@socketsecurity/cli-with-sentry 1.9.0 → 1.10.0

package/dist/cli.js

@@ -2445,9 +2445,9 @@ const SBT_DIALECT = {
   }]
 };
 
-// Maven's resolver (Aether/maven-resolver): no attribute-based variants. Two
-// failure shapes (artifact-resolution miss with config = scope, dependency-graph
-// build failure with config = "graph") both classify off the root-cause message.
+// Maven's resolver (Aether/maven-resolver): no attribute-based variants. Both
+// failure shapes (artifact-resolution miss, dependency-graph build failure)
+// classify off the root-cause message.
 function classifyMavenFailure(detail) {
   const t = (detail || '').toLowerCase();
   if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception')) {
@@ -2493,6 +2493,17 @@ const MAVEN_DIALECT = {
 
 // Per-resolver classify + render/score policy.
 
+// Where the invoking command lets the user set each build option, so a remedy
+// names something they can actually set.
+
+const DSI_SETUP_COMMAND = 'socket manifest setup --dynamic-sbom-inference';
+
+// The single-build manifest commands take every option as a flag.
+const FLAG_HINTS = {
+  flags: new Set(['excludeConfigs', 'ignoreUnresolved', 'verbose']),
+  setupCommand: 'socket manifest setup',
+  socketJson: constants.default.SOCKET_JSON
+};
 const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15;
 const RESOLUTION_REPORT_CONFIG_LIMIT = 20;
 
@@ -2509,26 +2520,57 @@ function dedupCoords(coords) {
   }
   return [...set].filter(c => c.split(':').length >= 3 || !versioned.has(c)).sort();
 }
+function firstLine(s) {
+  return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
+}
 function fmtList(list, limit) {
   const shown = list.slice(0, limit).join(', ');
   return list.length > limit ? `${shown} (+${list.length - limit} more)` : shown;
 }
-function firstLine(s) {
-  return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
+function flagText(option, value) {
+  const flag = `--${utils.camelToKebab(option)}`;
+  return value === true ? flag : `${flag} '${value}'`;
+}
+
+// Where a failure happened, for builds with several subprojects.
+function inProjects(projects) {
+  const list = [...(typeof projects === 'string' ? [projects] : projects)].filter(Boolean).sort().map(p => `\`${p}\``);
+  return list.length ? ` (in ${fmtList(list, 3)})` : '';
+}
+
+// `excludableConfigs` is empty when excluding configurations cannot clear
+// every blocking failure.
+function proceedHint(hints, tool, excludableConfigs) {
+  const options = [['ignoreUnresolved', true]];
+  if (excludableConfigs.length) {
+    options.push(['excludeConfigs', excludableConfigs.join(',')]);
+  }
+  const asFlags = options.filter(o => hints.flags.has(o[0]));
+  const inSocketJson = options.filter(o => !hints.flags.has(o[0]));
+  const setup = `\`${hints.setupCommand}\``;
+  if (!inSocketJson.length) {
+    return asFlags.length === 1 ? [`To proceed, re-run with ${flagText(...asFlags[0])}.`] : ['To proceed, re-run with either:', ...asFlags.map(o => `    ${flagText(...o)}`)];
+  }
+  if (!asFlags.length) {
+    return [`To proceed, set ${options.length > 1 ? 'either of these' : 'this'} under defaults.manifest.${tool} in ${hints.socketJson} (${setup} walks you through it):`, ...options.map(([option, value]) => `    "${option}": ${JSON.stringify(value)}`)];
+  }
+  return ['To proceed, either:', ...asFlags.map(o => `    re-run with ${flagText(...o)}`), ...inSocketJson.map(([option, value]) => `    set defaults.manifest.${tool}.${option} to ${JSON.stringify(value)} in ${hints.socketJson} (${setup})`)];
 }
 
 // Severity is per-kind; the exit-code decision lives in the caller. We do NOT
 // cross-reference what resolved elsewhere: the failed selector carries no
 // classifier/type, so relating a failed and a succeeded dep is unsound.
-function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
+function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
+  const dialect = dialectFor(tool);
   const name = dialect.label;
+  const hints = opts.hints ?? FLAG_HINTS;
   const unscannable = opts.unscannable ?? [];
-  const unscannableConfigs = new Set(unscannable.map(u => u.config));
+  const unscannableConfigs = new Set(unscannable.filter(u => u.config).map(u => u.config));
   const specOf = new Map(dialect.categories.map(c => [c.key, c]));
   const isBlocking = cat => specOf.get(cat)?.blocking ?? true;
 
