fix(manifest): correct 1.1.125 changelog label; quote-aware build-tool opts

Address review feedback on the maven PR:

- CHANGELOG: the new section is the 1.1.125 release (per package.json after
  the v1.x merge), so relabel its heading `1.1.124` -> `1.1.125` (the link
  target was already v1.1.125).
- `--gradle-opts` / `--sbt-opts` / `--maven-opts` were split on every space,
  shredding a value with a spaced path (e.g. `-s "my settings.xml"`) into
  separate tokens. Introduce a shared quote-aware tokenizer
  (`parseBuildToolOpts`) honoring single/double quotes and use it across all
  manifest opts sites (gradle/kotlin/scala/maven + auto-manifest) so the fix
  is consistent rather than a maven-only divergence. Unquoted input tokenizes
  exactly as before.

Author: jfblaa

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.1.124](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.125) - 2026-06-19
+## [1.1.125](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.125) - 2026-06-19
 
 ### Added
 - New `socket manifest maven` command generates a Socket facts file (`.socket.facts.json`) directly from a Maven `pom.xml` project. Like the Gradle and sbt generators, it auto-detects your project, plugs into `socket manifest auto` and the `socket manifest setup` configurator, and accepts `--maven-opts` to pass options through to Maven (e.g. `--maven-opts="-P release -s settings.xml"`), plus `--bin` to point at a wrapper such as `./mvnw`.

src/commands/manifest/cmd-manifest-gradle.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -280,10 +281,7 @@ async function run(
     return
   }
 
-  const parsedGradleOpts = String(gradleOpts || '')
-    .split(' ')
-    .map(s => s.trim())
-    .filter(Boolean)
+  const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''))
 
   if (facts) {
     await convertGradleToFacts({

src/commands/manifest/cmd-manifest-kotlin.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -283,10 +284,7 @@ async function run(
     return
   }
 
-  const parsedGradleOpts = String(gradleOpts || '')
-    .split(' ')
-    .map(s => s.trim())
-    .filter(Boolean)
+  const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''))
 
   if (facts) {
     await convertGradleToFacts({

src/commands/manifest/cmd-manifest-maven.mts

@@ -4,6 +4,7 @@ import { debugFn } from '@socketsecurity/registry/lib/debug'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertMavenToFacts } from './convert-maven-to-facts.mts'
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import constants, { SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -218,10 +219,7 @@ async function run(
     return
   }
 
-  const parsedMavenOpts = String(mavenOpts || '')
-    .split(' ')
-    .map(s => s.trim())
-    .filter(Boolean)
+  const parsedMavenOpts = parseBuildToolOpts(String(mavenOpts || ''))
 
   await convertMavenToFacts({
     bin: String(bin),

src/commands/manifest/cmd-manifest-scala.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertSbtToFacts } from './convert-sbt-to-facts.mts'
 import { convertSbtToMaven } from './convert_sbt_to_maven.mts'
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -337,10 +338,7 @@ async function run(
     return
   }
 
-  const parsedSbtOpts = String(sbtOpts || '')
-    .split(' ')
-    .map(s => s.trim())
-    .filter(Boolean)
+  const parsedSbtOpts = parseBuildToolOpts(String(sbtOpts || ''))
 
   if (facts) {
     await convertSbtToFacts({

src/commands/manifest/generate_auto_manifest.mts

@@ -9,6 +9,7 @@ import { convertSbtToFacts } from './convert-sbt-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
 import { convertSbtToMaven } from './convert_sbt_to_maven.mts'
 import { handleManifestConda } from './handle-manifest-conda.mts'
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
 
