@socketsecurity/cli 1.1.101 → 1.1.151

package/dist/utils.js

@@ -3,8 +3,8 @@
 var vendor = require('./vendor.js');
 var logger = require('../external/@socketsecurity/registry/lib/logger');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
+var debug$2 = require('../external/@socketsecurity/registry/lib/debug');
+var objects = require('../external/@socketsecurity/registry/lib/objects');
 var constants = require('./constants.js');
 var arrays = require('../external/@socketsecurity/registry/lib/arrays');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
@@ -18,22 +18,23 @@ var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var fs = require('node:fs');
 var fs$2 = require('node:fs/promises');
-var promises$1 = require('node:stream/promises');
-var node_zlib = require('node:zlib');
+var require$$9 = require('node:stream/promises');
+var require$$11 = require('node:zlib');
 var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
-var require$$5 = require('node:module');
+var require$$1 = require('node:module');
 var os = require('node:os');
-var require$$3 = require('node:https');
+var require$$13 = require('node:https');
 var web = require('node:stream/web');
-var require$$13 = require('../external/@socketsecurity/registry/lib/url');
+var url = require('../external/@socketsecurity/registry/lib/url');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
 var require$$0$1 = require('node:url');
 var globs = require('../external/@socketsecurity/registry/lib/globs');
 var streams = require('../external/@socketsecurity/registry/lib/streams');
-var promises = require('node:timers/promises');
-var require$$1 = require('node:util');
+var require$$7 = require('node:timers/promises');
+var require$$10 = require('node:util');
+var require$$12 = require('node:http');
 var node_tls = require('node:tls');
 var process$1 = require('node:process');
 var require$$0 = require('node:crypto');
@@ -98,13 +99,13 @@ function debugApiResponse(method, endpoint, status, error, duration, headers) {
  */
 function debugFileOp(operation, filepath, error) {
   if (error) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       operation,
       filepath,
       error: error instanceof Error ? error.message : 'Unknown error'
     });
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `File ${operation}: ${filepath}`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `File ${operation}: ${filepath}`);
   }
 }
 
@@ -116,19 +117,19 @@ function debugScan(phase, packageCount, details) {
   switch (phase) {
     case 'start':
       if (packageCount) {
-        require$$9.debugFn('notice', `Scanning ${packageCount} packages`);
+        debug$2.debugFn('notice', `Scanning ${packageCount} packages`);
       }
       break;
     case 'progress':
-      if (require$$9.isDebug('silly') && packageCount) {
-        require$$9.debugFn('silly', `Scan progress: ${packageCount} packages processed`);
+      if (debug$2.isDebug('silly') && packageCount) {
+        debug$2.debugFn('silly', `Scan progress: ${packageCount} packages processed`);
       }
       break;
     case 'complete':
-      require$$9.debugFn('notice', `Scan complete${packageCount ? `: ${packageCount} packages` : ''}`);
+      debug$2.debugFn('notice', `Scan complete${packageCount ? `: ${packageCount} packages` : ''}`);
       break;
     case 'error':
-      require$$9.debugDir('error', {
+      debug$2.debugDir('error', {
         phase: 'scan_error',
         details
       });
@@ -141,14 +142,14 @@ function debugScan(phase, packageCount, details) {
  */
 function debugConfig(source, found, error) {
   if (error) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       source,
       error: error instanceof Error ? error.message : 'Unknown error'
     });
   } else if (found) {
-    require$$9.debugFn('notice', `Config loaded: ${source}`);
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `Config not found: ${source}`);
+    debug$2.debugFn('notice', `Config loaded: ${source}`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `Config not found: ${source}`);
   }
 }
 
@@ -158,15 +159,15 @@ function debugConfig(source, found, error) {
  */
 function debugGit(operation, success, details) {
   if (!success) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       git_op: operation,
       ...details
     });
-  } else if (require$$9.isDebug('notice') && operation.includes('push') || operation.includes('commit')) {
+  } else if (debug$2.isDebug('notice') && operation.includes('push') || operation.includes('commit')) {
     // Only log important operations like push and commit.
-    require$$9.debugFn('notice', `Git ${operation} succeeded`);
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `Git ${operation}`);
+    debug$2.debugFn('notice', `Git ${operation} succeeded`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `Git ${operation}`);
   }
 }
 
@@ -280,7 +281,7 @@ function shouldSave(currentContent, originalContent, originalFileContent, option
   const sortedContent = sort ? sortKeys(content) : content;
   const origContent = originalContent ? stripFormattingSymbols(originalContent) : {};
   if (ignoreWhitespace) {
-    return !require$$1.isDeepStrictEqual(sortedContent, origContent);
+    return !require$$10.isDeepStrictEqual(sortedContent, origContent);
   }
   const formatting = getFormattingFromContent(currentContent);
   const newFileContent = stringifyWithFormatting(sortedContent, formatting);
@@ -297,7 +298,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
       await fs.promises.writeFile(filepath, content);
       if (process.platform === 'win32') {
         // eslint-disable-next-line no-await-in-loop
-        await promises.setTimeout(50);
+        await require$$7.setTimeout(50);
         let accessRetries = 0;
         const maxAccessRetries = 5;
         while (accessRetries < maxAccessRetries) {
@@ -305,12 +306,12 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
             // eslint-disable-next-line no-await-in-loop
             await fs.promises.access(filepath);
             // eslint-disable-next-line no-await-in-loop
-            await promises.setTimeout(10);
+            await require$$7.setTimeout(10);
             break;
           } catch {
             const delay = 20 * (accessRetries + 1);
             // eslint-disable-next-line no-await-in-loop
-            await promises.setTimeout(delay);
+            await require$$7.setTimeout(delay);
             accessRetries++;
           }
         }
@@ -324,7 +325,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
       }
       const delay = baseDelay * 2 ** attempt;
       // eslint-disable-next-line no-await-in-loop
-      await promises.setTimeout(delay);
+      await require$$7.setTimeout(delay);
     }
   }
 }
@@ -353,7 +354,7 @@ async function readFile(filepath) {
       }
       const delay = process.platform === 'win32' ? 50 * (attempt + 1) : 20;
       // eslint-disable-next-line no-await-in-loop
-      await promises.setTimeout(delay);
+      await require$$7.setTimeout(delay);
     }
   }
   throw new Error('Unreachable code');
@@ -410,7 +411,7 @@ class EditableJson {
     const indent = detectIndent(data);
     const newline = detectNewline(data)
     // Use type assertion to allow symbol indexing.
-    ;
+;
     parsed[INDENT_SYMBOL] = indent;
     parsed[NEWLINE_SYMBOL] = newline;
     this._content = parsed;
@@ -524,7 +525,7 @@ class InputError extends Error {
 async function captureException(exception, hint) {
   const result = captureExceptionSync(exception, hint);
   // "Sleep" for a second, just in case, hopefully enough time to initiate fetch.
-  await promises.setTimeout(1000);
+  await require$$7.setTimeout(1000);
   return result;
 }
 function captureExceptionSync(exception, hint) {
@@ -532,7 +533,7 @@ function captureExceptionSync(exception, hint) {
   if (!Sentry) {
     return '';
   }
-  require$$9.debugFn('notice', 'send: exception to Sentry');
+  debug$2.debugFn('notice', 'send: exception to Sentry');
   return Sentry.captureException(exception, hint);
 }
 
@@ -694,8 +695,8 @@ function findSocketYmlSync(dir = process.cwd()) {
           }
         };
       } catch (e) {
-        require$$9.debugFn('error', `Failed to parse config file: ${ymlPath}`);
-        require$$9.debugDir('error', e);
+        debug$2.debugFn('error', `Failed to parse config file: ${ymlPath}`);
+        debug$2.debugDir('error', e);
         return {
           ok: false,
           message: `Found file but was unable to parse ${ymlPath}`,
@@ -759,7 +760,7 @@ let _cachedConfig;
 // When using --config or SOCKET_CLI_CONFIG, do not persist the config.
 let _configFromFlag = false;
 function overrideCachedConfig(jsonConfig) {
-  require$$9.debugFn('notice', 'override: full config (not stored)');
+  debug$2.debugFn('notice', 'override: full config (not stored)');
   let config;
   try {
     config = JSON.parse(String(jsonConfig));
@@ -801,15 +802,22 @@ function overrideCachedConfig(jsonConfig) {
   };
 }
 function overrideConfigApiToken(apiToken) {
-  require$$9.debugFn('notice', 'override: Socket API token (not stored)');
-  // Set token to the local cached config and mark it read-only so it doesn't persist.
-  _cachedConfig = {
-    ...vendor.configExports,
-    ...(apiToken === undefined ? {} : {
-      apiToken: String(apiToken)
-    })
-  };
-  _configFromFlag = true;
+  debug$2.debugFn('notice', 'override: Socket API token (not stored)');
+  if (apiToken === undefined) {
+    // SOCKET_CLI_NO_API_TOKEN: operate with no token and lock the config to
+    // read-only so nothing is persisted for this run.
+    _cachedConfig = {
+      ...vendor.configExports
+    };
+    _configFromFlag = true;
+    return;
+  }
+  // A token supplied via env (SOCKET_CLI_API_TOKEN / SOCKET_SECURITY_API_TOKEN)
+  // overrides authentication only. getDefaultApiToken() reads it straight from
+  // the environment, so we intentionally do NOT inject it into the cached config
+  // and do NOT mark the config read-only: unrelated keys (e.g. defaultOrg) can
+  // still be saved with `socket config set`, while the env token never reaches
+  // disk because it never enters the persisted cache.
 }
 let _pendingSave = false;
 function updateConfigValue(configKey, value) {
@@ -838,7 +846,7 @@ function updateConfigValue(configKey, value) {
     return {
       ok: true,
       message: `Config key '${key}' was ${wasDeleted ? 'deleted' : `updated`}`,
-      data: 'Change applied but not persisted; current config is overridden through env var or flag'
+      data: 'The active config is read-only because it was fully overridden by the ' + '--config flag, SOCKET_CLI_CONFIG, or SOCKET_CLI_NO_API_TOKEN. Remove ' + 'the override to save changes to disk.'
     };
   }
   if (!_pendingSave) {
@@ -931,7 +939,7 @@ function updateConfigValue(configKey, value) {
  * - Used for permission validation and help text
  */
 
-const require$3 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$3 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 let _requirements;
 function getRequirements() {
   if (_requirements === undefined) {
@@ -995,14 +1003,14 @@ function getRequirementsKey(cmdPath) {
  * Wraps debugFn to provide a simpler API.
  */
 const debug$1 = message => {
-  require$$9.debugFn('socket:telemetry:service', message);
+  debug$2.debugFn('socket:telemetry:service', message);
 };
 
 /**
  * DebugDir wrapper for telemetry service.
  */
 const debugDirWrapper = obj => {
-  require$$9.debugDir('socket:telemetry:service', obj);
+  debug$2.debugDir('socket:telemetry:service', obj);
 };
 