   // Aggregate by (coord, category): one module can fail with different causes
-  // across configs. Keep first-seen detail, union the configs.
+  // across configs. Keep first-seen detail, union the configs and projects.
 
   const byKey = new Map();
   const keyOf = (coord, category) => `${coord} ${category}`;
@@ -2541,12 +2583,19 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
         coord: f.coord,
         category,
         detail: f.detail,
-        configs: new Set()
+        configs: new Set(),
+        projects: new Set(),
+        configless: false
       };
       byKey.set(key, info);
     }
     if (f.config) {
       info.configs.add(f.config);
+    } else {
+      info.configless = true;
+    }
+    if (f.project) {
+      info.projects.add(f.project);
     }
   }
   const allInfos = [...byKey.values()];
@@ -2563,6 +2612,8 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   });
   const blockingUnscannable = unscannableInfos.filter(u => u.blocking);
   const nonBlockingUnscannable = unscannableInfos.filter(u => !u.blocking);
+  const blockingUnscannableConfigs = blockingUnscannable.filter(u => u.config);
+  const blockingUnscannableProjects = blockingUnscannable.filter(u => !u.config);
   const perDepBlockingConfigs = new Set();
   for (const info of allInfos) {
     if (isBlocking(info.category)) {
@@ -2571,10 +2622,13 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
       }
     }
   }
-  const blockingConfigs = new Set([...perDepBlockingConfigs, ...blockingUnscannable.map(u => u.config)]);
+  const blockingConfigs = new Set([...perDepBlockingConfigs, ...blockingUnscannableConfigs.map(u => u.config)]);
   const blockingFailed = [...blockingConfigs].sort();
+  // A blocking failure outside any configuration leaves every configuration of
+  // its project incomplete, so none can be reported as succeeded.
+  const hasBlockingConfiglessFailure = blockingUnscannableProjects.length > 0 || allInfos.some(i => i.configless && isBlocking(i.category));
   // An un-scannable config was attempted but resolved nothing, so it didn't succeed.
-  const succeeded = scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
+  const succeeded = hasBlockingConfiglessFailure ? [] : scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
   const groups = dialect.categories.map(spec => ({
     spec,
     infos: dedupCoords(allInfos.filter(i => i.category === spec.key).map(i => i.coord)).map(c => byKey.get(keyOf(c, spec.key)))
@@ -2587,7 +2641,8 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   const out = [];
   if (hasBlockingFailures) {
     if (blockingCount > 0) {
-      out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):` : `Could not resolve ${blockingCount} dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):`);
+      const inConfigs = perDepBlockingConfigs.size ? ` in ${perDepBlockingConfigs.size} configuration(s)` : '';
+      out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies)${inConfigs}:` : `Could not resolve ${blockingCount} dependency(ies)${inConfigs}:`);
       for (const {
         infos,
         spec
@@ -2597,29 +2652,36 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
         for (const info of infos.slice(0, RESOLUTION_REPORT_ARTIFACT_LIMIT)) {
           const fl = firstLine(info.detail);
           const reasonSuffix = spec.showReason && fl ? `  [${fl}]` : '';
-          out.push(`    - ${info.coord}${reasonSuffix}`);
+          out.push(`    - ${info.coord}${inProjects(info.projects)}${reasonSuffix}`);
         }
         if (infos.length > RESOLUTION_REPORT_ARTIFACT_LIMIT) {
           out.push(`    … and ${infos.length - RESOLUTION_REPORT_ARTIFACT_LIMIT} more`);
         }
       }
     }
-    if (blockingUnscannable.length) {
-      // Separate from the per-dep block above, but only if there is one — otherwise
-      // the summary would lead with a blank line (a dangling ✗ under logger.fail).
+    const pushUnscannable = (items, header, label) => {
+      if (!items.length) {
+        return;
+      }
+      // Separate from the block above, but only if there is one — otherwise the
+      // summary would lead with a blank line (a dangling ✗ under logger.fail).
       if (out.length) {
         out.push('');
