@socketsecurity/cli-with-sentry 1.9.1 → 1.10.1

package/dist/cli.js

@@ -1824,12 +1824,16 @@ function reachMemoryLimitToMb(value) {
 // independent reactors is intentionally duplicated across all of their
 // components[].
 
-// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact).
+// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact); no
+// `targets` means the artifact did not resolve.
 function attachPaths(entry, artifactPaths) {
   const paths = artifactPaths.pathsById.get(entry.id);
+  const targets = paths ? paths.targets : [];
   return {
     ...entry,
-    targets: [...(paths?.targets ?? [])],
+    ...(targets ? {
+      targets: [...targets]
+    } : {}),
     sources: [...(paths?.sources ?? [])]
   };
 }
@@ -2351,9 +2355,17 @@ function classifyGradleFailure(detail) {
   if (t.includes('no matching variant') || t.includes('no variants of') || t.includes('unable to find a matching variant') || t.includes('no compatible variant')) {
     return 'no-matching-variant';
   }
-  if (t.includes('cannot choose between')) {
+  // The artifact-level form: several transforms produce the requested variant
+  // ("transformation chains" from Gradle 8.12, "transforms" before it).
+  if (t.includes('cannot choose between') || t.includes('found multiple transformation chains') || t.includes('found multiple transforms that can produce a variant')) {
     return 'variant-ambiguity';
   }
+  // One line per problem of the artifact; a checksum missing from the
+  // metadata is no evidence against it, unlike any other problem.
+  const problems = t.split('\n').filter(l => l.startsWith('on artifact '));
+  if (problems.length && problems.every(l => l.endsWith(': checksum is missing from verification metadata.'))) {
+    return 'checksum-missing';
+  }
   if (t.includes('could not get') || t.includes('could not head') || t.includes('status code 401') || t.includes('status code 403') || t.includes('connection refused') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('certification path') || t.includes('peer not authenticated')) {
     return 'repository-or-network';
   }
@@ -2365,8 +2377,9 @@ function classifyGradleFailure(detail) {
 
 // Every kind blocks except variant-ambiguity: the module demonstrably exists
 // and is almost always captured via another configuration, so it's benign for
-// the SBOM (non-blocking, count only). A module that resolves in NO config
-// surfaces as not-found / no-matching-variant, which stay blocking.
+// the SBOM (non-blocking, count only). The renderer blocks it anyway when the
+// module resolved in no configuration of its project. Nor does checksum-missing:
+// teams often record checksums only for what their own tasks resolve.
 const GRADLE_DIALECT = {
   label: 'Gradle',
   classify: classifyGradleFailure,
@@ -2399,8 +2412,13 @@ const GRADLE_DIALECT = {
     blocking: true
   }, {
     key: 'variant-ambiguity',
+    header: n => `  Ambiguous variant — ${n} could not choose a variant, and the module resolved in no other configuration:`,
     blocking: false,
     notice: (n, depCount, configCount) => `Skipped ${depCount} dependency(ies) with ambiguous variant selection in ${configCount} configuration(s) — re-run with --verbose for ${n}'s messages.`
+  }, {
+    key: 'checksum-missing',
+    blocking: false,
+    notice: (n, depCount, configCount) => `Left ${depCount} dependency(ies) uninstalled in ${configCount} configuration(s): ${n}'s verification metadata has no checksum for their artifacts — re-run with --verbose for ${n}'s messages.`
   }]
 };
 
@@ -2445,19 +2463,29 @@ const SBT_DIALECT = {
   }]
 };
 
-// Maven's resolver (Aether/maven-resolver): no attribute-based variants. Two
-// failure shapes (artifact-resolution miss with config = scope, dependency-graph
-// build failure with config = "graph") both classify off the root-cause message.
+// Maven's resolver (Aether/maven-resolver): no attribute-based variants. Both
+// failure shapes (artifact-resolution miss, dependency-graph build failure)
+// classify off the root-cause message.
 function classifyMavenFailure(detail) {
   const t = (detail || '').toLowerCase();
-  if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception')) {
+  if (t.includes('could not transfer') || t.includes('connection refused') || t.includes('connect timed out') || t.includes('connection timed out') || t.includes('read timed out') || t.includes('status code: 401') || t.includes('status code: 403') || t.includes('unauthorized') || t.includes('forbidden') || t.includes('peer not authenticated') || t.includes('certpathbuilderexception') ||
+  // Maven 3.8.1+ blocks plain-HTTP repositories behind its
+  // maven-default-http-blocker mirror.
+  t.includes('blocked mirror for repositories') ||
+  // Offline (-o): no repository was asked, so the artifact may well exist.
+  t.includes('in offline mode')) {
     return 'repository-or-network';
   }
-  if (t.includes('could not find artifact') || t.includes('failure to find') || t.includes('could not resolve') || t.includes('no versions available') || t.includes('not found')) {
+  if (t.includes('could not find artifact') || t.includes('failure to find') || t.includes('could not resolve') || t.includes('no versions available') || t.includes('not found') ||
+  // maven-resolver's remote repository filters (prefixes, groupId): the
+  // repository is known not to serve that path or group.
+  t.includes('not allowed from')) {
     return 'not-found';
   }
   // POM exists but can't be read/parsed.
-  if (t.includes('failed to read artifact descriptor') || t.includes('invalid pom') || t.includes('could not parse pom')) {
+  if (t.includes('failed to read artifact descriptor') || t.includes('invalid pom') || t.includes('could not parse pom') ||
+  // Maven's warning for a POM its descriptor policy tolerated as invalid.
+  t.includes('is invalid, transitive dependencies')) {
     return 'config-problem';
   }
   return 'other';
@@ -2488,68 +2516,143 @@ const MAVEN_DIALECT = {
   }]
 };
 
+// A resolution that threw without naming a dependency: one configuration, or
+// with an empty `config` the whole project.
+
+// A module (`group:name`, from any longer coordinate) within one project.
+function moduleKey(project, coord) {
+  return `${project}\t${coord.split(':').slice(0, 2).join(':')}`;
+}
+
 // Recognized from the build tool's message; drives wording AND whether the kind
 // is blocking. An unrecognized message degrades to 'other' (blocking) — safe.
 
