Merge remote-tracking branch 'origin/v1.x' into coana-15.3.22

# Conflicts:
#	CHANGELOG.md

Author: mtorp

CHANGELOG.md

@@ -4,11 +4,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.1.115](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.115) - 2026-06-06
+## [1.1.116](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.116) - 2026-06-06
 
 ### Changed
 - Updated the Coana CLI to v `15.3.22`.
 
+## [1.1.115](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.115) - 2026-06-04
+
+### Fixed
+- `socket manifest gradle`, `kotlin`, and `scala` (including sbt-based projects) now stream the underlying build-tool and Coana output and surface the real failure reason. Previously a generation failure could collapse to an unhelpful `Coana command failed (exit code 1): command failed` with no detail, hiding actionable hints such as unresolved dependencies (re-run with `--ignore-unresolved` / `--exclude-configs`, or `--pom` for the legacy `pom.xml` output).
+
 ## [1.1.114](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.114) - 2026-06-04
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.115",
+  "version": "1.1.116",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",

src/commands/ci/fetch-default-org-slug.mts

@@ -45,7 +45,11 @@ export async function getDefaultOrgSlug(
     }
   }
 
-  const slug = (organizations as any)[keys[0]!]?.name ?? undefined
+  // Use the org's URL-safe `slug`, not its display `name`: this value is
+  // exported as SOCKET_ORG_SLUG for the Coana CLI, which resolves the org by
+  // slug. `name` is the human-readable display name (and may be null), so using
+  // it here produced a wrong/empty org identifier.
+  const slug = organizations[0]?.slug ?? undefined
   if (!slug) {
     return {
       ok: false,

src/commands/ci/fetch-default-org-slug.test.mts

@@ -0,0 +1,89 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { getDefaultOrgSlug } from './fetch-default-org-slug.mts'
+import { fetchOrganization } from '../organization/fetch-organization-list.mts'
+import { getConfigValueOrUndef } from '../../utils/config.mts'
+
+vi.mock('../organization/fetch-organization-list.mts', () => ({
+  fetchOrganization: vi.fn(),
+}))
+vi.mock('../../utils/config.mts', () => ({
+  getConfigValueOrUndef: vi.fn(() => undefined),
+}))
+// Keep SOCKET_CLI_ORG_SLUG unset so the resolver falls through to the API path.
+vi.mock('../../constants.mts', () => ({
+  default: { ENV: {} },
+}))
+
+describe('getDefaultOrgSlug', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(getConfigValueOrUndef).mockReturnValue(undefined)
+  })
+
+  it('resolves the org slug (not the display name) from the API', async () => {
+    vi.mocked(fetchOrganization).mockResolvedValue({
+      ok: true,
+      data: {
+        organizations: [
+          {
+            id: 'org-id',
+            name: 'Display Name',
+            image: null,
+            plan: 'free',
+            slug: 'my-org-slug',
+          },
+        ],
+      },
+    } as any)
+
+    const result = await getDefaultOrgSlug()
+
+    expect(result.ok).toBe(true)
+    // Regression guard: must be the URL-safe slug, never the display name.
+    expect(result.ok && result.data).toBe('my-org-slug')
+  })
+
+  it('resolves the slug even when the display name is null', async () => {
+    vi.mocked(fetchOrganization).mockResolvedValue({
+      ok: true,
+      data: {
+        organizations: [
+          {
+            id: 'org-id',
+            name: null,
+            image: null,
+            plan: 'free',
+            slug: 'slug-only',
+          },
+        ],
+      },
+    } as any)
+
+    const result = await getDefaultOrgSlug()
+
+    expect(result.ok).toBe(true)
+    expect(result.ok && result.data).toBe('slug-only')
+  })
+
+  it('prefers the defaultOrg config value without calling the API', async () => {
+    vi.mocked(getConfigValueOrUndef).mockReturnValue('configured-org')
+
+    const result = await getDefaultOrgSlug()
+
+    expect(result.ok).toBe(true)
+    expect(result.ok && result.data).toBe('configured-org')
+    expect(fetchOrganization).not.toHaveBeenCalled()
+  })
+
+  it('fails when the API returns no organizations', async () => {
+    vi.mocked(fetchOrganization).mockResolvedValue({
+      ok: true,
+      data: { organizations: [] },
+    } as any)
+
+    const result = await getDefaultOrgSlug()
+
+    expect(result.ok).toBe(false)
+  })
+})

src/utils/dlx.mts

@@ -444,6 +444,18 @@ export async function spawnCoanaDlx(
     )
   }
 
+  // `shadowNpmBase` (the dlx launcher) configures the child's stdio from its
+  // `options` arg, NOT from the registry-spawn `extra` arg — the latter only
+  // attaches metadata to the result. Callers that requested streaming via
+  // `spawnExtra` (the 4th arg), e.g. `{ stdio: 'inherit' }` from
+  // `socket manifest gradle`, were therefore silently ignored on this path:
+  // Coana ran piped and its output — including the real failure reason — never
+  // reached the user, leaving only an unhelpful "command failed". Promote the
+  // requested stdio into the dlx options so it is honored here too.
+  // `spawnCoanaScriptViaNode` already reads `spawnExtra.stdio` for the
+  // local-path and npm-install branches, so this aligns all three paths.
+  const requestedStdio = spawnExtra?.['stdio'] ?? getOwn(dlxOptions, 'stdio')
+
   try {
     // Use npm/dlx version.
     const result = await spawnDlx(
@@ -454,8 +466,14 @@ export async function spawnCoanaDlx(
       args,
       {
         force: true,
-        silent: true,
+        // Do NOT silence the launcher. `--silent` (npm loglevel silent) hides
+        // npm's own download/registry/launch errors, so when npx/pnpm-dlx fails
+        // to fetch @coana-tech/cli the user is left with a bare exit code and no
+        // cause. shadowNpmBase defaults to `--loglevel error`, which keeps real
+        // launcher errors visible while staying quiet on success.
+        silent: false,
         ...dlxOptions,
+        ...(requestedStdio === undefined ? {} : { stdio: requestedStdio }),
         env: finalEnv,
         ipc: {
           [constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS]: true,
@@ -484,7 +502,7 @@ export async function spawnCoanaDlx(
     }
 
