cachedConfig, JSON.parse(Buffer.from(raw, 'base64').toString()));
@@ -653,7 +654,7 @@ function getConfigValues() {
           updateConfigValue(constants.CONFIG_KEY_API_TOKEN, token);
         }
       } else {
-        fs.mkdirSync(socketAppDataPath, {
+        u.mkdirSync(socketAppDataPath, {
           recursive: true
         });
       }
@@ -682,10 +683,10 @@ function findSocketYmlSync(dir = process.cwd()) {
   let prevDir = null;
   while (dir !== prevDir) {
     let ymlPath = path.join(dir, constants.SOCKET_YML);
-    let yml = fs$1.safeReadFileSync(ymlPath);
+    let yml = fs.safeReadFileSync(ymlPath);
     if (yml === undefined) {
       ymlPath = path.join(dir, constants.SOCKET_YAML);
-      yml = fs$1.safeReadFileSync(ymlPath);
+      yml = fs.safeReadFileSync(ymlPath);
     }
     if (typeof yml === 'string') {
       try {
@@ -864,12 +865,12 @@ function updateConfigValue(configKey, value) {
         socketAppDataPath
       } = constants.default;
       if (socketAppDataPath) {
-        fs.mkdirSync(socketAppDataPath, {
+        u.mkdirSync(socketAppDataPath, {
           recursive: true
         });
         const configFilePath = path.join(socketAppDataPath, 'config.json');
         // Read existing file to preserve formatting, then update with new values.
-        const existingRaw = fs$1.safeReadFileSync(configFilePath);
+        const existingRaw = fs.safeReadFileSync(configFilePath);
         const EditableJson = getEditableJsonClass();
         const editor = new EditableJson();
         if (existingRaw !== undefined) {
@@ -916,7 +917,7 @@ function updateConfigValue(configKey, value) {
 
         // Stringify with formatting preserved.
         const jsonContent = JSON.stringify(contentToSave, undefined, indent).replace(/\n/g, newline);
-        fs.writeFileSync(configFilePath, Buffer.from(jsonContent + newline).toString('base64'));
+        u.writeFileSync(configFilePath, Buffer.from(jsonContent + newline).toString('base64'));
       }
     });
   }
@@ -1892,7 +1893,7 @@ function getExtraCaCerts() {
     return undefined;
   }
   try {
-    const extraCerts = fs.readFileSync(certPath, 'utf-8');
+    const extraCerts = u.readFileSync(certPath, 'utf-8');
     // Combine default root certificates with extra certificates. Specifying ca
     // in an agent replaces the default trust store, so both must be included.
     _extraCaCerts = [...node_tls.rootCertificates, extraCerts];
@@ -2225,6 +2226,21 @@ function _httpsRequestFetch(url, init, agent, redirectCount) {
     req.end();
   });
 }
+
+/**
+ * The cause for a failed request to `path`, with the explanation the Socket
+ * API gives in its `{ error: { message } }` body when there is one.
+ */
+async function describeApiFailure(response, path) {
+  let serverMessage;
+  try {
+    serverMessage = JSON.parse(await response.text())?.error?.message;
+  } catch {
+    // A body that isn't JSON carries no message.
+  }
+  const reason = await getErrorMessageForHttpStatusCode(response.status);
+  return typeof serverMessage === 'string' && serverMessage ? `${response.statusText}: ${serverMessage} (reason: ${reason}) (path: ${path})` : `${response.statusText} (reason: ${reason}) (path: ${path})`;
+}
 async function apiFetch(url, init = {}) {
   return await _httpsRequestFetch(url, init, getHttpsAgent(), 0);
 }
@@ -2449,9 +2465,6 @@ async function handleApiCallNoSpinner(value, description) {
 }
 async function queryApi(path, apiToken) {
   const baseUrl = getDefaultApiBaseUrl();
-  if (!baseUrl) {
-    throw new Error('Socket API base URL is not configured.');
-  }
   const url = `${baseUrl}${baseUrl.endsWith('/') ? '' : '/'}${path}`;
   const result = await apiFetch(url, {
     method: 'GET',
@@ -2519,7 +2532,7 @@ async function queryApiSafeTextWithStatus(path, description, commandPath) {
     return {
       ok: false,
       message: 'Socket API error',
-      cause: `${result.statusText} (reason: ${await getErrorMessageForHttpStatusCode(status)}) (path: ${path})`,
+      cause: await describeApiFailure(result, path),
       data: {
         code: status
       }
@@ -2590,13 +2603,6 @@ async function sendApiRequest(path, options) {
     };
   }
   const baseUrl = getDefaultApiBaseUrl();
-  if (!baseUrl) {
-    return {
-      ok: false,
-      message: 'Configuration Error',
-      cause: 'Socket API endpoint is not configured. Please check your environment configuration.'
-    };
-  }
   const {
     body,
     commandPath,
@@ -2657,7 +2663,7 @@ async function sendApiRequest(path, options) {
     return {
       ok: false,
       message: 'Socket API error',
-      cause: `${result.statusText} (reason: ${await getErrorMessageForHttpStatusCode(status)}) (path: ${path})`,
+      cause: await describeApiFailure(result, path),
       data: {
         code: status
       }
@@ -4540,7 +4546,7 @@ async function getWorkspaceGlobs(agent, cwd = process.cwd()) {
   let workspacePatterns;
   if (agent === constants.PNPM) {
     const workspacePath = path.join(cwd, 'pnpm-workspace.yaml');
-    const yml = await fs$1.safeReadFile(workspacePath);
+    const yml = await fs.safeReadFile(workspacePath);
     if (yml) {
       try {
         workspacePatterns = vendor.distExports$1.parse(yml)?.packages;
@@ -4766,7 +4772,7 @@ async function globWithGitIgnore(patterns, options) {
         venv: true
       };
     }
-    const content = (await fs$1.safeReadFile(filepath)) ?? '';
+    const content = (await fs.safeReadFile(filepath)) ?? '';
     return {
       content,
       dir: dirRel,
@@ -4898,7 +4904,7 @@ function pathsToGlobPatterns(paths, cwd) {
     }
     const absolutePath = path.isAbsolute(p) ? p : path.resolve(cwd ?? process.cwd(), p);
     // If the path is a directory, scan it recursively for all files.
-    if (fs$1.isDirSync(absolutePath)) {
+    if (fs.isDirSync(absolutePath)) {
       return `${p}/**/*`;
     }
     return p;
@@ -5054,237 +5060,6 @@ function* walkNestedMap(map, keys = []) {
   }
 }
 
-/**
- * Coana integration utilities for Socket CLI.
- * Manages reachability analysis via Coana tech CLI.
- *
- * Key Functions:
- * - compressSocketFactsForUpload: Brotli-compress any .socket.facts.json
- *   entries in scanPaths just before upload, returning swapped paths plus a
- *   cleanup callback. Coana keeps writing plain JSON; the on-the-wire form
- *   to depscan is brotli (api-v0 decodes at the multipart boundary).
- * - extractReachabilityErrors: Extract per-component reachability errors
- * - extractTier1ReachabilityScanId: Extract scan ID from socket facts file
- * - getFullWorkspacePath: Label a build-root/workspace pair the way Coana does
- * - snapshotSocketFacts: Copy aside the socket facts files Coana overwrites
- *   in place, so a failed analysis can be rolled back
- *
- * Integration:
- * - Works with @coana-tech/cli for reachability analysis
- * - Processes socket facts JSON files
- * - Extracts full application reachability scan identifiers
- */
-
-const {
-  DOT_SOCKET_DOT_FACTS_JSON
-} = constants.default;
-/**
- * For each `.socket.facts.json` in `scanPaths`, stream-brotli-compress a
- * sibling `.socket.facts.json.br` next to the original file and swap its
- * path in. Other paths pass through unchanged. Missing files also pass
- * through unchanged (the upload will fail downstream with the same error
- * it would have).
- *
- * Streaming + worker-thread compression keeps the event loop responsive:
- * default brotli quality (11) on a 60+MB facts file takes multiple seconds
- * of CPU, which would otherwise freeze the spinner / signal handlers /
- * any concurrent work.
- *
- * The `.br` lives next to the source rather than under the OS temp dir
- * because depscan's multipart ingest (`addStreamEntry`) rejects entries
- * whose names contain `..` traversal segments. The SDK computes the
- * multipart entry name via `path.relative(cwd, brPath)`, so an OS-tmpdir
- * temp path turns into `../../../var/folders/...` and gets dropped as
- * `unmatchedFiles`. Sibling-write keeps the relative path inside cwd, and
- * keeps the directory shape symmetric with the plain `.socket.facts.json`
- * upload (depscan strips only the `.br` suffix at ingest, so
- * `<dir>/.socket.facts.json.br` and `<dir>/.socket.facts.json` resolve to
- * the same storage path).
- *
- * Concurrent scans against the same source directory are already racy on
- * `.socket.facts.json` itself (coana writes to a single path), so the
- * sibling `.br` doesn't introduce a new race.
- *
- * Caller MUST `await cleanup()` (typically in a `finally` block) once the
- * upload completes — successful or not — to remove the sibling files.
- */
-async function compressSocketFactsForUpload(scanPaths) {
-  const brPaths = [];
-  const cleanup = async () => {
-    const targets = brPaths.splice(0);
-    // `recursive: true` defends against the (defensive) case where a sibling
-    // path was somehow created as a directory — `rm` would otherwise throw
-    // on the first such entry and skip the rest. `force: true` no-ops on
-    // missing paths so the function stays idempotent.
-    await Promise.all(targets.map(t => fs$2.rm(t, {
-      recursive: true,
-      force: true
-    })));
-  };
-  // Use `allSettled` (not `all`) so a failure in one entry doesn't leak the
-  // others' in-flight pipelines past our `catch`. If we used `all`, the
-  // first rejection would bubble out while sibling pipelines were still
-  // writing bytes — `cleanup()` would race with those writes and could
-  // remove a `.br` only to have it re-created after we returned.
-  const results = await Promise.allSettled(scanPaths.map(async p => {
-    // depscan decodes only the bare `.socket.facts.json.br`; a named facts
-    // file is uploaded as plain JSON.
-    if (path.basename(p) !== DOT_SOCKET_DOT_FACTS_JSON) {
-      return p;
-    }
-    if (!fs.existsSync(p)) {
-      return p;
-    }
-    const brPath = `${p}.br`;
-    // Track the sibling path BEFORE the pipeline starts so a
-    // partially-written `.br` is removed even if the pipeline rejects.
-    // `rm({ force: true })` no-ops on missing files, so tracking before
-    // creation is safe.
-    brPaths.push(brPath);
-    await require$$9.pipeline(fs.createReadStream(p), require$$11.createBrotliCompress(), fs.createWriteStream(brPath));
-    return brPath;
-  }));
-  const failure = results.find(r => r.status === 'rejected');
-  if (failure) {
-    // All pipelines have settled, so cleanup() can safely remove every
-    // `.br` we tracked (succeeded or partial) without racing live writes.
-    await cleanup();
-    throw failure.reason;
-  }
-  const paths = results.map(r => r.value);
-  return {
-    paths,
-    cleanup
-  };
-}
-
-// `.socket.facts.json` or a named `<entry>.socket.facts.json`, matching
-// depscan's case-insensitive `*.socket.facts.json`.
-function isSocketFactsFile(filepath) {
-  return path.basename(filepath).toLowerCase().endsWith(DOT_SOCKET_DOT_FACTS_JSON);
-}
-
-// A Coana reachability report, never input to a new analysis: the bare
-// `.socket.facts.json` (Coana's default name; producers name theirs after the
-// build) or the path this run tells Coana to write to.