 // Per-resolver classify + render/score policy.
 
+// Where the invoking command lets the user set each build option, so a remedy
+// names something they can actually set.
+
+const DSI_SETUP_COMMAND = 'socket manifest setup --dynamic-sbom-inference';
+const REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG = '--reach-continue-on-install-errors';
+
+// The single-build manifest commands take every option as a flag.
+const FLAG_HINTS = {
+  flags: new Set(['excludeConfigs', 'ignoreUnresolved', 'verbose']),
+  setupCommand: 'socket manifest setup',
+  socketJson: constants.default.SOCKET_JSON
+};
 const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15;
 const RESOLUTION_REPORT_CONFIG_LIMIT = 20;
 
 // Drop a bare "group:name" when a versioned "group:name:v" of the same module
-// is also present: the lenient resolver reports both forms for one failure.
-function dedupCoords(coords) {
-  const set = new Set(coords);
+// failed in the same projects: the lenient resolver reports both forms for one
+// failure.
+function dedupInfos(infos) {
   const versioned = new Set();
-  for (const c of set) {
-    const p = c.split(':');
+  for (const i of infos) {
+    const p = i.coord.split(':');
     if (p.length >= 3) {
-      versioned.add(`${p[0]}:${p[1]}`);
+      for (const project of i.projects) {
+        versioned.add(moduleKey(project, i.coord));
+      }
     }
   }
-  return [...set].filter(c => c.split(':').length >= 3 || !versioned.has(c)).sort();
+  return infos.filter(i => i.coord.split(':').length >= 3 || ![...i.projects].every(p => versioned.has(moduleKey(p, i.coord)))).sort((a, b) => a.coord < b.coord ? -1 : a.coord > b.coord ? 1 : 0);
+}
+function firstLine(s) {
+  return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
 }
 function fmtList(list, limit) {
   const shown = list.slice(0, limit).join(', ');
   return list.length > limit ? `${shown} (+${list.length - limit} more)` : shown;
 }
-function firstLine(s) {
-  return (s || '').split('\n').map(l => l.trim()).find(Boolean) ?? '';
+function flagText(option, value) {
+  const flag = `--${utils.camelToKebab(option)}`;
+  return value === true ? flag : `${flag} '${value}'`;
+}
+
+// Where a failure happened, for builds with several subprojects.
+function inProjects(projects) {
+  const list = [...(typeof projects === 'string' ? [projects] : projects)].filter(Boolean).sort().map(p => `\`${p}\``);
+  return list.length ? ` (in ${fmtList(list, 3)})` : '';
+}
+function installErrorsHint(hints, ignored) {
+  const flag = hints.continueOnInstallErrorsFlag;
+  if (!flag) {
+    return [];
+  }
+  return [ignored ? `Reachability analysis cannot install the ignored dependencies; pass ${flag} unless you already do.` : `If you ignore unresolved dependencies, also pass ${flag}: reachability analysis cannot install them.`];
 }
 
-// Severity is per-kind; the exit-code decision lives in the caller. We do NOT
-// cross-reference what resolved elsewhere: the failed selector carries no
-// classifier/type, so relating a failed and a succeeded dep is unsound.
-function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
+// `excludableConfigs` is empty when excluding configurations cannot clear
+// every blocking failure.
+function proceedHint(hints, tool, excludableConfigs) {
+  const options = [['ignoreUnresolved', true]];
+  if (excludableConfigs.length) {
+    options.push(['excludeConfigs', excludableConfigs.join(',')]);
+  }
+  const asFlags = options.filter(o => hints.flags.has(o[0]));
+  const inSocketJson = options.filter(o => !hints.flags.has(o[0]));
+  const setup = `\`${hints.setupCommand}\``;
+  if (!inSocketJson.length) {
+    return asFlags.length === 1 ? [`To proceed, re-run with ${flagText(...asFlags[0])}.`] : ['To proceed, re-run with either:', ...asFlags.map(o => `    ${flagText(...o)}`)];
+  }
+  if (!asFlags.length) {
+    return [`To proceed, set ${options.length > 1 ? 'either of these' : 'this'} under defaults.manifest.${tool} in ${hints.socketJson} (${setup} walks you through it):`, ...options.map(([option, value]) => `    "${option}": ${JSON.stringify(value)}`)];
+  }
+  return ['To proceed, either:', ...asFlags.map(o => `    re-run with ${flagText(...o)}`), ...inSocketJson.map(([option, value]) => `    set defaults.manifest.${tool}.${option} to ${JSON.stringify(value)} in ${hints.socketJson} (${setup})`)];
+}
+
+// What resolved elsewhere is consulted only by module (group:name): a failed
+// selector carries no classifier/type to relate it to one artifact.
+function renderResolutionReport(failures, scannedConfigs, tool, opts = {}) {
+  const dialect = dialectFor(tool);
   const name = dialect.label;
+  const hints = opts.hints ?? FLAG_HINTS;
   const unscannable = opts.unscannable ?? [];
-  const unscannableConfigs = new Set(unscannable.map(u => u.config));
+  const unscannableConfigs = new Set(unscannable.filter(u => u.config).map(u => u.config));
   const specOf = new Map(dialect.categories.map(c => [c.key, c]));
   const isBlocking = cat => specOf.get(cat)?.blocking ?? true;
 
-  // Aggregate by (coord, category): one module can fail with different causes
-  // across configs. Keep first-seen detail, union the configs.
+  // A non-blocking kind is only benign when its module resolved anyway: one
+  // that resolved in no configuration of its project is missing from that
+  // project's SBOM.
+  const resolved = opts.resolvedModules;
+  const isFailureBlocking = (category, f) => isBlocking(category) || !!resolved && !resolved.has(moduleKey(f.project, f.coord));
+
+  // Aggregate by (coord, category, blocking): one module can fail with
+  // different causes across configs, and block in only some projects. Keep
+  // first-seen detail, union the configs and projects.
 