 /**
@@ -1367,7 +1375,7 @@ class TelemetryService {
  * Debug wrapper for telemetry integration.
  */
 const debug = message => {
-  require$$9.debugFn('socket:telemetry:integration', message);
+  debug$2.debugFn('socket:telemetry:integration', message);
 };
 
 /**
@@ -1816,6 +1824,32 @@ async function trackSubprocessError(command, startTime, error, exitCode, metadat
  * - Includes CLI version and platform information
  */
 
+// SDK v4 rejects request timeouts outside this range (see the SDK's
+// MIN_HTTP_TIMEOUT / MAX_HTTP_TIMEOUT). The SDK does not re-export those
+// constants, so the bounds are mirrored here.
+const MIN_API_TIMEOUT_MS = 5_000;
+const MAX_API_TIMEOUT_MS = 300_000;
+
+// Clamp a SOCKET_CLI_API_TIMEOUT value into the SDK's accepted range. The SDK
+// throws a TypeError on out-of-range timeouts, so an out-of-range user value
+// would otherwise make every API call fail; clamping preserves intent (a small
+// value maps to the floor, a huge value to the ceiling) while staying valid.
+function clampApiTimeout(timeout) {
+  return Math.min(Math.max(timeout, MIN_API_TIMEOUT_MS), MAX_API_TIMEOUT_MS);
+}
+
+// Lazy-evaluated full CLI user agent for direct (non-SDK) API calls.
+// Includes the CLI product token, Node.js version, and OS platform/arch.
+// e.g. "socket/1.1.96 node/v22.0.0 linux/arm64"
+let _cliUserAgent;
+function getCliUserAgent() {
+  if (!_cliUserAgent) {
+    const name = constants.default.ENV.INLINED_SOCKET_CLI_NAME.replace('@', '').replace('/', '-');
+    const version = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
+    _cliUserAgent = [`${name}/${version}`, `node/${process.version}`, `${process.platform}/${process.arch}`].join(' ');
+  }
+  return _cliUserAgent;
+}
 const TOKEN_PREFIX = 'sktsec_';
 const TOKEN_PREFIX_LENGTH = TOKEN_PREFIX.length;
 const TOKEN_VISIBLE_LENGTH = 5;
@@ -1823,13 +1857,13 @@ const TOKEN_VISIBLE_LENGTH = 5;
 // The Socket API server that should be used for operations.
 function getDefaultApiBaseUrl$1() {
   const baseUrl = constants.default.ENV.SOCKET_CLI_API_BASE_URL || getConfigValueOrUndef(constants.CONFIG_KEY_API_BASE_URL);
-  return require$$13.isUrl(baseUrl) ? baseUrl : undefined;
+  return url.isUrl(baseUrl) ? baseUrl : undefined;
 }
 
 // The Socket API server that should be used for operations.
 function getDefaultProxyUrl() {
   const apiProxy = constants.default.ENV.SOCKET_CLI_API_PROXY || getConfigValueOrUndef(constants.CONFIG_KEY_API_PROXY);
-  return require$$13.isUrl(apiProxy) ? apiProxy : undefined;
+  return url.isUrl(apiProxy) ? apiProxy : undefined;
 }
 
 // Cached extra CA certificates for SSL_CERT_FILE support.
@@ -1862,7 +1896,7 @@ function getExtraCaCerts() {
     _extraCaCerts = [...node_tls.rootCertificates, extraCerts];
     return _extraCaCerts;
   } catch (e) {
-    require$$9.debugFn('warn', `Failed to read certificate file: ${certPath}`, e);
+    debug$2.debugFn('warn', `Failed to read certificate file: ${certPath}`, e);
     return undefined;
   }
 }
@@ -1912,7 +1946,7 @@ async function setupSdk(options) {
   let {
     apiProxy
   } = opts;
-  if (!require$$13.isUrl(apiProxy)) {
+  if (!url.isUrl(apiProxy)) {
     apiProxy = getDefaultProxyUrl();
   }
   const {
@@ -1921,31 +1955,45 @@ async function setupSdk(options) {
 
   // Usage of HttpProxyAgent vs. HttpsProxyAgent based on the chart at:
   // https://github.com/delvedor/hpagent?tab=readme-ov-file#usage
-  const ProxyAgent = apiBaseUrl?.startsWith('http:') ? vendor.HttpProxyAgent : vendor.HttpsProxyAgent;
+  const isHttp = apiBaseUrl?.startsWith('http:');
+  const ProxyAgent = isHttp ? vendor.HttpProxyAgent : vendor.HttpsProxyAgent;
 
   // Load extra CA certificates for SSL_CERT_FILE support when
   // NODE_EXTRA_CA_CERTS was not set at process startup.
   const ca = getExtraCaCerts();
+
+  // Always pass an explicit agent. Node >=19's global agent enables keepAlive
+  // with a 5s socket timeout that Node applies as a per-socket inactivity
+  // timeout. A request made without an explicit agent inherits it and is torn
+  // down after 5s of socket inactivity, even when SOCKET_CLI_API_TIMEOUT is
+  // unset. This breaks slow endpoints like upload-manifest-files, which streams
+  // a chunked multipart body while the server parses auth/multipart before
+  // sending any response byte. A fresh Agent carries no timeout, so a request
+  // is bounded only by a real SOCKET_CLI_API_TIMEOUT (applied below via the
+  // SDK's timeout option) or until interrupted.
   const sdkOptions = {
-    ...(apiProxy ? {
-      agent: new ProxyAgent({
-        proxy: apiProxy,
-        ...(ca ? {
-          ca,
-          proxyConnectOptions: {
-            ca
-          }
-        } : {})
-      })
-    } : ca ? {
-      agent: new require$$3.Agent({
-        ca
-      })
-    } : {}),
+    agent: apiProxy ? new ProxyAgent({
+      proxy: apiProxy,
+      ...(ca ? {
+        ca,
+        proxyConnectOptions: {
+          ca
+        }
+      } : {})
+    }) : isHttp ? new require$$12.Agent() : new require$$13.Agent(ca ? {
+      ca
+    } : undefined),
     ...(apiBaseUrl ? {
       baseUrl: apiBaseUrl
     } : {}),
-    timeout: constants.default.ENV.SOCKET_CLI_API_TIMEOUT,
+    // SDK v4 validates the request timeout to be within [5000, 300000] ms and
+    // throws otherwise. Only forward a truthy timeout; when unset (0) omit it
+    // so the SDK applies its own default instead of rejecting the value. A
+    // truthy-but-out-of-range value is clamped into the accepted range rather
+    // than forwarded, which would make every SDK call throw.
+    ...(constants.default.ENV.SOCKET_CLI_API_TIMEOUT ? {
+      timeout: clampApiTimeout(constants.default.ENV.SOCKET_CLI_API_TIMEOUT)
+    } : {}),
     userAgent: vendor.distExports.createUserAgentFromPkgJson({
       name: constants.default.ENV.INLINED_SOCKET_CLI_NAME,
       version: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
@@ -2034,32 +2082,36 @@ async function setupSdk(options) {
 const MAX_REDIRECTS = 20;
 const NO_ERROR_MESSAGE = 'No error message returned';
 
-// Cached HTTPS agent for extra CA certificate support in direct API calls.
+// Cached HTTPS agent for direct API calls. Undefined only until the first
+// getHttpsAgent() call lazily creates it.
 let _httpsAgent;
-let _httpsAgentResolved = false;
 
-// Returns an HTTPS agent configured with extra CA certificates when
-// SSL_CERT_FILE is set but NODE_EXTRA_CA_CERTS is not.
+// Returns an explicit HTTPS agent for direct API calls, carrying extra CA
+// certificates when SSL_CERT_FILE is set but NODE_EXTRA_CA_CERTS is not. An
+// explicit agent is always returned. Node >=19's global agent enables keepAlive
+// with a 5s socket timeout that Node applies as a per-socket inactivity
+// timeout. A request made without an explicit agent inherits it and is torn
+// down after 5s of socket inactivity, prematurely dropping slow or idle-gapped
+// requests (e.g. streaming full-scan responses, large downloads) even when no
+// timeout was requested. A fresh Agent carries no timeout.
 function getHttpsAgent() {
-  if (_httpsAgentResolved) {
+  if (_httpsAgent) {
     return _httpsAgent;
   }
-  _httpsAgentResolved = true;
   const ca = getExtraCaCerts();
-  if (!ca) {
-    return undefined;
-  }
-  _httpsAgent = new require$$3.Agent({
+  const agent = ca ? new require$$13.Agent({
     ca
-  });
-  return _httpsAgent;
+  }) : new require$$13.Agent();
+  _httpsAgent = agent;
+  return agent;
 }
 
 // All outbound API requests use node:https.request rather than global fetch.
 // This ensures no body timeout is applied — large streaming ND-JSON responses
-// (e.g. full scan results) can transfer without a hard deadline. When
-// SSL_CERT_FILE is configured, a custom HttpsAgent carrying the extra CA
-// certificates is passed; otherwise the default agent is used.
+// (e.g. full scan results) can transfer without a hard deadline. An explicit
+// HttpsAgent is always passed (carrying extra CA certificates when
+// SSL_CERT_FILE is configured) so requests do not inherit Node's global-agent
+// keepAlive socket timeout.
 