-function isReachabilityReportPath(filepath, options) {
-  const {
-    cwd,
-    outputPath
-  } = {
-    __proto__: null,
-    ...options
-  };
-  return path.basename(filepath).toLowerCase() === DOT_SOCKET_DOT_FACTS_JSON || path.resolve(cwd, filepath) === path.resolve(cwd, outputPath);
-}
-function extractReachabilityErrors(socketFactsFile) {
-  const json = fs$1.readJsonSync(socketFactsFile, {
-    throws: false
-  });
-  if (!json || !Array.isArray(json.components)) {
-    return [];
-  }
-  const errors = [];
-  for (const component of json.components) {
-    if (!Array.isArray(component.reachability)) {
-      continue;
-    }
-    for (const ghsaEntry of component.reachability) {
-      if (!Array.isArray(ghsaEntry.reachability)) {
-        continue;
-      }
-      for (const entry of ghsaEntry.reachability) {
-        if (entry.type === 'error') {
-          errors.push({
-            componentName: String(component.name ?? ''),
-            componentVersion: String(component.version ?? ''),
-            ghsaId: String(ghsaEntry.ghsa_id ?? ''),
-            subprojectPath: String(entry.subprojectPath ?? ''),
-            workspacePath: String(entry.workspacePath ?? '')
-          });
-        }
-      }
-    }
-  }
-  return errors;
-}
-function extractTier1ReachabilityScanId(socketFactsFile) {
-  const json = fs$1.readJsonSync(socketFactsFile, {
-    throws: false
-  });
-  const tier1ReachabilityScanId = String(json?.['tier1ReachabilityScanId'] ?? '').trim();
-  return tier1ReachabilityScanId.length > 0 ? tier1ReachabilityScanId : undefined;
-}
-
-// Label a reachability location the way Coana's own `getFullWorkspacePath`
-// does. Since @coana-tech/cli v15.10.8 `subprojectPath` names the build root
-// and `workspacePath` the workspace within it, so a single-root repo reports
-// `.` as its subproject and must be labelled by its workspace alone.
-function getFullWorkspacePath(subprojectPath, workspacePath) {
-  const subproject = subprojectPath && subprojectPath !== '.' ? subprojectPath : '';
-  const workspace = workspacePath && workspacePath !== '.' ? workspacePath : '';
-  if (subproject && workspace) {
-    return `${subproject}/${workspace}`;
-  }
-  return subproject || workspace || '.';
-}
-// Coana overwrites `.socket.facts.json` in place, so an analysis that fails
-// part way leaves partial output where the scan's inputs used to be.
-async function snapshotSocketFacts(scanPaths, options) {
-  const {
-    cwd,
-    outputPath,
-    tmpDir
-  } = {
-    __proto__: null,
-    ...options
-  };
-  const sources = new Set(scanPaths.filter(p => path.basename(p) === DOT_SOCKET_DOT_FACTS_JSON).map(p => path.resolve(cwd, p)));
-  sources.add(path.resolve(cwd, outputPath));
-  const snapshotDir = path.join(tmpDir, 'socket-facts-snapshot');
-  await fs$2.mkdir(snapshotDir, {
-    recursive: true
-  });
-  const captured = [];
-  const created = [];
-  await Promise.all(Array.from(sources, async (source, index) => {
-    if (!fs.existsSync(source)) {
-      created.push(source);
-      return;
-    }
-    const backup = path.join(snapshotDir, `${index}.json`);
-    try {
-      await fs$2.copyFile(source, backup);
-      captured.push({
-        backup,
-        source
-      });
-    } catch (e) {
-      // A path we cannot copy is left out of both lists so restore() leaves
-      // it untouched rather than deleting a file it never captured.
-      debug$2.debugFn('warn', `[socket-facts] snapshot failed: ${source}`);
-      debug$2.debugDir('error', e);
-    }
-  }));
-  return {
-    async restore() {
-      await Promise.all([...captured.map(async ({
-        backup,
-        source
-      }) => {
-        try {
-          await fs$2.copyFile(backup, source);
-        } catch (e) {
-          debug$2.debugFn('warn', `[socket-facts] restore failed: ${source}`);
-          debug$2.debugDir('error', e);
-        }
-      }), ...created.map(source => fs$2.rm(source, {
-        force: true
-      }).catch(() => {}))]);
-    }
-  };
-}
-
 /**
  * File system utilities for Socket CLI.
  * Provides file and directory search functionality.
@@ -5336,7 +5111,7 @@ async function findUp(name, options) {
       const thePath = path.join(dir, name);
       try {
         // eslint-disable-next-line no-await-in-loop
-        const stats = await fs.promises.stat(thePath);
+        const stats = await u.promises.stat(thePath);
         if (!onlyDirectories && stats.isFile()) {
           return thePath;
         }
@@ -5350,11 +5125,11 @@ async function findUp(name, options) {
   return undefined;
 }
 async function withTmpDir(prefix, fn) {
-  const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), prefix));
+  const tmpDir = await u.promises.mkdtemp(path.join(os.tmpdir(), prefix));
   try {
     return await fn(tmpDir);
   } finally {
-    await fs.promises.rm(tmpDir, {
+    await u.promises.rm(tmpDir, {
       recursive: true,
       force: true
     }).catch(() => {});
@@ -5366,771 +5141,605 @@ async function withTmpDir(prefix, fn) {
 // path still gets a usable absolute value instead of throwing.
 async function realpathOrResolved(target) {
   try {
-    return await fs.promises.realpath(target);
+    return await u.promises.realpath(target);
   } catch {
     return path.resolve(target);
   }
 }
 
-function findBinPathDetailsSync(binName) {
-  const rawBinPaths = bin.whichBinSync(binName, {
-    all: true,
-    nothrow: true
-  }) ?? [];
-  // whichBinSync may return a string when only one result is found, even with all: true.
-  // This handles both the current published version and future versions.
-  const binPaths = Array.isArray(rawBinPaths) ? rawBinPaths : typeof rawBinPaths === 'string' ? [rawBinPaths] : [];
-  const {
-    shadowBinPath
-  } = constants.default;
-  let shadowIndex = -1;
-  let theBinPath;
-  for (let i = 0, {
-      length
-    } = binPaths; i < length; i += 1) {
-    const binPath = binPaths[i];
-    // Skip our bin directory if it's in the front.
-    if (path.dirname(binPath) === shadowBinPath) {
-      shadowIndex = i;
-    } else {
-      theBinPath = bin.resolveBinPathSync(binPath);
-      break;
-    }
+/**
+ * Coana CLI releases for Socket CLI.
+ * Runs the Coana CLI from the cache that Coana and the Socket CLIs share, and
+ * downloads it from the Socket API when the cache lacks it. "Launching Coana"
+ * in coana-package-manager's packages/cli/docs/gcs-releases.md specifies the
+ * steps.
+ *
+ * Key Functions:
+ * - spawnCoana: Run the Coana CLI for a version spec
+ *
+ * Cache:
+ * - Only the vendored coana-cache.mjs reads or writes it
+ */
+
+const CACHE_NOT_WRITABLE_EXIT_CODE = 3;
+const COANA_CACHE_SCRIPT = 'coana-cache.mjs';
+const COMPONENT = 'cli';
+const NOT_CACHED_EXIT_CODE = 4;
+const SHA256_REGEXP = /^[0-9a-f]{64}$/;
+function cacheResultToCResult(result) {
+  if (result.exitCode === 0) {
+    return {
+      ok: true,
+      data: result.stdout
+    };
   }
   return {
-    name: binName,
-    path: theBinPath,
-    shadowed: shadowIndex !== -1
+    ok: false,
+    message: result.exitCode === CACHE_NOT_WRITABLE_EXIT_CODE ? 'Cannot write to the Coana cache' : 'The Coana cache failed',
+    cause: result.stderr || `${COANA_CACHE_SCRIPT} exited with ${result.exitCode}`
   };
 }
-function findNpmDirPathSync(npmBinPath) {
-  const {
-    WIN32
-  } = constants.default;
-  let thePath = npmBinPath;
-  while (true) {
-    const libNmNpmPath = path.join(thePath, `lib/${constants.NODE_MODULES}/${constants.NPM}`);
-    // mise, which uses opaque binaries, puts its npm bin in a path like:
-    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/bin/npm.
-    // HOWEVER, the location of the npm install is:
-    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/lib/node_modules/npm.
-    if (
-    // Use existsSync here because statsSync, even with { throwIfNoEntry: false },
-    // will throw an ENOTDIR error for paths like ./a-file-that-exists/a-directory-that-does-not.
-    // See https://github.com/nodejs/node/issues/56993.
-    fs$1.isDirSync(libNmNpmPath)) {
-      thePath = libNmNpmPath;
-    }
-    const hasNmInCurrPath = fs$1.isDirSync(path.join(thePath, constants.NODE_MODULES));
-    const hasNmInParentPath = !hasNmInCurrPath && fs$1.isDirSync(path.join(thePath, `../${constants.NODE_MODULES}`));
-    if (
-    // npm bin paths may look like:
-    //   /usr/local/share/npm/bin/npm
-    //   /Users/SomeUsername/.nvm/versions/node/vX.X.X/bin/npm
-    //   C:\Users\SomeUsername\AppData\Roaming\npm\bin\npm.cmd
-    // OR
-    //   C:\Program Files\nodejs\npm.cmd
-    //
-    // In practically all cases the npm path contains a node_modules folder:
-    //   /usr/local/share/npm/bin/npm/node_modules
-    //   C:\Program Files\nodejs\node_modules
-    (hasNmInCurrPath ||
-    // In some bespoke cases the node_modules folder is in the parent directory.
-    hasNmInParentPath) && (
-    // Optimistically look for the default location.
-    path.basename(thePath) === constants.NPM ||
-    // Chocolatey installs npm bins in the same directory as node bins.
-    WIN32 && fs.existsSync(path.join(thePath, `${constants.NPM}.cmd`)))) {
-      return hasNmInParentPath ? path.dirname(thePath) : thePath;
-    }
-    const parent = path.dirname(thePath);
-    if (parent === thePath) {
-      return undefined;
-    }
-    thePath = parent;
-  }
-}
+
 /**
- * Converts absolute scan targets inside cwd back to cwd-relative paths before
- * glob expansion. SCA excludes passed through `additionalIgnores` are anchored
- * to cwd, so package discovery needs target globs in the same coordinate
- * system for fast-glob to apply those ignores consistently.
+ * Build a CResult error from a thrown spawn error, preserving exit code,
+ * signal, and stderr context.
  */
-function normalizeScanInputPath(pathToNormalize, cwd) {
-  if (!path.isAbsolute(pathToNormalize)) {
-    return pathToNormalize;
+function coanaSpawnErrorResult(e) {
+  const stderr = e?.stderr;
+  const stdout = e?.stdout;
+  const exitCode = e?.code;
+  const signal = e?.signal;
+  const details = [];
+  if (typeof exitCode === 'number') {
+    details.push(`exit code ${exitCode}`);
   }
-  const relativePath = path.relative(cwd, pathToNormalize);
-  const isInsideCwd = relativePath === '' || !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
-  if (!isInsideCwd) {
-    return pathToNormalize;
+  if (signal) {
+    details.push(`signal ${signal}`);
   }
-  return stripTrailingSlash(relativePath.replaceAll('\\', '/')) || '.';
-}
-async function getPackageFilesForScan(inputPaths, supportedFiles, options) {
-  const {
-    additionalIgnores,
-    config: socketConfig,
-    cwd = process.cwd()
-  } = {
-    __proto__: null,
-    ...options
+  const detailSuffix = details.length ? ` (${details.join(', ')})` : '';
+  // Coana logs some failures, e.g. unresolved Gradle dependencies, to stdout.