@@ -45,11 +46,7 @@ export async function generateAutoManifest({
       // Note: `sbt` is more likely to be resolved against PATH env.
       bin: sockJson.defaults?.manifest?.sbt?.bin ?? 'sbt',
       cwd,
-      sbtOpts:
-        sockJson.defaults?.manifest?.sbt?.sbtOpts
-          ?.split(' ')
-          .map(s => s.trim())
-          .filter(Boolean) ?? [],
+      sbtOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.sbt?.sbtOpts),
       verbose: Boolean(sockJson.defaults?.manifest?.sbt?.verbose),
     }
     // Socket facts is the default; opt into pom generation with
@@ -83,11 +80,9 @@ export async function generateAutoManifest({
         : path.join(cwd, 'gradlew'),
       cwd,
       verbose: Boolean(sockJson.defaults?.manifest?.gradle?.verbose),
-      gradleOpts:
-        sockJson.defaults?.manifest?.gradle?.gradleOpts
-          ?.split(' ')
-          .map(s => s.trim())
-          .filter(Boolean) ?? [],
+      gradleOpts: parseBuildToolOpts(
+        sockJson.defaults?.manifest?.gradle?.gradleOpts,
+      ),
     }
     // Socket facts is the default; opt into pom generation with
     // `defaults.manifest.gradle.facts: false` in socket.json.
@@ -124,11 +119,9 @@ export async function generateAutoManifest({
         sockJson.defaults?.manifest?.maven?.ignoreUnresolved,
       ),
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
-      mavenOpts:
-        sockJson.defaults?.manifest?.maven?.mavenOpts
-          ?.split(' ')
-          .map(s => s.trim())
-          .filter(Boolean) ?? [],
+      mavenOpts: parseBuildToolOpts(
+        sockJson.defaults?.manifest?.maven?.mavenOpts,
+      ),
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
     })
   }

src/commands/manifest/parse-build-tool-opts.mts

@@ -0,0 +1,52 @@
+// Tokenizes a build-tool options string (e.g. the value of `--gradle-opts`,
+// `--sbt-opts`, `--maven-opts`) into individual argv tokens. Splits on
+// whitespace but honors single and double quotes so a value containing spaces,
+// such as a settings path (`-s "my settings.xml"`), survives as one token
+// instead of being shredded into three. Quotes are consumed (not emitted), and
+// quoting is intra-token aware (`-Dkey="a b"` -> `-Dkey=a b`). For unquoted
+// input this is equivalent to the previous whitespace split.
+export function parseBuildToolOpts(opts: string | undefined): string[] {
+  if (!opts) {
+    return []
+  }
+  const tokens: string[] = []
+  let current = ''
+  let hasToken = false
+  let inSingle = false
+  let inDouble = false
+  for (let i = 0; i < opts.length; i += 1) {
+    const ch = opts[i]
+    if (inSingle) {
+      if (ch === "'") {
+        inSingle = false
+      } else {
+        current += ch
+      }
+    } else if (inDouble) {
+      if (ch === '"') {
+        inDouble = false
+      } else {
+        current += ch
+      }
+    } else if (ch === "'") {
+      inSingle = true
+      hasToken = true
+    } else if (ch === '"') {
+      inDouble = true
+      hasToken = true
+    } else if (ch === ' ' || ch === '\t') {
+      if (hasToken) {
+        tokens.push(current)
+        current = ''
+        hasToken = false
+      }
+    } else {
+      current += ch
+      hasToken = true
+    }
+  }
+  if (hasToken) {
+    tokens.push(current)
+  }
+  return tokens
+}

src/commands/manifest/parse-build-tool-opts.test.mts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+
+import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
+
+describe('parseBuildToolOpts', () => {
+  it('returns an empty array for empty/undefined input', () => {
+    expect(parseBuildToolOpts(undefined)).toEqual([])
+    expect(parseBuildToolOpts('')).toEqual([])
+    expect(parseBuildToolOpts('   ')).toEqual([])
+  })
+
+  it('splits a plain space-separated string (parity with the old split)', () => {
+    expect(parseBuildToolOpts('-P release -s settings.xml')).toEqual([
+      '-P',
+      'release',
+      '-s',
+      'settings.xml',
+    ])
+  })
+
+  it('collapses runs of whitespace and trims', () => {
+    expect(parseBuildToolOpts('  -P   release  ')).toEqual(['-P', 'release'])
+  })
+
+  it('keeps a double-quoted value with spaces as one token', () => {
+    expect(parseBuildToolOpts('-s "my settings.xml"')).toEqual([
+      '-s',
+      'my settings.xml',
+    ])
+  })
+
+  it('keeps a single-quoted value with spaces as one token', () => {
+    expect(parseBuildToolOpts("-s 'my settings.xml'")).toEqual([
+      '-s',
+      'my settings.xml',
+    ])
+  })
+
+  it('handles quotes inside a token', () => {
+    expect(parseBuildToolOpts('-Dprop="a b"')).toEqual(['-Dprop=a b'])
+  })
+})