 // Internal httpsRequest-based fetch with redirect support.
 function _httpsRequestFetch(url, init, agent, redirectCount) {
@@ -2071,7 +2123,7 @@ function _httpsRequestFetch(url, init, agent, redirectCount) {
     if (init.body) {
       headers['content-length'] = String(Buffer.byteLength(init.body));
     }
-    const req = require$$3.request(url, {
+    const req = require$$13.request(url, {
       method: init.method || 'GET',
       headers,
       agent
@@ -2220,6 +2272,26 @@ async function getErrorMessageForHttpStatusCode(code) {
   }
   return `Server responded with status code ${code}`;
 }
+
+/**
+ * The subset of a Socket SDK result that {@link handleApiCall} reads. Both the
+ * OpenAPI-derived `SocketSdkResult<T>` family and the SDK 4.x strict result
+ * types (`OrganizationsResult`, `RepositoryResult`, `DeleteResult`, ...)
+ * structurally satisfy this shape, so a caller can pass whichever result a
+ * given SDK method returns without forcing a (sometimes stale) operation-key
+ * shape onto the strict return types.
+ */
+
+/**
+ * The success `data` type carried by a Socket SDK result union `R`. The
+ * conditional distributes over `R`'s members, so only the success member(s)
+ * contribute their `data`; the error member resolves to `never` and drops out.
+ * Inferring the whole result `R` and extracting here (rather than inferring a
+ * bare `Data` from a `Promise<{ data: Data } | ...>`) avoids `Data` absorbing
+ * the error branch's `data?: undefined` — which would otherwise widen every
+ * result to `CResult<Data | undefined>`.
+ */
+
 /**
  * Handle Socket SDK API calls with error handling and permission logging.
  */
@@ -2268,25 +2340,25 @@ async function handleApiCall(value, options) {
     if (description && !silence) {
       logger.logger.fail(`An error was thrown while requesting ${description}`);
     }
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       socketSdkErrorResult
     });
     return socketSdkErrorResult;
   }
 
-  // Note: TS can't narrow down the type of result due to generics.
+  // The `success` discriminant is a concrete boolean literal in both branches,
+  // so this narrows the result to its error branch regardless of `R`.
   if (sdkResult.success === false) {
     const endpoint = description || 'Socket API';
     debugApiResponse('API', endpoint, sdkResult.status);
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       sdkResult
     });
-    const errCResult = sdkResult;
-    const errStr = errCResult.error ? String(errCResult.error).trim() : '';
+    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
     const message = errStr || NO_ERROR_MESSAGE;
-    const reason = errCResult.cause || NO_ERROR_MESSAGE;
+    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
     const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
-    const cause = errCResult.url ? `${baseCause} (url: ${errCResult.url})` : baseCause;
+    const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
     const socketSdkErrorResult = {
       ok: false,
       message: 'Socket API error',
@@ -2302,6 +2374,9 @@ async function handleApiCall(value, options) {
     }
     return socketSdkErrorResult;
   }
+  // Narrowing a type parameter by its `success` discriminant resolves `.data`
+  // through the constraint's success branch (`unknown`); re-apply the precise
+  // per-call success type the return contract already guarantees.
   const socketSdkSuccessResult = {
     ok: true,
     data: sdkResult.data
@@ -2313,8 +2388,8 @@ async function handleApiCallNoSpinner(value, description) {
   try {
     sdkResult = await value;
   } catch (e) {
-    require$$9.debugFn('error', `API request failed: ${description}`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `API request failed: ${description}`);
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'Socket API error';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2328,18 +2403,18 @@ async function handleApiCallNoSpinner(value, description) {
     };
   }
 
-  // Note: TS can't narrow down the type of result due to generics
+  // The `success` discriminant is a concrete boolean literal in both branches,
+  // so this narrows the result to its error branch regardless of `R`.
   if (sdkResult.success === false) {
-    require$$9.debugFn('error', `fail: ${description} bad response`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `fail: ${description} bad response`);
+    debug$2.debugDir('inspect', {
       sdkResult
     });
-    const sdkErrorResult = sdkResult;
-    const errStr = sdkErrorResult.error ? String(sdkErrorResult.error).trim() : '';
+    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
     const message = errStr || NO_ERROR_MESSAGE;
-    const reason = sdkErrorResult.cause || NO_ERROR_MESSAGE;
+    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
     const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
-    const cause = sdkErrorResult.url ? `${baseCause} (url: ${sdkErrorResult.url})` : baseCause;
+    const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
     return {
       ok: false,
       message: 'Socket API error',
@@ -2349,10 +2424,12 @@ async function handleApiCallNoSpinner(value, description) {
       }
     };
   } else {
-    const sdkSuccessResult = sdkResult;
+    // Narrowing a type parameter by its `success` discriminant resolves `.data`
+    // through the constraint's success branch (`unknown`); re-apply the precise
+    // per-call success type the return contract already guarantees.
     return {
       ok: true,
-      data: sdkSuccessResult.data
+      data: sdkResult.data
     };
   }
 }
@@ -2365,16 +2442,19 @@ async function queryApi(path, apiToken) {
   const result = await apiFetch(url, {
     method: 'GET',
     headers: {
-      Authorization: `Basic ${btoa(`${apiToken}:`)}`
+      Authorization: `Basic ${btoa(`${apiToken}:`)}`,
+      'User-Agent': getCliUserAgent()
     }
   });
   return result;
 }
-
 /**
- * Query Socket API endpoint and return text response with error handling.
+ * Query a Socket API endpoint and return the HTTP status alongside the text
+ * body, with error handling. Unlike queryApiSafeText this surfaces the status
+ * on success (including 2xx statuses like 202 Accepted), so callers can drive
+ * status-dependent flows such as the cached-scan 202 poll loop.
  */
-async function queryApiSafeText(path, description, commandPath) {
+async function queryApiSafeTextWithStatus(path, description, commandPath) {
   const apiToken = getDefaultApiToken();
   if (!apiToken) {
     return {
@@ -2405,8 +2485,8 @@ async function queryApiSafeText(path, description, commandPath) {
       spinner.failAndStop(`An error was thrown while requesting ${description}.`);
       debugApiResponse('GET', path, undefined, e, duration);
     }
-    require$$9.debugFn('error', 'Query API request failed');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Query API request failed');
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'API request failed';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2432,14 +2512,17 @@ async function queryApiSafeText(path, description, commandPath) {
     };
   }
   try {
-    const data = await result.text();
+    const text = await result.text();
     return {
       ok: true,
-      data
+      data: {
+        status: result.status,
+        text
+      }
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to read API response text');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to read API response text');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'API request failed',
@@ -2448,6 +2531,17 @@ async function queryApiSafeText(path, description, commandPath) {
   }
 }
 
+/**
+ * Query Socket API endpoint and return text response with error handling.
+ */
+async function queryApiSafeText(path, description, commandPath) {
+  const result = await queryApiSafeTextWithStatus(path, description);
+  return result.ok ? {
+    ok: true,
+    data: result.data.text
+  } : result;
+}
+
 /**
  * Query Socket API endpoint and return parsed JSON response.
  */
@@ -2510,7 +2604,8 @@ async function sendApiRequest(path, options) {
       method,
       headers: {
         Authorization: `Basic ${btoa(`${apiToken}:`)}`,
-        'Content-Type': 'application/json'
+        'Content-Type': 'application/json',
+        'User-Agent': getCliUserAgent()
       },
       ...(body ? {
         body: JSON.stringify(body)
@@ -2524,8 +2619,8 @@ async function sendApiRequest(path, options) {
     if (description) {
       spinner.failAndStop(`An error was thrown while requesting ${description}.`);
     }
-    require$$9.debugFn('error', `API ${method} request failed`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `API ${method} request failed`);
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'API request failed';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2561,8 +2656,8 @@ async function sendApiRequest(path, options) {
       data: data
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to parse API response JSON');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to parse API response JSON');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'API request failed',
@@ -2693,9 +2788,9 @@ cols) {
 // Serialize the final result object before printing it
 // All commands that support the --json flag should call this before printing
 function serializeResultJson(data) {
-  if (!require$$11.isObject(data)) {
+  if (!objects.isObject(data)) {
     process.exitCode = 1;
-    require$$9.debugFn('inspect', {
+    debug$2.debugFn('inspect', {
       data
     });
 
@@ -2713,8 +2808,8 @@ function serializeResultJson(data) {
     process.exitCode = 1;
     const message = 'There was a problem converting the data set to JSON. Please try again without --json';
     logger.logger.fail(message);
-    require$$9.debugFn('error', 'JSON serialization failed');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'JSON serialization failed');
+    debug$2.debugDir('error', e);
 
     // This could be caused by circular references, which is an "us" problem.
     return `${JSON.stringify({
@@ -2979,7 +3074,7 @@ function getHelpListOutput(list, options) {
   const names = Object.keys(list).sort(sorts.naturalCompare);
   for (const name of names) {
     const entry = list[name];
-    const entryIsObj = require$$11.isObject(entry);
+    const entryIsObj = objects.isObject(entry);
     if (entryIsObj && 'hidden' in entry && entry?.hidden) {
       continue;
     }
@@ -3077,9 +3172,9 @@ function getAsciiHeader(command, orgFlag, compactMode = false) {
   // Version display: show hash in debug mode, otherwise show semantic version.
   const fullVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   const versionHash = constants.default.ENV.INLINED_SOCKET_CLI_VERSION_HASH;
-  const cliVersion = redacting ? REDACTED : require$$9.isDebug() ? versionHash : `v${fullVersion}`;
+  const cliVersion = redacting ? REDACTED : debug$2.isDebug() ? versionHash : `v${fullVersion}`;
   const nodeVersion = redacting ? REDACTED : process.version;
-  const showNodeVersion = !redacting && require$$9.isDebug();
+  const showNodeVersion = !redacting && debug$2.isDebug();
   const defaultOrg = getConfigValueOrUndef(constants.CONFIG_KEY_DEFAULT_ORG);
   const configFromFlagDot = isConfigFromFlag() ? '*' : '.';
 
@@ -3197,7 +3292,7 @@ async function meowWithSubcommands(config, options) {
       hidden: true,
       description: 'Print the app version'
     },
-    ...require$$11.getOwn(additionalOptions, 'flags')
+    ...objects.getOwn(additionalOptions, 'flags')
   };
   const [commandOrAliasName_, ...rawCommandArgv] = argv;
   let commandOrAliasName = commandOrAliasName_;
@@ -3232,7 +3327,7 @@ async function meowWithSubcommands(config, options) {
     }
   }
   if (isRootCommand) {
-    const hiddenDebugFlag = !require$$9.isDebug();
+    const hiddenDebugFlag = !debug$2.isDebug();
     flags$1['compactHeader'] = {
       ...flags$1['compactHeader'],
       hidden: false
@@ -3295,7 +3390,7 @@ async function meowWithSubcommands(config, options) {
     spinner: spinnerFlag
   } = cli1.flags;
   const compactMode = compactHeaderFlag || constants.default.ENV.CI && !constants.default.ENV.VITEST;
-  const noSpinner = spinnerFlag === false || require$$9.isDebug();
+  const noSpinner = spinnerFlag === false || debug$2.isDebug();
 
   // Use CI spinner style when --no-spinner is passed or debug mode is enabled.
   // This prevents the spinner from interfering with debug output.
@@ -3318,8 +3413,10 @@ async function meowWithSubcommands(config, options) {
   } else {
     const tokenOverride = constants.default.ENV.SOCKET_CLI_API_TOKEN;
     if (tokenOverride) {
-      // This will set the token (even if there was a config override) and
-      // set it to readOnly, making sure the temp token won't be persisted.
+      // The env token overrides authentication only. getDefaultApiToken reads it
+      // straight from the environment, so overrideConfigApiToken does not inject
+      // it into the cached config and leaves the config writable — unrelated keys
+      // still persist, while the env token itself is never written to disk.
       overrideConfigApiToken(tokenOverride);
     }
   }
@@ -3393,10 +3490,10 @@ async function meowWithSubcommands(config, options) {
   } else {
     lines.push('Commands');
     lines.push(`  ${getHelpListOutput({
-      ...require$$11.toSortedObject(Object.fromEntries(Object.entries(subcommands).filter(({
+      ...objects.toSortedObject(Object.fromEntries(Object.entries(subcommands).filter(({
         1: subcommand
       }) => !subcommand.hidden))),
-      ...require$$11.toSortedObject(Object.fromEntries(Object.entries(aliases).filter(({
+      ...objects.toSortedObject(Object.fromEntries(Object.entries(aliases).filter(({
         1: alias
       }) => {
         const {
@@ -3541,7 +3638,7 @@ function meowOrExit(config, options) {
     version: versionFlag
   } = cli.flags;
   const compactMode = compactHeaderFlag || constants.default.ENV.CI && !constants.default.ENV.VITEST;
-  const noSpinner = spinnerFlag === false || require$$9.isDebug();
+  const noSpinner = spinnerFlag === false || debug$2.isDebug();
 