+  const detail = stderr || stdout || getErrorCause(e);
+  const message = typeof exitCode === 'string' ? `Failed to launch Coana${detailSuffix}: ${detail}` : `Coana command failed${detailSuffix}: ${detail}`;
+  return {
+    ok: false,
+    data: e,
+    message
   };
-
-  // Apply the supported files filter during streaming to avoid accumulating
-  // all files in memory. This is critical for large monorepos with 100k+ files
-  // where accumulating all paths before filtering causes OOM errors.
-  const filter = createSupportedFilesFilter(supportedFiles);
-  const normalizedInputPaths = inputPaths.map(p => normalizeScanInputPath(p, cwd));
-  return await globWithGitIgnore(pathsToGlobPatterns(normalizedInputPaths, cwd), {
-    additionalIgnores,
-    cwd,
-    filter,
-    socketConfig
-  });
 }
 
-function exitWithBinPathError$2(binName) {
-  logger.logger.fail(`Socket unable to locate ${binName}; ensure it is available in the PATH environment variable`);
-  // The exit code 127 indicates that the command or binary being executed
-  // could not be found.
-  // eslint-disable-next-line n/no-process-exit
-  process.exit(127);
-  // This line is never reached in production, but helps tests.
-  throw new Error('process.exit called');
-}
-let _yarnBinPath;
-function getYarnBinPath() {
-  if (_yarnBinPath === undefined) {
-    _yarnBinPath = getYarnBinPathDetails().path;
-    if (!_yarnBinPath) {
-      exitWithBinPathError$2(constants.YARN);
+/**
+ * Stream `component`'s tarball into `destDir`, checking its size and sha256 on
+ * the way. The tarball holds only regular files, so anything else is dropped.
+ */
+async function downloadComponent(component, destDir) {
+  const response = await apiFetch(component.url, {
+    headers: {
+      'User-Agent': getCliUserAgent()
     }
+  });
+  if (!response.ok || !response.body) {
+    await response.body?.cancel();
+    debug$2.debugFn('error', `Coana CLI download failed with ${response.status}`);
+    return {
+      ok: false,
+      status: response.status
+    };
   }
-  return _yarnBinPath;
-}
-let _yarnBinPathDetails;
-function getYarnBinPathDetails() {
-  if (_yarnBinPathDetails === undefined) {
-    _yarnBinPathDetails = findBinPathDetailsSync(constants.YARN);
-  }
-  return _yarnBinPathDetails;
-}
-function isYarnBinPathShadowed() {
-  return getYarnBinPathDetails().shadowed;
-}
-
-let _isYarnBerry;
-function isYarnBerry() {
-  if (_isYarnBerry === undefined) {
-    try {
-      const yarnBinPath = getYarnBinPath();
-      const result = spawn.spawnSync(yarnBinPath, [constants.FLAG_VERSION], {
-        encoding: constants.UTF8,
-        // On Windows, yarn is often a .cmd file that requires shell execution.
-        // The spawn function from @socketsecurity/registry will handle this properly
-        // when shell is true.
-        shell: constants.default.WIN32
-      });
-      if (result.status === 0 && result.stdout) {
-        const version = result.stdout;
-        // Yarn Berry starts from version 2.x
-        const majorVersion = parseInt(version.split('.')[0], 10);
-        _isYarnBerry = majorVersion >= 2;
-      } else {
-        _isYarnBerry = false;
+  const hash = require$$0.createHash('sha256');
+  let received = 0;
+  await require$$9.pipeline(require$$1$1.Readable.from(response.body), new require$$1$1.Transform({
+    transform(chunk, _encoding, callback) {
+      received += chunk.length;
+      if (received > component.size) {
+        callback(new Error(`The Coana CLI tarball is larger than the expected ${component.size} bytes`));
+        return;
       }
-    } catch {
-      _isYarnBerry = false;
-    }
+      hash.update(chunk);
+      callback(null, chunk);
+    }
+  }), vendor.uo({
+    cwd: destDir,
+    filter: (_path, entry) => 'type' in entry && (entry.type === 'Directory' || entry.type === 'File'),
+    // Run as root, tar would otherwise give the shared cache the archive's
+    // owners.
+    preserveOwner: false,
+    strict: true
+  }));
+  const sha256 = hash.digest('hex');
+  if (received !== component.size || sha256 !== component.sha256) {
+    throw new Error(`The Coana CLI tarball does not match its checksum (expected ${component.size} bytes with sha256 ${component.sha256}, got ${received} bytes with sha256 ${sha256})`);
   }
-  return _isYarnBerry;
+  return {
+    ok: true
+  };
 }
 
 /**
- * DLX execution utilities for Socket CLI.
- * Manages package execution via npx/pnpm dlx/yarn dlx commands.
- *
- * Key Functions:
- * - spawnCdxgenDlx: Execute CycloneDX generator via dlx
- * - spawnCoanaDlx: Execute Coana CLI tool via dlx
- * - spawnDlx: Execute packages using dlx-style commands
- * - spawnSynpDlx: Execute Synp converter via dlx
- *
- * Package Manager Detection:
- * - Auto-detects npm, pnpm, or yarn based on lockfiles
- * - Supports force-refresh and silent execution modes
- *
- * Integration:
- * - Works with shadow binaries for security scanning
- * - Handles version pinning and cache management
- * - Configures environment for third-party tools
+ * The directory of the Coana CLI's `cli` component for `versionSpec`, an exact
+ * version or a range, downloading it into the cache when the cache lacks it.
+ * `env` reaches the cache script, which reads `XDG_CACHE_HOME` from it.
  */
-
-const require$2 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
-const {
-  PACKAGE_LOCK_JSON,
-  PNPM_LOCK_YAML,
-  YARN_LOCK
-} = constants.default;
-/**
- * Regex to check if a version string contains range operators.
- * Matches any version with range operators: ~, ^, >, <, =, x, X, *, spaces, or ||.
- */
-const rangeOperatorsRegExp = /[~^><=xX* ]|\|\|/;
-
-/**
- * Spawns a package using dlx-style execution (npx/pnpm dlx/yarn dlx).
- * Automatically detects the appropriate package manager if not specified.
- * Uses force/update flags to ensure the latest version within the range is fetched.
- */
-async function spawnDlx(packageSpec, args, options, spawnExtra) {
-  // If version is not pinned exactly, default to force and silent for better UX.
-  const isNotPinned = rangeOperatorsRegExp.test(packageSpec.version);
-  const {
-    agent,
-    force = false,
-    silent = isNotPinned,
-    ...shadowOptions
-  } = options ?? {};
-  let finalShadowOptions = shadowOptions;
-  let pm = agent;
-
-  // Auto-detect package manager if not specified.
-  if (!pm) {
-    const pnpmLockPath = await findUp(PNPM_LOCK_YAML, {
-      onlyFiles: true
-    });
-    const yarnLockPath = pnpmLockPath ? undefined : await findUp(YARN_LOCK, {
-      onlyFiles: true
-    });
-    const npmLockPath = pnpmLockPath || yarnLockPath ? undefined : await findUp(PACKAGE_LOCK_JSON, {
-      onlyFiles: true
-    });
-    if (pnpmLockPath) {
-      pm = constants.PNPM;
-    } else if (yarnLockPath) {
-      pm = constants.YARN;
-    } else if (npmLockPath) {
-      pm = constants.NPM;
-    } else {
-      // Default to npm if no lockfile found.
-      pm = constants.NPM;
-    }
-  }
-  const packageString = `${packageSpec.name}@${packageSpec.version}`;
-
-  // Build command args based on package manager.
-  let spawnArgs;
-  if (pm === constants.PNPM) {
-    spawnArgs = [];
-    // The --silent flag must come before dlx, not after.
-    if (silent) {
-      spawnArgs.push(constants.FLAG_SILENT);
+async function getCoanaCliDir(versionSpec, org, env, spinner) {
+  try {
+    const exactVersion = vendor.semverExports.valid(versionSpec);
+    if (exactVersion) {
+      const cached = await lookup(exactVersion);
+      if (cached) {
+        return cached;
+      }
     }
-    spawnArgs.push('dlx');
-    // Never let the target project's `.pnpmfile.cjs` hooks run while we launch
-    // a third-party tool via `pnpm dlx`. In a pnpm workspace root, `pnpm dlx`
-    // loads the cwd's `.pnpmfile.cjs`, so a broken hook there (e.g. a `require`
-    // of an unresolved Git LFS pointer) crashes the launcher with a bare exit
-    // code before our tool ever starts. The dlx tool installs into an isolated
-    // store, so the project's install hooks are irrelevant to it. pnpm honors
-    // this only as a config setting, not as a `dlx` CLI flag, so it must be set
-    // via the npm_config_ env var. See: https://pnpm.io/npmrc#settings
-    const pnpmEnv = {
-      ...objects.getOwn(finalShadowOptions, 'env'),
-      npm_config_ignore_pnpmfile: 'true'
-    };
-    if (force) {
-      // Set dlx-cache-max-age to 0 minutes to bypass cache and force a fresh
-      // download. This ensures we always get the latest version within the range.
-      pnpmEnv['npm_config_dlx_cache_max_age'] = '0';
+    if (!org.ok) {
+      // getDefaultOrgSlug puts some explanations in `data`.
+      const detail = org.cause ?? (typeof org.data === 'string' ? org.data : undefined);
+      return {
+        ok: false,
+        message: constants.ERROR_UNABLE_RESOLVE_ORG,
+        cause: `Downloading the Coana CLI ${versionSpec} needs one: ${org.message}${detail ? ` (${detail})` : ''}`
+      };
     }
-    finalShadowOptions = {
-      ...finalShadowOptions,
-      env: pnpmEnv
-    };
-    spawnArgs.push(packageString, ...args);
-    const shadowPnpmBin = /*@__PURE__*/require$2(constants.default.shadowPnpmBinPath);
-    return await shadowPnpmBin(spawnArgs, finalShadowOptions, spawnExtra);
-  } else if (pm === constants.YARN && isYarnBerry()) {
-    spawnArgs = ['dlx'];
-    // Yarn dlx runs in a temporary environment by design and should always fetch fresh.
-    if (silent) {
-      spawnArgs.push(constants.FLAG_QUIET);
+    const orgSlug = org.data;
+    const artifacts = await requestArtifacts(exactVersion ?? versionSpec, orgSlug);
+    if (!artifacts.ok) {
+      return artifacts;
     }
-    spawnArgs.push(packageString, ...args);
-
-    // Use node-modules linker instead of PnP to avoid issues with packages
-    // that have undeclared dependencies (e.g. @coana-tech/cli -> @babel/types).
-    finalShadowOptions = {
-      ...finalShadowOptions,
-      env: {
-        ...objects.getOwn(finalShadowOptions, 'env'),
-        YARN_NODE_LINKER: 'node-modules'
+    if (artifacts.data.version !== exactVersion) {
+      const cached = await lookup(artifacts.data.version);
+      if (cached) {
+        return cached;
       }
-    };
-    const shadowYarnBin = /*@__PURE__*/require$2(constants.default.shadowYarnBinPath);
-    return await shadowYarnBin(spawnArgs, finalShadowOptions, spawnExtra);
-  } else {
-    // Use npm exec/npx.
-    // For consistency, we'll use npx which is more commonly used for one-off execution.
-    spawnArgs = ['--yes'];
-    if (force) {
-      // Use --force to bypass cache and get latest within range.