       }
-      out.push(opts.ignoreUnresolved ? `Ignored ${blockingUnscannable.length} configuration(s) that could not be scanned:` : `Could not scan ${blockingUnscannable.length} configuration(s) (reason from ${name}):`);
-      for (const u of blockingUnscannable.slice(0, RESOLUTION_REPORT_CONFIG_LIMIT)) {
+      out.push(header);
+      for (const u of items.slice(0, RESOLUTION_REPORT_CONFIG_LIMIT)) {
         const fl = firstLine(u.detail);
-        out.push(`    - ${u.config}${fl ? `  [${fl}]` : ''}`);
+        out.push(`    - ${label(u)}${fl ? `  [${fl}]` : ''}`);
       }
-      if (blockingUnscannable.length > RESOLUTION_REPORT_CONFIG_LIMIT) {
-        out.push(`    … and ${blockingUnscannable.length - RESOLUTION_REPORT_CONFIG_LIMIT} more`);
+      if (items.length > RESOLUTION_REPORT_CONFIG_LIMIT) {
+        out.push(`    … and ${items.length - RESOLUTION_REPORT_CONFIG_LIMIT} more`);
       }
+    };
+    pushUnscannable(blockingUnscannableConfigs, opts.ignoreUnresolved ? `Ignored ${blockingUnscannableConfigs.length} configuration(s) that could not be scanned:` : `Could not scan ${blockingUnscannableConfigs.length} configuration(s) (reason from ${name}):`, u => `${u.config}${inProjects(u.project)}`);
+    pushUnscannable(blockingUnscannableProjects, opts.ignoreUnresolved ? `Ignored ${blockingUnscannableProjects.length} project(s) whose dependencies could not be resolved:` : `Could not resolve the dependencies of ${blockingUnscannableProjects.length} project(s) (reason from ${name}):`, u => `\`${u.project}\``);
+    if (succeeded.length || blockingFailed.length) {
+      out.push('');
     }
-    out.push('');
     if (succeeded.length) {
       out.push(`Resolution succeeded in: ${fmtList(succeeded, RESOLUTION_REPORT_CONFIG_LIMIT)}`);
     }
@@ -2628,14 +2690,10 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
     }
     if (willFail) {
       out.push('');
-      out.push(`To proceed, re-run with either:`);
-      out.push(`    --ignore-unresolved`);
-      if (blockingFailed.length) {
-        out.push(`    --exclude-configs '${blockingFailed.join(',')}'`);
-      }
+      out.push(...proceedHint(hints, tool, hasBlockingConfiglessFailure ? [] : blockingFailed));
     }
     out.push('');
-    out.push(`Re-run with --verbose for ${name}'s full messages.`);
+    out.push(hints.flags.has('verbose') ? `Re-run with --verbose for ${name}'s full messages.` : `For ${name}'s full messages, ${verboseHint(hints, tool)}.`);
   }
   const notices = [];
   for (const {
@@ -2652,7 +2710,7 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   // matching the deliberately-lenient per-dep variant-ambiguity policy.
   if (nonBlockingUnscannable.length) {
     const n = new Set(nonBlockingUnscannable.map(u => u.config)).size;
-    notices.push(`Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.`);
+    notices.push(hints.flags.has('verbose') ? `Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.` : `Could not scan ${n} configuration(s); for ${name}'s messages, ${verboseHint(hints, tool)}.`);
   }
   const detailLines = [`${name}'s full message for each unresolved dependency:`];
   for (const info of allInfos) {
@@ -2664,10 +2722,10 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   }
   if (unscannable.length) {
     detailLines.push('');
-    detailLines.push(`${name} configurations that could not be scanned:`);
+    detailLines.push(`${name} resolutions that could not be scanned:`);
     for (const u of unscannable) {
       detailLines.push('');
-      detailLines.push(`  ${u.config}:`);
+      detailLines.push(`  ${u.config || 'all dependencies'}${inProjects(u.project)}:`);
       for (const line of (u.detail || '(no message)').split('\n')) {
         detailLines.push(`    ${line}`);
       }
@@ -2691,7 +2749,10 @@ function dialectFor(tool) {
   }
 }
 function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'gradle', opts = {}) {
-  return renderResolutionReport(failures, scannedConfigs, dialectFor(tool), opts);
+  return renderResolutionReport(failures, scannedConfigs, tool, opts);
+}
+function verboseHint(hints, tool) {
+  return hints.flags.has('verbose') ? 'pass --verbose' : `set defaults.manifest.${tool}.verbose to true in ${hints.socketJson}`;
 }
 