   // Use CI spinner style when --no-spinner is passed.
   // This prevents the spinner from interfering with debug output.
@@ -3578,7 +3675,7 @@ function meowOrExit(config, options) {
   }
 
   // Meow doesn't detect 'version' as an unknown flag, so we do the leg work here.
-  if (versionFlag && !require$$11.hasOwn(cliConfig.flags, 'version')) {
+  if (versionFlag && !objects.hasOwn(cliConfig.flags, 'version')) {
     // Use `console.error` here instead of `logger.error` to match Meow behavior.
     console.error('Unknown flag\n--version');
     // eslint-disable-next-line n/no-process-exit
@@ -3649,7 +3746,7 @@ async function fetchOrganization(options) {
     }
     sockSdk = sockSdkCResult.data;
   }
-  const orgsCResult = await handleApiCall(sockSdk.getOrganizations(), {
+  const orgsCResult = await handleApiCall(sockSdk.listOrganizations(), {
     description,
     silence
   });
@@ -3778,7 +3875,7 @@ async function determineOrgSlug(orgFlag, interactive, dryRun) {
 async function getDefaultOrgSlug(silence) {
   const defaultOrgResult = getConfigValueOrUndef('defaultOrg');
   if (defaultOrgResult) {
-    require$$9.debugFn('notice', 'use: org from "defaultOrg" value of socket/settings local app data', defaultOrgResult);
+    debug$2.debugFn('notice', 'use: org from "defaultOrg" value of socket/settings local app data', defaultOrgResult);
     return {
       ok: true,
       data: defaultOrgResult
@@ -3786,7 +3883,7 @@ async function getDefaultOrgSlug(silence) {
   }
   const envOrgSlug = constants.default.ENV.SOCKET_CLI_ORG_SLUG;
   if (envOrgSlug) {
-    require$$9.debugFn('notice', 'use: org from SOCKET_CLI_ORG_SLUG environment variable', envOrgSlug);
+    debug$2.debugFn('notice', 'use: org from SOCKET_CLI_ORG_SLUG environment variable', envOrgSlug);
     return {
       ok: true,
       data: envOrgSlug
@@ -3809,7 +3906,12 @@ async function getDefaultOrgSlug(silence) {
       data: `No organization associated with the Socket API token. Unable to continue.`
     };
   }
-  const slug = organizations[keys[0]]?.name ?? undefined;
+
+  // Use the org's URL-safe `slug`, not its display `name`: this value is
+  // exported as SOCKET_ORG_SLUG for the Coana CLI, which resolves the org by
+  // slug. `name` is the human-readable display name (and may be null), so using
+  // it here produced a wrong/empty org identifier.
+  const slug = organizations[0]?.slug ?? undefined;
   if (!slug) {
     return {
       ok: false,
@@ -3817,7 +3919,7 @@ async function getDefaultOrgSlug(silence) {
       data: `Cannot determine the default organization for the API token. Unable to continue.`
     };
   }
-  require$$9.debugFn('notice', 'resolve: org from Socket API', slug);
+  debug$2.debugFn('notice', 'resolve: org from Socket API', slug);
   return {
     ok: true,
     message: 'Retrieved default org from server',
@@ -3954,14 +4056,14 @@ async function getRepoInfo(cwd = process.cwd()) {
     })).stdout;
     info = parseGitRemoteUrl(remoteUrl);
     if (!info) {
-      require$$9.debugFn('warn', `Unmatched git remote URL format: ${remoteUrl}`);
-      require$$9.debugDir('warn', {
+      debug$2.debugFn('warn', `Unmatched git remote URL format: ${remoteUrl}`);
+      debug$2.debugDir('warn', {
         remoteUrl
       });
     }
   } catch (e) {
     // Expected failure when not in a git repo.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'git remote get-url failed',
       error: e
     });
@@ -3987,7 +4089,7 @@ async function gitBranch(cwd = process.cwd()) {
     return gitSymbolicRefResult.stdout;
   } catch (e) {
     // Expected in detached HEAD state, fallback to rev-parse.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'In detached HEAD state',
       error: e
     });
@@ -3999,7 +4101,7 @@ async function gitBranch(cwd = process.cwd()) {
     return gitRevParseResult.stdout;
   } catch (e) {
     // Both methods failed, likely not in a git repo.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'Unable to determine git branch',
       error: e
     });
@@ -4031,7 +4133,7 @@ async function detectDefaultBranch(cwd = process.cwd()) {
 async function gitCleanFdx(cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['clean', '-fdx'], stdioIgnoreOptions);
@@ -4047,7 +4149,7 @@ async function gitCleanFdx(cwd = process.cwd()) {
 async function gitCheckoutBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['checkout', branch], stdioIgnoreOptions);
@@ -4066,7 +4168,7 @@ async function gitCreateBranch(branch, cwd = process.cwd()) {
   }
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['branch', branch], stdioIgnoreOptions);
@@ -4082,7 +4184,7 @@ async function gitCreateBranch(branch, cwd = process.cwd()) {
 async function gitPushBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['push', '--force', '--set-upstream', 'origin', branch], stdioIgnoreOptions);
@@ -4090,9 +4192,9 @@ async function gitPushBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     if (spawn.isSpawnError(e) && e.code === 128) {
-      require$$9.debugFn('error', "Push denied: token requires write permissions for 'contents' and 'pull-requests'");
-      require$$9.debugDir('error', e);
-      require$$9.debugDir('inspect', {
+      debug$2.debugFn('error', "Push denied: token requires write permissions for 'contents' and 'pull-requests'");
+      debug$2.debugDir('error', e);
+      debug$2.debugDir('inspect', {
         branch
       });
     } else {
@@ -4105,7 +4207,7 @@ async function gitPushBranch(branch, cwd = process.cwd()) {
 }
 async function gitCommit(commitMsg, filepaths, options) {
   if (!filepaths.length) {
-    require$$9.debugFn('notice', `miss: no filepaths to add`);
+    debug$2.debugFn('notice', `miss: no filepaths to add`);
     return false;
   }
   const {
@@ -4119,7 +4221,7 @@ async function gitCommit(commitMsg, filepaths, options) {
   await gitEnsureIdentity(user, email, cwd);
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['add', ...filepaths], stdioIgnoreOptions);
@@ -4130,7 +4232,7 @@ async function gitCommit(commitMsg, filepaths, options) {
     debugGit('add', false, {
       error: e
     });
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       filepaths
     });
     return false;
@@ -4143,7 +4245,7 @@ async function gitCommit(commitMsg, filepaths, options) {
     debugGit('commit', false, {
       error: e
     });
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       commitMsg
     });
   }
@@ -4152,7 +4254,7 @@ async function gitCommit(commitMsg, filepaths, options) {
 async function gitDeleteBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if branch does not exist.
@@ -4160,7 +4262,7 @@ async function gitDeleteBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     // Expected failure when branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Branch deletion failed (may not exist): ${branch}`,
       error: e
     });
@@ -4170,7 +4272,7 @@ async function gitDeleteBranch(branch, cwd = process.cwd()) {
 async function gitDeleteRemoteBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if branch does not exist.
@@ -4178,7 +4280,7 @@ async function gitDeleteRemoteBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     // Expected failure when remote branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Remote branch deletion failed (may not exist): ${branch}`,
       error: e
     });
@@ -4201,7 +4303,7 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
       configValue = gitConfigResult.stdout;
     } catch (e) {
       // Expected when config property is not set.
-      require$$9.debugDir('inspect', {
+      debug$2.debugDir('inspect', {
         message: `Git config property not set: ${prop}`,
         error: e
       });
@@ -4209,14 +4311,14 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
     if (configValue !== value) {
       const stdioIgnoreOptions = {
         cwd,
-        stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+        stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
       };
       try {
         await spawn.spawn('git', ['config', prop, value], stdioIgnoreOptions);
       } catch (e) {
-        require$$9.debugFn('warn', `Failed to set git config: ${prop}`);
-        require$$9.debugDir('warn', e);
-        require$$9.debugDir('inspect', {
+        debug$2.debugFn('warn', `Failed to set git config: ${prop}`);
+        debug$2.debugDir('warn', e);
+        debug$2.debugDir('inspect', {
           value
         });
       }
@@ -4226,7 +4328,7 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
 async function gitLocalBranchExists(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if the branch does not exist.
@@ -4246,7 +4348,7 @@ async function gitRemoteBranchExists(branch, cwd = process.cwd()) {
     return lsRemoteResult.stdout.length > 0;
   } catch (e) {
     // Expected when remote is not accessible or branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Remote branch check failed: ${branch}`,
       error: e
     });
@@ -4262,7 +4364,7 @@ async function gitResetAndClean(branch = 'HEAD', cwd = process.cwd()) {
 async function gitResetHard(branch = 'HEAD', cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['reset', '--hard', branch], stdioIgnoreOptions);
@@ -4288,8 +4390,8 @@ async function gitUnstagedModifiedFiles(cwd = process.cwd()) {
       data: relPaths.map(p => path$1.normalizePath(p))
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to get unstaged modified files');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to get unstaged modified files');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'Git Error',
@@ -4359,8 +4461,16 @@ constants.NODE_MODULES,
 // Where Node modules are installed, see <https://nodejs.org/>
 // Taken from globby:
 // https://github.com/sindresorhus/globby/blob/v14.0.2/ignore.js#L11-L16
-'flow-typed'];
+'flow-typed',
+// Conventional Python virtual environment dir. Arbitrarily-named venvs are
+// detected via their pyvenv.cfg marker during the discovery walk below.
+'.venv'];
 const IGNORED_DIR_PATTERNS = IGNORED_DIRS.map(i => `**/${i}`);
+
+// Marker file at the root of every Python virtual environment (stdlib `venv`
+// per PEP 405, and virtualenv >= 20). Lets us detect venvs that don't use a
+// conventional directory name.
+const PYVENV_CFG = 'pyvenv.cfg';
 async function getWorkspaceGlobs(agent, cwd = process.cwd()) {
   let workspacePatterns;
   if (agent === constants.PNPM) {
@@ -4481,20 +4591,49 @@ async function globWithGitIgnore(patterns, options) {
     ...options
   };
   const ignores = new Set(IGNORED_DIR_PATTERNS);
+
+  // CLI-supplied `additionalIgnores` are already anchored minimatch — they
+  // must not pass through the `ignore` package (whose gitignore "match
+  // anywhere" semantics would re-interpret a bare `tests` to match
+  // `subdir/tests/foo.json`). Keep them in fast-glob's ignore list across
+  // both paths; only gitignore-translated entries go into the `ig` matcher.
+  const cliMinimatchIgnores = additionalIgnores ?? [];
   const projectIgnorePaths = socketConfig?.projectIgnorePaths;
-  if (Array.isArray(projectIgnorePaths)) {
-    const ignorePatterns = ignoreFileLinesToGlobPatterns(projectIgnorePaths, path.join(cwd, '.gitignore'), cwd);
-    for (const pattern of ignorePatterns) {
-      ignores.add(pattern);
-    }
-  }
-  const gitIgnoreStream = vendor.outExports.globStream(['**/.gitignore'], {
+  const projectIgnoreGlobs = Array.isArray(projectIgnorePaths) ? ignoreFileLinesToGlobPatterns(projectIgnorePaths, path.join(cwd, '.gitignore'), cwd) : [];
+  for (const pattern of projectIgnoreGlobs) {
+    ignores.add(pattern);
+  }
+
+  // The discovery walk (`.gitignore` files plus `pyvenv.cfg` venv markers) has
+  // to honor the same directory exclusions as the package walk below. Otherwise
+  // an unreadable subtree (e.g. a postgres `pgdata` dir owned by another uid, or
+  // a Docker volume mount) makes fast-glob throw `EACCES: permission denied,
+  // scandir` *here* — before --exclude-paths (`cliMinimatchIgnores`) or
+  // projectIgnorePaths are ever applied to the main walk, which is why excluding
+  // the path did not help. `suppressErrors` is the backstop: a directory the
+  // user simply cannot read cannot contain manifests they could scan anyway, so
+  // skip it instead of aborting the whole `socket fix` / `socket scan` run.
+  // Negated patterns are dropped — for a discovery walk they could only
+  // re-include a subtree (never prevent a crash), and fast-glob treats `!`
+  // ignore entries inconsistently. Folding pyvenv.cfg discovery into this same
+  // walk avoids a second full-tree traversal.
+  const discoveryStream = vendor.outExports.globStream(['**/.gitignore', `**/${PYVENV_CFG}`], {
     absolute: true,
     cwd,
     dot: true,
-    ignore: DEFAULT_IGNORE_FOR_GIT_IGNORE
+    ignore: [...DEFAULT_IGNORE_FOR_GIT_IGNORE, ...projectIgnoreGlobs, ...cliMinimatchIgnores].filter(p => p.charCodeAt(0) !== 33 /*'!'*/).map(stripTrailingSlash),
+    suppressErrors: true
   });
-  for await (const ignorePatterns of streams.transform(gitIgnoreStream, async filepath => ignoreFileToGlobPatterns((await fs$1.safeReadFile(filepath)) ?? '', filepath, cwd), {
+  for await (const ignorePatterns of streams.transform(discoveryStream, async filepath => {
+    if (path.basename(filepath) === PYVENV_CFG) {
+      // A pyvenv.cfg sits at the venv root, so exclude the whole directory.
+      const relDir = path.relative(cwd, path.dirname(filepath)).replace(/\\/g, '/');
+      // An empty relDir means the scan target itself is a venv root; don't
+      // emit `/**`, which would exclude everything the user explicitly targeted.
+      return relDir ? [`${relDir}/**`] : [];
+    }
+    return ignoreFileToGlobPatterns((await fs$1.safeReadFile(filepath)) ?? '', filepath, cwd);
+  }, {
     concurrency: 8
   })) {
     for (const p of ignorePatterns) {
@@ -4508,20 +4647,20 @@ async function globWithGitIgnore(patterns, options) {
       break;
     }
   }
-
-  // CLI-supplied `additionalIgnores` are already anchored minimatch — they
-  // must not pass through the `ignore` package (whose gitignore "match
-  // anywhere" semantics would re-interpret a bare `tests` to match
-  // `subdir/tests/foo.json`). Keep them in fast-glob's ignore list across
-  // both paths; only gitignore-translated entries go into the `ig` matcher.
-  const cliMinimatchIgnores = additionalIgnores ?? [];
   const globOptions = {
     __proto__: null,
     absolute: true,
     cwd,
     dot: true,
     ignore: hasNegatedPattern ? [...globs.defaultIgnore, ...cliMinimatchIgnores] : [...ignores, ...cliMinimatchIgnores].map(stripTrailingSlash),
-    ...additionalOptions
+    ...additionalOptions,
+    // Skip directories the running user cannot read rather than aborting the
+    // whole walk on the first `EACCES` (see the .gitignore discovery walk
+    // above for the full rationale). Pinned after `...additionalOptions` so a
+    // caller's options bag cannot accidentally flip it back to `false` and
+    // re-introduce the crash — `suppressErrors` is a safety invariant here, not
+    // a tunable.
+    suppressErrors: true
   };
 