   const byKey = new Map();
-  const keyOf = (coord, category) => `${coord} ${category}`;
   for (const f of failures) {
     const category = dialect.classify(f.detail);
-    const key = keyOf(f.coord, category);
+    const blocking = isFailureBlocking(category, f);
+    const key = `${f.coord} ${category} ${blocking}`;
     let info = byKey.get(key);
     if (!info) {
       info = {
         coord: f.coord,
         category,
+        blocking,
         detail: f.detail,
-        configs: new Set()
+        configs: new Set(),
+        projects: new Set(),
+        configless: false
       };
       byKey.set(key, info);
     }
     if (f.config) {
       info.configs.add(f.config);
+    } else {
+      info.configless = true;
+    }
+    if (f.project) {
+      info.projects.add(f.project);
     }
   }
   const allInfos = [...byKey.values()];
+  const isInfoBlocking = info => info.blocking;
 
   // A whole-config throw is classified by the same cause rules as a per-dep
   // failure: ambiguity stays lenient, every other cause is fail-closed.
@@ -2563,31 +2666,43 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   });
   const blockingUnscannable = unscannableInfos.filter(u => u.blocking);
   const nonBlockingUnscannable = unscannableInfos.filter(u => !u.blocking);
+  const blockingUnscannableConfigs = blockingUnscannable.filter(u => u.config);
+  const blockingUnscannableProjects = blockingUnscannable.filter(u => !u.config);
   const perDepBlockingConfigs = new Set();
   for (const info of allInfos) {
-    if (isBlocking(info.category)) {
+    if (isInfoBlocking(info)) {
       for (const c of info.configs) {
         perDepBlockingConfigs.add(c);
       }
     }
   }
-  const blockingConfigs = new Set([...perDepBlockingConfigs, ...blockingUnscannable.map(u => u.config)]);
+  const blockingConfigs = new Set([...perDepBlockingConfigs, ...blockingUnscannableConfigs.map(u => u.config)]);
   const blockingFailed = [...blockingConfigs].sort();
+  // A blocking failure outside any configuration leaves every configuration of
+  // its project incomplete, so none can be reported as succeeded.
+  const hasBlockingConfiglessFailure = blockingUnscannableProjects.length > 0 || allInfos.some(i => i.configless && isInfoBlocking(i));
   // An un-scannable config was attempted but resolved nothing, so it didn't succeed.
-  const succeeded = scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
+  const succeeded = hasBlockingConfiglessFailure ? [] : scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
   const groups = dialect.categories.map(spec => ({
     spec,
-    infos: dedupCoords(allInfos.filter(i => i.category === spec.key).map(i => i.coord)).map(c => byKey.get(keyOf(c, spec.key)))
+    infos: dedupInfos(allInfos.filter(i => i.category === spec.key))
+  }));
+  const blockingGroups = groups.map(g => ({
+    ...g,
+    infos: g.infos.filter(isInfoBlocking)
+  })).filter(g => g.infos.length);
+  const nonBlockingGroups = groups.map(g => ({
+    ...g,
+    infos: g.infos.filter(i => !isInfoBlocking(i))
   })).filter(g => g.infos.length);
-  const blockingGroups = groups.filter(g => g.spec.blocking);
-  const nonBlockingGroups = groups.filter(g => !g.spec.blocking);
   const blockingCount = blockingGroups.reduce((n, g) => n + g.infos.length, 0);
   const hasBlockingFailures = blockingCount > 0 || blockingUnscannable.length > 0;
   const willFail = hasBlockingFailures && !opts.ignoreUnresolved;
   const out = [];
   if (hasBlockingFailures) {
     if (blockingCount > 0) {
-      out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):` : `Could not resolve ${blockingCount} dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):`);
+      const inConfigs = perDepBlockingConfigs.size ? ` in ${perDepBlockingConfigs.size} configuration(s)` : '';
+      out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies)${inConfigs}:` : `Could not resolve ${blockingCount} dependency(ies)${inConfigs}:`);
       for (const {
         infos,
         spec
@@ -2597,29 +2712,36 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
         for (const info of infos.slice(0, RESOLUTION_REPORT_ARTIFACT_LIMIT)) {
           const fl = firstLine(info.detail);
           const reasonSuffix = spec.showReason && fl ? `  [${fl}]` : '';
-          out.push(`    - ${info.coord}${reasonSuffix}`);
+          out.push(`    - ${info.coord}${inProjects(info.projects)}${reasonSuffix}`);
         }
         if (infos.length > RESOLUTION_REPORT_ARTIFACT_LIMIT) {
           out.push(`    … and ${infos.length - RESOLUTION_REPORT_ARTIFACT_LIMIT} more`);
         }
       }
     }
-    if (blockingUnscannable.length) {
-      // Separate from the per-dep block above, but only if there is one — otherwise
-      // the summary would lead with a blank line (a dangling ✗ under logger.fail).
+    const pushUnscannable = (items, header, label) => {
+      if (!items.length) {
+        return;
+      }