 const PURL_TYPE_MAVEN = 'maven';
@@ -3056,7 +3117,7 @@ function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
 function buildReport(parsed) {
   const seen = new Set();
   const failures = parsed.failures.filter(f => {
-    const key = `${f.coord}|${f.detail}|${f.config}`;
+    const key = `${f.coord}|${f.detail}|${f.config}|${f.project}`;
     if (seen.has(key)) {
       return false;
     }
@@ -3065,7 +3126,7 @@ function buildReport(parsed) {
   });
   const seenUnscannable = new Set();
   const unscannable = parsed.unscannable.filter(u => {
-    const key = `${u.config}|${u.detail}`;
+    const key = `${u.config}|${u.detail}|${u.project}`;
     if (seenUnscannable.has(key)) {
       return false;
     }
@@ -3232,8 +3293,8 @@ function serializeExcludePathPatterns(paths) {
 //   edge        rootId  parentCoordId  childCoordId
 //   file        rootId  coordId  path                    (--with-files only)
 //   scanned     config
-//   failure     coord  detail  config
-//   unscannable config  detail
+//   failure     coord  detail  config  projectKey   (config empty: no configuration)
+//   unscannable config  detail  projectKey          (config empty: whole project)
 //
 // `projectKey` is the tool's unique project identity (Maven: GAV; Gradle:
 // project path; sbt: project id), emitted as the project id; a `node` whose
@@ -3402,15 +3463,17 @@ function parseRecords(text) {
           result.failures.push({
             coord: f[1],
             detail: f[2] ?? '',
-            config: f[3] ?? ''
+            config: f[3] ?? '',
+            project: f[4] ?? ''
           });
         }
         break;
       case 'unscannable':
-        if (f[1]) {
+        if (f[1] || f[3]) {
           result.unscannable.push({
-            config: f[1],
-            detail: f[2] ?? ''
+            config: f[1] ?? '',
+            detail: f[2] ?? '',
+            project: f[3] ?? ''
           });
         }
         break;
@@ -3431,6 +3494,10 @@ function manifestScriptsPath(...parts) {
   return path.join(constants.default.distPath, 'manifest-scripts', ...parts);
 }
 
+// Streamed build output is a diagnostic: it goes to stderr so the command's own
+// stdout (e.g. --json) stays machine-readable.
+const STREAM_TO_STDERR = ['inherit', 2, 'inherit'];
+
 // Don't throw on a non-zero exit: the script emits failure records, so a usable
 // records file still exists. A non-exit spawn error (e.g. missing executable)
 // propagates.
@@ -3438,7 +3505,7 @@ async function runNeverThrow(bin, args, opts) {
   try {
     const result = await spawn.spawn(bin, args, {
       cwd: opts.projectDir,
-      stdio: opts.stdio ?? 'inherit',
+      stdio: opts.stdio === 'pipe' ? 'pipe' : [...STREAM_TO_STDERR],
       ...(opts.env ? {
         env: opts.env
       } : {}),
@@ -3654,6 +3721,7 @@ async function runManifestFacts({
   ecosystem,
   excludeConfigs,
   excludePaths,
+  hints = FLAG_HINTS,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -3705,7 +3773,7 @@ async function runManifestFacts({
       logger.logger.info(`(Running ${ecosystem} with output streaming; this can take a while.)`);
       result = await runManifestScript(ecosystem, scriptOpts);
     } else {
-      logger.logger.info(`(No live output; pass --verbose to stream the ${ecosystem} build output.)`);
+      logger.logger.info(`(No live output; to stream the ${ecosystem} build output, ${verboseHint(hints, ecosystem)}.)`);
       spinner.start(`Resolving ${ecosystem} dependencies ...`);
       result = await runManifestScript(ecosystem, scriptOpts);
       if (result.code === 0) {
@@ -3721,7 +3789,7 @@ async function runManifestFacts({
       spinner.failAndStop(`Failed to run ${ecosystem}.`);
     }
     process.exitCode = 1;
-    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${utils.getErrorMessageOr(e, String(e))}` : ' (run with --verbose for details).'));
+    logger.logger.fail(`Could not run the ${ecosystem} build tool: ${utils.getErrorMessageOr(e, String(e))}`);
     return null;
   }
   const {
@@ -3735,6 +3803,7 @@ async function runManifestFacts({
     stdout
   } = result;
   const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
+    hints,
     ignoreUnresolved,
     unscannable: report.unscannable
   });
@@ -3821,16 +3890,22 @@ async function runManifestFacts({
   };
 }
 