   // When no filter is provided and no negated patterns exist, use the fast path.
@@ -4614,14 +4753,14 @@ function pathsToGlobPatterns(paths, cwd) {
 
 function createPurlObject(type, name, options) {
   let opts;
-  if (require$$11.isObjectObject(type)) {
+  if (objects.isObjectObject(type)) {
     opts = {
       __proto__: null,
       ...type
     };
     type = opts.type;
     name = opts.name;
-  } else if (require$$11.isObjectObject(name)) {
+  } else if (objects.isObjectObject(name)) {
     opts = {
       __proto__: null,
       ...name
@@ -4751,7 +4890,7 @@ function* walkNestedMap(map, keys = []) {
  * Integration:
  * - Works with @coana-tech/cli for reachability analysis
  * - Processes socket facts JSON files
- * - Extracts tier 1 reachability scan identifiers
+ * - Extracts full application reachability scan identifiers
  */
 
 const {
@@ -4818,7 +4957,7 @@ async function compressSocketFactsForUpload(scanPaths) {
     // `rm({ force: true })` no-ops on missing files, so tracking before
     // creation is safe.
     brPaths.push(brPath);
-    await promises$1.pipeline(fs.createReadStream(p), node_zlib.createBrotliCompress(), fs.createWriteStream(brPath));
+    await require$$9.pipeline(fs.createReadStream(p), require$$11.createBrotliCompress(), fs.createWriteStream(brPath));
     return brPath;
   }));
   const failure = results.find(r => r.status === 'rejected');
@@ -4936,6 +5075,17 @@ async function findUp(name, options) {
   }
   return undefined;
 }
+async function withTmpDir(prefix, fn) {
+  const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), prefix));
+  try {
+    return await fn(tmpDir);
+  } finally {
+    await fs.promises.rm(tmpDir, {
+      recursive: true,
+      force: true
+    }).catch(() => {});
+  }
+}
 
 function findBinPathDetailsSync(binName) {
   const rawBinPaths = bin.whichBinSync(binName, {
@@ -5132,7 +5282,7 @@ function isYarnBerry() {
  * - Configures environment for third-party tools
  */
 
-const require$2 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$2 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 const {
   PACKAGE_LOCK_JSON,
   PNPM_LOCK_YAML,
@@ -5194,20 +5344,27 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
       spawnArgs.push(constants.FLAG_SILENT);
     }
     spawnArgs.push('dlx');
+    // Never let the target project's `.pnpmfile.cjs` hooks run while we launch
+    // a third-party tool via `pnpm dlx`. In a pnpm workspace root, `pnpm dlx`
+    // loads the cwd's `.pnpmfile.cjs`, so a broken hook there (e.g. a `require`
+    // of an unresolved Git LFS pointer) crashes the launcher with a bare exit
+    // code before our tool ever starts. The dlx tool installs into an isolated
+    // store, so the project's install hooks are irrelevant to it. pnpm honors
+    // this only as a config setting, not as a `dlx` CLI flag, so it must be set
+    // via the npm_config_ env var. See: https://pnpm.io/npmrc#settings
+    const pnpmEnv = {
+      ...objects.getOwn(finalShadowOptions, 'env'),
+      npm_config_ignore_pnpmfile: 'true'
+    };
     if (force) {
-      // For pnpm, set dlx-cache-max-age to 0 via env to force fresh download.
-      // This ensures we always get the latest version within the range.
-      finalShadowOptions = {
-        ...finalShadowOptions,
-        env: {
-          ...require$$11.getOwn(finalShadowOptions, 'env'),
-          // Set dlx cache max age to 0 minutes to bypass cache.
-          // The npm_config_ prefix is how pnpm reads config from environment variables.
-          // See: https://pnpm.io/npmrc#settings
-          npm_config_dlx_cache_max_age: '0'
-        }
-      };
+      // Set dlx-cache-max-age to 0 minutes to bypass cache and force a fresh
+      // download. This ensures we always get the latest version within the range.
+      pnpmEnv['npm_config_dlx_cache_max_age'] = '0';
     }
+    finalShadowOptions = {
+      ...finalShadowOptions,
+      env: pnpmEnv
+    };
     spawnArgs.push(packageString, ...args);
     const shadowPnpmBin = /*@__PURE__*/require$2(constants.default.shadowPnpmBinPath);
     return await shadowPnpmBin(spawnArgs, finalShadowOptions, spawnExtra);
@@ -5224,7 +5381,7 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
     finalShadowOptions = {
       ...finalShadowOptions,
       env: {
-        ...require$$11.getOwn(finalShadowOptions, 'env'),
+        ...objects.getOwn(finalShadowOptions, 'env'),
         YARN_NODE_LINKER: 'node-modules'
       }
     };
@@ -5254,6 +5411,30 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
  */
 const installedCoanaScriptPathsByVersion = new Map();
 