+      // Separate from the block above, but only if there is one — otherwise the
+      // summary would lead with a blank line (a dangling ✗ under logger.fail).
       if (out.length) {
         out.push('');
       }
-      out.push(opts.ignoreUnresolved ? `Ignored ${blockingUnscannable.length} configuration(s) that could not be scanned:` : `Could not scan ${blockingUnscannable.length} configuration(s) (reason from ${name}):`);
-      for (const u of blockingUnscannable.slice(0, RESOLUTION_REPORT_CONFIG_LIMIT)) {
+      out.push(header);
+      for (const u of items.slice(0, RESOLUTION_REPORT_CONFIG_LIMIT)) {
         const fl = firstLine(u.detail);
-        out.push(`    - ${u.config}${fl ? `  [${fl}]` : ''}`);
+        out.push(`    - ${label(u)}${fl ? `  [${fl}]` : ''}`);
       }
-      if (blockingUnscannable.length > RESOLUTION_REPORT_CONFIG_LIMIT) {
-        out.push(`    … and ${blockingUnscannable.length - RESOLUTION_REPORT_CONFIG_LIMIT} more`);
+      if (items.length > RESOLUTION_REPORT_CONFIG_LIMIT) {
+        out.push(`    … and ${items.length - RESOLUTION_REPORT_CONFIG_LIMIT} more`);
       }
+    };
+    pushUnscannable(blockingUnscannableConfigs, opts.ignoreUnresolved ? `Ignored ${blockingUnscannableConfigs.length} configuration(s) that could not be scanned:` : `Could not scan ${blockingUnscannableConfigs.length} configuration(s) (reason from ${name}):`, u => `${u.config}${inProjects(u.project)}`);
+    pushUnscannable(blockingUnscannableProjects, opts.ignoreUnresolved ? `Ignored ${blockingUnscannableProjects.length} project(s) whose dependencies could not be resolved:` : `Could not resolve the dependencies of ${blockingUnscannableProjects.length} project(s) (reason from ${name}):`, u => `\`${u.project}\``);
+    if (succeeded.length || blockingFailed.length) {
+      out.push('');
     }
-    out.push('');
     if (succeeded.length) {
       out.push(`Resolution succeeded in: ${fmtList(succeeded, RESOLUTION_REPORT_CONFIG_LIMIT)}`);
     }
@@ -2628,14 +2750,12 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
     }
     if (willFail) {
       out.push('');
-      out.push(`To proceed, re-run with either:`);
-      out.push(`    --ignore-unresolved`);
-      if (blockingFailed.length) {
-        out.push(`    --exclude-configs '${blockingFailed.join(',')}'`);
-      }
+      out.push(...proceedHint(hints, tool, hasBlockingConfiglessFailure ? [] : blockingFailed), ...installErrorsHint(hints, false));
+    } else if (hints.continueOnInstallErrorsFlag) {
+      out.push('', ...installErrorsHint(hints, true));
     }
     out.push('');
-    out.push(`Re-run with --verbose for ${name}'s full messages.`);
+    out.push(hints.flags.has('verbose') ? `Re-run with --verbose for ${name}'s full messages.` : `For ${name}'s full messages, ${verboseHint(hints, tool)}.`);
   }
   const notices = [];
   for (const {
@@ -2648,11 +2768,11 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
     const configCount = new Set(infos.flatMap(i => [...i.configs])).size;
     notices.push(spec.notice(name, infos.length, configCount));
   }
-  // A config-level throw whose cause classifies as variant ambiguity is surfaced, not failed —
-  // matching the deliberately-lenient per-dep variant-ambiguity policy.
+  // A config-level throw whose cause classifies as variant ambiguity is surfaced, not failed: many
+  // configurations are marked resolvable yet too underspecified to resolve.
   if (nonBlockingUnscannable.length) {
     const n = new Set(nonBlockingUnscannable.map(u => u.config)).size;
-    notices.push(`Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.`);
+    notices.push(hints.flags.has('verbose') ? `Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.` : `Could not scan ${n} configuration(s); for ${name}'s messages, ${verboseHint(hints, tool)}.`);
   }
   const detailLines = [`${name}'s full message for each unresolved dependency:`];
   for (const info of allInfos) {
@@ -2664,10 +2784,10 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   }
   if (unscannable.length) {
     detailLines.push('');
-    detailLines.push(`${name} configurations that could not be scanned:`);
+    detailLines.push(`${name} resolutions that could not be scanned:`);
     for (const u of unscannable) {
       detailLines.push('');
-      detailLines.push(`  ${u.config}:`);
+      detailLines.push(`  ${u.config || 'all dependencies'}${inProjects(u.project)}:`);
       for (const line of (u.detail || '(no message)').split('\n')) {
         detailLines.push(`    ${line}`);
       }
@@ -2691,7 +2811,10 @@ function dialectFor(tool) {
   }
 }
 function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'gradle', opts = {}) {
-  return renderResolutionReport(failures, scannedConfigs, dialectFor(tool), opts);
+  return renderResolutionReport(failures, scannedConfigs, tool, opts);
+}
+function verboseHint(hints, tool) {
+  return hints.flags.has('verbose') ? 'pass --verbose' : `set defaults.manifest.${tool}.verbose to true in ${hints.socketJson}`;
 }
 