+// Relative to the user's shell when inside it, else absolute.
+function displayPath(file) {
+  const rel = path.relative(process.cwd(), file);
+  return rel.startsWith('..') || path.isAbsolute(rel) ? file : rel;
+}
+
 // A cascaded (not just root-level) disabled additionally skips this one build
 // root here, on top of its existing root-only ecosystem-wide meaning for
 // auto/gradle/etc. facts:false has no pom-mode equivalent here (facts-only),
 // so it skips too.
-function getSkipReason(disabled, facts) {
+function getSkipReason(ecosystem, disabled, facts) {
   if (disabled) {
-    return 'defaults.manifest.<ecosystem>.disabled is true';
+    return `defaults.manifest.${ecosystem}.disabled is true`;
   }
   if (facts === false) {
-    return 'defaults.manifest.<ecosystem>.facts is false (pom mode)';
+    return `defaults.manifest.${ecosystem}.facts is false (pom mode)`;
   }
   return undefined;
 }
@@ -3849,6 +3924,8 @@ function nearestDisabledRoot(dir, disabledRoots) {
 async function runEcosystemCandidates({
   candidatesByTool,
   excludePaths,
+  ignoreUnresolved: ignoreUnresolvedOverride,
+  optionFlags,
   realCwd,
   rootSockJson,
   sbtTmpDir,
@@ -3879,7 +3956,8 @@ async function runEcosystemCandidates({
         ignoreUnresolved,
         includeConfigs,
         javaHome,
-        skipReason
+        skipReason,
+        verbose: configVerbose
       } = resolveEcosystemConfig(ecosystem, dir, sockJson);
       if (skipReason) {
         // Only warn for a genuinely new disabled root, not one already
@@ -3914,12 +3992,17 @@ async function runEcosystemCandidates({
         ecosystem,
         excludeConfigs,
         excludePaths: excludePathsForRoot,
-        ignoreUnresolved,
+        hints: {
+          flags: optionFlags,
+          setupCommand: DSI_SETUP_COMMAND,
+          socketJson: displayPath(path.join(dir, constants.SOCKET_JSON))
+        },
+        ignoreUnresolved: ignoreUnresolvedOverride ?? ignoreUnresolved,
         includeConfigs,
         javaHome,
         sidecarAcc,
         tmpDir: ecosystem === 'sbt' ? sbtTmpDir : undefined,
-        verbose,
+        verbose: verbose || configVerbose,
         withFiles
       });
       if (result === null) {
@@ -3928,8 +4011,11 @@ async function runEcosystemCandidates({
           ecosystem,
           status: 'failed'
         });
-        logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir}'s workspace layout could not be determined, so its remaining build roots cannot be safely classified as covered or independent.`);
-        for (const abortedDir of dirs.slice(dirIndex + 1)) {
+        const abortedDirs = dirs.slice(dirIndex + 1);
+        if (abortedDirs.length) {
+          logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir} failed to generate Socket facts, and without them the remaining build roots cannot be safely classified as covered or independent.`);
+        }
+        for (const abortedDir of abortedDirs) {
           outcomes.push({
             dir: abortedDir,
             ecosystem,
@@ -3966,6 +4052,8 @@ async function runEcosystemCandidates({
 async function generateRecursiveManifests({
   cwd,
   excludePaths,
+  ignoreUnresolved,
+  optionFlags = new Set(),
   sbtTmpDir,
   sidecarAcc,
   verbose,
@@ -3987,6 +4075,8 @@ async function generateRecursiveManifests({
   const runAll = resolvedSbtTmpDir => runEcosystemCandidates({
     candidatesByTool,
     excludePaths,
+    ignoreUnresolved,
+    optionFlags,
     realCwd,
     rootSockJson,
     sbtTmpDir: resolvedSbtTmpDir,
@@ -4023,7 +4113,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
       ignoreUnresolved: Boolean(config?.ignoreUnresolved),
       includeConfigs: config?.includeConfigs ?? '',
       javaHome: config?.javaHome ?? undefined,
-      skipReason: getSkipReason(config?.disabled, config?.facts)
+      skipReason: getSkipReason(ecosystem, config?.disabled, config?.facts),
+      verbose: Boolean(config?.verbose)
     };
   }
   if (ecosystem === 'gradle') {
@@ -4036,7 +4127,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
       ignoreUnresolved: Boolean(config?.ignoreUnresolved),
       includeConfigs: config?.includeConfigs ?? '',
       javaHome: config?.javaHome ?? undefined,
-      skipReason: getSkipReason(config?.disabled, config?.facts)
+      skipReason: getSkipReason(ecosystem, config?.disabled, config?.facts),
+      verbose: Boolean(config?.verbose)
     };
   }
   const config = sockJson.defaults?.manifest?.maven;
@@ -4048,7 +4140,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
     ignoreUnresolved: Boolean(config?.ignoreUnresolved),
     includeConfigs: config?.includeConfigs ?? '',
     javaHome: config?.javaHome ?? undefined,
-    skipReason: getSkipReason(config?.disabled)
+    skipReason: getSkipReason(ecosystem, config?.disabled),
+    verbose: Boolean(config?.verbose)
   };
 }
 