+/**
+ * Strip npm-injected `npm_package_*` env vars before spawning a Coana
+ * subprocess. npm (and pnpm/yarn classic) populate one env var per leaf in
+ * the cwd's package.json — `npm_package_dependencies_*`, `npm_package_scripts_*`,
+ * etc. In big monorepos with hundreds of deps this can easily account for
+ * 50KB+ of environment, pushing combined argv + env past Linux ARG_MAX
+ * (~128KB) and causing `spawn` to fail with E2BIG before Coana even starts.
+ *
+ * Coana does not read `npm_package_*` itself, so dropping them is safe. We
+ * intentionally keep `npm_config_*` (registry, cache, proxy settings sourced
+ * from .npmrc), `npm_lifecycle_*`, and everything else untouched — those can
+ * matter for outbound network behavior of nested `npm install` calls.
+ */
+function sanitizeEnvForCoanaSubprocess(env) {
+  const out = {};
+  for (const key of Object.keys(env)) {
+    if (key.startsWith('npm_package_')) {
+      continue;
+    }
+    out[key] = env[key];
+  }
+  return out;
+}
+
 /**
  * Spawn an installed Coana entry point via `node` (or directly, if it's a
  * native binary). Shared by the SOCKET_CLI_COANA_LOCAL_PATH branch and the
@@ -5264,8 +5445,8 @@ async function spawnCoanaScriptViaNode(scriptPath, args, finalEnv, options, spaw
   const spawnArgs = isBinary ? args : [scriptPath, ...args];
   const spawnResult = await spawn.spawn(isBinary ? scriptPath : 'node', spawnArgs, {
     cwd: options.cwd,
-    env: finalEnv,
-    stdio: spawnExtra?.['stdio'] || 'inherit'
+    env: sanitizeEnvForCoanaSubprocess(finalEnv),
+    stdio: options.stdio ?? spawnExtra?.['stdio'] ?? 'inherit'
   });
   return {
     ok: true,
@@ -5309,7 +5490,7 @@ async function installCoanaToTmpdir(version, finalEnv) {
   }
   const installDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'socket-coana-'));
   await spawn.spawn('npm', ['install', '--no-save', '--no-package-lock', '--no-audit', '--no-fund', '--prefix', installDir, `@coana-tech/cli@${version}`], {
-    env: finalEnv,
+    env: sanitizeEnvForCoanaSubprocess(finalEnv),
     stdio: 'inherit'
   });
   const scriptPath = await resolveCoanaBinFromInstallDir(installDir);
@@ -5341,6 +5522,38 @@ async function spawnCoanaViaNpmInstall(args, version, finalEnv, options, spawnEx
     return buildDlxErrorResult(e);
   }
 }
+/**
+ * Resolve how the Coana engine should be launched.
+ *
+ * SOCKET_CLI_COANA_LAUNCHER wins when set:
+ * - 'auto' (default): try dlx first, fall back to `npm install` + `node` on
+ *   launcher-level failures.
+ * - 'npm-install': skip dlx entirely; always `npm install` + `node`.
+ * - 'npx': dlx only; never fall back.
+ * Unrecognized values warn and behave as 'auto'.
+ *
+ * The legacy boolean variables SOCKET_CLI_COANA_FORCE_NPM_INSTALL
+ * ('npm-install') and SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK ('npx') are still
+ * honored when the new variable is unset, but are intentionally undocumented.
+ */
+function getCoanaLauncherMode() {
+  const rawMode = process.env['SOCKET_CLI_COANA_LAUNCHER'];
+  const mode = rawMode?.trim().toLowerCase();
+  if (mode) {
+    if (mode === 'auto' || mode === 'npm-install' || mode === 'npx') {
+      return mode;
+    }
+    logger.logger.warn(`Ignoring unrecognized SOCKET_CLI_COANA_LAUNCHER value "${rawMode}"; expected "auto", "npm-install", or "npx".`);
+    return 'auto';
+  }
+  if (process.env['SOCKET_CLI_COANA_FORCE_NPM_INSTALL']) {
+    return 'npm-install';
+  }
+  if (process.env['SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK']) {
+    return 'npx';
+  }
+  return 'auto';
+}
 
 /**
  * Helper to spawn coana with dlx.
@@ -5352,9 +5565,10 @@ async function spawnCoanaViaNpmInstall(args, version, finalEnv, options, spawnEx
  *
  * If the dlx path fails (e.g. broken `npx` on the host), falls back to
  * `npm install`-ing @coana-tech/cli into a temp directory and invoking it
- * directly via `node`. The fallback can be disabled with
- * SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK or forced as the primary path with
- * SOCKET_CLI_COANA_FORCE_NPM_INSTALL.
+ * directly via `node`. The launcher strategy can be overridden with
+ * SOCKET_CLI_COANA_LAUNCHER: 'auto' (the default) tries dlx with the
+ * npm-install fallback, 'npm-install' skips dlx entirely, and 'npx' never
+ * falls back.
  */
 async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
   const {
@@ -5369,9 +5583,8 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
   const mixinsEnv = {
     SOCKET_CLI_VERSION: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
     // Forwarded to the Coana CLI so it can append our product token to its
-    // outbound axios User-Agent header. Format mirrors Coana's base UA:
-    // `socket/<version> node/<nodeVersion> <platform>/<arch>`.
-    SOCKET_CALLER_USER_AGENT: `socket/${constants.default.ENV.INLINED_SOCKET_CLI_VERSION} node/${process.version} ${process.platform}/${process.arch}`
+    // outbound axios User-Agent header.
+    SOCKET_CALLER_USER_AGENT: getCliUserAgent()
   };
   const defaultApiToken = getDefaultApiToken();
   if (defaultApiToken) {
@@ -5396,23 +5609,38 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
     ...spawnEnv
   };
   const resolvedVersion = coanaVersion || constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION;
+
+  // `shadowNpmBase` (the dlx launcher) configures the child's stdio from its
+  // `options` arg, NOT from the registry-spawn `extra` arg — the latter only
+  // attaches metadata to the result. Callers that requested streaming via
+  // `spawnExtra` (the 4th arg), e.g. `{ stdio: 'inherit' }` from
+  // `socket manifest gradle`, were therefore silently ignored on this path:
+  // Coana ran piped and its output — including the real failure reason — never
+  // reached the user, leaving only an unhelpful "command failed". Resolve the
+  // requested stdio from either argument and honor it on every launch path:
+  // dlx, local-path, and npm-install (e.g. `socket fix --silence` requests
+  // `stdio: 'pipe'` via options).
+  const requestedStdio = spawnExtra?.['stdio'] ?? objects.getOwn(dlxOptions, 'stdio');
   const localCoanaPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
   // Use local Coana CLI if path is provided.
   if (localCoanaPath) {
     try {
       return await spawnCoanaScriptViaNode(localCoanaPath, args, finalEnv, {
-        cwd: dlxOptions.cwd
+        cwd: dlxOptions.cwd,
+        stdio: requestedStdio
       }, spawnExtra);
     } catch (e) {
       return buildDlxErrorResult(e);
     }
   }
+  const launcherMode = getCoanaLauncherMode();
 
   // Allow forcing the npm-install path for debugging or for environments
   // where dlx is known-broken.
-  if (process.env['SOCKET_CLI_COANA_FORCE_NPM_INSTALL']) {
+  if (launcherMode === 'npm-install') {
     return await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
-      cwd: dlxOptions.cwd
+      cwd: dlxOptions.cwd,
+      stdio: requestedStdio
     }, spawnExtra);
   }
   try {
@@ -5422,8 +5650,16 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
       version: resolvedVersion
     }, args, {
       force: true,
-      silent: true,
+      // Do NOT silence the launcher. `--silent` (npm loglevel silent) hides
+      // npm's own download/registry/launch errors, so when npx/pnpm-dlx fails
+      // to fetch @coana-tech/cli the user is left with a bare exit code and no
+      // cause. shadowNpmBase defaults to `--loglevel error`, which keeps real
+      // launcher errors visible while staying quiet on success.
+      silent: false,
       ...dlxOptions,
+      ...(requestedStdio === undefined ? {} : {
+        stdio: requestedStdio
+      }),
       env: finalEnv,
       ipc: {
         [constants.default.SOCKET_CLI_SHADOW_ACCEPT_RISKS]: true,
@@ -5439,7 +5675,7 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
     };
   } catch (e) {
     const dlxError = buildDlxErrorResult(e);
-    if (process.env['SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK']) {
+    if (launcherMode === 'npx') {
       return dlxError;
     }
 
@@ -5449,9 +5685,10 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
     if (!shouldFallbackOnDlxError(e)) {
       return dlxError;
     }
-    logger.logger.warn('Coana dlx invocation failed before Coana started; falling back to `npm install` + `node`.');
+    logger.logger.warn('Coana dlx invocation failed; retrying via `npm install` + `node`.');
     const fallbackResult = await spawnCoanaViaNpmInstall(args, resolvedVersion, finalEnv, {
-      cwd: dlxOptions.cwd
+      cwd: dlxOptions.cwd,
+      stdio: requestedStdio
     }, spawnExtra);
     if (fallbackResult.ok) {
       return fallbackResult;
@@ -5485,10 +5722,29 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
  *    rather than blindly re-running Coana.
  */
 function shouldFallbackOnDlxError(e) {
-  const capturedStderr = String(e?.stderr ?? '');
-  if (capturedStderr && /Coana CLI version/i.test(capturedStderr)) {
+  // Coana clearly ran (its banner is in the captured stderr) → any later
+  // non-zero exit is a real Coana failure and retrying would hit it again.
+  if (coanaBannerSeen(e)) {
     return false;
   }
+  return dlxLauncherFailedBeforeCoana(e);
+}
+
+/**
+ * Heuristic: did the dlx launcher (npx / pnpm dlx / yarn dlx) fail BEFORE the
+ * Coana process itself started? True for spawn-level errors (a string `code`
+ * like ENOENT), signal kills, and exit codes >= 128 (conventionally
+ * signal-derived) — all cases where the launcher, not Coana, is the culprit
+ * (e.g. npx missing from PATH, or @coana-tech/cli failing to download). A small
+ * integer exit code is deliberately NOT treated as a launch failure: Coana's
+ * own exit codes are small integers too, so it is genuinely ambiguous.
+ *
+ * Caveat: a launcher that fails to download the package can also exit with a
+ * small integer (npm/npx often exit 1), which lands in the ambiguous bucket.
+ * We cannot disambiguate those from a real Coana exit without inspecting the
+ * launcher's output, so the npm-install fallback does not fire for them.
+ */
+function dlxLauncherFailedBeforeCoana(e) {
   const code = e?.code;
   // Spawn-level failure (e.g. ENOENT when npx is missing from PATH).
   if (typeof code === 'string') {
@@ -5500,10 +5756,18 @@ function shouldFallbackOnDlxError(e) {
   }
   // Exit codes >= 128 are conventionally signal-derived, and the observed
   // npx-launcher failures in the wild fall into this range (e.g. 249, 254).
-  if (typeof code === 'number' && code >= 128) {
-    return true;
-  }
-  return false;
+  return typeof code === 'number' && code >= 128;
+}
+
+/**
+ * Definitive proof Coana actually booted: its startup banner appears in the
+ * captured stderr. Only available when the launcher's output was piped
+ * (captured); with inherited stdio there is nothing to inspect, so this
+ * returns false (the failure is then classified by exit code / signal alone).
+ */
+function coanaBannerSeen(e) {
+  const capturedStderr = String(e?.stderr ?? '');
+  return !!capturedStderr && /Coana CLI version/i.test(capturedStderr);
 }
 