 const PURL_TYPE_MAVEN = 'maven';
@@ -2726,7 +2849,7 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], graphs, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], [...parsed.excludedProjects.values()], graphs, fileExists)
   };
 }
 
@@ -2753,11 +2876,13 @@ function buildPerRoot(parsed) {
           children: [],
           direct: false,
           project: n.project,
-          targets: []
+          targets: [],
+          unfetched: false
         };
         nodes.set(id, node);
       }
       node.direct ||= n.direct;
+      node.unfetched ||= n.unfetched;
       node.targets.push(...n.targets);
     }
     for (const [p, c] of r.edges) {
@@ -2797,7 +2922,7 @@ function mergeById(perRoot) {
           prod: false,
           direct: false,
           project: node.project,
-          targets: new Set()
+          resolutions: []
         };
         finalNodes.set(coordId, fn);
       }
@@ -2807,8 +2932,11 @@ function mergeById(perRoot) {
       if (node.direct) {
         fn.direct = true;
       }
-      for (const t of node.targets) {
-        fn.targets.add(t);
+      if (node.unfetched || node.targets.length) {
+        fn.resolutions.push({
+          targets: node.targets,
+          unfetched: node.unfetched
+        });
       }
     }
   }
@@ -3029,19 +3157,34 @@ function byProject(projects, graphs, ids) {
     return [p.projectKey, g ? [...ids(g)].sort() : []];
   }));
 }
-function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
+function buildArtifactPaths(finalNodes, projects, excludedProjects, graphs, fileExists) {
   const pathsById = new Map();
+  // Every root that fetched an artifact lists its file, so check each path once.
+  const existing = new Map();
+  const exists = p => {
+    let e = existing.get(p);
+    if (e === undefined) {
+      e = fileExists(p);
+      existing.set(p, e);
+    }
+    return e;
+  };
   for (const [id, fn] of finalNodes) {
     if (!fn.project) {
-      pathsById.set(id, {
+      // Only a root that fetched every file of the artifact, all still on
+      // disk, resolved it: a partial list would claim it resolved whole.
+      const complete = fn.resolutions.filter(r => !r.unfetched && r.targets.every(exists));
+      pathsById.set(id, fn.resolutions.length && !complete.length ? {
+        sources: []
+      } : {
         sources: [],
-        targets: [...fn.targets].filter(fileExists).sort()
+        targets: [...new Set(complete.flatMap(r => r.targets))].sort()
       });
     }
   }
   // A project's own component shares its id, so this also covers dependency
   // edges onto a sibling project.
-  for (const p of projects) {
+  for (const p of [...projects, ...excludedProjects]) {
     pathsById.set(p.projectKey, {
       sources: [...new Set(p.sources)].filter(fileExists).sort(),
       targets: [...new Set(p.targets)].filter(fileExists).sort()
@@ -3056,7 +3199,7 @@ function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
 function buildReport(parsed) {
   const seen = new Set();
   const failures = parsed.failures.filter(f => {
-    const key = `${f.coord}|${f.detail}|${f.config}`;
+    const key = `${f.coord}|${f.detail}|${f.config}|${f.project}`;
     if (seen.has(key)) {
       return false;
     }
@@ -3065,15 +3208,24 @@ function buildReport(parsed) {
   });
   const seenUnscannable = new Set();
   const unscannable = parsed.unscannable.filter(u => {
-    const key = `${u.config}|${u.detail}`;
+    const key = `${u.config}|${u.detail}|${u.project}`;
     if (seenUnscannable.has(key)) {
       return false;
     }
     seenUnscannable.add(key);
     return true;
   });
+  const resolvedModules = new Set();
+  if (failures.length) {
+    for (const r of parsed.roots.values()) {
+      for (const n of r.nodes.values()) {
+        resolvedModules.add(moduleKey(r.projectKey, `${n.coord.group}:${n.coord.name}`));
+      }
+    }
+  }
   return {
     failures,
+    resolvedModules,
     scannedConfigs: parsed.scannedConfigs,
     unscannable
   };
@@ -3227,13 +3379,15 @@ function serializeExcludePathPatterns(paths) {
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
 //   projectBuild  projectKey  path                     (build-root-relative; may be absent on disk)
+//   excludedProject  projectKey                          (--with-files only; paths without a project)
 //   root        rootId  projectKey  config  prod(0|1)
 //   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
 //   file        rootId  coordId  path                    (--with-files only)
+//   unfetched   rootId  coordId                          (--with-files only; requested artifact not fetched)
 //   scanned     config
-//   failure     coord  detail  config
-//   unscannable config  detail
+//   failure     coord  detail  config  projectKey   (config empty: not placeable in one)
+//   unscannable config  detail  projectKey          (config empty: whole project)
 //
 // `projectKey` is the tool's unique project identity (Maven: GAV; Gradle:
 // project path; sbt: project id), emitted as the project id; a `node` whose
@@ -3269,12 +3423,14 @@ function parseRecords(text) {
     buildRoot: '',
     entry: '',
     projects: new Map(),
+    excludedProjects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
     failures: [],
     unscannable: []
   };
   const scanned = new Set();
+  const excluded = new Set();
   const root = id => {
     let r = result.roots.get(id);
     if (!r) {
@@ -3343,6 +3499,9 @@ function parseRecords(text) {
           project(f[1] ?? '').targets.push(f[2]);
         }
         break;
+      case 'excludedProject':
+        excluded.add(f[1] ?? '');
+        break;
       case 'projectBuild':
         if (f[2]) {
           project(f[1] ?? '').buildFiles.push(f[2]);
@@ -3371,7 +3530,8 @@ function parseRecords(text) {
             },
             direct: bool(f[8]),
             project: f[9] ?? '',
-            targets: []
+            targets: [],
+            unfetched: false
           });
           break;
         }
@@ -3384,6 +3544,14 @@ function parseRecords(text) {
           }
           break;
         }
+      case 'unfetched':
+        {
+          const node = root(f[1] ?? '').nodes.get(f[2] ?? '');
+          if (node) {
+            node.unfetched = true;
+          }
+          break;
+        }
       case 'file':
         {
           const node = root(f[1] ?? '').nodes.get(f[2] ?? '');
@@ -3402,20 +3570,29 @@ function parseRecords(text) {
           result.failures.push({
             coord: f[1],
             detail: f[2] ?? '',
-            config: f[3] ?? ''
+            config: f[3] ?? '',
+            project: f[4] ?? ''
           });
         }
         break;
       case 'unscannable':
-        if (f[1]) {
+        if (f[1] || f[3]) {
           result.unscannable.push({
-            config: f[1],
-            detail: f[2] ?? ''
+            config: f[1] ?? '',
+            detail: f[2] ?? '',
+            project: f[3] ?? ''
           });
         }
         break;
     }
   }
+  for (const key of excluded) {
+    const p = result.projects.get(key);
+    if (p) {
+      result.projects.delete(key);
+      result.excludedProjects.set(key, p);
+    }
+  }
   result.scannedConfigs = [...scanned].sort();
   return result;
 }
@@ -3431,6 +3608,10 @@ function manifestScriptsPath(...parts) {
   return path.join(constants.default.distPath, 'manifest-scripts', ...parts);
 }
 