-      spawnArgs.push('--force');
     }
-    if (silent) {
-      spawnArgs.push(constants.FLAG_SILENT);
+    const downloading = `Downloading the Coana CLI ${artifacts.data.version}...`;
+    const spinning = spinner?.isSpinning ? spinner : undefined;
+    const previousText = spinning?.text;
+    if (spinning) {
+      spinning.setText(downloading);
+    } else {
+      logger.logger.info(downloading);
     }
-    spawnArgs.push(packageString, ...args);
-    const shadowNpxBin = /*@__PURE__*/require$2(constants.default.shadowNpxBinPath);
-    return await shadowNpxBin(spawnArgs, finalShadowOptions, spawnExtra);
+    try {
+      return await installComponent(artifacts.data, orgSlug, env);
+    } finally {
+      spinning?.setText(previousText);
+    }
+  } catch (e) {
+    return {
+      ok: false,
+      message: `Failed to get the Coana CLI ${versionSpec}`,
+      cause: getErrorCause(e)
+    };
+  }
+
+  /** The cached directory or a failure; `undefined` when the cache lacks it. */
+  async function lookup(version) {
+    const result = await runCoanaCache(['lookup', version, COMPONENT], env);
+    return result.exitCode === NOT_CACHED_EXIT_CODE ? undefined : cacheResultToCResult(result);
   }
 }
-/**
- * Cache of resolved Coana CLI script paths from the npm-install fallback,
- * keyed by version string. Lives for the lifetime of the Socket CLI process so
- * repeated invocations (e.g. socket fix --pr looping per GHSA) only install
- * once.
- */
-const installedCoanaScriptPathsByVersion = new Map();
-
-/**
- * Strip npm-injected `npm_package_*` env vars before spawning a Coana
- * subprocess. npm (and pnpm/yarn classic) populate one env var per leaf in
- * the cwd's package.json — `npm_package_dependencies_*`, `npm_package_scripts_*`,
- * etc. In big monorepos with hundreds of deps this can easily account for
- * 50KB+ of environment, pushing combined argv + env past Linux ARG_MAX
- * (~128KB) and causing `spawn` to fail with E2BIG before Coana even starts.
- *
- * Coana does not read `npm_package_*` itself, so dropping them is safe. We
- * intentionally keep `npm_config_*` (registry, cache, proxy settings sourced
- * from .npmrc), `npm_lifecycle_*`, and everything else untouched — those can
- * matter for outbound network behavior of nested `npm install` calls.
- */
-function sanitizeEnvForCoanaSubprocess(env) {
-  const out = {};
-  for (const key of Object.keys(env)) {
-    if (key.startsWith('npm_package_')) {
-      continue;
+async function installComponent(artifacts, orgSlug, env) {
+  return await withTmpDir('socket-coana-cli-', async extractDir => {
+    let current = artifacts;
+    let download = await downloadComponent(current.cli, extractDir);
+    // A 4xx means the signed URL expired or was otherwise refused.
+    if (!download.ok && download.status >= 400 && download.status < 500) {
+      // Pin the new request to the resolved version, which a range is not.
+      const renewed = await requestArtifacts(current.version, orgSlug);
+      if (!renewed.ok) {
+        return renewed;
+      }
+      current = renewed.data;
+      download = await downloadComponent(current.cli, extractDir);
+    }
+    if (!download.ok) {
+      return {
+        ok: false,
+        message: `Failed to download the Coana CLI ${current.version}`,
+        cause: `The download host responded with status ${download.status}.`
+      };
     }
-    out[key] = env[key];
+    return cacheResultToCResult(await runCoanaCache(['install', current.version, COMPONENT, current.cli.sha256, extractDir], env));
+  });
+}
+function parseCoanaArtifacts(value) {
+  const {
+    components,
+    version
+  } = value ?? {};
+  const {
+    sha256,
+    size,
+    url
+  } = components?.[COMPONENT] ?? {};
+  if (typeof version !== 'string' || !vendor.semverExports.valid(version) || typeof sha256 !== 'string' || !SHA256_REGEXP.test(sha256) || typeof size !== 'number' || !Number.isSafeInteger(size) || size <= 0 || typeof url !== 'string' ||
+  // apiFetch speaks only https.
+  !url.startsWith('https://') || !URL.canParse(url)) {
+    return undefined;
   }
-  return out;
+  return {
+    cli: {
+      sha256,
+      size,
+      url
+    },
+    version
+  };
 }
-
-/**
- * Spawn an installed Coana entry point via `node` (or directly, if it's a
- * native binary). Shared by the SOCKET_CLI_COANA_LOCAL_PATH branch and the
- * npm-install fallback.
- */
-async function spawnCoanaScriptViaNode(scriptPath, args, finalEnv, options, spawnExtra) {
-  const isBinary = !scriptPath.endsWith('.js') && !scriptPath.endsWith('.mjs');
-  const spawnArgs = isBinary ? args : [scriptPath, ...args];
-  const spawnResult = await spawn.spawn(isBinary ? scriptPath : 'node', spawnArgs, {
-    cwd: options.cwd,
-    env: sanitizeEnvForCoanaSubprocess(finalEnv),
-    stdio: options.stdio ?? spawnExtra?.['stdio'] ?? 'inherit'
+async function requestArtifacts(versionSpec, orgSlug) {
+  const result = await sendApiRequest(`orgs/${encodeURIComponent(orgSlug)}/coana-cli/artifacts`, {
+    body: {
+      components: [COMPONENT],
+      version: versionSpec
+    },
+    method: 'POST'
   });
+  if (!result.ok) {
+    return result;
+  }
+  const artifacts = parseCoanaArtifacts(result.data);
+  if (!artifacts) {
+    debug$2.debugDir('inspect', {
+      body: result.data
+    });
+    return {
+      ok: false,
+      message: 'Socket API error',
+      cause: `Unexpected response to a request for the Coana CLI ${versionSpec}`
+    };
+  }
   return {
     ok: true,
-    data: spawnResult.stdout
+    data: artifacts
   };
 }
 
 /**
- * Resolve the executable JS file inside an installed @coana-tech/cli package
- * by reading its package.json `bin` field. Returns an absolute path suitable
- * for passing to `node`.
+ * Run the vendored cache script, which prints only a directory to stdout.
+ * Throws only when Node itself cannot be spawned.
  */
-async function resolveCoanaBinFromInstallDir(installDir) {
-  const packageJsonPath = path.join(installDir, 'node_modules', '@coana-tech', 'cli', 'package.json');
-  const pkg = JSON.parse(await fs.promises.readFile(packageJsonPath, 'utf8'));
-  const {
-    bin
-  } = pkg;
-  let relativeBin;
-  if (typeof bin === 'string') {
-    relativeBin = bin;
-  } else if (bin && typeof bin === 'object') {
-    // Prefer an entry named "coana" if present; otherwise take the first.
-    relativeBin = bin['coana'] ?? Object.values(bin)[0];
-  }
-  if (!relativeBin) {
-    throw new Error(`@coana-tech/cli package.json at ${packageJsonPath} is missing a usable bin entry`);
+async function runCoanaCache(args, env) {
+  try {
+    const result = await spawn.spawn(constants.default.execPath, [path.join(constants.default.distPath, COANA_CACHE_SCRIPT), ...args], {
+      env,
+      stdio: 'pipe'
+    });
+    return {
+      exitCode: 0,
+      stderr: String(result.stderr).trim(),
+      stdout: String(result.stdout).trim()
+    };
+  } catch (e) {
+    const exitCode = e?.code;
+    if (typeof exitCode !== 'number') {
+      throw e;
+    }
+    return {
+      exitCode,
+      stderr: String(e?.stderr ?? '').trim(),
+      stdout: String(e?.stdout ?? '').trim()
+    };
   }
-  return path.resolve(path.dirname(packageJsonPath), relativeBin);
 }
 
 /**
- * Install @coana-tech/cli into a fresh temp directory via `npm install` and
- * return its executable JS path. Caches the result per version for the
- * lifetime of the process.
+ * `env` without the `npm_package_*` variables that npm, pnpm and yarn classic
+ * set for each leaf of the cwd's package.json. Coana doesn't read them, and in
+ * a large monorepo they can push argv and env past ARG_MAX, so that the spawn
+ * fails with E2BIG.
+ *
+ * The registry's `spawn` spreads `process.env` under the env it is given, so
+ * they are set to `undefined`, which Node drops.
  */
-async function installCoanaToTmpdir(version, finalEnv) {
-  const cached = installedCoanaScriptPathsByVersion.get(version);
-  if (cached) {
-    return cached;
+function withoutNpmPackageEnv(env) {
+  const out = {};
+  for (const key of Object.keys(env)) {
+    out[key] = key.startsWith('npm_package_') ? undefined : env[key];
   }
-  const installDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'socket-coana-'));
-  await spawn.spawn('npm', ['install', '--no-save', '--no-package-lock', '--no-audit', '--no-fund', '--prefix', installDir, `@coana-tech/cli@${version}`], {
-    env: sanitizeEnvForCoanaSubprocess(finalEnv),
-    stdio: 'inherit'
-  });
-  const scriptPath = await resolveCoanaBinFromInstallDir(installDir);
-  installedCoanaScriptPathsByVersion.set(version, scriptPath);
-  return scriptPath;
+  return out;
 }
 
 /**
- * Fallback path used when the dlx (npx / pnpm dlx / yarn dlx) invocation
- * fails. Installs @coana-tech/cli into a temp directory via `npm install`
- * and spawns it directly via `node`.
+ * Run the Coana CLI, downloading it into the cache that Coana and the Socket
+ * CLIs share when the cache lacks the version. Returns a CResult with Coana's
+ * stdout.
+ *
+ * If SOCKET_CLI_COANA_LOCAL_PATH environment variable is set, uses the local
+ * Coana CLI at that path instead.
  */
-async function spawnCoanaViaNpmInstall(args, version, finalEnv, options, spawnExtra) {
-  let scriptPath;
+async function spawnCoana(args, orgSlug, options) {
+  const {
+    coanaVersion,
+    cwd,
+    env: spawnEnv,
+    spinner,
+    stdio = 'inherit'
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const mixinsEnv = {
+    SOCKET_CLI_VERSION: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
+    // Forwarded to the Coana CLI so it can append our product token to its
+    // outbound axios User-Agent header.
+    SOCKET_CALLER_USER_AGENT: getCliUserAgent()
+  };
+  const defaultApiToken = getDefaultApiToken();
+  if (defaultApiToken) {
+    mixinsEnv['SOCKET_CLI_API_TOKEN'] = defaultApiToken;
+  }
+  const org = orgSlug ? {
+    ok: true,
+    data: orgSlug
+  } : await getDefaultOrgSlug();
+  if (org.ok) {
+    mixinsEnv['SOCKET_ORG_SLUG'] = org.data;
+  }
+  const proxyUrl = getDefaultProxyUrl();
+  if (proxyUrl) {
+    mixinsEnv['SOCKET_CLI_API_PROXY'] = proxyUrl;
+  }
+  const finalEnv = withoutNpmPackageEnv({
+    ...process.env,
+    ...constants.default.processEnv,
+    ...mixinsEnv,
+    ...spawnEnv
+  });
+  let scriptPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
+  if (!scriptPath) {
+    const coanaDirCResult = await getCoanaCliDir(coanaVersion || constants.COANA_CLI_VERSION, org, finalEnv, spinner);
+    if (!coanaDirCResult.ok) {
+      return coanaDirCResult;
+    }
+    scriptPath = path.join(coanaDirCResult.data, 'cli-wrapper.mjs');
+  }
+
+  // A local path may name a native binary.
+  const isBinary = !scriptPath.endsWith('.js') && !scriptPath.endsWith('.mjs');
   try {
-    scriptPath = await installCoanaToTmpdir(version, finalEnv);
-  } catch (e) {
-    const stderr = e?.stderr;
-    const cause = getErrorCause(e);
+    const spawnResult = await spawn.spawn(isBinary ? scriptPath : constants.default.execPath, isBinary ? args : [scriptPath, ...args], {
+      cwd,
+      env: finalEnv,
+      spinner,
+      stdio
+    });
     return {
-      ok: false,
-      data: e,
-      message: `npm install fallback failed: ${stderr || cause}`
+      ok: true,
+      data: String(spawnResult.stdout)
     };
-  }
-  try {
-    return await spawnCoanaScriptViaNode(scriptPath, args, finalEnv, options, spawnExtra);
   } catch (e) {
-    return buildDlxErrorResult(e);
+    return coanaSpawnErrorResult(e);
   }
 }
+
+/**
+ * Coana integration utilities for Socket CLI.