@@ -6463,6 +6556,7 @@ async function convertGradleToFacts({
   excludeConfigs,
   excludePaths,
   gradleOpts,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6477,6 +6571,7 @@ async function convertGradleToFacts({
     ecosystem: 'gradle',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -6493,6 +6588,7 @@ async function convertMavenToFacts({
   cwd,
   excludeConfigs,
   excludePaths,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6508,6 +6604,7 @@ async function convertMavenToFacts({
     ecosystem: 'maven',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -6525,6 +6622,7 @@ async function convertSbtToFacts({
   cwd,
   excludeConfigs,
   excludePaths,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6541,6 +6639,7 @@ async function convertSbtToFacts({
     ecosystem: 'sbt',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -7004,6 +7103,12 @@ async function handleManifestConda({
   await outputRequirements(data, outputKind, out === '-' ? out : path.resolve(cwd, out));
 }
 
+// Auto-manifest reads every build option from the root socket.json.
+const AUTO_MANIFEST_HINTS = {
+  flags: new Set(),
+  setupCommand: 'socket manifest setup',
+  socketJson: constants.SOCKET_JSON
+};
 // Under --auto-manifest, a manifest generator that failed — raising the exit
 // code above the value captured before it ran — aborts the whole run: a partial
 // or empty SBOM silently under-reports dependencies. The generator has already
@@ -7055,6 +7160,7 @@ async function generateAutoManifest({
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.sbt?.javaHome ?? undefined,
+        hints: AUTO_MANIFEST_HINTS,
         sidecarAcc,
         tmpDir,
         withFiles: computeArtifactsSidecar
@@ -7090,6 +7196,7 @@ async function generateAutoManifest({
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined,
+        hints: AUTO_MANIFEST_HINTS,
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
@@ -7114,6 +7221,7 @@ async function generateAutoManifest({
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       javaHome: sockJson.defaults?.manifest?.maven?.javaHome ?? undefined,
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts ?? undefined),
+      hints: AUTO_MANIFEST_HINTS,
       sidecarAcc,
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar
@@ -10006,7 +10114,7 @@ const generalFlags$2 = {
   allowOverrides: {
     type: 'boolean',
     default: false,
-    description: "When the only fix for a vulnerability is blocked by a parent package's declared version range, write an override or resolution that forces the fixed version under that parent. This can install a version outside the range the parent declares, so test the parent afterwards. Works for npm, pnpm, Yarn Berry and Rush projects."
+    description: "When the only fix for a vulnerability is blocked by a parent package's declared version range, write an override or resolution that forces the fixed version under that parent. This can install a version outside the range the parent declares, so test the parent afterwards. Works for npm, pnpm, Yarn and Rush projects."
   },
   autopilot: {
     type: 'boolean',
@@ -12935,12 +13043,15 @@ async function outputManifestDynamicSbomInference(result, outputKind) {