+// Streamed build output is a diagnostic: it goes to stderr so the command's own
+// stdout (e.g. --json) stays machine-readable.
+const STREAM_TO_STDERR = ['inherit', 2, 'inherit'];
+
 // Don't throw on a non-zero exit: the script emits failure records, so a usable
 // records file still exists. A non-exit spawn error (e.g. missing executable)
 // propagates.
@@ -3438,7 +3619,7 @@ async function runNeverThrow(bin, args, opts) {
   try {
     const result = await spawn.spawn(bin, args, {
       cwd: opts.projectDir,
-      stdio: opts.stdio ?? 'inherit',
+      stdio: opts.stdio === 'pipe' ? 'pipe' : [...STREAM_TO_STDERR],
       ...(opts.env ? {
         env: opts.env
       } : {}),
@@ -3563,7 +3744,10 @@ async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
     const bin = resolveBuildToolBin('gradle', opts.projectDir, opts.bin);
     // Disable the configuration cache: the init script's legacy
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
-    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
+    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false',
+    // Names each artifact's own verification problem, so a checksum missing
+    // from the metadata can be told apart from a mismatch.
+    '-Porg.gradle.dependency.verification.console=verbose', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
     return await assembleFromRecords('gradle', out, recordsFile);
   });
@@ -3577,6 +3761,11 @@ async function enumerateGradleWorkspaces(opts) {
 async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFilename, task) {
   await writeSbtPlugin(globalBase, pluginSourceFilename, pluginDestFilename);
   const recordsFile = path.join(globalBase, 'records.tsv');
+  // The global base is shared across sbt roots: a build that dies before
+  // writing must not be read as the previous root's records.
+  await u.promises.rm(recordsFile, {
+    force: true
+  });
   const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
   // Fresh per-run global base (not ~/.sbt): sbt executes everything under
   // plugins/, so a shared path is a code-injection surface. BSP off for this
@@ -3654,6 +3843,7 @@ async function runManifestFacts({
   ecosystem,
   excludeConfigs,
   excludePaths,
+  hints = FLAG_HINTS,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -3705,7 +3895,7 @@ async function runManifestFacts({
       logger.logger.info(`(Running ${ecosystem} with output streaming; this can take a while.)`);
       result = await runManifestScript(ecosystem, scriptOpts);
     } else {
-      logger.logger.info(`(No live output; pass --verbose to stream the ${ecosystem} build output.)`);
+      logger.logger.info(`(No live output; to stream the ${ecosystem} build output, ${verboseHint(hints, ecosystem)}.)`);
       spinner.start(`Resolving ${ecosystem} dependencies ...`);
       result = await runManifestScript(ecosystem, scriptOpts);
       if (result.code === 0) {
@@ -3721,7 +3911,7 @@ async function runManifestFacts({
       spinner.failAndStop(`Failed to run ${ecosystem}.`);
     }
     process.exitCode = 1;
-    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${utils.getErrorMessageOr(e, String(e))}` : ' (run with --verbose for details).'));
+    logger.logger.fail(`Could not run the ${ecosystem} build tool: ${utils.getErrorMessageOr(e, String(e))}`);
     return null;
   }
   const {
@@ -3735,7 +3925,9 @@ async function runManifestFacts({
     stdout
   } = result;
   const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
+    hints,
     ignoreUnresolved,
+    resolvedModules: report.resolvedModules,
     unscannable: report.unscannable
   });
   if (rendered.hasBlockingFailures) {
@@ -3821,16 +4013,22 @@ async function runManifestFacts({
   };
 }
 
+// Relative to the user's shell when inside it, else absolute.
+function displayPath(file) {
+  const rel = path.relative(process.cwd(), file);
+  return rel.startsWith('..') || path.isAbsolute(rel) ? file : rel;
+}
+
 // A cascaded (not just root-level) disabled additionally skips this one build
 // root here, on top of its existing root-only ecosystem-wide meaning for
 // auto/gradle/etc. facts:false has no pom-mode equivalent here (facts-only),
 // so it skips too.
-function getSkipReason(disabled, facts) {
+function getSkipReason(ecosystem, disabled, facts) {
   if (disabled) {
-    return 'defaults.manifest.<ecosystem>.disabled is true';
+    return `defaults.manifest.${ecosystem}.disabled is true`;
   }
   if (facts === false) {
-    return 'defaults.manifest.<ecosystem>.facts is false (pom mode)';
+    return `defaults.manifest.${ecosystem}.facts is false (pom mode)`;
   }
   return undefined;
 }
@@ -3849,6 +4047,8 @@ function nearestDisabledRoot(dir, disabledRoots) {
 async function runEcosystemCandidates({
   candidatesByTool,
   excludePaths,
+  ignoreUnresolved: ignoreUnresolvedOverride,
+  optionFlags,
   realCwd,
   rootSockJson,
   sbtTmpDir,
@@ -3879,7 +4079,8 @@ async function runEcosystemCandidates({
         ignoreUnresolved,
         includeConfigs,
         javaHome,
-        skipReason
+        skipReason,
+        verbose: configVerbose
       } = resolveEcosystemConfig(ecosystem, dir, sockJson);
       if (skipReason) {
         // Only warn for a genuinely new disabled root, not one already
@@ -3914,12 +4115,18 @@ async function runEcosystemCandidates({
         ecosystem,
         excludeConfigs,
         excludePaths: excludePathsForRoot,
-        ignoreUnresolved,
+        hints: {
+          continueOnInstallErrorsFlag: withFiles ? REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG : undefined,
+          flags: optionFlags,
+          setupCommand: DSI_SETUP_COMMAND,
+          socketJson: displayPath(path.join(dir, constants.SOCKET_JSON))
+        },
+        ignoreUnresolved: ignoreUnresolvedOverride ?? ignoreUnresolved,
         includeConfigs,
         javaHome,
         sidecarAcc,
         tmpDir: ecosystem === 'sbt' ? sbtTmpDir : undefined,
-        verbose,
+        verbose: verbose || configVerbose,
         withFiles
       });
       if (result === null) {
@@ -3928,8 +4135,11 @@ async function runEcosystemCandidates({
           ecosystem,
           status: 'failed'
         });
-        logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir}'s workspace layout could not be determined, so its remaining build roots cannot be safely classified as covered or independent.`);
-        for (const abortedDir of dirs.slice(dirIndex + 1)) {
+        const abortedDirs = dirs.slice(dirIndex + 1);
+        if (abortedDirs.length) {
+          logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir} failed to generate Socket facts, and without them the remaining build roots cannot be safely classified as covered or independent.`);
+        }
+        for (const abortedDir of abortedDirs) {
           outcomes.push({
             dir: abortedDir,
             ecosystem,
@@ -3966,6 +4176,8 @@ async function runEcosystemCandidates({
 async function generateRecursiveManifests({
   cwd,
   excludePaths,
+  ignoreUnresolved,
+  optionFlags = new Set(),
   sbtTmpDir,
   sidecarAcc,
   verbose,
@@ -3987,6 +4199,8 @@ async function generateRecursiveManifests({
   const runAll = resolvedSbtTmpDir => runEcosystemCandidates({
     candidatesByTool,
     excludePaths,
+    ignoreUnresolved,
+    optionFlags,
     realCwd,
     rootSockJson,
     sbtTmpDir: resolvedSbtTmpDir,
@@ -3998,10 +4212,10 @@ async function generateRecursiveManifests({
   // A shared global base across every sbt root in this run lets sbt's own
   // Scala-toolchain cache under <base>/boot survive between invocations
   // instead of being reprovisioned per root (the plugin file is rewritten and
-  // records.tsv is fully overwritten - not appended - on every invocation, so
-  // reuse is safe). A caller-supplied sbtTmpDir is reused as-is (the caller
-  // owns its lifetime); otherwise one is allocated and cleaned up here, but
-  // only when there's an sbt root to benefit from sharing it at all.
+  // records.tsv is removed before every invocation, so reuse is safe). A
+  // caller-supplied sbtTmpDir is reused as-is (the caller owns its lifetime);
+  // otherwise one is allocated and cleaned up here, but only when there's an
+  // sbt root to benefit from sharing it at all.
   const outcomes = sbtTmpDir ? await runAll(sbtTmpDir) : candidatesByTool.get('sbt')?.length ? await utils.withTmpDir('socket-sbt-facts-shared-', runAll) : await runAll(undefined);
   if (verbose) {
     logger.logger.info(`Discovered ${outcomes.length} build-tool candidate(s).`);
@@ -4023,7 +4237,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
       ignoreUnresolved: Boolean(config?.ignoreUnresolved),
       includeConfigs: config?.includeConfigs ?? '',
       javaHome: config?.javaHome ?? undefined,
-      skipReason: getSkipReason(config?.disabled, config?.facts)
+      skipReason: getSkipReason(ecosystem, config?.disabled, config?.facts),
+      verbose: Boolean(config?.verbose)
     };
   }
   if (ecosystem === 'gradle') {
@@ -4036,7 +4251,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
       ignoreUnresolved: Boolean(config?.ignoreUnresolved),
       includeConfigs: config?.includeConfigs ?? '',
       javaHome: config?.javaHome ?? undefined,
-      skipReason: getSkipReason(config?.disabled, config?.facts)
+      skipReason: getSkipReason(ecosystem, config?.disabled, config?.facts),
+      verbose: Boolean(config?.verbose)
     };
   }
   const config = sockJson.defaults?.manifest?.maven;
@@ -4048,7 +4264,8 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
     ignoreUnresolved: Boolean(config?.ignoreUnresolved),
     includeConfigs: config?.includeConfigs ?? '',
     javaHome: config?.javaHome ?? undefined,
-    skipReason: getSkipReason(config?.disabled)
+    skipReason: getSkipReason(ecosystem, config?.disabled),
+    verbose: Boolean(config?.verbose)
   };
 }
 