+ * Manages reachability analysis via Coana tech CLI.
+ *
+ * Key Functions:
+ * - compressSocketFactsForUpload: Brotli-compress any .socket.facts.json
+ *   entries in scanPaths just before upload, returning swapped paths plus a
+ *   cleanup callback. Coana keeps writing plain JSON; the on-the-wire form
+ *   to depscan is brotli (api-v0 decodes at the multipart boundary).
+ * - extractReachabilityErrors: Extract per-component reachability errors
+ * - extractTier1ReachabilityScanId: Extract scan ID from socket facts file
+ * - getFullWorkspacePath: Label a build-root/workspace pair the way Coana does
+ * - snapshotSocketFacts: Copy aside the socket facts files Coana overwrites
+ *   in place, so a failed analysis can be rolled back
+ *
+ * Integration:
+ * - Works with @coana-tech/cli for reachability analysis
+ * - Processes socket facts JSON files
+ * - Extracts full application reachability scan identifiers
+ */
+
+const {
+  DOT_SOCKET_DOT_FACTS_JSON
+} = constants.default;
 /**
- * Resolve how the Coana engine should be launched.
+ * For each `.socket.facts.json` in `scanPaths`, stream-brotli-compress a
+ * sibling `.socket.facts.json.br` next to the original file and swap its
+ * path in. Other paths pass through unchanged. Missing files also pass
+ * through unchanged (the upload will fail downstream with the same error
+ * it would have).
+ *
+ * Streaming + worker-thread compression keeps the event loop responsive:
+ * default brotli quality (11) on a 60+MB facts file takes multiple seconds
+ * of CPU, which would otherwise freeze the spinner / signal handlers /
+ * any concurrent work.
+ *
+ * The `.br` lives next to the source rather than under the OS temp dir
+ * because depscan's multipart ingest (`addStreamEntry`) rejects entries
+ * whose names contain `..` traversal segments. The SDK computes the
+ * multipart entry name via `path.relative(cwd, brPath)`, so an OS-tmpdir
+ * temp path turns into `../../../var/folders/...` and gets dropped as
+ * `unmatchedFiles`. Sibling-write keeps the relative path inside cwd, and
+ * keeps the directory shape symmetric with the plain `.socket.facts.json`
+ * upload (depscan strips only the `.br` suffix at ingest, so
+ * `<dir>/.socket.facts.json.br` and `<dir>/.socket.facts.json` resolve to
+ * the same storage path).
  *
- * SOCKET_CLI_COANA_LAUNCHER wins when set:
- * - 'auto' (default): try dlx first, fall back to `npm install` + `node` on
- *   launcher-level failures.
- * - 'npm-install': skip dlx entirely; always `npm install` + `node`.
- * - 'npx': dlx only; never fall back.
- * Unrecognized values warn and behave as 'auto'.
+ * Concurrent scans against the same source directory are already racy on
+ * `.socket.facts.json` itself (coana writes to a single path), so the
+ * sibling `.br` doesn't introduce a new race.
  *
- * The legacy boolean variables SOCKET_CLI_COANA_FORCE_NPM_INSTALL
- * ('npm-install') and SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK ('npx') are still
- * honored when the new variable is unset, but are intentionally undocumented.
+ * Caller MUST `await cleanup()` (typically in a `finally` block) once the
+ * upload completes — successful or not — to remove the sibling files.
  */
-function getCoanaLauncherMode() {
-  const rawMode = process.env['SOCKET_CLI_COANA_LAUNCHER'];
-  const mode = rawMode?.trim().toLowerCase();
-  if (mode) {
-    if (mode === 'auto' || mode === 'npm-install' || mode === 'npx') {
-      return mode;
+async function compressSocketFactsForUpload(scanPaths) {
+  const brPaths = [];
+  const cleanup = async () => {
+    const targets = brPaths.splice(0);
+    // `recursive: true` defends against the (defensive) case where a sibling
+    // path was somehow created as a directory — `rm` would otherwise throw
+    // on the first such entry and skip the rest. `force: true` no-ops on
+    // missing paths so the function stays idempotent.
+    await Promise.all(targets.map(t => fs$1.rm(t, {
+      recursive: true,
+      force: true
+    })));
+  };
+  // Use `allSettled` (not `all`) so a failure in one entry doesn't leak the
+  // others' in-flight pipelines past our `catch`. If we used `all`, the
+  // first rejection would bubble out while sibling pipelines were still
+  // writing bytes — `cleanup()` would race with those writes and could
+  // remove a `.br` only to have it re-created after we returned.
+  const results = await Promise.allSettled(scanPaths.map(async p => {
+    // depscan decodes only the bare `.socket.facts.json.br`; a named facts
+    // file is uploaded as plain JSON.
+    if (path.basename(p) !== DOT_SOCKET_DOT_FACTS_JSON) {
+      return p;
+    }
+    if (!u.existsSync(p)) {
+      return p;
     }
-    logger.logger.warn(`Ignoring unrecognized SOCKET_CLI_COANA_LAUNCHER value "${rawMode}"; expected "auto", "npm-install", or "npx".`);
-    return 'auto';
+    const brPath = `${p}.br`;
+    // Track the sibling path BEFORE the pipeline starts so a
+    // partially-written `.br` is removed even if the pipeline rejects.
+    // `rm({ force: true })` no-ops on missing files, so tracking before
+    // creation is safe.
+    brPaths.push(brPath);
+    await require$$9.pipeline(u.createReadStream(p), require$$11.createBrotliCompress(), u.createWriteStream(brPath));
+    return brPath;
+  }));
+  const failure = results.find(r => r.status === 'rejected');
+  if (failure) {
+    // All pipelines have settled, so cleanup() can safely remove every
+    // `.br` we tracked (succeeded or partial) without racing live writes.
+    await cleanup();
+    throw failure.reason;
+  }
+  const paths = results.map(r => r.value);
+  return {
+    paths,
+    cleanup
+  };
+}
+
+// `.socket.facts.json` or a named `<entry>.socket.facts.json`, matching
+// depscan's case-insensitive `*.socket.facts.json`.
+function isSocketFactsFile(filepath) {
+  return path.basename(filepath).toLowerCase().endsWith(DOT_SOCKET_DOT_FACTS_JSON);
+}
+
+// A Coana reachability report, never input to a new analysis: the bare
+// `.socket.facts.json` (Coana's default name; producers name theirs after the
+// build) or the path this run tells Coana to write to.
+function isReachabilityReportPath(filepath, options) {
+  const {
+    cwd,
+    outputPath
+  } = {
+    __proto__: null,
+    ...options
+  };
+  return path.basename(filepath).toLowerCase() === DOT_SOCKET_DOT_FACTS_JSON || path.resolve(cwd, filepath) === path.resolve(cwd, outputPath);
+}
+function extractReachabilityErrors(socketFactsFile) {
+  const json = fs.readJsonSync(socketFactsFile, {
+    throws: false
+  });
+  if (!json || !Array.isArray(json.components)) {
+    return [];
   }
-  if (process.env['SOCKET_CLI_COANA_FORCE_NPM_INSTALL']) {
-    return 'npm-install';
+  const errors = [];
+  for (const component of json.components) {
+    if (!Array.isArray(component.reachability)) {
+      continue;
+    }
+    for (const ghsaEntry of component.reachability) {
+      if (!Array.isArray(ghsaEntry.reachability)) {
+        continue;
+      }
+      for (const entry of ghsaEntry.reachability) {
+        if (entry.type === 'error') {
+          errors.push({
+            componentName: String(component.name ?? ''),
+            componentVersion: String(component.version ?? ''),
+            ghsaId: String(ghsaEntry.ghsa_id ?? ''),
+            subprojectPath: String(entry.subprojectPath ?? ''),
+            workspacePath: String(entry.workspacePath ?? '')
+          });
+        }
+      }
+    }
   }
-  if (process.env['SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK']) {
-    return 'npx';
+  return errors;
+}
+function extractTier1ReachabilityScanId(socketFactsFile) {
+  const json = fs.readJsonSync(socketFactsFile, {
+    throws: false
+  });
+  const tier1ReachabilityScanId = String(json?.['tier1ReachabilityScanId'] ?? '').trim();
+  return tier1ReachabilityScanId.length > 0 ? tier1ReachabilityScanId : undefined;
+}
+
+// Label a reachability location the way Coana's own `getFullWorkspacePath`
+// does. Since @coana-tech/cli v15.10.8 `subprojectPath` names the build root
+// and `workspacePath` the workspace within it, so a single-root repo reports
+// `.` as its subproject and must be labelled by its workspace alone.
+function getFullWorkspacePath(subprojectPath, workspacePath) {
+  const subproject = subprojectPath && subprojectPath !== '.' ? subprojectPath : '';
+  const workspace = workspacePath && workspacePath !== '.' ? workspacePath : '';
+  if (subproject && workspace) {
+    return `${subproject}/${workspace}`;
   }
-  return 'auto';
+  return subproject || workspace || '.';
 }
-
-/**
- * Helper to spawn coana with dlx.
- * Automatically uses force and silent when version is not pinned exactly.
- * Returns a CResult with stdout extraction for backward compatibility.
- *
- * If SOCKET_CLI_COANA_LOCAL_PATH environment variable is set, uses the local
- * Coana CLI at that path instead of downloading from npm.
- *
- * If the dlx path fails (e.g. broken `npx` on the host), falls back to
- * `npm install`-ing @coana-tech/cli into a temp directory and invoking it
- * directly via `node`. The launcher strategy can be overridden with
- * SOCKET_CLI_COANA_LAUNCHER: 'auto' (the default) tries dlx with the
- * npm-install fallback, 'npm-install' skips dlx entirely, and 'npx' never
- * falls back.
- */
-async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
+// Coana overwrites `.socket.facts.json` in place, so an analysis that fails
+// part way leaves partial output where the scan's inputs used to be.
+async function snapshotSocketFacts(scanPaths, options) {
   const {
-    coanaVersion,
-    env: spawnEnv,
-    ipc,
-    ...dlxOptions
+    cwd,
+    outputPath,
+    tmpDir
   } = {
     __proto__: null,
     ...options
   };
-  const mixinsEnv = {
-    SOCKET_CLI_VERSION: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
-    // Forwarded to the Coana CLI so it can append our product token to its
-    // outbound axios User-Agent header.