 async function handleManifestDynamicSbomInference({
   cwd,
   excludePaths,
+  ignoreUnresolved,
   outputKind,
   verbose
 }) {
   const outcomes = await generateRecursiveManifests({
     cwd,
     excludePaths,
+    ignoreUnresolved,
+    optionFlags: new Set(['ignoreUnresolved', 'verbose']),
     verbose
   });
   const result = !outcomes.length ? {
@@ -12968,6 +13079,10 @@ const config$d = {
     ...flags.commonFlags,
     ...flags.outputFlags,
     ...excludePathsFlag,
+    ignoreUnresolved: {
+      type: 'boolean',
+      description: "Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts files); overrides each build's socket.json setting"
+    },
     verbose: {
       type: 'boolean',
       default: false,
@@ -13012,6 +13127,7 @@ async function run$E(argv, importMeta, {
   });
   const {
     dryRun,
+    ignoreUnresolved,
     json,
     markdown,
     verbose: verboseFlag
@@ -13055,6 +13171,7 @@ async function run$E(argv, importMeta, {
   await handleManifestDynamicSbomInference({
     cwd,
     excludePaths,
+    ignoreUnresolved,
     outputKind,
     verbose
   });
@@ -14731,7 +14848,7 @@ async function enumerateWorkspaces({
     result = await enumerateWorkspaces$1(ecosystem, scriptOpts);
   } catch (e) {
     process.exitCode = 1;
-    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (' (run with --verbose for details).'));
+    logger.logger.fail(`Could not run the ${ecosystem} build tool: ${utils.getErrorMessageOr(e, String(e))}`);
     return;
   }
   if (!result.projects.length) {
@@ -19871,6 +19988,16 @@ async function validateReachabilityTarget(targets, cwd) {
   return result;
 }
 
+// Build options that `socket manifest <tool>` takes as flags but the scan
+// commands read from each build's socket.json, so passing them does nothing.
+const SOCKET_JSON_ONLY_FLAGS = ['excludeConfigs', 'ignoreUnresolved', 'includeConfigs', 'verbose'];
+function warnSocketJsonOnlyFlags(flags, command) {
+  const ignored = SOCKET_JSON_ONLY_FLAGS.filter(name => flags[name] !== undefined).map(name => `--${utils.camelToKebab(name)}`);
+  if (ignored.length) {
+    logger.logger.warn(`Ignoring ${ignored.join(', ')}: \`${command}\` reads build options from each build's socket.json. Set them there, for example with \`${DSI_SETUP_COMMAND}\`.`);
+  }
+}
+
 const CMD_NAME$a = 'create';
 
 // Accepted for backwards compatibility but forwarded nowhere, so passing one
@@ -20110,6 +20237,7 @@ async function run$d(argv, importMeta, {
 
   // Validate ecosystem values against the reachability-supported set.
   const reachEcosystems = utils.parseReachEcosystems(utils.cmdFlagValueToArray(cli.flags['reachEcosystems']));
+  warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$a}`);
   const dryRun = !!cli.flags['dryRun'];
   const uvMembers = !!cli.flags['uvMembers'];
   let {
@@ -22463,6 +22591,7 @@ async function run$7(argv, importMeta, {
     importMeta,
     parentName
   });
+  warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$4}`);
   const {
     cwd: cwdOverride,
     dynamicSbomInference,
@@ -24539,5 +24668,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=c715fb1e-bcb7-40c4-b394-2bc4db5e64a
+//# debugId=ccb7632d-f5e4-4589-8d85-1814c416c744
 //# sourceMappingURL=cli.js.map