@@ -6463,6 +6680,7 @@ async function convertGradleToFacts({
   excludeConfigs,
   excludePaths,
   gradleOpts,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6470,13 +6688,14 @@ async function convertGradleToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: gradleOpts,
     cwd,
     ecosystem: 'gradle',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -6493,6 +6712,7 @@ async function convertMavenToFacts({
   cwd,
   excludeConfigs,
   excludePaths,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6501,13 +6721,14 @@ async function convertMavenToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: mavenOpts,
     cwd,
     ecosystem: 'maven',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -6525,6 +6746,7 @@ async function convertSbtToFacts({
   cwd,
   excludeConfigs,
   excludePaths,
+  hints,
   ignoreUnresolved,
   includeConfigs,
   javaHome,
@@ -6534,13 +6756,14 @@ async function convertSbtToFacts({
   verbose,
   withFiles
 }) {
-  await runManifestFacts({
+  return await runManifestFacts({
     bin,
     buildOpts: sbtOpts,
     cwd,
     ecosystem: 'sbt',
     excludeConfigs,
     excludePaths,
+    hints,
     ignoreUnresolved,
     includeConfigs,
     javaHome,
@@ -7004,12 +7227,20 @@ async function handleManifestConda({
   await outputRequirements(data, outputKind, out === '-' ? out : path.resolve(cwd, out));
 }
 
-// Under --auto-manifest, a manifest generator that failed — raising the exit
-// code above the value captured before it ran — aborts the whole run: a partial
-// or empty SBOM silently under-reports dependencies. The generator has already
-// logged the specifics. A tolerated resolution failure (ignoreUnresolved) warns
-// without touching the exit code, so it passes through here and the run
-// continues.
+// Auto-manifest reads every build option from the root socket.json.
+const AUTO_MANIFEST_HINTS = {
+  flags: new Set(),
+  setupCommand: 'socket manifest setup',
+  socketJson: constants.SOCKET_JSON
+};
+// A failed generator aborts --auto-manifest: a partial SBOM silently
+// under-reports dependencies. Facts generators return null on failure; the
+// others only change the exit code.
+function abortFactsRunIfFailed(ecosystem, outcome) {
+  if (outcome === null) {
+    throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
+  }
+}
 function abortManifestRunIfFailed(ecosystem, beforeExitCode) {
   if (process.exitCode && process.exitCode !== beforeExitCode) {
     throw new utils.InputError(`Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`);
@@ -7026,6 +7257,10 @@ async function generateAutoManifest({
 }) {
   const sockJson = utils.readOrDefaultSocketJson(cwd);
   const generatedFiles = [];
+  const hints = computeArtifactsSidecar ? {
+    ...AUTO_MANIFEST_HINTS,
+    continueOnInstallErrorsFlag: REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG
+  } : AUTO_MANIFEST_HINTS;
 