-    SOCKET_CALLER_USER_AGENT: getCliUserAgent()
-  };
-  const defaultApiToken = getDefaultApiToken();
-  if (defaultApiToken) {
-    mixinsEnv['SOCKET_CLI_API_TOKEN'] = defaultApiToken;
-  }
-  if (orgSlug) {
-    mixinsEnv['SOCKET_ORG_SLUG'] = orgSlug;
-  } else {
-    const orgSlugCResult = await getDefaultOrgSlug();
-    if (orgSlugCResult.ok) {
-      mixinsEnv['SOCKET_ORG_SLUG'] = orgSlugCResult.data;
+  const sources = new Set(scanPaths.filter(p => path.basename(p) === DOT_SOCKET_DOT_FACTS_JSON).map(p => path.resolve(cwd, p)));
+  sources.add(path.resolve(cwd, outputPath));
+  const snapshotDir = path.join(tmpDir, 'socket-facts-snapshot');
+  await fs$1.mkdir(snapshotDir, {
+    recursive: true
+  });
+  const captured = [];
+  const created = [];
+  await Promise.all(Array.from(sources, async (source, index) => {
+    if (!u.existsSync(source)) {
+      created.push(source);
+      return;
     }
-  }
-  const proxyUrl = getDefaultProxyUrl();
-  if (proxyUrl) {
-    mixinsEnv['SOCKET_CLI_API_PROXY'] = proxyUrl;
-  }
-  const finalEnv = {
-    ...process.env,
-    ...constants.default.processEnv,
-    ...mixinsEnv,
-    ...spawnEnv
-  };
-  const resolvedVersion = coanaVersion || constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION;
-
-  // `shadowNpmBase` (the dlx launcher) configures the child's stdio from its
-  // `options` arg, NOT from the registry-spawn `extra` arg — the latter only
-  // attaches metadata to the result. Callers that requested streaming via
-  // `spawnExtra` (the 4th arg), e.g. `{ stdio: 'inherit' }` from
-  // `socket manifest gradle`, were therefore silently ignored on this path:
-  // Coana ran piped and its output — including the real failure reason — never
-  // reached the user, leaving only an unhelpful "command failed". Resolve the
-  // requested stdio from either argument and honor it on every launch path:
-  // dlx, local-path, and npm-install (e.g. `socket fix --silence` requests
-  // `stdio: 'pipe'` via options).
-  const requestedStdio = spawnExtra?.['stdio'] ?? objects.getOwn(dlxOptions, 'stdio');
-  const localCoanaPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
-  // Use local Coana CLI if path is provided.
-  if (localCoanaPath) {
+    const backup = path.join(snapshotDir, `${index}.json`);
     try {
-      return await spawnCoanaScriptViaNode(localCoanaPath, args, finalEnv, {
-        cwd: dlxOptions.cwd,
-        stdio: requestedStdio
-      }, spawnExtra);
+      await fs$1.copyFile(source, backup);
+      captured.push({
+        backup,
+        source
+      });
     } catch (e) {
-      return buildDlxErrorResult(e);
+      // A path we cannot copy is left out of both lists so restore() leaves
+      // it untouched rather than deleting a file it never captured.
+      debug$2.debugFn('warn', `[socket-facts] snapshot failed: ${source}`);
+      debug$2.debugDir('error', e);
     }
-  }
-  const launcherMode = getCoanaLauncherMode();
-
-  // Allow forcing the npm-install path for debugging or for environments
-  // where dlx is known-broken.
-  if (launcherMode === 'npm-install') {
-    return await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
-      cwd: dlxOptions.cwd,
-      stdio: requestedStdio
-    }, spawnExtra);
-  }
-  try {
-    // Use npm/dlx version.
-    const result = await spawnDlx({
-      name: '@coana-tech/cli',
-      version: resolvedVersion
-    }, args, {
-      force: true,
-      // Do NOT silence the launcher. `--silent` (npm loglevel silent) hides
-      // npm's own download/registry/launch errors, so when npx/pnpm-dlx fails
-      // to fetch @coana-tech/cli the user is left with a bare exit code and no
-      // cause. shadowNpmBase defaults to `--loglevel error`, which keeps real
-      // launcher errors visible while staying quiet on success.
-      silent: false,
-      ...dlxOptions,
-      ...(requestedStdio === undefined ? {} : {
-        stdio: requestedStdio
-      }),
-      env: finalEnv,
-      ipc: {
-        [constants.default.SOCKET_CLI_SHADOW_ACCEPT_RISKS]: true,
-        [constants.default.SOCKET_CLI_SHADOW_API_TOKEN]: constants.default.SOCKET_PUBLIC_API_TOKEN,
-        [constants.default.SOCKET_CLI_SHADOW_SILENT]: true,
-        ...ipc
-      }
-    }, spawnExtra);
-    const output = await result.spawnPromise;
-    return {
-      ok: true,
-      data: output.stdout
-    };
-  } catch (e) {
-    const dlxError = buildDlxErrorResult(e);
-    if (launcherMode === 'npx') {
-      return dlxError;
-    }
-
-    // Only retry via `npm install` when the failure looks like the launcher
-    // never got Coana running. A real Coana process that booted and exited
-    // with an error would just hit the same failure on retry.
-    if (!shouldFallbackOnDlxError(e)) {
-      return dlxError;
-    }
-    logger.logger.warn('Coana dlx invocation failed; retrying via `npm install` + `node`.');
-    const fallbackResult = await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
-      cwd: dlxOptions.cwd,
-      stdio: requestedStdio
-    }, spawnExtra);
-    if (fallbackResult.ok) {
-      return fallbackResult;
-    }
-    // Surface both errors so support has full context.
-    return {
-      ok: false,
-      data: e,
-      message: `${dlxError.message}. npm-install fallback also failed: ${fallbackResult.message}`
-    };
-  }
-}
-
-/**
- * Decide whether a thrown dlx error should trigger the npm-install fallback.
- *
- * The goal is to retry only when the dlx launcher (npx / pnpm dlx / yarn dlx)
- * failed before Coana itself ran. If Coana actually booted, any subsequent
- * non-zero exit is a real Coana failure and retrying would hit the same one.
- *
- * Signals we use, in priority order:
- * 1. Captured stderr containing Coana's startup banner — definitive proof
- *    Coana ran, so do NOT retry. Only available when the caller passed
- *    `stdio: 'pipe'` (or the spawn defaulted to it).
- * 2. Spawn-level errors (`e.code` is a string like 'ENOENT'): the binary
- *    wasn't found / couldn't start — retry.
- * 3. Signal kills (`e.signal` set, or numeric `e.code >= 128`): conventionally
- *    not a clean exit; the customer-observed exit code 249 falls here. Retry.
- * 4. Small integer exit codes with no banner in captured stderr: ambiguous,
- *    but Coana's own exit codes are small integers, so default to NOT retrying
- *    rather than blindly re-running Coana.
- */
-function shouldFallbackOnDlxError(e) {
-  // Coana clearly ran (its banner is in the captured stderr) → any later
-  // non-zero exit is a real Coana failure and retrying would hit it again.
-  if (coanaBannerSeen(e)) {
-    return false;
-  }
-  return dlxLauncherFailedBeforeCoana(e);
-}
-
-/**
- * Heuristic: did the dlx launcher (npx / pnpm dlx / yarn dlx) fail BEFORE the
- * Coana process itself started? True for spawn-level errors (a string `code`
- * like ENOENT), signal kills, and exit codes >= 128 (conventionally
- * signal-derived) — all cases where the launcher, not Coana, is the culprit
- * (e.g. npx missing from PATH, or @coana-tech/cli failing to download). A small
- * integer exit code is deliberately NOT treated as a launch failure: Coana's
- * own exit codes are small integers too, so it is genuinely ambiguous.
- *
- * Caveat: a launcher that fails to download the package can also exit with a
- * small integer (npm/npx often exit 1), which lands in the ambiguous bucket.
- * We cannot disambiguate those from a real Coana exit without inspecting the
- * launcher's output, so the npm-install fallback does not fire for them.
- */
-function dlxLauncherFailedBeforeCoana(e) {
-  const code = e?.code;
-  // Spawn-level failure (e.g. ENOENT when npx is missing from PATH).
-  if (typeof code === 'string') {
-    return true;
-  }
-  // Killed by signal — almost never a clean Coana exit.
-  if (e?.signal) {
-    return true;
-  }
-  // Exit codes >= 128 are conventionally signal-derived, and the observed
-  // npx-launcher failures in the wild fall into this range (e.g. 249, 254).
-  return typeof code === 'number' && code >= 128;
-}
-
-/**
- * Definitive proof Coana actually booted: its startup banner appears in the
- * captured stderr. Only available when the launcher's output was piped
- * (captured); with inherited stdio there is nothing to inspect, so this
- * returns false (the failure is then classified by exit code / signal alone).
- */
-function coanaBannerSeen(e) {
-  const capturedStderr = String(e?.stderr ?? '');
-  return !!capturedStderr && /Coana CLI version/i.test(capturedStderr);
-}
-
-/**
- * Build a CResult error from a thrown spawn error, preserving exit code,
- * signal, and stderr context.
- */
-function buildDlxErrorResult(e) {
-  const stderr = e?.stderr;
-  const stdout = e?.stdout;
-  const exitCode = e?.code;
-  const signal = e?.signal;
-  const cause = getErrorCause(e);
-  const details = [];
-  if (typeof exitCode === 'number') {
-    details.push(`exit code ${exitCode}`);
-  }
-  if (signal) {
-    details.push(`signal ${signal}`);
-  }
-  const detailSuffix = details.length ? ` (${details.join(', ')})` : '';
-  // Prefer captured stderr, then stdout, then the generic spawn error. Coana
-  // logs some failures (e.g. unresolved Gradle dependencies) to stdout, so
-  // without the stdout fallback a piped failure collapsed to an unhelpful
-  // "command failed" even when the real reason was captured.
-  const detail = stderr || stdout || cause;
-  // Be honest about WHERE the failure happened. On the dlx path the spawned
-  // process is the package-manager launcher (npx / pnpm dlx / yarn dlx), which
-  // downloads @coana-tech/cli and only then runs it — so a failure may be the
-  // launcher dying before Coana ever started, not Coana itself. We can only be
-  // CERTAIN of that for a spawn-level error (a string `code` like ENOENT: the
-  // launcher binary could not start, so Coana provably never ran). A non-zero
-  // exit or signal is genuinely ambiguous — Coana may have started, streamed
-  // output, and then died (e.g. OOM), or the launcher may have failed to fetch
-  // the package — and with inherited stdio there is no captured output to tell
-  // them apart, so we must not assert either way.
-  let message;
-  if (coanaBannerSeen(e)) {
-    message = `Coana command failed${detailSuffix}: ${detail}`;
-  } else if (typeof e?.code === 'string') {
-    message = `Failed to launch Coana via the package manager${detailSuffix} — the npx/pnpm-dlx/yarn-dlx launcher could not start (e.g. it is missing from PATH): ${detail}`;
-  } else {
-    message = `Coana failed to run via the package manager${detailSuffix}: ${detail}`;
-  }
+  }));
   return {
-    ok: false,
-    data: e,
-    message
+    async restore() {
+      await Promise.all([...captured.map(async ({
+        backup,
+        source
+      }) => {
+        try {
+          await fs$1.copyFile(backup, source);
+        } catch (e) {
+          debug$2.debugFn('warn', `[socket-facts] restore failed: ${source}`);
+          debug$2.debugDir('error', e);
+        }
+      }), ...created.map(source => fs$1.rm(source, {
+        force: true
+      }).catch(() => {}))]);
+    }
   };
 }
 
-/**
- * Helper to spawn cdxgen with dlx.
- */
-async function spawnCdxgenDlx(args, options, spawnExtra) {
-  return await spawnDlx({
-    name: '@cyclonedx/cdxgen',
-    version: constants.default.ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION
-  }, args, {
-    force: false,
-    silent: true,
-    ...options
-  }, spawnExtra);
-}
-
-/**
- * Helper to spawn synp with dlx.
