feat(fix): add --package-managers flag

[Martin Torp (mtorp)]

Summary

Forward Coana's new --package-managers filter (coana-tech/coana-package-manager#2214) through socket fix so users can narrow fix computation to specific package managers within an ecosystem (e.g. only PNPM artifacts in a monorepo that mixes pnpm/yarn/npm).

Mirrors how --ecosystems (→ Coana --purl-types) is already plumbed through cmd-fix.mts → handle-fix.mts → coana-fix.mts.

Behavior

• New flag: --package-managers <values...> on socket fix.
• Accepts space- or comma-separated values; case-insensitive (normalized to uppercase before validation and before forwarding).
• Validated against the same set as Coana's getFilterablePackageManagers(): CARGO, COMPOSER, GO, GRADLE, MAVEN, NPM, NUGET, PIPENV, PIP_REQUIREMENTS, PNPM, POETRY, RUBYGEMS, RUSH, SBT, YARN. Invalid values fail early with a friendly error listing valid values.
• Forwarded to both Coana subcommands invoked by the fix flow:
  • find-vulnerabilities (GHSA discovery in discoverGhsaIds)
  • compute-fixes-and-upgrade-purls (both the local-mode call and the per-GHSA CI-loop call)
• When combined with --ecosystems, Coana intersects the two filters per-artifact (an artifact must satisfy both).

Files changed

• src/utils/package-manager.mts (new) — ALL_PACKAGE_MANAGERS constant + isValidPackageManager validator.
• src/commands/fix/cmd-fix.mts — flag definition, validation, forwarding to handleFix.
• src/commands/fix/types.mts — packageManagers: string[] on FixConfig.
• src/commands/fix/handle-fix.mts — destructure + forward to coanaFix (and debug logging).
• src/commands/fix/coana-fix.mts — pass --package-managers to all three Coana spawn sites.
• src/commands/fix/cmd-fix.integration.test.mts — 5 new cmdit cases (single, lowercase comma-separated, multiple flags, invalid value, combined with --ecosystems); updated --help snapshot.

Out of scope

Mirrors the Coana PR's out-of-scope notes:

• Not added to socket scan reach / the Coana run command. Its --purl-types operates at ecosystem-level pre-install and a per-PM filter there would require a larger refactor in Coana.
• No bump of @coana-tech/cli here. The flag is forward-compatible — once a Coana release containing the linked PR is published, a separate version-bump PR will activate the feature for users.
• Socket-side filtering: like --ecosystems today, the Socket CLI just forwards the flag; all matching logic lives in Coana.

Test plan

• tsgo clean.

• eslint clean on changed files (one pre-existing import-order warning in coana-fix.mts is unrelated).

• pnpm test:unit src/commands/fix/cmd-fix.integration.test.mts passes for all --ecosystems, --package-managers, and --help snapshot tests (5 new tests + 4 existing ecosystem tests + help snapshot).

• End-to-end smoke against a real multi-PM project (npm-app with axios@0.21.0 + real package-lock.json, pnpm-app with lodash@4.17.20 + real pnpm-lock.yaml, yarn-app with minimist@1.2.5 + real yarn.lock):

  Run	axios (npm)	lodash (pnpm)	minimist (yarn)
  baseline	✓	✓	✓
  --package-managers NPM	✓ kept	✗ excluded	⚠ included (PM-undetermined fallthrough)
  --package-managers PNPM	✗ excluded	✓ kept	⚠ included (PM-undetermined fallthrough)
  --package-managers YARN	✗ excluded	✗ excluded	✓ kept

  The axios (npm) and lodash (pnpm) cases are mutually-exclusive across the NPM/PNPM filters as expected. The minimist (yarn) case logs Coana's documented Could not determine package manager from manifest files [yarn-app/package.json] — including in --package-managers results fallthrough — Coana's per-artifact manifestFiles doesn't include the yarn.lock for that artifact, so its lockfile-based PM detection can't fire. That's a Coana-side detail (out of scope for this PR) — the Socket CLI is forwarding the flag correctly, as evidenced by the differentiated outputs across runs.

• Validation: socket fix --package-managers FOO exits non-zero with Invalid package manager: "FOO". Valid values are: CARGO, COMPOSER, GO, GRADLE, MAVEN, NPM, NUGET, PIPENV, PIP_REQUIREMENTS, PNPM, POETRY, RUBYGEMS, RUSH, SBT, and YARN.

• Case-insensitive: --package-managers npm,pnpm accepted (uppercased before forward).

Follow-ups

• Bump @coana-tech/cli once a release containing the linked PR ships.
• Investigate (in Coana) why a real yarn.lock isn't surfacing on the artifact's manifestFiles — would let YARN's filter exclude the yarn-app's vulns the same way NPM/PNPM do today.

---

Note

Medium Risk
Moderate risk: changes socket fix CLI surface area and alters which artifacts Coana processes by forwarding a new filter flag, which could change fix coverage in mixed-package-manager repos. Logic is straightforward (validation + argument plumbing) and covered by new integration/E2E tests.

Overview
Adds a new socket fix --package-managers filter to restrict fix computation to specific package managers (case-insensitive, comma/space-separated), with early validation and a clear error listing allowed values.

Plumbs the validated filter through the full fix flow (cmd-fix → handle-fix → coana-fix) and forwards --package-managers to both Coana invocations used for discovery and fix computation (local and CI/PR modes). Updates help text, adds integration + E2E coverage (including a new multi-PM fixture), and bumps @coana-tech/cli to 15.2.0 along with the release/version metadata (1.1.90).

^{Reviewed by Cursor Bugbot for commit 0d46020. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​15.1.0 ⏵ 15.2.0

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​15.1.0 ⏵ 15.2.0

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @coana-tech/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coana-tech/cli@15.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@coana-tech/cli@15.2.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0d46020. Configure here.}