From cbbdbfa81c98078a165f1ec62f2c3adb47f5823e Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Fri, 16 Oct 2026 10:04:30 +0200
Subject: [PATCH] fix(fix): exit 5 when computed fixes go unapplied

Coana exits with 5 when it computed fixes it could not apply, and lists
them under notApplied in its output file. Local-mode socket fix already
reads that list and fails with "Some computed fixes were not applied",
but the result carried no exit code, so the command exited with 1.
Automation could not tell a partly applied run from a failed one.

The not-applied result now carries code 5, which outputFixResult uses
as the process exit code. Other failures still exit with 1.
---
 CHANGELOG.md                               | 5 +++++
 src/commands/fix/coana-fix.mts             | 2 ++
 src/commands/fix/handle-fix-limit.test.mts | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2bee00186..f532d543b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+### Changed
+- `socket fix` now exits with code 5 when it computed fixes it could not apply, matching the Coana CLI. Automation can tell this apart from a failed run, which still exits with 1. The `--output-file` JSON lists the unapplied fixes under `notApplied`.
+
 ## [1.8.3](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.3) - 2026-10-15
 
 ### Changed
diff --git a/src/commands/fix/coana-fix.mts b/src/commands/fix/coana-fix.mts
index 411cafbf5..eafbdc02c 100644
--- a/src/commands/fix/coana-fix.mts
+++ b/src/commands/fix/coana-fix.mts
@@ -252,6 +252,7 @@ function readWrittenFiles(outputFile: string): Set<string> | undefined {
 type CoanaFixResult = CResult<{ fixedAll: boolean; ghsaDetails: unknown[] }>
 
 // Coana exits with this code after writing an --output-file that lists computed fixes it left unapplied.
+// Local mode exits with it too, so automation can tell unapplied fixes from a failed run.
 const COANA_FIXES_NOT_APPLIED_EXIT_CODE = 5
 
 type NotAppliedFix = {
@@ -585,6 +586,7 @@ async function coanaFixWithFacts(
       if (!fixCResult.ok || notApplied.length) {
         return {
           ok: false,
+          code: COANA_FIXES_NOT_APPLIED_EXIT_CODE,
           message:
             fixesResultJson?.type === 'no-fixes-applied'
               ? 'No computed fixes were applied'
diff --git a/src/commands/fix/handle-fix-limit.test.mts b/src/commands/fix/handle-fix-limit.test.mts
index 3f3803051..c8ed5548e 100644
--- a/src/commands/fix/handle-fix-limit.test.mts
+++ b/src/commands/fix/handle-fix-limit.test.mts
@@ -609,6 +609,7 @@ describe('socket fix --pr-limit behavior verification', () => {
 
       expect(result).toEqual({
         ok: false,
+        code: 5,
         message: 'No computed fixes were applied',
         cause: expect.stringContaining('no supported lockfile found'),
         data: {
@@ -642,6 +643,7 @@ describe('socket fix --pr-limit behavior verification', () => {
       })
 
       expect(result.ok).toBe(false)
+      expect(result.code).toBe(5)
       expect(result.message).toBe('Some computed fixes were not applied')
       expect(result.data).toEqual({ fixedAll: false, ghsaDetails: [output] })
       expect(JSON.parse(await fs.readFile(outputFile, 'utf8'))).toEqual(output)