 /**
@@ -5512,6 +5776,7 @@ function shouldFallbackOnDlxError(e) {
  */
 function buildDlxErrorResult(e) {
   const stderr = e?.stderr;
+  const stdout = e?.stdout;
   const exitCode = e?.code;
   const signal = e?.signal;
   const cause = getErrorCause(e);
@@ -5523,7 +5788,29 @@ function buildDlxErrorResult(e) {
     details.push(`signal ${signal}`);
   }
   const detailSuffix = details.length ? ` (${details.join(', ')})` : '';
-  const message = stderr ? `Coana command failed${detailSuffix}: ${stderr}` : `Coana command failed${detailSuffix}: ${cause}`;
+  // Prefer captured stderr, then stdout, then the generic spawn error. Coana
+  // logs some failures (e.g. unresolved Gradle dependencies) to stdout, so
+  // without the stdout fallback a piped failure collapsed to an unhelpful
+  // "command failed" even when the real reason was captured.
+  const detail = stderr || stdout || cause;
+  // Be honest about WHERE the failure happened. On the dlx path the spawned
+  // process is the package-manager launcher (npx / pnpm dlx / yarn dlx), which
+  // downloads @coana-tech/cli and only then runs it — so a failure may be the
+  // launcher dying before Coana ever started, not Coana itself. We can only be
+  // CERTAIN of that for a spawn-level error (a string `code` like ENOENT: the
+  // launcher binary could not start, so Coana provably never ran). A non-zero
+  // exit or signal is genuinely ambiguous — Coana may have started, streamed
+  // output, and then died (e.g. OOM), or the launcher may have failed to fetch
+  // the package — and with inherited stdio there is no captured output to tell
+  // them apart, so we must not assert either way.
+  let message;
+  if (coanaBannerSeen(e)) {
+    message = `Coana command failed${detailSuffix}: ${detail}`;
+  } else if (typeof e?.code === 'string') {
+    message = `Failed to launch Coana via the package manager${detailSuffix} — the npx/pnpm-dlx/yarn-dlx launcher could not start (e.g. it is missing from PATH): ${detail}`;
+  } else {
+    message = `Coana failed to run via the package manager${detailSuffix}: ${detail}`;
+  }
   return {
     ok: false,
     data: e,
@@ -5622,7 +5909,7 @@ function getDefaultSocketJson() {
 function readSocketJsonSync(cwd, defaultOnError = false) {
   const sockJsonPath = path.join(cwd, constants.SOCKET_JSON);
   if (!fs.existsSync(sockJsonPath)) {
-    require$$9.debugFn('notice', `miss: ${constants.SOCKET_JSON} not found at ${cwd}`);
+    debug$2.debugFn('notice', `miss: ${constants.SOCKET_JSON} not found at ${cwd}`);
     return {
       ok: true,
       data: getDefaultSocketJson()
@@ -5634,16 +5921,16 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
   } catch (e) {
     if (defaultOnError) {
       logger.logger.warn(`Failed to read ${constants.SOCKET_JSON}, using default`);
-      require$$9.debugFn('warn', `Failed to read ${constants.SOCKET_JSON} sync`);
-      require$$9.debugDir('warn', e);
+      debug$2.debugFn('warn', `Failed to read ${constants.SOCKET_JSON} sync`);
+      debug$2.debugDir('warn', e);
       return {
         ok: true,
         data: getDefaultSocketJson()
       };
     }
     const cause = formatErrorWithDetail(`An error occurred while trying to read ${constants.SOCKET_JSON}`, e);
-    require$$9.debugFn('error', `Failed to read ${constants.SOCKET_JSON} sync`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `Failed to read ${constants.SOCKET_JSON} sync`);
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: `Failed to read ${constants.SOCKET_JSON}`,
@@ -5654,11 +5941,11 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
   try {
     jsonObj = JSON.parse(jsonContent);
   } catch (e) {
-    require$$9.debugFn('error', `Failed to parse ${constants.SOCKET_JSON} as JSON (sync)`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Failed to parse ${constants.SOCKET_JSON} as JSON (sync)`);
+    debug$2.debugDir('inspect', {
       jsonContent
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
     if (defaultOnError) {
       logger.logger.warn(`Failed to parse ${constants.SOCKET_JSON}, using default`);
       return {
@@ -5692,11 +5979,11 @@ async function writeSocketJson(cwd, sockJson) {
   try {
     jsonContent = JSON.stringify(sockJson, null, 2);
   } catch (e) {
-    require$$9.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
+    debug$2.debugDir('inspect', {
       sockJson
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'Failed to serialize to JSON',
@@ -5812,12 +6099,12 @@ async function fetchGhsaDetails(ids) {
       if (advisory && advisory.ghsaId) {
         results.set(id, advisory);
       } else {
-        require$$9.debugFn('notice', `miss: no advisory found for ${id}`);
+        debug$2.debugFn('notice', `miss: no advisory found for ${id}`);
       }
     }
   } catch (e) {
-    require$$9.debugFn('error', formatErrorWithDetail('Failed to fetch GHSA details', e));
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', formatErrorWithDetail('Failed to fetch GHSA details', e));
+    debug$2.debugDir('error', e);
   }
   return results;
 }
@@ -5828,13 +6115,13 @@ function getOctokit() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.default.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$9.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      debug$2.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     const octokitOptions = {
       auth: SOCKET_CLI_GITHUB_TOKEN,
       baseUrl: constants.default.ENV.GITHUB_API_URL
     };
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       octokitOptions
     });
     _octokit = new vendor.Octokit(octokitOptions);
@@ -5848,7 +6135,7 @@ function getOctokitGraphql() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.default.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$9.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      debug$2.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     _octokitGraphql = vendor.graphql2.defaults({
       headers: {
@@ -5901,31 +6188,31 @@ async function setGitRemoteGithubRepoUrl(owner, repo, token, cwd = process.cwd()
   const {
     GITHUB_SERVER_URL
   } = constants.default.ENV;
-  const urlObj = require$$13.parseUrl(GITHUB_SERVER_URL);
+  const urlObj = url.parseUrl(GITHUB_SERVER_URL);
   const host = urlObj?.host;
   if (!host) {
-    require$$9.debugFn('error', 'invalid: GITHUB_SERVER_URL env var');
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', 'invalid: GITHUB_SERVER_URL env var');
+    debug$2.debugDir('inspect', {
       GITHUB_SERVER_URL
     });
     return false;
   }
-  const url = `https://x-access-token:${token}@${host}/${owner}/${repo}`;
+  const url$1 = `https://x-access-token:${token}@${host}/${owner}/${repo}`;
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
-  const quotedCmd = `\`git remote set-url origin ${url}\``;
-  require$$9.debugFn('stdio', `spawn: ${quotedCmd}`);
+  const quotedCmd = `\`git remote set-url origin ${url$1}\``;
+  debug$2.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
-    await spawn.spawn('git', ['remote', 'set-url', 'origin', url], stdioIgnoreOptions);
+    await spawn.spawn('git', ['remote', 'set-url', 'origin', url$1], stdioIgnoreOptions);
     return true;
   } catch (e) {
-    require$$9.debugFn('error', `Git command failed: ${quotedCmd}`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Git command failed: ${quotedCmd}`);
+    debug$2.debugDir('inspect', {
       cmd: quotedCmd
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
   }
   return false;
 }
@@ -6218,11 +6505,31 @@ function isPnpmLockfileScanCommand(command) {
 // export type _Check_EcosystemString_has_all_purl_types =
 //   ExpectNever<MissingInEcosystemString>
 
-const ALL_ECOSYSTEMS = ['alpm', 'apk', 'bitbucket', 'cargo', 'chrome', 'cocoapods', 'composer', 'conan', 'conda', 'cran', 'deb', 'docker', 'gem', 'generic', 'github', 'golang', 'hackage', 'hex', 'huggingface', 'maven', 'mlflow', constants.NPM, 'nuget', 'oci', 'pub', 'pypi', 'qpkg', 'rpm', 'swift', 'swid', 'unknown', 'vscode'];
+const ALL_ECOSYSTEMS = ['alpm', 'apk', 'bitbucket', 'cargo', 'chrome', 'clawhub', 'cocoapods', 'composer', 'conan', 'conda', 'cran', 'deb', 'docker', 'gem', 'generic', 'github', 'golang', 'hackage', 'hex', 'huggingface', 'maven', 'mlflow', constants.NPM, 'nuget', 'oci', 'pub', 'pypi', 'qpkg', 'rpm', 'socket', 'swift', 'swid', 'unknown', 'vscode'];
 new Set(ALL_ECOSYSTEMS);
+
+// Purl types accepted by Coana's reachability `--purl-types` gate
+// (@coana-tech/cli `getAdvisoryEcosystemFromPurlType`), narrower than
+// ALL_ECOSYSTEMS. Values outside this set are rejected by the engine at scan
+// time, so we validate up front. Keep in sync when bumping @coana-tech/cli.
+const REACHABILITY_SUPPORTED_ECOSYSTEMS = ['cargo', 'composer', 'gem', 'golang', 'maven', constants.NPM, 'nuget', 'pypi'];
 function getEcosystemChoicesForMeow() {
   return [...ALL_ECOSYSTEMS];
 }
+function getReachabilityEcosystemChoices() {
+  return [...REACHABILITY_SUPPORTED_ECOSYSTEMS];
+}
+function parseReachEcosystems(raw) {
+  const choices = getReachabilityEcosystemChoices();
+  const result = [];
+  for (const ecosystem of raw) {
+    if (!choices.includes(ecosystem)) {
+      throw new InputError(`Invalid ecosystem: "${ecosystem}". Valid values are: ${arrays.joinAnd(choices)}`);
+    }
+    result.push(ecosystem);
+  }
+  return result;
+}
 
 /**
  * Package manager identifiers accepted by Coana's --package-managers filter.
@@ -6401,7 +6708,7 @@ function getNpmRequire() {
   if (_npmRequire === undefined) {
     const npmDirPath = getNpmDirPath();
     const npmNmPath = path.join(npmDirPath, `${constants.NODE_MODULES}/npm`);
-    _npmRequire = require$$5.createRequire(path.join(fs.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
+    _npmRequire = require$$1.createRequire(path.join(fs.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
   }
   return _npmRequire;
 }
@@ -6453,7 +6760,7 @@ function shadowNpmInstall(options) {
     __proto__: null,
     ...options
   };
-  const useDebug = require$$9.isDebug('stdio');
+  const useDebug = debug$2.isDebug('stdio');
   const terminatorPos = args.indexOf('--');
   const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
   const binArgs = rawBinArgs.filter(a => !agent.isNpmAuditFlag(a) && !agent.isNpmFundFlag(a) && !agent.isNpmProgressFlag(a));
@@ -6461,12 +6768,12 @@ function shadowNpmInstall(options) {
   const progressArg = rawBinArgs.findLast(agent.isNpmProgressFlag) !== '--no-progress';
   const isSilent = !useDebug && !binArgs.some(agent.isNpmLoglevelFlag);
   const logLevelArgs = isSilent ? [constants.FLAG_LOGLEVEL, 'silent'] : [];
-  const useIpc = require$$11.isObject(ipc);
+  const useIpc = objects.isObject(ipc);
 