- */
-async function spawnSynpDlx(args, options, spawnExtra) {
-  return await spawnDlx({
-    name: 'synp',
-    version: `${constants.default.ENV.INLINED_SOCKET_CLI_SYNP_VERSION}`
-  }, args, {
-    force: false,
-    silent: true,
-    ...options
-  }, spawnExtra);
-}
-
 function getEnterpriseOrgs(orgs) {
   return orgs.filter(o => o.plan.includes('enterprise'));
 }
@@ -6244,7 +5853,7 @@ function readSocketJsonCascade(dir, boundaryDir, rootSockJson) {
   // increasing precedence and the nearest-to-dir file wins last.
   const ancestorsFarToNear = [];
   while (current !== boundary) {
-    if (fs.existsSync(path.join(current, constants.SOCKET_JSON))) {
+    if (u.existsSync(path.join(current, constants.SOCKET_JSON))) {
       const jsonCResult = readSocketJsonSync(current, true);
       if (jsonCResult.ok) {
         ancestorsFarToNear.unshift(jsonCResult.data);
@@ -6269,7 +5878,7 @@ function getDefaultSocketJson() {
 }
 function readSocketJsonSync(cwd, defaultOnError = false) {
   const sockJsonPath = path.join(cwd, constants.SOCKET_JSON);
-  if (!fs.existsSync(sockJsonPath)) {
+  if (!u.existsSync(sockJsonPath)) {
     debug$2.debugFn('notice', `miss: ${constants.SOCKET_JSON} not found at ${cwd}`);
     return {
       ok: true,
@@ -6278,7 +5887,7 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
   }
   let jsonContent = null;
   try {
-    jsonContent = fs.readFileSync(sockJsonPath, 'utf8');
+    jsonContent = u.readFileSync(sockJsonPath, 'utf8');
   } catch (e) {
     if (defaultOnError) {
       logger.logger.warn(`Failed to read ${constants.SOCKET_JSON}, using default`);
@@ -6335,28 +5944,146 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
     data: jsonObj
   };
 }
-async function writeSocketJson(cwd, sockJson) {
-  let jsonContent = '';
-  try {
-    jsonContent = JSON.stringify(sockJson, null, 2);
-  } catch (e) {
-    debug$2.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
-    debug$2.debugDir('inspect', {
-      sockJson
-    });
-    debug$2.debugDir('error', e);
-    return {
-      ok: false,
-      message: 'Failed to serialize to JSON',
-      cause: `There was an unexpected problem converting the ${constants.SOCKET_JSON} object to a JSON string. Unable to store it.`
-    };
+async function writeSocketJson(cwd, sockJson) {
+  let jsonContent = '';
+  try {
+    jsonContent = JSON.stringify(sockJson, null, 2);
+  } catch (e) {
+    debug$2.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
+    debug$2.debugDir('inspect', {
+      sockJson
+    });
+    debug$2.debugDir('error', e);
+    return {
+      ok: false,
+      message: 'Failed to serialize to JSON',
+      cause: `There was an unexpected problem converting the ${constants.SOCKET_JSON} object to a JSON string. Unable to store it.`
+    };
+  }
+  const filepath = path.join(cwd, constants.SOCKET_JSON);
+  await u.promises.writeFile(filepath, `${jsonContent}\n`, 'utf8');
+  return {
+    ok: true,
+    data: undefined
+  };
+}
+
+function findBinPathDetailsSync(binName) {
+  const rawBinPaths = bin.whichBinSync(binName, {
+    all: true,
+    nothrow: true
+  }) ?? [];
+  // whichBinSync may return a string when only one result is found, even with all: true.
+  // This handles both the current published version and future versions.
+  const binPaths = Array.isArray(rawBinPaths) ? rawBinPaths : typeof rawBinPaths === 'string' ? [rawBinPaths] : [];
+  const {
+    shadowBinPath
+  } = constants.default;
+  let shadowIndex = -1;
+  let theBinPath;
+  for (let i = 0, {
+      length
+    } = binPaths; i < length; i += 1) {
+    const binPath = binPaths[i];
+    // Skip our bin directory if it's in the front.
+    if (path.dirname(binPath) === shadowBinPath) {
+      shadowIndex = i;
+    } else {
+      theBinPath = bin.resolveBinPathSync(binPath);
+      break;
+    }
+  }
+  return {
+    name: binName,
+    path: theBinPath,
+    shadowed: shadowIndex !== -1
+  };
+}
+function findNpmDirPathSync(npmBinPath) {
+  const {
+    WIN32
+  } = constants.default;
+  let thePath = npmBinPath;
+  while (true) {
+    const libNmNpmPath = path.join(thePath, `lib/${constants.NODE_MODULES}/${constants.NPM}`);
+    // mise, which uses opaque binaries, puts its npm bin in a path like:
+    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/bin/npm.
+    // HOWEVER, the location of the npm install is:
+    //   /Users/SomeUsername/.local/share/mise/installs/node/vX.X.X/lib/node_modules/npm.
+    if (
+    // Use existsSync here because statsSync, even with { throwIfNoEntry: false },
+    // will throw an ENOTDIR error for paths like ./a-file-that-exists/a-directory-that-does-not.
+    // See https://github.com/nodejs/node/issues/56993.
+    fs.isDirSync(libNmNpmPath)) {
+      thePath = libNmNpmPath;
+    }
+    const hasNmInCurrPath = fs.isDirSync(path.join(thePath, constants.NODE_MODULES));
+    const hasNmInParentPath = !hasNmInCurrPath && fs.isDirSync(path.join(thePath, `../${constants.NODE_MODULES}`));
+    if (
+    // npm bin paths may look like:
+    //   /usr/local/share/npm/bin/npm
+    //   /Users/SomeUsername/.nvm/versions/node/vX.X.X/bin/npm
+    //   C:\Users\SomeUsername\AppData\Roaming\npm\bin\npm.cmd
+    // OR
+    //   C:\Program Files\nodejs\npm.cmd
+    //
+    // In practically all cases the npm path contains a node_modules folder:
+    //   /usr/local/share/npm/bin/npm/node_modules
+    //   C:\Program Files\nodejs\node_modules
+    (hasNmInCurrPath ||
+    // In some bespoke cases the node_modules folder is in the parent directory.
+    hasNmInParentPath) && (
+    // Optimistically look for the default location.
+    path.basename(thePath) === constants.NPM ||
+    // Chocolatey installs npm bins in the same directory as node bins.
+    WIN32 && u.existsSync(path.join(thePath, `${constants.NPM}.cmd`)))) {
+      return hasNmInParentPath ? path.dirname(thePath) : thePath;
+    }
+    const parent = path.dirname(thePath);
+    if (parent === thePath) {
+      return undefined;
+    }
+    thePath = parent;
+  }
+}
+/**
+ * Converts absolute scan targets inside cwd back to cwd-relative paths before
+ * glob expansion. SCA excludes passed through `additionalIgnores` are anchored
+ * to cwd, so package discovery needs target globs in the same coordinate
+ * system for fast-glob to apply those ignores consistently.
+ */
+function normalizeScanInputPath(pathToNormalize, cwd) {
+  if (!path.isAbsolute(pathToNormalize)) {
+    return pathToNormalize;
   }
-  const filepath = path.join(cwd, constants.SOCKET_JSON);
-  await fs.promises.writeFile(filepath, `${jsonContent}\n`, 'utf8');
-  return {
-    ok: true,
-    data: undefined
+  const relativePath = path.relative(cwd, pathToNormalize);
+  const isInsideCwd = relativePath === '' || !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+  if (!isInsideCwd) {
+    return pathToNormalize;
+  }
+  return stripTrailingSlash(relativePath.replaceAll('\\', '/')) || '.';
+}
+async function getPackageFilesForScan(inputPaths, supportedFiles, options) {
+  const {
+    additionalIgnores,
+    config: socketConfig,
+    cwd = process.cwd()
+  } = {
+    __proto__: null,
+    ...options
   };
+
+  // Apply the supported files filter during streaming to avoid accumulating
+  // all files in memory. This is critical for large monorepos with 100k+ files
+  // where accumulating all paths before filtering causes OOM errors.
+  const filter = createSupportedFilesFilter(supportedFiles);
+  const normalizedInputPaths = inputPaths.map(p => normalizeScanInputPath(p, cwd));
+  return await globWithGitIgnore(pathsToGlobPatterns(normalizedInputPaths, cwd), {
+    additionalIgnores,
+    cwd,
+    filter,
+    socketConfig
+  });
 }
 
 /**
@@ -6389,11 +6116,11 @@ async function readCache(key,
 // 5 minute in milliseconds time to live (TTL).
 ttlMs = 5 * 60 * 1000) {
   const cacheJsonPath = path.join(constants.default.githubCachePath, `${key}.json`);
-  const stat = fs$1.safeStatsSync(cacheJsonPath);
+  const stat = fs.safeStatsSync(cacheJsonPath);
   if (stat) {
     const isExpired = Date.now() - stat.mtimeMs > ttlMs;
     if (!isExpired) {
-      return await fs$1.readJson(cacheJsonPath);
+      return await fs.readJson(cacheJsonPath);
     }
   }
   return undefined;
@@ -6403,12 +6130,12 @@ async function writeCache(key, data) {
     githubCachePath
   } = constants.default;
   const cacheJsonPath = path.join(githubCachePath, `${key}.json`);
-  if (!fs.existsSync(githubCachePath)) {
-    await fs.promises.mkdir(githubCachePath, {
+  if (!u.existsSync(githubCachePath)) {
+    await u.promises.mkdir(githubCachePath, {
       recursive: true
     });
   }
-  await fs$1.writeJson(cacheJsonPath, data);
+  await fs.writeJson(cacheJsonPath, data);
 }
 async function cacheFetch(key, fetcher, ttlMs) {
   // Optionally disable cache.
@@ -6920,7 +6647,7 @@ const COMPLETION_CMD_PREFIX = 'complete -F _socket_completion';
 function getCompletionSourcingCommand() {
   // Note: this is exported to distPath in .config/rollup.dist.config.mjs
   const completionScriptExportPath = path.join(constants.default.distPath, 'socket-completion.bash');
-  if (!fs.existsSync(completionScriptExportPath)) {
+  if (!u.existsSync(completionScriptExportPath)) {
     return {
       ok: false,
       message: 'Tab Completion script not found',
@@ -6973,6 +6700,210 @@ fi
   };
 }
 
+function exitWithBinPathError$2(binName) {
+  logger.logger.fail(`Socket unable to locate ${binName}; ensure it is available in the PATH environment variable`);
+  // The exit code 127 indicates that the command or binary being executed
+  // could not be found.
+  // eslint-disable-next-line n/no-process-exit
+  process.exit(127);
+  // This line is never reached in production, but helps tests.
+  throw new Error('process.exit called');
+}
+let _yarnBinPath;
+function getYarnBinPath() {
+  if (_yarnBinPath === undefined) {
+    _yarnBinPath = getYarnBinPathDetails().path;
+    if (!_yarnBinPath) {
+      exitWithBinPathError$2(constants.YARN);
+    }
+  }
+  return _yarnBinPath;
+}
+let _yarnBinPathDetails;
+function getYarnBinPathDetails() {
+  if (_yarnBinPathDetails === undefined) {
+    _yarnBinPathDetails = findBinPathDetailsSync(constants.YARN);
+  }
+  return _yarnBinPathDetails;
+}
+function isYarnBinPathShadowed() {
+  return getYarnBinPathDetails().shadowed;
+}
+
+let _isYarnBerry;
+function isYarnBerry() {
+  if (_isYarnBerry === undefined) {
+    try {
+      const yarnBinPath = getYarnBinPath();
+      const result = spawn.spawnSync(yarnBinPath, [constants.FLAG_VERSION], {
+        encoding: constants.UTF8,
+        // On Windows, yarn is often a .cmd file that requires shell execution.
+        // The spawn function from @socketsecurity/registry will handle this properly
+        // when shell is true.
+        shell: constants.default.WIN32
+      });
+      if (result.status === 0 && result.stdout) {
+        const version = result.stdout;
+        // Yarn Berry starts from version 2.x
+        const majorVersion = parseInt(version.split('.')[0], 10);
+        _isYarnBerry = majorVersion >= 2;
+      } else {
+        _isYarnBerry = false;
+      }
+    } catch {
+      _isYarnBerry = false;
+    }
+  }
+  return _isYarnBerry;
+}
+
+/**
+ * DLX execution utilities for Socket CLI.
+ * Manages package execution via npx/pnpm dlx/yarn dlx commands.