     logger.warn(
-      'Coana dlx invocation failed before Coana started; falling back to `npm install` + `node`.',
+      'Coana dlx invocation failed; retrying via `npm install` + `node`.',
     )
 
     const fallbackResult = await spawnCoanaViaNpmInstall(
@@ -526,10 +544,29 @@ export async function spawnCoanaDlx(
  *    rather than blindly re-running Coana.
  */
 function shouldFallbackOnDlxError(e: unknown): boolean {
-  const capturedStderr = String((e as any)?.stderr ?? '')
-  if (capturedStderr && /Coana CLI version/i.test(capturedStderr)) {
+  // Coana clearly ran (its banner is in the captured stderr) → any later
+  // non-zero exit is a real Coana failure and retrying would hit it again.
+  if (coanaBannerSeen(e)) {
     return false
   }
+  return dlxLauncherFailedBeforeCoana(e)
+}
+
+/**
+ * Heuristic: did the dlx launcher (npx / pnpm dlx / yarn dlx) fail BEFORE the
+ * Coana process itself started? True for spawn-level errors (a string `code`
+ * like ENOENT), signal kills, and exit codes >= 128 (conventionally
+ * signal-derived) — all cases where the launcher, not Coana, is the culprit
+ * (e.g. npx missing from PATH, or @coana-tech/cli failing to download). A small
+ * integer exit code is deliberately NOT treated as a launch failure: Coana's
+ * own exit codes are small integers too, so it is genuinely ambiguous.
+ *
+ * Caveat: a launcher that fails to download the package can also exit with a
+ * small integer (npm/npx often exit 1), which lands in the ambiguous bucket.
+ * We cannot disambiguate those from a real Coana exit without inspecting the
+ * launcher's output, so the npm-install fallback does not fire for them.
+ */
+function dlxLauncherFailedBeforeCoana(e: unknown): boolean {
   const code = (e as any)?.code
   // Spawn-level failure (e.g. ENOENT when npx is missing from PATH).
   if (typeof code === 'string') {
@@ -541,10 +578,18 @@ function shouldFallbackOnDlxError(e: unknown): boolean {
   }
   // Exit codes >= 128 are conventionally signal-derived, and the observed
   // npx-launcher failures in the wild fall into this range (e.g. 249, 254).
-  if (typeof code === 'number' && code >= 128) {
-    return true
-  }
-  return false
+  return typeof code === 'number' && code >= 128
+}
+
+/**
+ * Definitive proof Coana actually booted: its startup banner appears in the
+ * captured stderr. Only available when the launcher's output was piped
+ * (captured); with inherited stdio there is nothing to inspect, so this
+ * returns false (the failure is then classified by exit code / signal alone).
+ */
+function coanaBannerSeen(e: unknown): boolean {
+  const capturedStderr = String((e as any)?.stderr ?? '')
+  return !!capturedStderr && /Coana CLI version/i.test(capturedStderr)
 }
 
 /**
@@ -553,6 +598,7 @@ function shouldFallbackOnDlxError(e: unknown): boolean {
  */
 function buildDlxErrorResult(e: unknown): CResult<string> {
   const stderr = (e as any)?.stderr
+  const stdout = (e as any)?.stdout
   const exitCode = (e as any)?.code
   const signal = (e as any)?.signal
   const cause = getErrorCause(e)
@@ -564,9 +610,29 @@ function buildDlxErrorResult(e: unknown): CResult<string> {
     details.push(`signal ${signal}`)
   }
   const detailSuffix = details.length ? ` (${details.join(', ')})` : ''
-  const message = stderr
-    ? `Coana command failed${detailSuffix}: ${stderr}`
-    : `Coana command failed${detailSuffix}: ${cause}`
+  // Prefer captured stderr, then stdout, then the generic spawn error. Coana
+  // logs some failures (e.g. unresolved Gradle dependencies) to stdout, so
+  // without the stdout fallback a piped failure collapsed to an unhelpful
+  // "command failed" even when the real reason was captured.
+  const detail = stderr || stdout || cause
+  // Be honest about WHERE the failure happened. On the dlx path the spawned
+  // process is the package-manager launcher (npx / pnpm dlx / yarn dlx), which
+  // downloads @coana-tech/cli and only then runs it — so a failure may be the
+  // launcher dying before Coana ever started, not Coana itself. We can only be
+  // CERTAIN of that for a spawn-level error (a string `code` like ENOENT: the
+  // launcher binary could not start, so Coana provably never ran). A non-zero
+  // exit or signal is genuinely ambiguous — Coana may have started, streamed
+  // output, and then died (e.g. OOM), or the launcher may have failed to fetch
+  // the package — and with inherited stdio there is no captured output to tell
+  // them apart, so we must not assert either way.
+  let message: string
+  if (coanaBannerSeen(e)) {
+    message = `Coana command failed${detailSuffix}: ${detail}`
+  } else if (typeof (e as any)?.code === 'string') {
+    message = `Failed to launch Coana via the package manager${detailSuffix} — the npx/pnpm-dlx/yarn-dlx launcher could not start (e.g. it is missing from PATH): ${detail}`
+  } else {
+    message = `Coana failed to run via the package manager${detailSuffix}: ${detail}`
+  }
   return {
     ok: false,
     data: e,