   // Resolved paths across all JVM roots, serialized to one sidecar at the end.
   const sidecarAcc = computeArtifactsSidecar ? new Map() : undefined;
@@ -7047,19 +7282,19 @@ async function generateAutoManifest({
     // `defaults.manifest.sbt.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.sbt?.facts !== false) {
       logger.logger.log('Detected a Scala sbt build, generating Socket facts...');
-      const beforeExitCode = process.exitCode;
-      await convertSbtToFacts({
+      const outcome = await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.sbt?.javaHome ?? undefined,
+        hints,
         sidecarAcc,
         tmpDir,
         withFiles: computeArtifactsSidecar
       });
-      abortManifestRunIfFailed('sbt', beforeExitCode);
+      abortFactsRunIfFailed('sbt', outcome);
     } else {
       logger.logger.log('Detected a Scala sbt build, generating pom files with sbt...');
       const beforeExitCode = process.exitCode;
@@ -7082,18 +7317,18 @@ async function generateAutoManifest({
     // `defaults.manifest.gradle.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.gradle?.facts !== false) {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), generating Socket facts...');
-      const beforeExitCode = process.exitCode;
-      await convertGradleToFacts({
+      const outcome = await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs: sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
         javaHome: sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined,
+        hints,
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
-      abortManifestRunIfFailed('gradle', beforeExitCode);
+      abortFactsRunIfFailed('gradle', outcome);
     } else {
       logger.logger.log('Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...');
       const beforeExitCode = process.exitCode;
@@ -7103,8 +7338,7 @@ async function generateAutoManifest({
   }
   if (!sockJson?.defaults?.manifest?.maven?.disabled && detected.maven) {
     logger.logger.log('Detected a Maven pom.xml build, generating Socket facts...');
-    const beforeExitCode = process.exitCode;
-    await convertMavenToFacts({
+    const outcome = await convertMavenToFacts({
       // Configured bin wins; else prefer ./mvnw, else mvn on PATH.
       bin: sockJson.defaults?.manifest?.maven?.bin ?? resolveBuildToolBin('maven', cwd),
       cwd,
@@ -7114,11 +7348,12 @@ async function generateAutoManifest({
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       javaHome: sockJson.defaults?.manifest?.maven?.javaHome ?? undefined,
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts ?? undefined),
+      hints,
       sidecarAcc,
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar
     });
-    abortManifestRunIfFailed('maven', beforeExitCode);
+    abortFactsRunIfFailed('maven', outcome);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
     const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
@@ -7414,17 +7649,13 @@ async function createNewScan({
         logger.logger.success('Reachability analysis completed successfully');
         reachabilityReport = reachResult.data?.reachabilityReport;
 
-        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
-        // (appended below) supersedes every facts file.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(p => !utils.isReachabilityReportPath(p, {
+        // Upload Coana's inputs next to its report: depscan drops the report's
+        // components without public metadata, such as private libraries.
+        const pathsForScan = (reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths).filter(p => !utils.isReachabilityReportPath(p, {
           cwd,
           outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON
-        })) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
-
-        // Append coana's reachability report, but not twice: a pre-generated facts
-        // input can resolve to the same path coana wrote its report to.
-        const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
-        scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
+        }));
+        scanPaths = [...pathsForScan, ...(reachabilityReport ? [reachabilityReport] : [])];
         tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
       }
     }
@@ -9989,7 +10220,7 @@ const excludePathsFlag$1 = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
-    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.'
   }
 };
 
@@ -12634,7 +12865,7 @@ const excludePathsFlag = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
-    description: 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+    description: 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.'
   }
 };
 
@@ -12935,12 +13166,15 @@ async function outputManifestDynamicSbomInference(result, outputKind) {
 async function handleManifestDynamicSbomInference({
   cwd,
   excludePaths,
+  ignoreUnresolved,
   outputKind,
   verbose
 }) {
   const outcomes = await generateRecursiveManifests({
     cwd,
     excludePaths,
+    ignoreUnresolved,
+    optionFlags: new Set(['ignoreUnresolved', 'verbose']),
     verbose
   });
   const result = !outcomes.length ? {
@@ -12968,6 +13202,10 @@ const config$d = {
     ...flags.commonFlags,
     ...flags.outputFlags,
     ...excludePathsFlag,
+    ignoreUnresolved: {
+      type: 'boolean',
+      description: "Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts files); overrides each build's socket.json setting"
+    },
     verbose: {
       type: 'boolean',
       default: false,
@@ -13012,6 +13250,7 @@ async function run$E(argv, importMeta, {
   });
   const {
     dryRun,
+    ignoreUnresolved,
     json,
     markdown,
     verbose: verboseFlag
@@ -13055,6 +13294,7 @@ async function run$E(argv, importMeta, {
   await handleManifestDynamicSbomInference({
     cwd,
     excludePaths,
+    ignoreUnresolved,
     outputKind,
     verbose
   });
@@ -14731,7 +14971,7 @@ async function enumerateWorkspaces({
     result = await enumerateWorkspaces$1(ecosystem, scriptOpts);
   } catch (e) {
     process.exitCode = 1;
-    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (' (run with --verbose for details).'));
+    logger.logger.fail(`Could not run the ${ecosystem} build tool: ${utils.getErrorMessageOr(e, String(e))}`);
     return;
   }
   if (!result.projects.length) {
@@ -19871,6 +20111,16 @@ async function validateReachabilityTarget(targets, cwd) {
   return result;
 }
 
+// Build options that `socket manifest <tool>` takes as flags but the scan
+// commands read from each build's socket.json, so passing them does nothing.
+const SOCKET_JSON_ONLY_FLAGS = ['excludeConfigs', 'ignoreUnresolved', 'includeConfigs', 'verbose'];
+function warnSocketJsonOnlyFlags(flags, command) {
+  const ignored = SOCKET_JSON_ONLY_FLAGS.filter(name => flags[name] !== undefined).map(name => `--${utils.camelToKebab(name)}`);
+  if (ignored.length) {
+    logger.logger.warn(`Ignoring ${ignored.join(', ')}: \`${command}\` reads build options from each build's socket.json. Set them there, for example with \`${DSI_SETUP_COMMAND}\`.`);
+  }
+}
+
 const CMD_NAME$a = 'create';
 
 // Accepted for backwards compatibility but forwarded nowhere, so passing one
@@ -20110,6 +20360,7 @@ async function run$d(argv, importMeta, {
 
   // Validate ecosystem values against the reachability-supported set.
   const reachEcosystems = utils.parseReachEcosystems(utils.cmdFlagValueToArray(cli.flags['reachEcosystems']));
+  warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$a}`);
   const dryRun = !!cli.flags['dryRun'];
   const uvMembers = !!cli.flags['uvMembers'];
   let {
@@ -22463,6 +22714,7 @@ async function run$7(argv, importMeta, {
     importMeta,
     parentName
   });
+  warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$4}`);
   const {
     cwd: cwdOverride,
     dynamicSbomInference,
@@ -24539,5 +24791,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=8345ea37-0e60-45d9-8a5b-618ab51856c6
+//# debugId=3195b2a9-2bce-44ed-8eea-bd5e763d40fa
 //# sourceMappingURL=cli.js.map