+ *
+ * Key Functions:
+ * - spawnCdxgenDlx: Execute CycloneDX generator via dlx
+ * - spawnDlx: Execute packages using dlx-style commands
+ * - spawnSynpDlx: Execute Synp converter via dlx
+ *
+ * Package Manager Detection:
+ * - Auto-detects npm, pnpm, or yarn based on lockfiles
+ * - Supports silent execution mode
+ *
+ * Integration:
+ * - Works with shadow binaries for security scanning
+ * - Handles version pinning and cache management
+ * - Configures environment for third-party tools
+ */
+
+const require$2 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const {
+  PACKAGE_LOCK_JSON,
+  PNPM_LOCK_YAML,
+  YARN_LOCK
+} = constants.default;
+/**
+ * Spawns a package using dlx-style execution (npx/pnpm dlx/yarn dlx).
+ * Automatically detects the appropriate package manager if not specified.
+ */
+async function spawnDlx(packageSpec, args, options, spawnExtra) {
+  const {
+    agent,
+    silent = false,
+    ...shadowOptions
+  } = options ?? {};
+  let finalShadowOptions = shadowOptions;
+  let pm = agent;
+
+  // Auto-detect package manager if not specified.
+  if (!pm) {
+    const pnpmLockPath = await findUp(PNPM_LOCK_YAML, {
+      onlyFiles: true
+    });
+    const yarnLockPath = pnpmLockPath ? undefined : await findUp(YARN_LOCK, {
+      onlyFiles: true
+    });
+    const npmLockPath = pnpmLockPath || yarnLockPath ? undefined : await findUp(PACKAGE_LOCK_JSON, {
+      onlyFiles: true
+    });
+    if (pnpmLockPath) {
+      pm = constants.PNPM;
+    } else if (yarnLockPath) {
+      pm = constants.YARN;
+    } else if (npmLockPath) {
+      pm = constants.NPM;
+    } else {
+      // Default to npm if no lockfile found.
+      pm = constants.NPM;
+    }
+  }
+  const packageString = `${packageSpec.name}@${packageSpec.version}`;
+
+  // Build command args based on package manager.
+  let spawnArgs;
+  if (pm === constants.PNPM) {
+    spawnArgs = [];
+    // The --silent flag must come before dlx, not after.
+    if (silent) {
+      spawnArgs.push(constants.FLAG_SILENT);
+    }
+    spawnArgs.push('dlx');
+    // Never let the target project's `.pnpmfile.cjs` hooks run while we launch
+    // a third-party tool via `pnpm dlx`. In a pnpm workspace root, `pnpm dlx`
+    // loads the cwd's `.pnpmfile.cjs`, so a broken hook there (e.g. a `require`
+    // of an unresolved Git LFS pointer) crashes the launcher with a bare exit
+    // code before our tool ever starts. The dlx tool installs into an isolated
+    // store, so the project's install hooks are irrelevant to it. pnpm honors
+    // this only as a config setting, not as a `dlx` CLI flag, so it must be set
+    // via the npm_config_ env var. See: https://pnpm.io/npmrc#settings
+    finalShadowOptions = {
+      ...finalShadowOptions,
+      env: {
+        ...objects.getOwn(finalShadowOptions, 'env'),
+        npm_config_ignore_pnpmfile: 'true'
+      }
+    };
+    spawnArgs.push(packageString, ...args);
+    const shadowPnpmBin = /*@__PURE__*/require$2(constants.default.shadowPnpmBinPath);
+    return await shadowPnpmBin(spawnArgs, finalShadowOptions, spawnExtra);
+  } else if (pm === constants.YARN && isYarnBerry()) {
+    spawnArgs = ['dlx'];
+    // Yarn dlx runs in a temporary environment by design and should always fetch fresh.
+    if (silent) {
+      spawnArgs.push(constants.FLAG_QUIET);
+    }
+    spawnArgs.push(packageString, ...args);
+
+    // Use node-modules linker instead of PnP to avoid issues with packages
+    // that have undeclared dependencies (e.g. @coana-tech/cli -> @babel/types).
+    finalShadowOptions = {
+      ...finalShadowOptions,
+      env: {
+        ...objects.getOwn(finalShadowOptions, 'env'),
+        YARN_NODE_LINKER: 'node-modules'
+      }
+    };
+    const shadowYarnBin = /*@__PURE__*/require$2(constants.default.shadowYarnBinPath);
+    return await shadowYarnBin(spawnArgs, finalShadowOptions, spawnExtra);
+  } else {
+    // Use npm exec/npx.
+    // For consistency, we'll use npx which is more commonly used for one-off execution.
+    spawnArgs = ['--yes'];
+    if (silent) {
+      spawnArgs.push(constants.FLAG_SILENT);
+    }
+    spawnArgs.push(packageString, ...args);
+    const shadowNpxBin = /*@__PURE__*/require$2(constants.default.shadowNpxBinPath);
+    return await shadowNpxBin(spawnArgs, finalShadowOptions, spawnExtra);
+  }
+}
+
+/**
+ * Helper to spawn cdxgen with dlx.
+ */
+async function spawnCdxgenDlx(args, options, spawnExtra) {
+  return await spawnDlx({
+    name: '@cyclonedx/cdxgen',
+    version: constants.default.ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION
+  }, args, {
+    silent: true,
+    ...options
+  }, spawnExtra);
+}
+
+/**
+ * Helper to spawn synp with dlx.
+ */
+async function spawnSynpDlx(args, options, spawnExtra) {
+  return await spawnDlx({
+    name: 'synp',
+    version: `${constants.default.ENV.INLINED_SOCKET_CLI_SYNP_VERSION}`
+  }, args, {
+    silent: true,
+    ...options
+  }, spawnExtra);
+}
+
 /**
  * Safe wrapper for npm-package-arg that doesn't throw.
  * Returns undefined if parsing fails.
@@ -7001,7 +6932,7 @@ function exitWithBinPathError$1(binName) {
 function findBinNextToNode(binName) {
   const nodeDir = path.dirname(process.execPath);
   const binPath = path.join(nodeDir, binName);
-  if (fs.existsSync(binPath)) {
+  if (u.existsSync(binPath)) {
     try {
       return bin.resolveBinPathSync(binPath);
     } catch {
@@ -7037,7 +6968,7 @@ function resolveBinPathToJsEntry(binPath, cliEntryName) {
     return binPath;
   }
   const jsEntryPath = path.join(npmDirPath, 'bin', cliEntryName);
-  return fs.existsSync(jsEntryPath) ? jsEntryPath : binPath;
+  return u.existsSync(jsEntryPath) ? jsEntryPath : binPath;
 }
 let _npmBinPath;
 function getNpmBinPath() {
@@ -7098,7 +7029,7 @@ function getNpmRequire() {
   if (_npmRequire === undefined) {
     const npmDirPath = getNpmDirPath();
     const npmNmPath = path.join(npmDirPath, `${constants.NODE_MODULES}/npm`);
-    _npmRequire = require$$1.createRequire(path.join(fs.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
+    _npmRequire = require$$1.createRequire(path.join(u.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
   }
   return _npmRequire;
 }
@@ -7327,8 +7258,8 @@ const readLockFileByAgent = (() => {
       return undefined;
     };
   }
-  const binaryReader = wrapReader(fs$1.readFileBinary);
-  const defaultReader = wrapReader(async lockPath => await fs$1.readFileUtf8(lockPath));
+  const binaryReader = wrapReader(fs.readFileBinary);
+  const defaultReader = wrapReader(async lockPath => await fs.readFileUtf8(lockPath));
   return new Map([[BUN, wrapReader(async (lockPath, agentExecPath, cwd = process.cwd()) => {
     const ext = path.extname(lockPath);
     if (ext === EXT_LOCK) {
@@ -7402,14 +7333,14 @@ function preferWindowsCmdShim(binPath, binName) {
   const cmdShim = path.join(path.dirname(binPath), `${binName}.cmd`);
 
   // Ensure shim exists, otherwise failback to binPath
-  return fs.existsSync(cmdShim) ? cmdShim : binPath;
+  return u.existsSync(cmdShim) ? cmdShim : binPath;
 }
 async function getAgentExecPath(agent) {
   const binName = binByAgent.get(agent);
   if (binName === NPM) {
     // Try to use constants.npmExecPath first, but verify it exists.
     const npmPath = preferWindowsCmdShim(constants.default.npmExecPath, NPM);
-    if (fs.existsSync(npmPath)) {
+    if (u.existsSync(npmPath)) {
       return npmPath;
     }
     // If npmExecPath doesn't exist, try common locations.
@@ -7417,12 +7348,12 @@ async function getAgentExecPath(agent) {
     const nodeDir = path.dirname(process.execPath);
     if (constants.default.WIN32) {
       const npmCmdInNodeDir = path.join(nodeDir, `${NPM}.cmd`);
-      if (fs.existsSync(npmCmdInNodeDir)) {
+      if (u.existsSync(npmCmdInNodeDir)) {
         return npmCmdInNodeDir;
       }
     }
     const npmInNodeDir = path.join(nodeDir, NPM);
-    if (fs.existsSync(npmInNodeDir)) {
+    if (u.existsSync(npmInNodeDir)) {
       return preferWindowsCmdShim(npmInNodeDir, NPM);
     }
     // Fall back to whichBin.
@@ -7433,7 +7364,7 @@ async function getAgentExecPath(agent) {
   if (binName === PNPM) {
     // Try to use constants.pnpmExecPath first, but verify it exists.
     const pnpmPath = constants.default.pnpmExecPath;
-    if (fs.existsSync(pnpmPath)) {
+    if (u.existsSync(pnpmPath)) {
       return pnpmPath;
     }
     // Fall back to whichBin.
@@ -7507,7 +7438,7 @@ async function detectPackageEnvironment({
   const pkgJsonPath = lockPath ? path.resolve(lockPath, `${isHiddenLockFile ? '../' : ''}../${PACKAGE_JSON}`) : await findUp(PACKAGE_JSON, {
     cwd
   });
-  const pkgPath = pkgJsonPath && fs.existsSync(pkgJsonPath) ? path.dirname(pkgJsonPath) : undefined;
+  const pkgPath = pkgJsonPath && u.existsSync(pkgJsonPath) ? path.dirname(pkgJsonPath) : undefined;
   const editablePkgJson = pkgPath ? await packages.readPackageJson(pkgPath, {
     editable: true
   }) : undefined;
@@ -8337,7 +8268,7 @@ function parsePnpmLockfile(lockfileContent) {
   return objects.isObjectObject(result) ? result : null;
 }
 async function readPnpmLockfile(lockfilePath) {
-  return fs.existsSync(lockfilePath) ? await fs$1.readFileUtf8(lockfilePath) : undefined;
+  return u.existsSync(lockfilePath) ? await fs.readFileUtf8(lockfilePath) : undefined;
 }
 function stripLeadingPnpmDepPathSlash(depPath) {
   return isPnpmDepPath(depPath) ? depPath.slice(1) : depPath;
@@ -9204,7 +9135,7 @@ exports.socketDashboardLink = socketDashboardLink;
 exports.socketDevLink = socketDevLink;
 exports.socketDocsLink = socketDocsLink;
 exports.spawnCdxgenDlx = spawnCdxgenDlx;
-exports.spawnCoanaDlx = spawnCoanaDlx;
+exports.spawnCoana = spawnCoana;
 exports.spawnSynpDlx = spawnSynpDlx;
 exports.stripTrailingSlash = stripTrailingSlash;
 exports.suggestOrgSlug = suggestOrgSlug;
@@ -9220,5 +9151,5 @@ exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=788830e0-d926-4fb1-9858-2d1428ea1492
+//# debugId=c2092386-922b-4fd3-808d-771e3469061f
 //# sourceMappingURL=utils.js.map