   // Include 'ipc' in the spawnOpts.stdio when an options.ipc object is provided.
   // See https://github.com/nodejs/node/blob/v23.6.0/lib/child_process.js#L161-L166
   // and https://github.com/nodejs/node/blob/v23.6.0/lib/internal/child_process.js#L238.
-  let stdio = require$$11.getOwn(spawnOpts, 'stdio');
+  let stdio = objects.getOwn(spawnOpts, 'stdio');
   if (typeof stdio === 'string') {
     stdio = useIpc ? [stdio, stdio, stdio, 'ipc'] : [stdio, stdio, stdio];
   } else if (Array.isArray(stdio)) {
@@ -6488,7 +6795,7 @@ function shadowNpmInstall(options) {
     env: {
       ...process.env,
       ...constants.default.processEnv,
-      ...require$$11.getOwn(spawnOpts, 'env')
+      ...objects.getOwn(spawnOpts, 'env')
     },
     spinner,
     stdio
@@ -6569,7 +6876,7 @@ function runAgentInstall(pkgEnvDetails, options) {
         CI: '1'
       } : {}),
       NODE_OPTIONS: cmdFlagsToString([...(skipNodeHardenFlags ? [] : constants.default.nodeHardenFlags), ...constants.default.nodeNoWarningsFlags]),
-      ...require$$11.getOwn(spawnOpts, 'env')
+      ...objects.getOwn(spawnOpts, 'env')
     }
   });
 }
@@ -6751,7 +7058,7 @@ async function getAgentExecPath(agent) {
 async function getAgentVersion(agent, agentExecPath, cwd) {
   let result;
   const quotedCmd = `\`${agent} ${constants.FLAG_VERSION}\``;
-  require$$9.debugFn('stdio', `spawn: ${quotedCmd}`);
+  debug$2.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
     let stdout;
 
@@ -6767,8 +7074,8 @@ async function getAgentVersion(agent, agentExecPath, cwd) {
           shouldRunWithNode = resolved;
         }
       } catch (e) {
-        require$$9.debugFn('warn', `Failed to resolve bin path for ${agentExecPath}, falling back to direct spawn.`);
-        require$$9.debugDir('error', e);
+        debug$2.debugFn('warn', `Failed to resolve bin path for ${agentExecPath}, falling back to direct spawn.`);
+        debug$2.debugDir('error', e);
       }
     }
     if (shouldRunWithNode) {
@@ -6790,11 +7097,11 @@ async function getAgentVersion(agent, agentExecPath, cwd) {
     // and tildes (~).
     vendor.semverExports.coerce(stdout) ?? undefined;
   } catch (e) {
-    require$$9.debugFn('error', `Package manager command failed: ${quotedCmd}`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Package manager command failed: ${quotedCmd}`);
+    debug$2.debugDir('inspect', {
       cmd: quotedCmd
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
   }
   return result;
 }
@@ -7023,6 +7330,20 @@ async function detectAndValidatePackageEnvironment(cwd, options) {
   };
 }
 
+// Check the public npm registry for a newer socket release.
+async function runSelfUpdateCheck() {
+  await vendor.updater({
+    name: constants.default.SOCKET_CLI_BIN_NAME,
+    registryUrl: 'https://registry.npmjs.org/',
+    ttl: 86_400_000 /* 24 hours in milliseconds */,
+    version: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
+    logCallback: (name, version, latest) => {
+      logger.logger.log(`\n\n📦 Update available for ${vendor.yoctocolorsCjsExports.cyan(name)}: ${vendor.yoctocolorsCjsExports.gray(version)} → ${vendor.yoctocolorsCjsExports.green(latest)}`);
+      logger.logger.log(`📝 ${socketPackageLink('npm', name, `files/${latest}/CHANGELOG.md`, 'View changelog')}`);
+    }
+  });
+}
+
 /**
  * Temporary package executor detection utilities for Socket CLI.
  * Identifies and handles temporary execution contexts.
@@ -7309,7 +7630,7 @@ function toFilterConfig(obj) {
   const normalized = {
     __proto__: null
   };
-  const keys = require$$11.isObject(obj) ? Object.keys(obj) : [];
+  const keys = objects.isObject(obj) ? Object.keys(obj) : [];
   for (const key of keys) {
     const value = obj[key];
     if (typeof value === 'boolean' || Array.isArray(value)) {
@@ -7362,7 +7683,7 @@ function parsePnpmLockfile(lockfileContent) {
       result = vendor.jsYaml.load(strings.stripBom(lockfileContent));
     } catch {}
   }
-  return require$$11.isObjectObject(result) ? result : null;
+  return objects.isObjectObject(result) ? result : null;
 }
 async function readPnpmLockfile(lockfilePath) {
   return fs.existsSync(lockfilePath) ? await fs$1.readFileUtf8(lockfilePath) : undefined;
@@ -7463,7 +7784,7 @@ class ColorOrMarkdown {
   }
 }
 
-const require$1 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$1 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 let _translations;
 function getTranslations() {
   if (_translations === undefined) {
@@ -7573,8 +7894,13 @@ async function addArtifactToAlertsMap(artifact, alertsByPurl, options) {
     blocked: true,
     critical: true,
     cve: true,
-    ...require$$11.getOwn(options, 'filter')
+    ...objects.getOwn(options, 'filter')
   });
+
+  // `issueRules` is a user-provided YAML map typed as
+  // `{ [issueName: string]: boolean }`, so key by `string` here. A string
+  // index signature also keeps the `enabledState[alert.type]` lookup below
+  // well-typed regardless of how `alert.type` resolves.
   const enabledState = {
     __proto__: null,
     ...socketYml?.issueRules
@@ -7593,7 +7919,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPurl, options) {
     const fixableCve = fixType === ALERT_FIX_TYPE.cve;
     const fixableUpgrade = fixType === ALERT_FIX_TYPE.upgrade;
     const fixable = fixableCve || fixableUpgrade;
-    const upgradable = fixableUpgrade && !require$$11.hasOwn(overrides, name);
+    const upgradable = fixableUpgrade && !objects.hasOwn(overrides, name);
     if (filterConfig.blocked && blocked || filterConfig.critical && critical || filterConfig.cve && cve || filterConfig.fixable && fixable || filterConfig.upgradable && upgradable) {
       sockPkgAlerts.push({
         name,
@@ -7867,7 +8193,7 @@ async function getAlertsMapFromPnpmLockfile(lockfile, options) {
 }
 async function getAlertsMapFromPurls(purls, options) {
   const uniqPurls = arrays.arrayUnique(purls);
-  require$$9.debugDir('silly', {
+  debug$2.debugDir('silly', {
     purls: uniqPurls
   });
   let {
@@ -7882,7 +8208,7 @@ async function getAlertsMapFromPurls(purls, options) {
     consolidate: false,
     nothrow: false,
     ...options,
-    filter: toFilterConfig(require$$11.getOwn(options, 'filter'))
+    filter: toFilterConfig(objects.getOwn(options, 'filter'))
   };
   if (opts.onlyFixable) {
     opts.filter.fixable = true;
@@ -7940,7 +8266,7 @@ async function getAlertsMapFromPurls(purls, options) {
       } else {
         spinner?.stop();
         logger.logger.fail(`Received a ${batchResult.status} response from Socket API which we consider a permanent failure:`, batchResult.error, batchResult.cause ? `( ${batchResult.cause} )` : '');
-        require$$9.debugDir('inspect', {
+        debug$2.debugDir('inspect', {
           batchResult
         });
         break;
@@ -8091,6 +8417,7 @@ function safeNpmSpecToPurl(pkgSpec) {
 exports.ALL_PACKAGE_MANAGERS = ALL_PACKAGE_MANAGERS;
 exports.AuthError = AuthError;
 exports.COMPLETION_CMD_PREFIX = COMPLETION_CMD_PREFIX;
+exports.IGNORED_DIRS = IGNORED_DIRS;
 exports.InputError = InputError;
 exports.RangeStyles = RangeStyles;
 exports.apiFetch = apiFetch;
@@ -8145,6 +8472,7 @@ exports.getOrgSlugs = getOrgSlugs;
 exports.getOutputKind = getOutputKind;
 exports.getPackageFilesForScan = getPackageFilesForScan;
 exports.getPublicApiToken = getPublicApiToken;
+exports.getReachabilityEcosystemChoices = getReachabilityEcosystemChoices;
 exports.getRepoInfo = getRepoInfo;
 exports.getRepoName = getRepoName;
 exports.getRepoOwner = getRepoOwner;
@@ -8191,13 +8519,16 @@ exports.meowOrExit = meowOrExit;
 exports.meowWithSubcommands = meowWithSubcommands;
 exports.msAtHome = msAtHome;
 exports.parsePnpmLockfile = parsePnpmLockfile;
+exports.parseReachEcosystems = parseReachEcosystems;
 exports.queryApiSafeJson = queryApiSafeJson;
 exports.queryApiSafeText = queryApiSafeText;
+exports.queryApiSafeTextWithStatus = queryApiSafeTextWithStatus;
 exports.readOrDefaultSocketJson = readOrDefaultSocketJson;
 exports.readOrDefaultSocketJsonUp = readOrDefaultSocketJsonUp;
 exports.readPnpmLockfile = readPnpmLockfile;
 exports.readSocketJsonSync = readSocketJsonSync;
 exports.runAgentInstall = runAgentInstall;
+exports.runSelfUpdateCheck = runSelfUpdateCheck;
 exports.safeNpa = safeNpa$1;
 exports.safeNpmSpecToPurl = safeNpmSpecToPurl;
 exports.sendApiRequest = sendApiRequest;
@@ -8208,7 +8539,6 @@ exports.setupTelemetryExitHandlers = setupTelemetryExitHandlers;
 exports.socketDashboardLink = socketDashboardLink;
 exports.socketDevLink = socketDevLink;
 exports.socketDocsLink = socketDocsLink;
-exports.socketPackageLink = socketPackageLink;
 exports.spawnCdxgenDlx = spawnCdxgenDlx;
 exports.spawnCoanaDlx = spawnCoanaDlx;
 exports.spawnSynpDlx = spawnSynpDlx;
@@ -8224,6 +8554,7 @@ exports.trackSubprocessStart = trackSubprocessStart;
 exports.updateConfigValue = updateConfigValue;
 exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
+exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=3d2a7b08-ceff-43f9-8aea-9e31467b851b
+//# debugId=42fc0b13-4cfc-491d-a46f-94274b113cbc
 //# sourceMappingURL=utils.js.map