feat(manifest): quiet JVM build-tool output behind a spinner (1.1.133)

`socket manifest gradle|sbt|maven` (and `--auto-manifest`) streamed the build
tool's full output to the terminal. Capture it by default and show a spinner
instead, streaming live only under --verbose. On a build crash the captured
output tail is surfaced so failures stay diagnosable without a rebuild.

Also fix runNeverThrow: the registry's isSpawnError is unreliable (it never
matches), so a non-zero build exit rethrew as an opaque "command failed" instead
of returning the exit code. Duck-type the numeric exit code directly.

Author: jfblaa

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.133](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.133) - 2026-07-01
+
+### Changed
+- Quieter `socket manifest gradle`, `sbt`, and `maven`: the build tool's output is now hidden behind a progress spinner and shown only if the build fails. Pass `--verbose` to stream it live.
+
 ## [1.1.132](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.132) - 2026-06-30
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.132",
+  "version": "1.1.133",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT",

src/commands/manifest/run-manifest-facts.mts

@@ -10,8 +10,21 @@ import constants from '../../constants.mts'
 import { InputError } from '../../utils/errors.mts'
 
 import type { BuildTool } from './scripts/build-tool.mts'
+import type { ManifestRunResult } from './scripts/run.mts'
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
+const MAX_FAILURE_OUTPUT_LINES = 40
+
+// Last N non-empty lines of the captured build output, for diagnosing a crash
+// without forcing a --verbose rebuild.
+function tailBuildOutput(stdout: string, stderr: string): string {
+  const combined = [stdout, stderr]
+    .map(s => s.trimEnd())
+    .filter(Boolean)
+    .join('\n')
+  return combined.split('\n').slice(-MAX_FAILURE_OUTPUT_LINES).join('\n')
+}
+
 // Runs the bundled build-tool resolution script for a JVM project and writes
 // `.socket.facts.json`. `withFiles` (reachability only) additionally folds
 // resolved artifact paths into `sidecarAcc`. A blocking resolution failure — or
@@ -46,17 +59,32 @@ export async function runManifestFacts({
     `Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`,
   )
 
-  const { artifactPaths, code, facts, report } = await runManifestScript(
-    ecosystem,
-    {
-      bin: bin || undefined,
-      excludeConfigs: excludeConfigs || undefined,
-      includeConfigs: includeConfigs || undefined,
-      projectDir: cwd,
-      toolOpts: buildOpts,
-      withFiles,
-    },
-  )
+  const scriptOpts = {
+    bin: bin || undefined,
+    excludeConfigs: excludeConfigs || undefined,
+    includeConfigs: includeConfigs || undefined,
+    projectDir: cwd,
+    // Stream the build tool's output only when asked; otherwise capture it and
+    // show a spinner, surfacing the output only if the build crashes.
+    stdio: verbose ? ('inherit' as const) : ('pipe' as const),
+    toolOpts: buildOpts,
+    withFiles,
+  }
+  const { spinner } = constants
+  let result: ManifestRunResult
+  if (verbose) {
+    result = await runManifestScript(ecosystem, scriptOpts)
+  } else {
+    spinner.start(
+      `Resolving ${ecosystem} dependencies (pass --verbose to stream build output) ...`,
+    )
+    try {
+      result = await runManifestScript(ecosystem, scriptOpts)
+    } finally {
+      spinner.stop()
+    }
+  }
+  const { artifactPaths, code, facts, report, stderr, stdout } = result
 
   const rendered = renderResolutionErrorReport(
     report.failures,
@@ -94,7 +122,15 @@ export async function runManifestFacts({
     !facts.projects?.length &&
     !report.failures.length
   ) {
-    const message = `The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts. Re-run with --verbose for the build tool's output.`
+    if (!verbose) {
+      const tail = tailBuildOutput(stdout, stderr)
+      if (tail) {
+        logger.group('Build output:')
+        logger.error(tail)
+        logger.groupEnd()
+      }
+    }
+    const message = `The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`
     if (!ignoreUnresolved) {
       throw new InputError(message)
     }

src/commands/manifest/scripts/run.mts

@@ -2,7 +2,7 @@ import { existsSync, promises as fs } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 
-import { isSpawnError, spawn } from '@socketsecurity/registry/lib/spawn'
+import { spawn } from '@socketsecurity/registry/lib/spawn'
 
 import { assembleFacts } from './assemble.mts'
 import { resolveBuildToolBin } from './build-tool.mts'
@@ -34,6 +34,9 @@ export type ManifestRunResult = {
   facts: SocketFactsSbom
   report: ResolutionReport
   artifactPaths: ResolvedArtifactPaths
+  // Captured build-tool output (empty when stdio is 'inherit').
+  stderr: string
+  stdout: string
 }
 
 type RunOutput = { code: number; stdout: string; stderr: string }
@@ -67,11 +70,21 @@ async function runNeverThrow(
       stderr: typeof result.stderr === 'string' ? result.stderr : '',
     }
   } catch (e) {
-    if (isSpawnError(e)) {
+    // A non-zero exit rejects with the spawn-result shape: a numeric `code` plus
+    // captured stdout/stderr. Return it so the caller can assemble failure
+    // records. Anything else (e.g. a missing executable, whose `code` is the
+    // string 'ENOENT') propagates. Duck-typed on purpose: the registry's
+    // isSpawnError is unreliable, so the numeric-code check is the real signal.
+    if (
+      e !== null &&
+      typeof e === 'object' &&
+      typeof (e as { code?: unknown }).code === 'number'
+    ) {
+      const err = e as { code: number; stdout?: unknown; stderr?: unknown }
       return {
-        code: e.code,
-        stdout: typeof e.stdout === 'string' ? e.stdout : '',
-        stderr: typeof e.stderr === 'string' ? e.stderr : '',
+        code: err.code,
+        stdout: typeof err.stdout === 'string' ? err.stdout : '',
+        stderr: typeof err.stderr === 'string' ? err.stderr : '',
       }
     }
     throw e
@@ -101,14 +114,21 @@ async function writeSbtPlugin(globalBase: string): Promise<void> {
 }
 
 async function assembleFromRecords(
-  code: number,
+  out: RunOutput,
   recordsFile: string,
 ): Promise<ManifestRunResult> {
   const text = existsSync(recordsFile)
     ? await fs.readFile(recordsFile, 'utf8')
     : ''
   const { artifactPaths, facts, report } = assembleFacts(parseRecords(text))
-  return { code, facts, report, artifactPaths }
+  return {
+    code: out.code,
+    facts,
+    report,
+    artifactPaths,
+    stderr: out.stderr,
+    stdout: out.stdout,
+  }
 }
 
 // Missing only in an unbuilt local checkout. Fail loudly: without the extension,
@@ -179,7 +199,7 @@ async function runGradle(
       '--console=plain',
     ]
     const out = await runNeverThrow(bin, args, opts)
-    return await assembleFromRecords(out.code, recordsFile)
+    return await assembleFromRecords(out, recordsFile)
   })
 }
 
@@ -211,7 +231,7 @@ async function runSbt(opts: ManifestScriptOptions): Promise<ManifestRunResult> {
       FACTS_TASK,
     ]
     const out = await runNeverThrow(bin, args, opts)
-    return await assembleFromRecords(out.code, recordsFile)
+    return await assembleFromRecords(out, recordsFile)
   })
 }
 
@@ -241,6 +261,6 @@ async function runMaven(
       'validate',
     ]
     const out = await runNeverThrow(bin, args, opts)
-    return await assembleFromRecords(out.code, recordsFile)
+    return await assembleFromRecords(out, recordsFile)
   })
 }