fix(fix): propagate Coana discovery failures + consume structured discovery result

[Martin Torp (mtorp)]

Problem

socket fix silently reported success when its GHSA discovery step failed. discoverGhsaIds collapsed every failure mode to an empty list:

• Coana exiting non-zero (the error message was discarded)
• npx/pnpm dlx failing to fetch @coana-tech/cli
• empty stdout from Coana
• a non-JSON final stdout line (swallowed by a bare catch {})

An empty id list then short-circuited coanaFix with ok: true, which outputFixResult renders as "Finished!" with exit code 0. A broken Coana in a customer's CI was indistinguishable from "nothing to fix" — and because the fix E2E tests only dump CLI output on non-zero exit, a silent no-op produced zero diagnostics (the flaky Python E2E test that exits 0 yet upgrades nothing).

A second, subtler hole: "backend resolved zero artifacts" and "genuinely nothing to fix" both surfaced as an empty list, with no way to tell them apart.

Changes (5 commits)

1. fix(fix): propagate Coana discovery failures instead of reporting success

discoverGhsaIds returns CResult<string[]>: a failed Coana spawn propagates its CResult as-is (exit code and stderr intact via buildDlxErrorResult); empty stdout, a non-JSON final line, or wrongly-shaped JSON each fail with a specific message. A genuine empty result still exits 0. Both call sites (local and CI/PR mode) propagate the failure, so the real reason reaches the user with a non-zero exit — and the E2E exit-code assertion failure now dumps CLI output, making the next occurrence self-diagnosing.

2. feat(fix): consume Coana's structured discovery result + 3. bump @coana-tech/cli to 15.9.7

coana-tech/coana-package-manager#2327 (released as coana 15.9.7) adds find-vulnerabilities --output-file <file>, writing a structured result:

{ "ghsaIds": ["GHSA-..."], "artifactCount": 137, "filteredArtifactCount": 42 }

Since the Coana version is pinned in this repo, discovery now always uses --output-file and reads that file — the brittle "JSON array on the final stdout line" parsing is gone entirely. A missing, unparseable, or wrongly-shaped result file fails the run with a specific message.

The artifact counts also close the second hole: when the backend resolved 0 artifacts, an empty result is almost certainly a server-side resolve problem rather than "nothing to fix", so the CLI now warns (The Socket backend resolved 0 artifacts…) instead of only printing "Finished!".

4. fix(fix): plug discovery result edge cases (Cursor Bugbot)

readStructuredDiscoveryResult no longer throws a TypeError on non-object JSON bodies (null, arrays, scalars) — they return the intended ok: false. The --output-file temp path is now also removed when the spawn fails (previously only cleaned up on success).

5. test(fix): log CLI output on any e2e failure, not just non-zero exits

A silent no-op exits 0, so the if (code !== 0) guard hid all CLI output for exactly the failure class that is hardest to diagnose. The E2E catch blocks now log unconditionally, so the next flake occurrence shows what Coana and the backend actually reported — including the zero-artifact warning.

Compatibility

• Coana 15.9.7 keeps the stdout output unchanged, but this CLI no longer consumes it. Users overriding --coana-version to something older than 15.9.7 will get a loud unknown option '--output-file' failure (propagated by commit 1) instead of a silent no-op — acceptable since the version is pinned.
• Failure contract unchanged: Coana prints errors to stderr and exits non-zero; spawnCoanaDlx maps that to ok: false, which now propagates.

Tests

handle-fix-limit.test.mts: 24 tests, all passing; tsgo/oxlint/eslint clean. Discovery mocks now write the structured envelope the way coana 15.9.7 does.

• Failure propagation: spawn failure (local + PR mode).
• Structured result: envelope read + counts; missing file / invalid JSON / wrong shape (incl. non-object bodies) each fail with specific messages; temp file removed on spawn failure; zero-artifact warning emitted; genuine empty result still exits 0 (regression guard).
• Verified the published @coana-tech/cli@15.9.7 exposes -o, --output-file (find-vulnerabilities --help).

Behavior change (intended)

Automation parsing socket fix --json that relied on ok: true + empty ghsaDetails when Coana was broken now gets ok: false + message and a non-zero exit.

---

Note

Medium Risk
Changes socket fix success/failure semantics and JSON ok for discovery errors, which can break automation that treated failed Coana runs as success; core fix path behavior is otherwise localized to discovery.

Overview
socket fix no longer treats a broken vulnerability-discovery step as “nothing to fix.” Discovery failures (Coana non-zero exit, missing/unreadable --output-file JSON) now return ok: false with a non-zero exit instead of Finished! with an empty result.

Discovery always runs Coana find-vulnerabilities with --output-file (Coana 15.9.7) and reads ghsaIds plus artifactCount from that JSON, replacing parsing the last stdout line. When artifactCount is 0, the CLI warns that backend resolve may be incomplete rather than only showing an empty list.

@coana-tech/cli is bumped to 15.9.7 (version 1.1.150). Tests mock the structured envelope and cover failure propagation and invalid discovery output.

^{Reviewed by Cursor Bugbot for commit 645d428. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 645d428. Configure here.}